Introduce bad_message.h for chrome and NaCl.

content/browser/bad_message.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_BAD_MESSAGE_H_
 #define CONTENT_BROWSER_BAD_MESSAGE_H_
 
 namespace content {
+class BrowserMessageFilter;
 class RenderProcessHost;
 
 namespace bad_message {
 
 // The browser process often chooses to terminate a renderer if it receives
 // a bad IPC message. The reasons are tracked for metrics.
 //
 // Content embedders should implement their own bad message statistics but
 // should use similar histogram names to make analysis easier.
 //
@@ skipping 14 matching lines @@
   RWH_BLUR = 10,
   RWH_SHARED_BITMAP = 11,
   RWH_BAD_ACK_MESSAGE = 12,
   RWHVA_SHARED_MEMORY = 13,
   SERVICE_WORKER_BAD_URL = 14,
   WC_INVALID_FRAME_SOURCE = 15,
   RWHVM_UNEXPECTED_FRAME_TYPE = 16,
   RFPH_DETACH = 17,
   DFH_BAD_EMBEDDER_MESSAGE = 18,
   NC_AUTO_SUBFRAME = 19,
+  CSDH_NOT_RECOGNIZED = 20,
+  DSMF_OPEN_STORAGE = 21,
+  DSMF_LOAD_STORAGE = 22,
+  DBMF_INVALID_ORIGIN_ON_OPEN = 23,
+  DBMF_DB_NOT_OPEN_ON_MODIFY = 24,
+  DBMF_DB_NOT_OPEN_ON_CLOSE = 25,
+  DBMF_INVALID_ORIGIN_ON_SQLITE_ERROR = 26,
+  RDH_INVALID_PRIORITY = 27,
+  RDH_REQUEST_NOT_TRANSFERRING = 28,
+  RDH_BAD_DOWNLOAD = 29,
+  NMF_NO_PERMISSION_SHOW = 30,
+  NMF_NO_PERMISSION_CLOSE = 31,
+  NMF_NO_PERMISSION_VERIFY = 32,
+  MH_INVALID_MIDI_PORT = 33,
+  MH_SYS_EX_PERMISSION = 34,
+  ACDH_REGISTER = 35,
+  ACDH_UNREGISTER = 36,
+  ACDH_SET_SPAWNING = 37,
+  ACDH_SELECT_CACHE = 38,
+  ACDH_SELECT_CACHE_FOR_WORKER = 39,
+  ACDH_SELECT_CACHE_FOR_SHARED_WORKER = 40,
+  ACDH_MARK_AS_FOREIGN_ENTRY = 41,
+  ACDH_PENDING_REPLY_IN_GET_STATUS = 42,
+  ACDH_GET_STATUS = 43,
+  ACDH_PENDING_REPLY_IN_START_UPDATE = 44,
+  ACDH_START_UPDATE = 45,
+  ACDH_PENDING_REPLY_IN_SWAP_CACHE = 46,
+  ACDH_SWAP_CACHE = 47,
+  SWDH_NOT_HANDLED = 48,
+  SWDH_REGISTER_BAD_URL = 49,
+  SWDH_REGISTER_NO_HOST = 50,
+  SWDH_REGISTER_CANNOT = 51,
+  SWDH_UNREGISTER_BAD_URL = 52,
+  SWDH_UNREGISTER_NO_HOST = 53,
+  SWDH_UNREGISTER_CANNOT = 54,
+  SWDH_GET_REGISTRATION_BAD_URL = 55,
+  SWDH_GET_REGISTRATION_NO_HOST = 56,
+  SWDH_GET_REGISTRATION_CANNOT = 57,
+  SWDH_GET_REGISTRATION_FOR_READY_NO_HOST = 58,
+  SWDH_GET_REGISTRATION_FOR_READY_ALREADY_IN_PROGRESS = 59,
+  SWDH_POST_MESSAGE = 60,
+  SWDH_PROVIDER_CREATED_NO_HOST = 61,
+  SWDH_PROVIDER_DESTROYED_NO_HOST = 62,
+  SWDH_SET_HOSTED_VERSION_NO_HOST = 63,
+  SWDH_SET_HOSTED_VERSION = 64,
+  SWDH_WORKER_SCRIPT_LOAD_NO_HOST = 65,
+  SWDH_INCREMENT_WORKER_BAD_HANDLE = 66,
+  SWDH_DECREMENT_WORKER_BAD_HANDLE = 67,
+  SWDH_INCREMENT_REGISTRATION_BAD_HANDLE = 68,
+  SWDH_DECREMENT_REGISTRATION_BAD_HANDLE = 69,
+  SWDH_TERMINATE_BAD_HANDLE = 70,
+  FAMF_APPEND_ITEM_TO_BLOB = 71,
+  FAMF_APPEND_SHARED_MEMORY_TO_BLOB = 72,
+  FAMF_MALFORMED_STREAM_URL = 73,
+  FAMF_APPEND_ITEM_TO_STREAM = 74,
+  FAMF_APPEND_SHARED_MEMORY_TO_STREAM = 75,
+  IDBDH_CAN_READ_FILE = 76,
+  IDBDH_GET_OR_TERMINATE = 77,

[Ilya Sherman, 2015/05/26 23:07:59]

nit: The manual numbering worries me a bit -- it's too easy to make a typo.  Is
there any advantage to using manual numbering over simply letting the compiler
auto-number?

[Charlie Reis, 2015/05/29 23:35:19]

isherman: See mpearson's comment here:
https://codereview.chromium.org/1128993005/diff/1/content/browser/bad_message...

[Ilya Sherman, 2015/05/31 00:30:27]

Hmm, ok.  I guess Mark and I have different opinions about which class of error
to optimize for :P  Thanks for the pointer.

[ncarter (slow), 2015/06/01 17:12:24]

FWIW, I used the TextPastry plugin to Sublime Text to auto-number these.

Having the numbers be explicit prevents a bug like what happened in
https://codereview.chromium.org/1153503003/ . Especially in these files, if we
auto-numbered, the temptation to group new entries with similarly-prefixed
existing entries would be too great.

Personally I'd rather have the "two entries sharing the same code for a couple
releases" bug than have the "everything was shifted off by one for a couple
releases" bug.

If we beef up the presubmits to detect renumbering or double-numbering problems,
I think we can defend against all kinds of bugs that people are worried about.

   // Please add new elements here. The naming convention is abbreviated class
   // name (e.g. RenderFrameHost becomes RFH) plus a unique description of the
   // reason.
   BAD_MESSAGE_MAX
 };
 
-// Called when the browser receives a bad IPC message from a renderer process.
-// Logs the event, records a histogram metric for the |reason|, and terminates
-// the process for |host|.
+// Called when the browser receives a bad IPC message from a renderer process on
+// the UI thread. Logs the event, records a histogram metric for the |reason|,
+// and terminates the process for |host|.
 void ReceivedBadMessage(RenderProcessHost* host, BadMessageReason reason);
 
+// Called when a browser message filter receives a bad IPC message from a
+// renderer or other child process. Logs the event, records a histogram metric
+// for the |reason|, and terminates the process for |filter|.
+void ReceivedBadMessage(BrowserMessageFilter* filter, BadMessageReason reason);
+
 }  // namespace bad_message
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_BAD_MESSAGE_H_