We added the crash in the release tests, which don't use Selenium. That made some of these steps easier. I'll try to translate that to Selenium, but I haven't tried this:
Chrome needs to be started with 2 additional environment variables: CHROME_HEADLESS=1 and BREAKPAD_DUMP_LOCATION=some writable folder. If you run in Linux, you can set this by adding ChromeOptions.MinidumpPath. That will be available for Windows starting with version 82.
Next you need a second ChromeDriver pointing to the same instance of Chrome.
You need the debuggerAddress used by the original Chrome instance. I don't think Selenium exposes that, so you would have to find it in the verbose log file. It's part of the RESPONSE InitSession entry:
"goog:chromeOptions": {
"debuggerAddress": "localhost:46837"
},
You should also be able to pick a port, by adding the argument --remote-debugging-port=<port> when starting Chrome.
The new ChromeDriver needs to run with ChromeOptions.DebuggerAddress set the the value found or set above. Several other options won't work at all in this new Chrome so don't set more than that.
The command needed is:
driver.ExecuteChromeCommand("Page.crash", new Dictionary<string, object>());
This won't work if the freeze is during initSession. It will throw an exception from Selenium, because ChromeDriver won't be able to process the post-command cleanup once the page crashes. But check the exception, because Chrome can refuse the request, which will also generate an exception. If the message contains "session deleted because of page crash", it worked as expected. The crash report should be in BREAKPAD_DUMP_LOCATION.