Add UMA histograms and logging for bad IPC message handling

content/browser/bad_message.h

Index: content/browser/bad_message.h
diff --git a/content/browser/bad_message.h b/content/browser/bad_message.h
new file mode 100644
index 0000000000000000000000000000000000000000..f402430d9d335137eb94a97847f23423976e421a
--- /dev/null
+++ b/content/browser/bad_message.h
@@ -0,0 +1,52 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_BAD_MESSAGE_H_
+#define CONTENT_BROWSER_BAD_MESSAGE_H_
+
+namespace content {
+class RenderProcessHost;
+
+namespace bad_message {
+
+// The browser process often chooses to terminate a renderer if it receives
+// a bad IPC message. The reasons are tracked for metrics.
+//
+// Content embedders should implement their own bad message statistics, but

[Charlie Reis, 2015/03/18 21:37:51]

nit: no comma (or say ", but they")

[James Cook, 2015/03/18 22:19:44]

Done.

+// should use similar histogram names to make analysis easier.
+//
+// NOTE: Do not remove or reorder elements in this end. Add new entries at the

[Charlie Reis, 2015/03/18 21:37:51]

nit: end -> list?

[James Cook, 2015/03/18 22:19:44]

Done.

+// end. We rely on these values in histograms.
+enum BadMessageReason {
+  NC_IN_PAGE_NAVIGATION = 0,

[Charlie Reis, 2015/03/18 21:37:51]

We should have a note on the naming convention for when people add new ones. 
Looks like it's an abbreviation of the class name followed by a unique
description of the kill site, with the assumption that reason codes each used in
a single location.

[James Cook, 2015/03/18 22:19:44]

Done.

+  RFH_CAN_COMMIT_URL_BLOCKED,
+  RFH_CAN_ACCESS_FILES_OF_PAGE_STATE,
+  RFH_SANDBOX_FLAGS,
+  RFH_NO_PROXY_TO_PARENT,
+  RPH_DESERIALIZATION_FAILED,
+  RVH_CAN_ACCESS_FILES_OF_PAGE_STATE,

[Charlie Reis, 2015/03/18 21:37:51]

For future reference, what happens if we want to change the name of one of
these?  RVH is going away, and most of these will move to RFH.  Are we stuck
with the old name?  (Not a big deal, but worth noting along with the other
warnings above.)

[James Cook, 2015/03/18 22:19:44]

No, they can be renamed as long as the value doesn't change. I added a note in
the comments.

+  RVH_FILE_CHOOSER_PATH,
+  RWH_SYNTHETIC_GESTURE,
+  RWH_FOCUS,
+  RWH_BLUR,
+  RWH_SHARED_BITMAP,
+  RWH_BAD_ACK_MESSAGE,
+  RWHVA_SHARED_MEMORY,
+  SERVICE_WORKER_BAD_URL,
+  WC_INVALID_FRAME_SOURCE,
+  RWHVM_UNEXPECTED_FRAME_TYPE,
+  // Please add new elements here.
+
+  BAD_MESSAGE_MAX
+};
+
+// Called when the browser receives a bad IPC message from a renderer process.
+// Log the event, records a histogram metric for the |reason|, and terminates

[Charlie Reis, 2015/03/18 21:37:51]

nit: Logs

[James Cook, 2015/03/18 22:19:44]

Done.

+// the process for |host|.
+void ReceivedBadMessage(RenderProcessHost* host, BadMessageReason reason);
+
+}  // namespace bad_message
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_BAD_MESSAGE_H_