Implement off-the-wire validation scheme for enum types.

ipc/ipc_message_macros.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Defining IPC Messages
 //
 // Your IPC messages will be defined by macros inside of an XXX_messages.h
 // header file.  Most of the time, the system can automatically generate all
 // of messaging mechanism from these definitions, but sometimes some manual
 // coding is required.  In these cases, you will also have an XXX_messages.cc
@@ skipping 112 matching lines @@
 // You will use IPC message macro invocations for three things:
 //   - New struct definitions for IPC
 //   - Registering existing struct and enum definitions with IPC
 //   - Defining the messages themselves
 //
 // New structs are defined with IPC_STRUCT_BEGIN(), IPC_STRUCT_MEMBER(),
 // IPC_STRUCT_END() family of macros.  These cause the XXX_messages.h
 // to proclaim equivalent struct declarations for use by callers, as well
 // as later registering the type with the message generation.  Note that
 // IPC_STRUCT_MEMBER() is only permitted inside matching calls to
-// IPC_STRUCT_BEGIN() / IPC_STRUCT_END().
+// IPC_STRUCT_BEGIN() / IPC_STRUCT_END(). There is also an
+// IPC_STRUCT_BEGIN_WITH_PARENT(), which behaves like IPC_STRUCT_BEGIN(),
+// but also accomodates structs that inherit from other structs.
 //
 // Externally-defined structs are registered with IPC_STRUCT_TRAITS_BEGIN(),
 // IPC_STRUCT_TRAITS_MEMBER(), and IPC_STRUCT_TRAITS_END() macros. These
 // cause registration of the types with message generation only.
 // There's also IPC_STRUCT_TRAITS_PARENT, which is used to register a parent
 // class (whose own traits are already defined). Note that
 // IPC_STRUCT_TRAITS_MEMBER() and IPC_STRUCT_TRAITS_PARENT are only permitted
 // inside matching calls to IPC_STRUCT_TRAITS_BEGIN() /
 // IPC_STRUCT_TRAITS_END().
 //
-// Enum types are registered with a single IPC_ENUM_TRAITS() macro.  There
-// is no need to enumerate each value to the IPC mechanism.
+// Enum types are registered with a single IPC_ENUM_TRAITS_VALIDATE() macro.
+// There is no need to enumerate each value to the IPC mechanism. Instead,
+// pass an expression in terms of the parameter |value| to provide
+// range-checking.  For convenience, the IPC_ENUM_TRAITS() is provided which
+// performs no checking, passing everything including out-of-range values.
+// Its use is discouraged. The IPC_ENUM_TRAITS_MAX_VALUE() macro can be used
+// for the typical case where the enum must be in the range 0..maxvalue
+// inclusive. The IPC_ENUM_TRAITS_MIN_MAX_VALUE() macro can be used for the
+// less typical case where the enum must be in the range minvalue..maxvalue
+// inclusive.
 //
 // Do not place semicolons following these IPC_ macro invocations.  There
 // is no reason to expect that their expansion corresponds one-to-one with
 // C++ statements.
 //
 // Once the types have been declared / registered, message definitions follow.
 // "Sync" messages are just synchronous calls, the Send() call doesn't return
 // until a reply comes back.  To declare a sync message, use the IPC_SYNC_
 // macros.  The numbers at the end show how many input/output parameters there
 // are (i.e. 1_2 is 1 in, 2 out).  Input parameters are first, followed by
@@ skipping 29 matching lines @@
 #define IPC_IPC_MESSAGE_MACROS_H_
 
 #include "base/profiler/scoped_profile.h"
 #include "ipc/ipc_message_utils.h"
 #include "ipc/param_traits_macros.h"
 
 #if defined(IPC_MESSAGE_IMPL)
 #include "ipc/ipc_message_utils_impl.h"
 #endif
 
-// Macros for defining structs.  May be subsequently redefined.
+// Convenience macro for defining structs without inheritence. Should not need
+// to be subsequently redefined.
 #define IPC_STRUCT_BEGIN(struct_name) \
   IPC_STRUCT_BEGIN_WITH_PARENT(struct_name, IPC::NoParams)
+
+// Macros for defining structs. Will be subsequently redefined.
 #define IPC_STRUCT_BEGIN_WITH_PARENT(struct_name, parent) \
   struct struct_name; \
   IPC_STRUCT_TRAITS_BEGIN(struct_name) \
   IPC_STRUCT_TRAITS_END() \
   struct IPC_MESSAGE_EXPORT struct_name : parent { \
     struct_name(); \
     ~struct_name();
 // Optional variadic parameters specify the default value for this struct
 // member. They are passed through to the constructor for |type|.
 #define IPC_STRUCT_MEMBER(type, name, ...) type name;
@@ skipping 786 matching lines @@
 // This corresponds to an enum value from IPCMessageStart.
 #define IPC_MESSAGE_CLASS(message) \
   IPC_MESSAGE_ID_CLASS(message.type())
 
 #endif  // IPC_IPC_MESSAGE_MACROS_H_
 
 // Clean up IPC_MESSAGE_START in this unguarded section so that the
 // XXX_messages.h files need not do so themselves.  This makes the
 // XXX_messages.h files easier to write.
 #undef IPC_MESSAGE_START