Add some <base> metrics to guide experimentation.

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
@@ skipping 742 matching lines @@
                    m_formAction.get(), url,
                    ContentSecurityPolicy::DirectiveType::FormAction,
                    redirectStatus)
              : checkSource(m_formAction.get(), url, redirectStatus);
 }
 
 bool CSPDirectiveList::allowBaseURI(
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
-  return reportingStatus == ContentSecurityPolicy::SendReport
-             ? checkSourceAndReportViolation(
-                   m_baseURI.get(), url,
-                   ContentSecurityPolicy::DirectiveType::BaseURI,
-                   redirectStatus)
-             : checkSource(m_baseURI.get(), url, redirectStatus);
+  bool result =
+      reportingStatus == ContentSecurityPolicy::SendReport
+          ? checkSourceAndReportViolation(
+                m_baseURI.get(), url,
+                ContentSecurityPolicy::DirectiveType::BaseURI, redirectStatus)
+          : checkSource(m_baseURI.get(), url, redirectStatus);
+
+  if (result &&
+      !checkSource(operativeDirective(m_baseURI.get()), url, redirectStatus)) {
+    UseCounter::count(m_policy->document(),
+                      UseCounter::BaseWouldBeBlockedByDefaultSrc);
+  }
+
+  return result;
 }
 
 bool CSPDirectiveList::allowWorkerFromSource(
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   // 'worker-src' overrides 'child-src', which overrides the default
   // sources. So, we do this nested set of calls to 'operativeDirective()' to
   // grab 'worker-src' if it exists, 'child-src' if it doesn't, and 'defaut-src'
   // if neither are available.
@@ skipping 511 matching lines @@
   visitor->trace(m_imgSrc);
   visitor->trace(m_mediaSrc);
   visitor->trace(m_manifestSrc);
   visitor->trace(m_objectSrc);
   visitor->trace(m_scriptSrc);
   visitor->trace(m_styleSrc);
   visitor->trace(m_workerSrc);
 }
 
 }  // namespace blink