Add UMA histograms and logging for bad IPC message handling

content/browser/renderer_host/render_process_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Represents the browser side of the browser <--> renderer communication
 // channel. There will be one RenderProcessHost per renderer process.
 
 #include "content/browser/renderer_host/render_process_host_impl.h"
 
 #include <algorithm>
@@ skipping 96 matching lines @@
 #include "content/common/child_process_host_impl.h"
 #include "content/common/child_process_messages.h"
 #include "content/common/content_switches_internal.h"
 #include "content/common/frame_messages.h"
 #include "content/common/gpu/gpu_memory_buffer_factory.h"
 #include "content/common/gpu/gpu_messages.h"
 #include "content/common/mojo/channel_init.h"
 #include "content/common/mojo/mojo_messages.h"
 #include "content/common/resource_messages.h"
 #include "content/common/view_messages.h"
+#include "content/public/browser/bad_message.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/navigator_connect_context.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/render_process_host_factory.h"
 #include "content/public/browser/render_process_host_observer.h"
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/render_widget_host_iterator.h"
 #include "content/public/browser/render_widget_host_view_frame_subscriber.h"
@@ skipping 909 matching lines @@
 
 void RenderProcessHostImpl::AddObserver(RenderProcessHostObserver* observer) {
   observers_.AddObserver(observer);
 }
 
 void RenderProcessHostImpl::RemoveObserver(
     RenderProcessHostObserver* observer) {
   observers_.RemoveObserver(observer);
 }
 
-void RenderProcessHostImpl::ReceivedBadMessage() {
+void RenderProcessHostImpl::ReceivedBadMessage(BadMessage reason) {
   base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
   if (command_line->HasSwitch(switches::kDisableKillAfterBadIPC))
     return;
 
   if (run_renderer_in_process()) {
     // In single process mode it is better if we don't suicide but just
     // crash.
     CHECK(false);
   }
+
+  LOG(ERROR) << "Terminating renderer for bad IPC message, reason "
+             << static_cast<int>(reason);
+  UMA_HISTOGRAM_ENUMERATION("Stability.BadMessageTerminated",
+                            static_cast<int>(reason),
+                            static_cast<int>(BadMessage::BAD_MESSAGE_MAX));
+
   // We kill the renderer but don't include a NOTREACHED, because we want the
   // browser to try to survive when it gets illegal messages from the renderer.
   Shutdown(RESULT_CODE_KILLED_BAD_MESSAGE, false);
 }
 
 void RenderProcessHostImpl::WidgetRestored() {
   // Verify we were properly backgrounded.
   DCHECK_EQ(backgrounded_, (visible_widgets_ == 0));
   visible_widgets_++;
   SetBackgrounded(false);
@@ skipping 486 matching lines @@
 }
 
 void RenderProcessHostImpl::OnChannelError() {
   ProcessDied(true /* already_dead */, nullptr);
 }
 
 void RenderProcessHostImpl::OnBadMessageReceived(const IPC::Message& message) {
   // Message de-serialization failed. We consider this a capital crime. Kill the
   // renderer if we have one.
   LOG(ERROR) << "bad message " << message.type() << " terminating renderer.";
   BrowserChildProcessHostImpl::HistogramBadMessageTerminated(

[Charlie Reis, 2015/03/13 23:41:49]

Huh, I wonder if we need this anymore.  I guess it's slightly different info
(process type rather than the place that killed it), so maybe it should stay.

       PROCESS_TYPE_RENDERER);
-  ReceivedBadMessage();
+  ReceivedBadMessage(BadMessage::RPH_DESERIALIZATION_FAILED);
 }
 
 BrowserContext* RenderProcessHostImpl::GetBrowserContext() const {
   return browser_context_;
 }
 
 bool RenderProcessHostImpl::InSameStoragePartition(
     StoragePartition* partition) const {
   return storage_partition_impl_ == partition;
 }
@@ skipping 835 matching lines @@
   if (worker_ref_count_ == 0)
     Cleanup();
 }
 
 void RenderProcessHostImpl::GetAudioOutputControllers(
     const GetAudioOutputControllersCallback& callback) const {
   audio_renderer_host()->GetOutputControllers(callback);
 }
 
 }  // namespace content