Mojo C++ Bindings: Add helpers for bad message reporting

mojo/public/cpp/bindings/message.h

Index: mojo/public/cpp/bindings/message.h
diff --git a/mojo/public/cpp/bindings/message.h b/mojo/public/cpp/bindings/message.h
index e758432b9a953d5131d53c10509c71b1d4a7f52f..2f4ec40ed5d6ce84ccb8e53f019d7febd147ef2d 100644
--- a/mojo/public/cpp/bindings/message.h
+++ b/mojo/public/cpp/bindings/message.h
@@ -13,6 +13,7 @@
 #include <string>
 #include <vector>
 
+#include "base/callback.h"
 #include "base/logging.h"
 #include "mojo/public/cpp/bindings/lib/message_buffer.h"
 #include "mojo/public/cpp/bindings/lib/message_internal.h"
@@ -20,6 +21,8 @@
 
 namespace mojo {
 
+using ReportBadMessageCallback = base::Callback<void(const std::string& error)>;
+
 // Message is a holder for the data and handles to be sent over a MessagePipe.
 // Message owns its data and handles, but a consumer of Message is free to
 // mutate the data and handles. The message's data is comprised of a header
@@ -186,6 +189,44 @@ class MessageReceiverWithResponderStatus : public MessageReceiver {
       WARN_UNUSED_RESULT = 0;
 };
 
+namespace internal {
+class SyncMessageResponseSetup;
+}
+
+// An object which should be constructed on the stack immediately before making
+// a sync request for which the caller wishes to perform custom validation of
+// the response value(s). It is illegal to make more than one sync call during
+// the lifetime of the topmost SyncMessageResponseContext, but it is legal to
+// nest contexts to support reentrancy.
+//
+// Usage should look something like:
+//
+//     SyncMessageResponseContext response_context;
+//     foo_interface->SomeSyncCall(&response_value);
+//     if (response_value.IsBad())
+//       response_context.ReportBadMessage("Bad response_value!");
+//
+class SyncMessageResponseContext {
+ public:
+  SyncMessageResponseContext();
+  ~SyncMessageResponseContext();
+
+  static SyncMessageResponseContext* current();
+
+  void ReportBadMessage(const std::string& error);
+
+  const ReportBadMessageCallback& GetBadMessageCallback();
+
+ private:
+  friend class internal::SyncMessageResponseSetup;
+
+  SyncMessageResponseContext* outer_context_;
+  Message response_;
+  ReportBadMessageCallback bad_message_callback_;
+
+  DISALLOW_COPY_AND_ASSIGN(SyncMessageResponseContext);
+};
+
 // Read a single message from the pipe. The caller should have created the
 // Message, but not called Initialize(). Returns MOJO_RESULT_SHOULD_WAIT if
 // the caller should wait on the handle to become readable. Returns
@@ -195,6 +236,20 @@ class MessageReceiverWithResponderStatus : public MessageReceiver {
 // NOTE: The message hasn't been validated and may be malformed!
 MojoResult ReadMessage(MessagePipeHandle handle, Message* message);
 
+// Reports the currently dispatching Message as bad. Note that this is only
+// legal to call from directly within the stack frame of a message dispatch. If
+// you need to do asynchronous work before you can determine the legitimacy of
+// a message, use TakeBadMessageCallback() and retain its result until you're
+// ready to invoke or discard it.
+void ReportBadMessage(const std::string& error);
+
+// Acquires a callback which may be run to report the currently dispatching
+// Message as bad. Note that this is only legal to call from directly within the
+// stack frame of a message dispatch, but the returned callback may be called
+// exactly once any time thereafter to report the message as bad. This may only
+// be called once per message.
+ReportBadMessageCallback GetBadMessageCallback();
+
 }  // namespace mojo
 
 #endif  // MOJO_PUBLIC_CPP_BINDINGS_MESSAGE_H_