Changeset 70637 in webkit

Timestamp:

Oct 27, 2010 5:07:36 AM (13 years ago)

Author:

commit-queue@webkit.org

Message:

2010-10-27 Kimmo Kinnunen <​kimmo.t.kinnunen@nokia.com>

Reviewed by Andreas Kling.

[Qt] WebKit2 UI process crashes if web process crashes
​https://bugs.webkit.org/show_bug.cgi?id=48400

Check the success of socket write operations.
Avoids crashing the UI process if web process has crashed.
Qt socket code segfaults when write is called for a socket
that has had an error.

• Platform/CoreIPC/qt/ConnectionQt.cpp: (CoreIPC::Connection::platformInvalidate): Reset m_socket after deletion.

(CoreIPC::Connection::sendOutgoingMessage):
Check error status of write operations and
invalidate socket if writes fail.

Location:

trunk/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• Platform/CoreIPC/qt/ConnectionQt.cpp (modified) (2 diffs)

trunk/WebKit2/ChangeLog

@@ +1 @@
+2010-10-27  Kimmo Kinnunen  <kimmo.t.kinnunen@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] WebKit2 UI process crashes if web process crashes
+        https://bugs.webkit.org/show_bug.cgi?id=48400
+
+        Check the success of socket write operations.
+        Avoids crashing the UI process if web process has crashed.
+        Qt socket code segfaults when write is called for a socket
+        that has had an error.
+
+        * Platform/CoreIPC/qt/ConnectionQt.cpp:
+        (CoreIPC::Connection::platformInvalidate):
+        Reset m_socket after deletion.
+
+        (CoreIPC::Connection::sendOutgoingMessage):
+        Check error status of write operations and
+        invalidate socket if writes fail.
+
 2010-10-27  Kimmo Kinnunen  <kimmo.t.kinnunen@nokia.com>
 

trunk/WebKit2/Platform/CoreIPC/qt/ConnectionQt.cpp

@@ -52 +52 @@
 {
     delete m_socket;
+    m_socket = 0;
 }
 
@@ -120 +121 @@
     // Write message size first
     // FIXME: Should  just do a single write.
-    m_socket->write(reinterpret_cast<char*>(&bufferSize), sizeof(bufferSize));
+    qint64 bytesWrittenForSize = m_socket->write(reinterpret_cast<char*>(&bufferSize), sizeof(bufferSize));
+    if (bytesWrittenForSize != sizeof(bufferSize)) {
+        connectionDidClose();
+        return false;
+    }
 
-    qint64 bytesWritten = m_socket->write(reinterpret_cast<char*>(arguments->buffer()), arguments->bufferSize());
+    qint64 bytesWrittenForBuffer = m_socket->write(reinterpret_cast<char*>(arguments->buffer()), arguments->bufferSize());
+    if (bytesWrittenForBuffer != arguments->bufferSize()) {
+        connectionDidClose();
+        return false;
+    }
 
-    ASSERT_UNUSED(bytesWritten, bytesWritten == arguments->bufferSize());
     return true;
 }