[28] ModelProcess ASSERT promoted to MESSAGE_CHECK for duplicate identifier

Severity: Low | Component: WebKit ModelProcess | 69ff7c4

Rated Low because the diff promotes a debug-only ASSERT on a renderer-supplied identifier to a release-enforced MESSAGE_CHECK in ModelProcessModelPlayerManagerProxy::createModelPlayer, and adds symmetric checks to deleteModelPlayer/unloadModelPlayer.

Source/WebKit/ModelProcess/ModelProcessModelPlayerManagerProxy.cpp

+#define MESSAGE_CHECK(assertion) MESSAGE_CHECK_BASE(assertion, m_modelConnectionToWebProcess->connection())
...
-    ASSERT(!m_proxies.contains(identifier));
+    MESSAGE_CHECK(!m_proxies.contains(identifier));

IPC-supplied identifier validation enforced only by debug-only ASSERT instead of release-build MESSAGE_CHECK, leaving the boundary check absent in shipping binaries.

HashMap::add is insert-if-absent: with ASSERT compiled out, a colliding identifier silently returns the existing entry, producing state confusion rather than a crash. ModelProcess is comparatively new (ENABLE(MODEL_PROCESS)) and its IPC surface has not had the years of audit pressure WebContent↔UIProcess has received.

This vulnerability weakens the IPC trust boundary between WebContent (untrusted) and ModelProcess (a privileged auxiliary process that hosts model rendering).

Audit directions

IPC handlers validating attacker-supplied identifiers with ASSERT instead of MESSAGE_CHECK. Grep Source/WebKit/UIProcess/, NetworkProcess/, GPUProcess/, ModelProcess/, especially ASSERT(.*contains.*identifier immediately followed by m_*.add(.
ObjectIdentifier-keyed maps in auxiliary processes with asymmetric create/delete validation. Audit ModelProcessModelPlayerProxy, RemoteRenderingBackend, RemoteAudioDestinationManager, RemoteMediaPlayerManagerProxy.
New IPC surfaces (ENABLE(MODEL_PROCESS) and similar) inheriting WebContent conventions incompletely. Review Source/WebKit/ModelProcess/ for ASSERT on values originating from IPC::Decoder.