Changeset 141562 in webkit

Timestamp:

Feb 1, 2013 2:06:06 AM (11 years ago)

Author:

Simon Hausmann

Message:

[EFL][WK2] MiniBrowser segfaults on loading google.com
​https://bugs.webkit.org/show_bug.cgi?id=108597

Patch by Gwang Yoon Hwang <​ryumiel@company100.net> on 2013-02-01
Reviewed by Andreas Kling.

• Platform/CoreIPC/unix/ConnectionUnix.cpp:

(CoreIPC::Connection::processMessage):
oolMessageBody should be properly initialized before it is used.

This patch also adds omitted break statement.

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• Platform/CoreIPC/unix/ConnectionUnix.cpp (modified) (2 diffs)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2013-02-01  Gwang Yoon Hwang  <ryumiel@company100.net>
+
+        [EFL][WK2] MiniBrowser segfaults on loading google.com
+        https://bugs.webkit.org/show_bug.cgi?id=108597
+
+        Reviewed by Andreas Kling.
+
+        * Platform/CoreIPC/unix/ConnectionUnix.cpp:
+        (CoreIPC::Connection::processMessage):
+        oolMessageBody should be properly initialized before it is used.
+
+        This patch also adds omitted break statement.
+
 2013-01-31  Jae Hyun Park  <jae.park@company100.net>
 

trunk/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp

@@ -223 +223 @@
                 if (!attachmentInfo[i].isNull())
                     attachmentFileDescriptorCount++;
+                break;
             case Attachment::Uninitialized:
             default:
@@ -238 +239 @@
     RefPtr<WebKit::SharedMemory> oolMessageBody;
 
-    if (attachmentCount) {
-        size_t fdIndex = 0;
-        for (size_t i = 0; i < attachmentCount; ++i) {
-            int fd = -1;
-            switch (attachmentInfo[i].getType()) {
-            case Attachment::MappedMemoryType:
-                if (!attachmentInfo[i].isNull())
-                    fd = m_fileDescriptors[fdIndex++];
-                attachments[attachmentCount - i - 1] = Attachment(fd, attachmentInfo[i].getSize());
-                break;
-            case Attachment::SocketType:
-                if (!attachmentInfo[i].isNull())
-                    fd = m_fileDescriptors[fdIndex++];
-                attachments[attachmentCount - i - 1] = Attachment(fd);
-                break;
-            case Attachment::Uninitialized:
-                attachments[attachmentCount - i - 1] = Attachment();
-            default:
-                break;
-            }
-        }
-
-        if (messageInfo.isMessageBodyIsOutOfLine()) {
-            ASSERT(messageInfo.bodySize());
-
-            if (attachmentInfo[attachmentCount].isNull()) {
-                ASSERT_NOT_REACHED();
-                return false;
-            }
-
-            WebKit::SharedMemory::Handle handle;
-            handle.adoptFromAttachment(m_fileDescriptors[attachmentFileDescriptorCount - 1], attachmentInfo[attachmentCount].getSize());
-
-            oolMessageBody = WebKit::SharedMemory::create(handle, WebKit::SharedMemory::ReadOnly);
-            if (!oolMessageBody) {
-                ASSERT_NOT_REACHED();
-                return false;
-            }
-        }
-    }
-
-    ASSERT(attachments.size() == messageInfo.isMessageBodyIsOutOfLine() ? messageInfo.attachmentCount() - 1 : messageInfo.attachmentCount());
+    size_t fdIndex = 0;
+    for (size_t i = 0; i < attachmentCount; ++i) {
+        int fd = -1;
+        switch (attachmentInfo[i].getType()) {
+        case Attachment::MappedMemoryType:
+            if (!attachmentInfo[i].isNull())
+                fd = m_fileDescriptors[fdIndex++];
+            attachments[attachmentCount - i - 1] = Attachment(fd, attachmentInfo[i].getSize());
+            break;
+        case Attachment::SocketType:
+            if (!attachmentInfo[i].isNull())
+                fd = m_fileDescriptors[fdIndex++];
+            attachments[attachmentCount - i - 1] = Attachment(fd);
+            break;
+        case Attachment::Uninitialized:
+            attachments[attachmentCount - i - 1] = Attachment();
+        default:
+            break;
+        }
+    }
+
+    if (messageInfo.isMessageBodyIsOutOfLine()) {
+        ASSERT(messageInfo.bodySize());
+
+        if (attachmentInfo[attachmentCount].isNull()) {
+            ASSERT_NOT_REACHED();
+            return false;
+        }
+
+        WebKit::SharedMemory::Handle handle;
+        handle.adoptFromAttachment(m_fileDescriptors[attachmentFileDescriptorCount - 1], attachmentInfo[attachmentCount].getSize());
+
+        oolMessageBody = WebKit::SharedMemory::create(handle, WebKit::SharedMemory::ReadOnly);
+        if (!oolMessageBody) {
+            ASSERT_NOT_REACHED();
+            return false;
+        }
+    }
+
+    ASSERT(attachments.size() == (messageInfo.isMessageBodyIsOutOfLine() ? messageInfo.attachmentCount() - 1 : messageInfo.attachmentCount()));
 
     uint8_t* messageBody = messageData;