REGRESSION(314479@main): Crash in WebPushD::Connection::connectionReceivedEvent() due to xpc_object_t ODR violation

ada15a6

// Source/WebKit/NetworkProcess/Notifications/Cocoa/WebPushDaemonConnectionCocoa.mm
+// This destructor must be defined in this .mm file (and not in WebPushDaemonConnection.cpp).
+// As the first non-pure non-inline virtual, it is the key function for Connection, and the
+// vtable is emitted in the same translation unit. xpc_object_t resolves to OS_xpc_object*
+// in .mm TUs but to void* in .cpp TUs. Emitting the vtable from a .cpp TU would sign its
+// slot with the void* discriminator, causing arm64e PAC failures at every .mm call site.
+Connection::~Connection() = default;

arm64e signs vtable function pointers with PAC discriminators derived from each virtual function's mangled name. The C header <os/object.h> gates OS_OBJECT_USE_OBJC on __OBJC__: in .mm TUs xpc_object_t is an ObjC object pointer (OS_xpc_object*), producing one mangled name; in .cpp TUs it is void*, producing a different one. C++ vtable emission follows the key function rule: the vtable is emitted as a strong external symbol once, in the same TU that defines the key function (the first out-of-line, non-pure, non-inline virtual).

This commit moves WebPushD::Connection::~Connection() from WebPushDaemonConnection.cpp to WebPushDaemonConnectionCocoa.mm. The destructor is the key function, so the vtable is now emitted from a .mm TU and every slot is PAC-signed with the ObjC OS_xpc_object* discriminator that all .mm call sites expect. Pre-fix the vtable was emitted from .cpp with void*-derived discriminators, and every authentication at a .mm call site tripped EXC_ARM_PAC_FAIL in the NetworkProcess.

Significance

Fixes an arm64e crash triggered by a silent ODR violation that caused the vtable for WebPushD::Connection to be signed with the wrong PAC discriminator — a systemic trap that can silently weaken arm64e PAC protection wherever the pattern repeats in Cocoa-facing WebKit code.

Audit directions

• WebKit classes with virtual methods taking XPC- or libdispatch-gated types (xpc_object_t, dispatch_object_t, dispatch_queue_t) whose headers are included by both .cpp and .mm TUs and whose key function lands in a .cpp TU. Each such class has a vtable signed with void* discriminators, weakening PAC at those virtual dispatches.
• Cross-reference key function placement against header type-resolution. The commit notes PCM::Connection was accidentally safe (its key function is already in .mm), implying this was discovered opportunistically rather than systematically — a survey of XPC-related virtual interfaces under Source/WebKit/NetworkProcess, Source/WebKit/GPUProcess, and Source/WebKit/Shared is warranted.
• Type-confusion or vtable-corruption primitives reaching such call sites would face weaker authentication than the surrounding code assumes; this matters when chaining a primitive through an XPC-handling virtual.

---