# IPC & remote decoding — dom/media review guidance

> Posture: the process on the other end of an actor is untrusted — a
> less-privileged content/GPU process may be compromised, so the receiver
> validates everything.

## General actor correctness

- **Validate on the receiving side.** Every new/changed message validates its
  inputs where it is received (a parent treats child input as hostile; validate
  the reverse direction too where a less-trusted peer sends to a more-trusted
  one). Do not assume a size/index/handle from the peer is in range.
- **Message flow / ordering.** Do not assume the peer sends messages in a
  particular order, or at all. Handle missing/late/duplicate messages.
- **Actor lifetime.** No `Send*` after `ActorDestroy`/`__delete__`; managed actors
  are torn down in the correct order; no dangling reference to a destroyed actor;
  `ActorDestroy` cleans up cleanly (including when the peer crashed).
- **IPDL annotations.** `nested`/`compress`/`[Async]`/`[Sync]` and message
  direction/side are correct for how the message is actually used.

## dom/media specifics

- **Remote decoding actors.** `RemoteMediaManagerChild`/`Parent` (formerly
  `RemoteDecoderManager*`) and the per-decoder `RemoteVideoDecoderChild`/
  `RemoteAudioDecoderChild` (under `PRemoteMediaManager`) run the decode in the RDD
  (or GPU/utility) process. Review new `Recv*`/`Send*` for input validation and
  correct actor thread affinity (the manager runs on its own thread — messages
  must be sent/received there).
- **Trust boundary on decoded output.** Frame descriptors, buffer sizes, strides,
  and `Shmem`/GPU handles coming back from the decoder process are untrusted —
  validate before mapping, indexing, or allocating against them. (The
  bounds/overflow mechanics of that validation are the memory-safety aspect; here
  the concern is that the check exists at the boundary at all.)
- **Shmem / handle lifetime.** A `Shmem` or GPU/texture handle shared across the
  boundary is released exactly once and not used after the owning actor is gone.
  Cross-process video images are ref-counted through a holder (`RemoteImageHolder`)
  that signals the decoder process to release when the last content-process
  reference drops — check that release path is not broken or double-run.
- **Peer-crash handling.** If the RDD/GPU process crashes, `ActorDestroy` must
  drive a clean recovery (surface an error / recreate), not a use-after-free or a
  hang on a promise that will never resolve.