← All issues

[28] ModelProcess ASSERT promoted to MESSAGE_CHECK for duplicate identifier

Severity: Low | Component: WebKit ModelProcess | 69ff7c4

Rated Low because the diff promotes a debug-only ASSERT on a renderer-supplied identifier to a release-enforced MESSAGE_CHECK in ModelProcessModelPlayerManagerProxy::createModelPlayer, and adds symmetric checks to deleteModelPlayer/unloadModelPlayer.

Source/WebKit/ModelProcess/ModelProcessModelPlayerManagerProxy.cpp

+#define MESSAGE_CHECK(assertion) MESSAGE_CHECK_BASE(assertion, m_modelConnectionToWebProcess->connection())
...
- ASSERT(!m_proxies.contains(identifier));
+ MESSAGE_CHECK(!m_proxies.contains(identifier));

IPC-supplied identifier validation enforced only by debug-only ASSERT instead of release-build MESSAGE_CHECK, leaving the boundary check absent in shipping binaries.

🔒

The release-build consequence of a debug-only invariant check at an IPC boundary, and how far the resulting state confusion could plausibly travel.

Subscribe to read more

🔒

Multiple reusable audit patterns identified for finding ASSERT-vs-MESSAGE_CHECK gaps across several auxiliary-process IPC surfaces.

Subscribe to read more