Add UMA histograms and logging for bad IPC message handling

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index df33497e5e11e9e6cb91dcdfd056c5d9a91e9416..bffe7967cf82839ab9bf181517c4a2d05aeb89c5 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -9,7 +9,6 @@
 #include "base/containers/hash_tables.h"
 #include "base/lazy_instance.h"
 #include "base/metrics/histogram.h"
-#include "base/metrics/user_metrics_action.h"
 #include "base/process/kill.h"
 #include "base/time/time.h"
 #include "content/browser/accessibility/accessibility_mode_helper.h"
@@ -48,6 +47,7 @@
 #include "content/common/render_frame_setup.mojom.h"
 #include "content/common/swapped_out_messages.h"
 #include "content/public/browser/ax_event_notification_details.h"
+#include "content/public/browser/bad_message.h"
 #include "content/public/browser/browser_accessibility_state.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_plugin_guest_manager.h"
@@ -812,9 +812,8 @@ void RenderFrameHostImpl::OnDidCommitProvisionalLoad(const IPC::Message& msg) {
   if (!CanCommitURL(validated_params.url)) {
     VLOG(1) << "Blocked URL " << validated_params.url.spec();
     validated_params.url = GURL(url::kAboutBlankURL);
-    RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled"));
     // Kills the process.
-    process->ReceivedBadMessage();
+    process->ReceivedBadMessage(BadMessage::RFH_CAN_COMMIT_URL_BLOCKED);
   }
 
   // Without this check, an evil renderer can trick the browser into creating
@@ -836,7 +835,8 @@ void RenderFrameHostImpl::OnDidCommitProvisionalLoad(const IPC::Message& msg) {
   // filenames it can't access in a future session restore.
   if (!render_view_host_->CanAccessFilesOfPageState(
           validated_params.page_state)) {
-    GetProcess()->ReceivedBadMessage();
+    GetProcess()->ReceivedBadMessage(
+        BadMessage::RFH_CAN_ACCESS_FILES_OF_PAGE_STATE);
     return;
   }
 
@@ -1217,8 +1217,7 @@ void RenderFrameHostImpl::OnDidChangeSandboxFlags(int32 frame_routing_id,
   // children.  If this is not the case, the renderer is considered malicious
   // and is killed.
   if (child->parent() != frame_tree_node()) {
-    RecordAction(base::UserMetricsAction("BadMessageTerminate_RFH"));
-    GetProcess()->ReceivedBadMessage();
+    GetProcess()->ReceivedBadMessage(BadMessage::RFH_SANDBOX_FLAGS);
     return;
   }
 
@@ -1275,7 +1274,7 @@ void RenderFrameHostImpl::OnDispatchLoad() {
   RenderFrameProxyHost* proxy =
       frame_tree_node()->render_manager()->GetProxyToParent();
   if (!proxy) {
-    GetProcess()->ReceivedBadMessage();
+    GetProcess()->ReceivedBadMessage(BadMessage::RFH_NO_PROXY_TO_PARENT);
     return;
   }