Source code
Revision control
Copy as Markdown
Other Tools
# IPC & remote decoding — dom/media review guidance
> Posture: the process on the other end of an actor is untrusted — a
> less-privileged content/GPU process may be compromised, so the receiver
> validates everything.
## General actor correctness
- **Validate on the receiving side.** Every new/changed message validates its
inputs where it is received (a parent treats child input as hostile; validate
the reverse direction too where a less-trusted peer sends to a more-trusted
one). Do not assume a size/index/handle from the peer is in range.
- **Message flow / ordering.** Do not assume the peer sends messages in a
particular order, or at all. Handle missing/late/duplicate messages.
- **Actor lifetime.** No `Send*` after `ActorDestroy`/`__delete__`; managed actors
are torn down in the correct order; no dangling reference to a destroyed actor;
`ActorDestroy` cleans up cleanly (including when the peer crashed).
- **IPDL annotations.** `nested`/`compress`/`[Async]`/`[Sync]` and message
direction/side are correct for how the message is actually used.
## dom/media specifics
- **Remote decoding actors.** `RemoteMediaManagerChild`/`Parent` (formerly
`RemoteDecoderManager*`) and the per-decoder `RemoteVideoDecoderChild`/
`RemoteAudioDecoderChild` (under `PRemoteMediaManager`) run the decode in the RDD
(or GPU/utility) process. Review new `Recv*`/`Send*` for input validation and
correct actor thread affinity (the manager runs on its own thread — messages
must be sent/received there).
- **Trust boundary on decoded output.** Frame descriptors, buffer sizes, strides,
and `Shmem`/GPU handles coming back from the decoder process are untrusted —
validate before mapping, indexing, or allocating against them. (The
bounds/overflow mechanics of that validation are the memory-safety aspect; here
the concern is that the check exists at the boundary at all.)
- **Shmem / handle lifetime.** A `Shmem` or GPU/texture handle shared across the
boundary is released exactly once and not used after the owning actor is gone.
Cross-process video images are ref-counted through a holder (`RemoteImageHolder`)
that signals the decoder process to release when the last content-process
reference drops — check that release path is not broken or double-run.
- **Peer-crash handling.** If the RDD/GPU process crashes, `ActorDestroy` must
drive a clean recovery (surface an error / recreate), not a use-after-free or a
hang on a promise that will never resolve.