Merge 231142 "Browser should do a breakpad dump when unable to m..."

> Browser should do a breakpad dump when unable to map renderer memory.
> 
> It seems possible that there's something wrong in the browser process in this case, so force it to do a crash dump.
> 
> BUG=311792
> R=piman@chromium.org
> 
> Review URL: https://codereview.chromium.org/42733002

TBR=jbauman@chromium.org

Review URL: https://codereview.chromium.org/46643004

git-svn-id: svn://svn.chromium.org/chrome/branches/1682/src@231184 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 40 insertions, 8 deletions

diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
index 3ad459b..7f41ab7 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
@@ -1549,7 +1549,8 @@ void RenderWidgetHostViewAura::SwapSoftwareFrame(
           frame_data.get(),
           frame_device_scale_factor,
           host_->GetProcess()->GetHandle())) {
-    host_->GetProcess()->ReceivedBadMessage();
+    ReleaseSoftwareFrame(output_surface_id, frame_data->id);
+    SendSoftwareFrameAck(output_surface_id);
     return;
   }
 
diff --git a/content/browser/renderer_host/software_frame_manager.cc b/content/browser/renderer_host/software_frame_manager.cc
index ac6fc3c..e5baafa 100644
--- a/content/browser/renderer_host/software_frame_manager.cc
+++ b/content/browser/renderer_host/software_frame_manager.cc
@@ -6,6 +6,7 @@
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
+#include "base/debug/alias.h"
 #include "base/sys_info.h"
 #include "content/browser/renderer_host/dip_util.h"
 #include "content/public/browser/user_metrics.h"
@@ -20,6 +21,31 @@ void ReleaseMailbox(scoped_refptr<content::SoftwareFrame> frame,
 
 namespace content {
 
+// Keep a count of how many memory buffers are in existence.
+// TODO(jbauman): remove once we have enough info.
+static int g_outstanding_buffers;
+
+#if defined(OS_WIN)
+unsigned int g_crash_count;
+
+// Capture a stack dump.
+// TODO(jbauman): Remove this terrible layering violation once we have some
+// dumps. http://crbug.com/311792
+void DumpWithoutCrashing() {
+  if (++g_crash_count > 2)
+    return;
+  int saved_buffers = g_outstanding_buffers;
+  base::debug::Alias(static_cast<void*>(&saved_buffers));
+  // Get the breakpad pointer from chrome.exe
+  typedef void(__cdecl * DumpProcessFunction)();
+  DumpProcessFunction DumpProcess =
+      reinterpret_cast<DumpProcessFunction>(::GetProcAddress(
+          ::GetModuleHandle(L"chrome.exe"), "DumpProcessWithoutCrash"));
+  if (DumpProcess)
+    DumpProcess();
+}
+#endif
+
 ////////////////////////////////////////////////////////////////////////////////
 // SoftwareFrame
 
@@ -48,20 +74,23 @@ class CONTENT_EXPORT SoftwareFrame : public base::RefCounted<SoftwareFrame> {
 };
 
 SoftwareFrame::SoftwareFrame(
-  base::WeakPtr<SoftwareFrameManagerClient> frame_manager_client,
-  uint32 output_surface_id,
-  unsigned frame_id,
-  gfx::Size frame_size_dip,
-  gfx::Size frame_size_pixels,
-  scoped_ptr<base::SharedMemory> shared_memory)
+    base::WeakPtr<SoftwareFrameManagerClient> frame_manager_client,
+    uint32 output_surface_id,
+    unsigned frame_id,
+    gfx::Size frame_size_dip,
+    gfx::Size frame_size_pixels,
+    scoped_ptr<base::SharedMemory> shared_memory)
     : frame_manager_client_(frame_manager_client),
       output_surface_id_(output_surface_id),
       frame_id_(frame_id),
       frame_size_dip_(frame_size_dip),
       frame_size_pixels_(frame_size_pixels),
-      shared_memory_(shared_memory.Pass()) {}
+      shared_memory_(shared_memory.Pass()) {
+  ++g_outstanding_buffers;
+}
 
 SoftwareFrame::~SoftwareFrame() {
+  --g_outstanding_buffers;
   if (frame_manager_client_) {
     frame_manager_client_->SoftwareFrameWasFreed(
         output_surface_id_, frame_id_);
@@ -99,6 +128,7 @@ bool SoftwareFrameManager::SwapToNewFrame(
     const size_t size_in_bytes = 4 * frame_data->size.GetArea();
 #ifdef OS_WIN
     if (!shared_memory->Map(0)) {
+      DumpWithoutCrashing();
       DLOG(ERROR) << "Unable to map renderer memory.";
       RecordAction(UserMetricsAction(
           "BadMessageTerminate_SharedMemoryManager1"));
@@ -106,6 +136,7 @@ bool SoftwareFrameManager::SwapToNewFrame(
     }
 
     if (shared_memory->mapped_size() < size_in_bytes) {
+      DumpWithoutCrashing();
       DLOG(ERROR) << "Shared memory too small for given rectangle";
       RecordAction(UserMetricsAction(
           "BadMessageTerminate_SharedMemoryManager2"));