`IPC::Untrusted<T>` wrapper for renderer-supplied values

Component: WebKit IPC | bafcdb2

WebKit treats the WebContent process as potentially compromised relative to privileged processes like the UI and Networking processes. Messages from WebContent carry security-relevant values — origins, sites, registrable domains, URLs — that a malicious or buggy renderer can forge, and the only defence to date has been a MESSAGE_CHECK macro that a developer has to remember to add on every code path touching such a value.

First of the series, this commit adds IPC::Untrusted<T> in Source/WebKit/Platform/IPC/Untrusted.h. The wrapper exposes no direct accessor at all: a caller can only reach the value through validate(), which runs a declared validation procedure, or unsafeExtractWithoutValidation(), which requires naming an UnvalidatedReason. No validators are wired up yet.

Significance

Missing validation stops being an absent runtime assert and becomes a compile error, because the wrapper offers no way to read the value without either validating it or naming a reason not to. Since the type has no accessor, the ArgumentCoder decode path can hand back an Untrusted<T> instead of a raw T, which makes unguarded paths visible in the type system rather than invisible in a missing assert.

Audit directions

The forward-facing pattern is a type-level guard whose coverage is exactly the set of values that arrive wrapped. Narrow: the escape hatch is the surface worth reading — every unsafeExtractWithoutValidation reason is a written-down trust assumption, and the set of reasons in use is a compact map of where the boundary is currently unenforced. Wider: the guard protects values decoded as Untrusted<T>, so audit the ArgumentCoder specializations for origin-bearing values still decoded raw — nested inside structs, carried as URLs, or arriving on message paths the generator enforcement does not cover. Widest: the same wrapper shape generalises to any value a privileged process receives from a less privileged one, so the question for future work is which other cross-process value classes (file paths, frame and page identifiers, sandbox extension handles) deserve the same treatment; the review tell is a privileged-side handler that reads a decoded parameter directly with no validate() or reason in the same expression.

---