Extra browser-side validation of transferred_request_child_id / request_id.

content/browser/bad_message.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_BAD_MESSAGE_H_
 #define CONTENT_BROWSER_BAD_MESSAGE_H_
 
 namespace content {
 class BrowserMessageFilter;
 class RenderProcessHost;
@@ skipping 146 matching lines @@
   RFH_INCONSISTENT_DEVTOOLS_MESSAGE = 133,
   DSH_DUPLICATE_CONNECTION_ID = 134,
   DSH_NOT_CREATED_SESSION_ID = 135,
   DSH_NOT_ALLOCATED_SESSION_ID = 136,
   DSH_DELETED_SESSION_ID = 137,
   DSH_WRONG_STORAGE_PARTITION = 138,
   BDH_DISALLOWED_ORIGIN = 139,
   ARH_CREATED_STREAM_WITHOUT_AUTHORIZATION = 140,
   MDDH_INVALID_DEVICE_TYPE_REQUEST = 141,
   MDDH_UNAUTHORIZED_ORIGIN = 142,
+  RDH_TRANSFERRING_REQUEST_NOT_FOUND = 143,
+  RDH_TRANSFERRING_NONNAVIGATIONAL_REQUEST = 144,
 
   // Please add new elements here. The naming convention is abbreviated class
   // name (e.g. RenderFrameHost becomes RFH) plus a unique description of the
   // reason. After making changes, you MUST update histograms.xml by running:
   // "python tools/metrics/histograms/update_bad_message_reasons.py"
   BAD_MESSAGE_MAX
 };
 
 // Called when the browser receives a bad IPC message from a renderer process on
 // the UI thread. Logs the event, records a histogram metric for the |reason|,
 // and terminates the process for |host|.
 void ReceivedBadMessage(RenderProcessHost* host, BadMessageReason reason);
 
 // Equivalent to the above, but callable from any thread.
 void ReceivedBadMessage(int render_process_id, BadMessageReason reason);
 
 // Called when a browser message filter receives a bad IPC message from a
 // renderer or other child process. Logs the event, records a histogram metric
 // for the |reason|, and terminates the process for |filter|.
 void ReceivedBadMessage(BrowserMessageFilter* filter, BadMessageReason reason);
 
 }  // namespace bad_message
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_BAD_MESSAGE_H_