Mojo: Report bindings validation errors via MojoNotifyBadMessage

mojo/public/cpp/bindings/message.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef MOJO_PUBLIC_CPP_BINDINGS_MESSAGE_H_
 #define MOJO_PUBLIC_CPP_BINDINGS_MESSAGE_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <limits>
 #include <memory>
 #include <vector>
 
 #include "base/logging.h"
 #include "mojo/public/cpp/bindings/lib/message_buffer.h"
 #include "mojo/public/cpp/bindings/lib/message_internal.h"
 #include "mojo/public/cpp/system/message.h"
 
 namespace mojo {
 
+class Error;
+
 // Message is a holder for the data and handles to be sent over a MessagePipe.
 // Message owns its data and handles, but a consumer of Message is free to
 // mutate the data and handles. The message's data is comprised of a header
 // followed by payload.
 class Message {
  public:
   Message();
   ~Message();
 
   // Initializes a Message with enough space for |capacity| bytes.
@@ skipping 60 matching lines @@
   std::vector<Handle>* mutable_handles() { return &handles_; }
 
   // Access the underlying Buffer interface.
   internal::Buffer* buffer() { return buffer_.get(); }
 
   // Takes a scoped MessageHandle which may be passed to |WriteMessageNew()| for
   // transmission. Note that this invalidates this Message object, taking
   // ownership of its internal storage and any attached handles.
   ScopedMessageHandle TakeMojoMessage();
 
+  // Notifies the system that this message is "bad," in this case meaning it was
+  // rejected by bindings validation code.
+  void NotifyBadMessage(const std::string& error);
+
  private:
   void CloseHandles();
 
   std::unique_ptr<internal::MessageBuffer> buffer_;
   std::vector<Handle> handles_;
 
   DISALLOW_COPY_AND_ASSIGN(Message);
 };
 
 class MessageReceiver {
  public:
   virtual ~MessageReceiver() {}
 
   // The receiver may mutate the given message.  Returns true if the message
   // was accepted and false otherwise, indicating that the message was invalid
-  // or malformed.
-  virtual bool Accept(Message* message) WARN_UNUSED_RESULT = 0;
+  // or malformed. If this returns false, |*error| may be populated with
+  // additional information about the failure reason.
+  virtual bool Accept(Message* message, Error* error) WARN_UNUSED_RESULT = 0;

[yzshen1, 2016/06/14 16:45:32]

Does it make sense to merge the return value with Error? IIUC, we don't need
orthogonal "accepted" and "error".

Error Accept(Message* message);
or void Accept(Message* message, Error* error);

[Ken Rockot(use gerrit already), 2016/06/14 21:20:40]

Done!

 };
 
 class MessageReceiverWithResponder : public MessageReceiver {
  public:
   ~MessageReceiverWithResponder() override {}
 
   // A variant on Accept that registers a MessageReceiver (known as the
   // responder) to handle the response message generated from the given
   // message. The responder's Accept method may be called during
   // AcceptWithResponder or some time after its return.
   //
   // NOTE: Upon returning true, AcceptWithResponder assumes ownership of
   // |responder| and will delete it after calling |responder->Accept| or upon
   // its own destruction.
   //
   // TODO(yzshen): consider changing |responder| to
   // std::unique_ptr<MessageReceiver>.
-  virtual bool AcceptWithResponder(Message* message, MessageReceiver* responder)
+  virtual bool AcceptWithResponder(Message* message,
+                                   MessageReceiver* responder,
+                                   Error* error)
       WARN_UNUSED_RESULT = 0;
 };
 
 // A MessageReceiver that is also able to provide status about the state
 // of the underlying MessagePipe to which it will be forwarding messages
 // received via the |Accept()| call.
 class MessageReceiverWithStatus : public MessageReceiver {
  public:
   ~MessageReceiverWithStatus() override {}
 
@@ skipping 19 matching lines @@
   // message. Any of the responder's methods (Accept or IsValid) may be called
   // during  AcceptWithResponder or some time after its return.
   //
   // NOTE: Upon returning true, AcceptWithResponder assumes ownership of
   // |responder| and will delete it after calling |responder->Accept| or upon
   // its own destruction.
   //
   // TODO(yzshen): consider changing |responder| to
   // std::unique_ptr<MessageReceiver>.
   virtual bool AcceptWithResponder(Message* message,
-                                   MessageReceiverWithStatus* responder)
+                                   MessageReceiverWithStatus* responder,
+                                   Error* error)
       WARN_UNUSED_RESULT = 0;
 };
 
 // Read a single message from the pipe. The caller should have created the
 // Message, but not called Initialize(). Returns MOJO_RESULT_SHOULD_WAIT if
 // the caller should wait on the handle to become readable. Returns
 // MOJO_RESULT_OK if the message was read successfully and should be
 // dispatched, otherwise returns an error code if something went wrong.
 //
 // NOTE: The message hasn't been validated and may be malformed!
 MojoResult ReadMessage(MessagePipeHandle handle, Message* message);
 
 }  // namespace mojo
 
 #endif  // MOJO_PUBLIC_CPP_BINDINGS_MESSAGE_H_