Ensure that any IPC sent from a child process that couldn't be deserialized causes that process to be killed.

Today we do this only for a subset of IPCs and not all process types.

R=jar@chromium.org, tsepez@chromium.org

Review URL: https://codereview.chromium.org/283313002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@270839 0039d316-1c4b-4281-b951-d872f2087c98

16 files changed, 264 insertions, 29 deletions

diff --git a/content/browser/browser_child_process_host_impl.cc b/content/browser/browser_child_process_host_impl.cc
index e1365f9..0c2b637 100644
--- a/content/browser/browser_child_process_host_impl.cc
+++ b/content/browser/browser_child_process_host_impl.cc
@@ -219,6 +219,12 @@ void BrowserChildProcessHostImpl::NotifyProcessInstanceCreated(
                     BrowserChildProcessInstanceCreated(data));
 }
 
+void BrowserChildProcessHostImpl::HistogramBadMessageTerminated(
+    int process_type) {
+  UMA_HISTOGRAM_ENUMERATION("ChildProcess.BadMessgeTerminated", process_type,
+                            PROCESS_TYPE_MAX);
+}
+
 base::TerminationStatus BrowserChildProcessHostImpl::GetTerminationStatus(
     bool known_dead, int* exit_code) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
@@ -252,6 +258,12 @@ void BrowserChildProcessHostImpl::OnChannelError() {
   delegate_->OnChannelError();
 }
 
+void BrowserChildProcessHostImpl::OnBadMessageReceived(
+    const IPC::Message& message) {
+  HistogramBadMessageTerminated(data_.process_type);
+  base::KillProcess(GetHandle(), RESULT_CODE_KILLED_BAD_MESSAGE, false);
+}
+
 bool BrowserChildProcessHostImpl::CanShutdown() {
   return delegate_->CanShutdown();
 }
diff --git a/content/browser/browser_child_process_host_impl.h b/content/browser/browser_child_process_host_impl.h
index 24bc1e7..0f7a3df 100644
--- a/content/browser/browser_child_process_host_impl.h
+++ b/content/browser/browser_child_process_host_impl.h
@@ -64,6 +64,7 @@ class CONTENT_EXPORT BrowserChildProcessHostImpl
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
   virtual void OnChannelConnected(int32 peer_pid) OVERRIDE;
   virtual void OnChannelError() OVERRIDE;
+  virtual void OnBadMessageReceived(const IPC::Message& message) OVERRIDE;
 
   // Removes this host from the host list. Calls ChildProcessHost::ForceShutdown
   void ForceShutdown();
@@ -81,6 +82,8 @@ class CONTENT_EXPORT BrowserChildProcessHostImpl
   // Called when an instance of a particular child is created in a page.
   static void NotifyProcessInstanceCreated(const ChildProcessData& data);
 
+  static void HistogramBadMessageTerminated(int process_type);
+
   BrowserChildProcessHostDelegate* delegate() const { return delegate_; }
 
   typedef std::list<BrowserChildProcessHostImpl*> BrowserChildProcessList;
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 26039a4..d2d8f74 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -38,6 +38,7 @@
 #include "cc/base/switches.h"
 #include "content/browser/appcache/appcache_dispatcher_host.h"
 #include "content/browser/appcache/chrome_appcache_service.h"
+#include "content/browser/browser_child_process_host_impl.h"
 #include "content/browser/browser_main.h"
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/browser_plugin/browser_plugin_message_filter.h"
@@ -1308,8 +1309,7 @@ bool RenderProcessHostImpl::OnMessageReceived(const IPC::Message& msg) {
   mark_child_process_activity_time();
   if (msg.routing_id() == MSG_ROUTING_CONTROL) {
     // Dispatch control messages.
-    bool msg_is_ok = true;
-    IPC_BEGIN_MESSAGE_MAP_EX(RenderProcessHostImpl, msg, msg_is_ok)
+    IPC_BEGIN_MESSAGE_MAP(RenderProcessHostImpl, msg)
       IPC_MESSAGE_HANDLER(ChildProcessHostMsg_ShutdownRequest,
                           OnShutdownRequest)
       IPC_MESSAGE_HANDLER(ChildProcessHostMsg_DumpHandlesDone,
@@ -1322,15 +1322,8 @@ bool RenderProcessHostImpl::OnMessageReceived(const IPC::Message& msg) {
       // Adding single handlers for your service here is fine, but once your
       // service needs more than one handler, please extract them into a new
       // message filter and add that filter to CreateMessageFilters().
-    IPC_END_MESSAGE_MAP_EX()
-
-    if (!msg_is_ok) {
-      // The message had a handler, but its de-serialization failed.
-      // We consider this a capital crime. Kill the renderer if we have one.
-      LOG(ERROR) << "bad message " << msg.type() << " terminating renderer.";
-      RecordAction(base::UserMetricsAction("BadMessageTerminate_BRPH"));
-      ReceivedBadMessage();
-    }
+    IPC_END_MESSAGE_MAP()
+
     return true;
   }
 
@@ -1347,11 +1340,10 @@ bool RenderProcessHostImpl::OnMessageReceived(const IPC::Message& msg) {
 
     // If this is a SwapBuffers, we need to ack it if we're not going to handle
     // it so that the GPU process doesn't get stuck in unscheduled state.
-    bool msg_is_ok = true;
-    IPC_BEGIN_MESSAGE_MAP_EX(RenderProcessHostImpl, msg, msg_is_ok)
+    IPC_BEGIN_MESSAGE_MAP(RenderProcessHostImpl, msg)
       IPC_MESSAGE_HANDLER(ViewHostMsg_CompositorSurfaceBuffersSwapped,
                           OnCompositorSurfaceBuffersSwappedNoHost)
-    IPC_END_MESSAGE_MAP_EX()
+    IPC_END_MESSAGE_MAP()
     return true;
   }
   return listener->OnMessageReceived(msg);
@@ -1372,6 +1364,15 @@ void RenderProcessHostImpl::OnChannelError() {
   ProcessDied(true /* already_dead */);
 }
 
+void RenderProcessHostImpl::OnBadMessageReceived(const IPC::Message& message) {
+  // Message de-serialization failed. We consider this a capital crime. Kill the
+  // renderer if we have one.
+  LOG(ERROR) << "bad message " << message.type() << " terminating renderer.";
+  BrowserChildProcessHostImpl::HistogramBadMessageTerminated(
+      PROCESS_TYPE_RENDERER);
+  ReceivedBadMessage();
+}
+
 BrowserContext* RenderProcessHostImpl::GetBrowserContext() const {
   return browser_context_;
 }
diff --git a/content/browser/renderer_host/render_process_host_impl.h b/content/browser/renderer_host/render_process_host_impl.h
index d0f9e96..a0be1cf 100644
--- a/content/browser/renderer_host/render_process_host_impl.h
+++ b/content/browser/renderer_host/render_process_host_impl.h
@@ -138,6 +138,7 @@ class CONTENT_EXPORT RenderProcessHostImpl
   virtual bool OnMessageReceived(const IPC::Message& msg) OVERRIDE;
   virtual void OnChannelConnected(int32 peer_pid) OVERRIDE;
   virtual void OnChannelError() OVERRIDE;
+  virtual void OnBadMessageReceived(const IPC::Message& message) OVERRIDE;
 
   // ChildProcessLauncher::Client implementation.
   virtual void OnProcessLaunched() OVERRIDE;
diff --git a/content/browser/worker_host/worker_process_host.cc b/content/browser/worker_host/worker_process_host.cc
index f00080e..f1fffed 100644
--- a/content/browser/worker_host/worker_process_host.cc
+++ b/content/browser/worker_host/worker_process_host.cc
@@ -373,9 +373,8 @@ void WorkerProcessHost::OnProcessLaunched() {
 }
 
 bool WorkerProcessHost::OnMessageReceived(const IPC::Message& message) {
-  bool msg_is_ok = true;
   bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP_EX(WorkerProcessHost, message, msg_is_ok)
+  IPC_BEGIN_MESSAGE_MAP(WorkerProcessHost, message)
     IPC_MESSAGE_HANDLER(WorkerHostMsg_WorkerContextClosed,
                         OnWorkerContextClosed)
     IPC_MESSAGE_HANDLER(WorkerHostMsg_WorkerContextDestroyed,
@@ -394,13 +393,6 @@ bool WorkerProcessHost::OnMessageReceived(const IPC::Message& message) {
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP_EX()
 
-  if (!msg_is_ok) {
-    NOTREACHED();
-    RecordAction(base::UserMetricsAction("BadMessageTerminate_WPH"));
-    base::KillProcess(
-        process_->GetData().handle, RESULT_CODE_KILLED_BAD_MESSAGE, false);
-  }
-
   return handled;
 }
 
diff --git a/content/common/child_process_host_impl.cc b/content/common/child_process_host_impl.cc
index 488cdb0..9ae7c82 100644
--- a/content/common/child_process_host_impl.cc
+++ b/content/common/child_process_host_impl.cc
@@ -293,6 +293,10 @@ void ChildProcessHostImpl::OnChannelError() {
   delegate_->OnChildDisconnected();
 }
 
+void ChildProcessHostImpl::OnBadMessageReceived(const IPC::Message& message) {
+  delegate_->OnBadMessageReceived(message);
+}
+
 void ChildProcessHostImpl::OnAllocateSharedMemory(
     uint32 buffer_size,
     base::SharedMemoryHandle* handle) {
diff --git a/content/common/child_process_host_impl.h b/content/common/child_process_host_impl.h
index 4ac660d..d8a2032 100644
--- a/content/common/child_process_host_impl.h
+++ b/content/common/child_process_host_impl.h
@@ -76,6 +76,7 @@ class CONTENT_EXPORT ChildProcessHostImpl : public ChildProcessHost,
   virtual bool OnMessageReceived(const IPC::Message& msg) OVERRIDE;
   virtual void OnChannelConnected(int32 peer_pid) OVERRIDE;
   virtual void OnChannelError() OVERRIDE;
+  virtual void OnBadMessageReceived(const IPC::Message& message) OVERRIDE;
 
   // Message handlers:
   void OnShutdownRequest();
diff --git a/ipc/ipc_channel_proxy.cc b/ipc/ipc_channel_proxy.cc
index 5c4d743..7e32018 100644
--- a/ipc/ipc_channel_proxy.cc
+++ b/ipc/ipc_channel_proxy.cc
@@ -64,6 +64,10 @@ bool ChannelProxy::Context::TryFilters(const Message& message) {
 #endif
 
   if (message_filter_router_->TryFilters(message)) {
+    if (message.dispatch_error()) {
+      listener_task_runner_->PostTask(
+          FROM_HERE, base::Bind(&Context::OnDispatchBadMessage, this, message));
+    }
 #ifdef IPC_MESSAGE_LOG_ENABLED
     if (logger->Enabled())
       logger->OnPostDispatchMessage(message, channel_id_);
@@ -267,6 +271,8 @@ void ChannelProxy::Context::OnDispatchMessage(const Message& message) {
 #endif
 
   listener_->OnMessageReceived(message);
+  if (message.dispatch_error())
+    listener_->OnBadMessageReceived(message);
 
 #ifdef IPC_MESSAGE_LOG_ENABLED
   if (logger->Enabled())
@@ -290,6 +296,12 @@ void ChannelProxy::Context::OnDispatchError() {
     listener_->OnChannelError();
 }
 
+// Called on the listener's thread
+void ChannelProxy::Context::OnDispatchBadMessage(const Message& message) {
+  if (listener_)
+    listener_->OnBadMessageReceived(message);
+}
+
 //-----------------------------------------------------------------------------
 
 ChannelProxy::ChannelProxy(const IPC::ChannelHandle& channel_handle,
diff --git a/ipc/ipc_channel_proxy.h b/ipc/ipc_channel_proxy.h
index 375a42b..0a3a5d2 100644
--- a/ipc/ipc_channel_proxy.h
+++ b/ipc/ipc_channel_proxy.h
@@ -180,6 +180,7 @@ class IPC_EXPORT ChannelProxy : public Sender, public base::NonThreadSafe {
     void AddFilter(MessageFilter* filter);
     void OnDispatchConnected();
     void OnDispatchError();
+    void OnDispatchBadMessage(const Message& message);
 
     scoped_refptr<base::SingleThreadTaskRunner> listener_task_runner_;
     Listener* listener_;
diff --git a/ipc/ipc_channel_reader.cc b/ipc/ipc_channel_reader.cc
index 401e4e1..9a3cc3c 100644
--- a/ipc/ipc_channel_reader.cc
+++ b/ipc/ipc_channel_reader.cc
@@ -95,6 +95,8 @@ bool ChannelReader::DispatchInputData(const char* input_data,
         HandleInternalMessage(m);
       else
         listener_->OnMessageReceived(m);
+      if (m.dispatch_error())
+        listener_->OnBadMessageReceived(m);
       p = message_tail;
     } else {
       // Last message is partial.
diff --git a/ipc/ipc_listener.h b/ipc/ipc_listener.h
index 9189eec..733bc46 100644
--- a/ipc/ipc_listener.h
+++ b/ipc/ipc_listener.h
@@ -28,6 +28,9 @@ class IPC_EXPORT Listener {
   // This method is not called when a channel is closed normally.
   virtual void OnChannelError() {}
 
+  // Called when a message's deserialization failed.
+  virtual void OnBadMessageReceived(const Message& message) {}
+
 #if defined(OS_POSIX)
   // Called on the server side when a channel that listens for connections
   // denies an attempt to connect.
diff --git a/ipc/ipc_message.cc b/ipc/ipc_message.cc
index f7fe827..1ac4d6e 100644
--- a/ipc/ipc_message.cc
+++ b/ipc/ipc_message.cc
@@ -47,7 +47,7 @@ Message::Message()
   header()->num_fds = 0;
   header()->pad = 0;
 #endif
-  InitLoggingVariables();
+  Init();
 }
 
 Message::Message(int32 routing_id, uint32 type, PriorityValue priority)
@@ -60,21 +60,22 @@ Message::Message(int32 routing_id, uint32 type, PriorityValue priority)
   header()->num_fds = 0;
   header()->pad = 0;
 #endif
-  InitLoggingVariables();
+  Init();
 }
 
 Message::Message(const char* data, int data_len) : Pickle(data, data_len) {
-  InitLoggingVariables();
+  Init();
 }
 
 Message::Message(const Message& other) : Pickle(other) {
-  InitLoggingVariables();
+  Init();
 #if defined(OS_POSIX)
   file_descriptor_set_ = other.file_descriptor_set_;
 #endif
 }
 
-void Message::InitLoggingVariables() {
+void Message::Init() {
+  dispatch_error_ = false;
 #ifdef IPC_MESSAGE_LOG_ENABLED
   received_time_ = 0;
   dont_log_ = false;
diff --git a/ipc/ipc_message.h b/ipc/ipc_message.h
index ea6cda6..e4b6208 100644
--- a/ipc/ipc_message.h
+++ b/ipc/ipc_message.h
@@ -121,6 +121,14 @@ class IPC_EXPORT Message : public Pickle {
     return (header()->flags & PUMPING_MSGS_BIT) != 0;
   }
 
+  void set_dispatch_error() const {
+    dispatch_error_ = true;
+  }
+
+  bool dispatch_error() const {
+    return dispatch_error_;
+  }
+
   uint32 type() const {
     return header()->type;
   }
@@ -236,7 +244,10 @@ class IPC_EXPORT Message : public Pickle {
     return headerT<Header>();
   }
 
-  void InitLoggingVariables();
+  void Init();
+
+  // Used internally to support IPC::Listener::OnBadMessageReceived.
+  mutable bool dispatch_error_;
 
 #if defined(OS_POSIX)
   // The set of file descriptors associated with this message.
diff --git a/ipc/ipc_message_macros.h b/ipc/ipc_message_macros.h
index d5ffff7..5bc1ad4 100644
--- a/ipc/ipc_message_macros.h
+++ b/ipc/ipc_message_macros.h
@@ -933,6 +933,8 @@
         TRACK_RUN_IN_IPC_HANDLER(member_func);                                 \
         msg_is_ok__ = msg_class::Dispatch(&ipc_message__, obj, this,           \
                                           param__, &member_func);              \
+        if (!msg_is_ok__)                                                      \
+          ipc_message__.set_dispatch_error();                                  \
       }                                                                        \
       break;
 
@@ -944,6 +946,8 @@
         TRACK_RUN_IN_IPC_HANDLER(member_func);                                 \
         msg_is_ok__ = msg_class::DispatchDelayReply(&ipc_message__, obj,       \
                                                   param__, &member_func);      \
+        if (!msg_is_ok__)                                                      \
+          ipc_message__.set_dispatch_error();                                  \
       }                                                                        \
       break;
 
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index cff311b..4ad93bf 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -2059,6 +2059,148 @@ Therefore, the affected-histogram name has to have at least one dot in it.
   </summary>
 </histogram>
 
+<histogram name="ChildProcess.BadMessgeTerminated" enum="ProcessType2">
+  <owner>jam@chromium.org</owner>
+  <summary>
+    Count of child processes killed because they sent an IPC that couldn't be
+    deserialized..
+  </summary>
+</histogram>
+
+<histogram name="ChildProcess.Crashed" enum="ProcessType">
+  <obsolete>
+    Deprecated 3/2013. Renamed to ChildProcess.Crashed2.
+  </obsolete>
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>Count of child process crashes grouped by process type.</summary>
+</histogram>
+
+<histogram name="ChildProcess.Crashed2" enum="ProcessType2">
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>Count of child process crashes grouped by process type.</summary>
+</histogram>
+
+<histogram name="ChildProcess.CrashedWasAlive" enum="ProcessType">
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>
+    Count of child process crashes that we miscounted because we took the exit
+    code too early. Grouped by process type.
+  </summary>
+</histogram>
+
+<histogram name="ChildProcess.Crashes" enum="ProcessType">
+  <obsolete>
+    Deprecated 10/2011. Renamed to ChildProcess.Crashed.
+  </obsolete>
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>Count of child process crashes grouped by process type.</summary>
+</histogram>
+
+<histogram name="ChildProcess.CrashesWasAlive" enum="ProcessType">
+  <obsolete>
+    Deprecated 10/2011. Renamed to ChildProcess.CrashedWasAlive.
+  </obsolete>
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>
+    Count of child process crashes that we miscounted because we took the exit
+    code too early. Grouped by process type.
+  </summary>
+</histogram>
+
+<histogram name="ChildProcess.DefaultCase" enum="ProcessType">
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>
+    Count of child process crashes for which we were not able to understand the
+    exit code, grouped by process type.
+  </summary>
+</histogram>
+
+<histogram name="ChildProcess.Disconnected" enum="ProcessType">
+  <obsolete>
+    Deprecated 3/2013. Renamed to ChildProcess.Disconnected2.
+  </obsolete>
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>
+    Count of child process abnormal channel disconnects grouped by process type.
+  </summary>
+</histogram>
+
+<histogram name="ChildProcess.Disconnected2" enum="ProcessType2">
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>
+    Count of child process abnormal channel disconnects grouped by process type.
+  </summary>
+</histogram>
+
+<histogram name="ChildProcess.DisconnectedAlive" enum="ProcessType">
+  <obsolete>
+    Deprecated 3/2013. Renamed to ChildProcess.DisconnectedAlive2.
+  </obsolete>
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>
+    Count of child process abnormal channel disconnects that are not classified
+    and reported because we took the exit code too early. Grouped by process
+    type.
+  </summary>
+</histogram>
+
+<histogram name="ChildProcess.DisconnectedAlive2" enum="ProcessType2">
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>
+    Count of child process abnormal channel disconnects that are not classified
+    and reported because we took the exit code too early. Grouped by process
+    type.
+  </summary>
+</histogram>
+
+<histogram name="ChildProcess.Killed" enum="ProcessType">
+  <obsolete>
+    Deprecated 3/2013. Renamed to ChildProcess.Killed2.
+  </obsolete>
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>Count of child process kills grouped by process type.</summary>
+</histogram>
+
+<histogram name="ChildProcess.Killed2" enum="ProcessType2">
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>Count of child process kills grouped by process type.</summary>
+</histogram>
+
+<histogram name="ChildProcess.KilledByExtensionAPI">
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>
+    Count of child processes killed by the extension API
+    (experimental.processes.terminate)
+  </summary>
+</histogram>
+
+<histogram name="ChildProcess.KilledWasAlive" enum="ProcessType">
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>
+    Count of child process kills that we miscounted because we took the exit
+    code too early. Grouped by process type.
+  </summary>
+</histogram>
+
+<histogram name="ChildProcess.Kills" enum="ProcessType">
+  <obsolete>
+    Deprecated 10/2011. Renamed to ChildProcess.Killed.
+  </obsolete>
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>Count of child process kills grouped by process type.</summary>
+</histogram>
+
+<histogram name="ChildProcess.KillsWasAlive" enum="ProcessType">
+  <obsolete>
+    Deprecated 10/2011. Renamed to ChildProcess.KilledWasAlive.
+  </obsolete>
+  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+  <summary>
+    Count of child process kills that we miscounted because we took the exit
+    code too early. Grouped by process type.
+  </summary>
+</histogram>
+
 <histogram name="Chrome.Android.Activity.CrashCounts" enum="AndroidActivityId">
   <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
   <summary>
@@ -40329,6 +40471,50 @@ Therefore, the affected-histogram name has to have at least one dot in it.
   <int value="7" label="PRIVET_DISABLE_NOTIFICATIONS_CLICKED"/>
 </enum>
 
+<enum name="ProcessType" type="int">
+  <obsolete>
+    Deprecated 3/2013. No longer generated.
+  </obsolete>
+  <summary>
+    The value for type comes from the ProcessType enum in
+    content/public/common/process_type.h.
+  </summary>
+  <int value="1" label="UNKNOWN"/>
+  <int value="2" label="BROWSER"/>
+  <int value="3" label="RENDER"/>
+  <int value="4" label="PLUGIN"/>
+  <int value="5" label="WORKER"/>
+  <int value="6" label="NACL"/>
+  <int value="7" label="UTILITY"/>
+  <int value="8" label="PROFILE_IMPORT"/>
+  <int value="9" label="ZYGOTE"/>
+  <int value="10" label="SANDBOX_HELPER"/>
+  <int value="11" label="NACL_BROKER_PROCESS"/>
+  <int value="12" label="GPU_PROCESS"/>
+  <int value="13" label="PPAPI_PLUGIN_PROCESS"/>
+</enum>
+
+<enum name="ProcessType2" type="int">
+  <summary>
+    The value for type comes from the ProcessType enum in
+    content/public/common/process_type.h.
+  </summary>
+  <int value="1" label="UNKNOWN"/>
+  <int value="2" label="BROWSER"/>
+  <int value="3" label="RENDER"/>
+  <int value="4" label="PLUGIN"/>
+  <int value="5" label="WORKER"/>
+  <int value="6" label="UTILITY"/>
+  <int value="7" label="ZYGOTE"/>
+  <int value="8" label="SANDBOX_HELPER"/>
+  <int value="9" label="GPU_PROCESS"/>
+  <int value="10" label="PPAPI_PLUGIN_PROCESS"/>
+  <int value="11" label="PPAPI_BROKER_PROCESS"/>
+  <int value="12" label="PROFILE_IMPORT"/>
+  <int value="13" label="NACL"/>
+  <int value="14" label="NACL_BROKER_PROCESS"/>
+</enum>
+
 <enum name="ProfileAddNewUser" type="int">
   <int value="0" label="Add new user from icon menu"/>
   <int value="1" label="Add new user from title bar menu"/>
diff --git a/ui/views/controls/webview/webview.h b/ui/views/controls/webview/webview.h
index 0bb0c68..831fe34 100644
--- a/ui/views/controls/webview/webview.h
+++ b/ui/views/controls/webview/webview.h
@@ -127,6 +127,7 @@ class WEBVIEW_EXPORT WebView : public View,
   // instantiation of the inline IPC::Listener methods in all translation units.
   virtual void OnChannelConnected(int32 peer_id) OVERRIDE {}
   virtual void OnChannelError() OVERRIDE {}
+  virtual void OnBadMessageReceived(const IPC::Message& message) OVERRIDE {}
 
  private:
   void AttachWebContents();