Add UKM metrics for postMessage events

This adds UKM metrics recording the source and target of each
postMessage event.

For cross-process postMessages, this is recorded from the browser side
as the source ID of the source page (navigation). For same-process
postMessages, this is recorded from the renderer side as the source ID
of the source frame (which may be a subframe), which can then be
correlated with the source page (navigation) via the DocumentCreated
event.

Change-Id: I1ba8fcb5d493f97d80e2de4c5c3f031025488310
Bug: 1112491
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2530774Reviewed-by: Aaron Colwell <acolwell@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Robert Kaplow <rkaplow@chromium.org>
Commit-Queue: Lily Chen <chlily@chromium.org>
Cr-Commit-Position: refs/heads/master@{#827820}

content/browser/renderer_host/render_frame_proxy_host.cc

@@ -34,6 +34,9 @@
 #include "content/public/common/referrer_type_converters.h"
 #include "ipc/ipc_message.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
+#include "services/metrics/public/cpp/ukm_builders.h"
+#include "services/metrics/public/cpp/ukm_recorder.h"
+#include "services/metrics/public/cpp/ukm_source_id.h"
 #include "services/network/public/cpp/web_sandbox_flags.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom.h"
@@ -541,6 +544,7 @@ void RenderFrameProxyHost::RouteMessageEvent(
   // If there is a |source_frame_token|, translate it to the frame token of the
   // equivalent RenderFrameProxyHost in the target process.
   base::Optional<base::UnguessableToken> translated_source_token;
+  ukm::SourceId source_page_ukm_source_id = ukm::kInvalidSourceId;
   if (source_frame_token) {
     RenderFrameHostImpl* source_rfh = RenderFrameHostImpl::FromFrameToken(
         GetProcess()->GetID(), source_frame_token.value());
@@ -580,9 +584,18 @@ void RenderFrameProxyHost::RouteMessageEvent(
         translated_source_token =
             source_proxy_in_target_site_instance->GetFrameToken();
       }
+
+      source_page_ukm_source_id = source_rfh->GetPageUkmSourceId();
     }
   }
 
+  // Record UKM metrics for the postMessage event.
+  ukm::builders::PostMessage_Incoming_Page ukm_builder(
+      target_rfh->GetPageUkmSourceId());
+  if (source_page_ukm_source_id != ukm::kInvalidSourceId)
+    ukm_builder.SetSourcePageSourceId(source_page_ukm_source_id);
+  ukm_builder.Record(ukm::UkmRecorder::Get());
+
   target_rfh->PostMessageEvent(translated_source_token, source_origin,
                                target_origin, std::move(message));
 }

third_party/blink/renderer/core/frame/local_dom_window.cc

@@ -32,6 +32,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "cc/input/snap_selection_strategy.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
+#include "services/metrics/public/cpp/ukm_builders.h"
 #include "third_party/blink/public/common/action_after_pagehide.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/common/features.h"
@@ -944,6 +945,11 @@ void LocalDOMWindow::SchedulePostMessage(
     MessageEvent* event,
     scoped_refptr<const SecurityOrigin> target,
     LocalDOMWindow* source) {
+  // Record UKM metrics for postMessage event.
+  ukm::builders::PostMessage_Incoming_Frame(UkmSourceID())
+      .SetSourceFrameSourceId(source->UkmSourceID())
+      .Record(UkmRecorder());
+
   // Allowing unbounded amounts of messages to build up for a suspended context
   // is problematic; consider imposing a limit or other restriction if this
   // surfaces often as a problem (see crbug.com/587012).

tools/metrics/ukm/ukm.xml

@@ -10720,6 +10720,35 @@ be describing additional metrics about the same event.
   </metric>
 </event>
 
+<event name="PostMessage.Incoming.Frame">
+  <owner>chlily@chromium.org</owner>
+  <owner>miketaylr@chromium.org</owner>
+  <summary>
+    The frame received an incoming postMessage event. This is recorded only for
+    postMessage events sent between frames in the same renderer process.
+  </summary>
+  <metric name="SourceFrameSourceId">
+    <summary>
+      The UKM source ID of the postMessage event's source frame, as an integer.
+    </summary>
+  </metric>
+</event>
+
+<event name="PostMessage.Incoming.Page">
+  <owner>chlily@chromium.org</owner>
+  <owner>miketaylr@chromium.org</owner>
+  <summary>
+    A frame on the page received an incoming postMessage event. This is recorded
+    only for postMessage events sent between frames in different renderer
+    processes.
+  </summary>
+  <metric name="SourcePageSourceId">
+    <summary>
+      The UKM source ID of the postMessage event's source page, as an integer.
+    </summary>
+  </metric>
+</event>
+
 <event name="PrefetchProxy" singular="True">
   <owner>robertogden@chromium.org</owner>
   <owner>ryansturm@chromium.org</owner>