aboutsummaryrefslogtreecommitdiffstats
path: root/src/qmlcompiler/qqmljsfunctioninitializer.cpp
diff options
context:
space:
mode:
authorSami Shalayel <sami.shalayel@qt.io>2024-12-02 10:03:09 +0100
committerSami Shalayel <sami.shalayel@qt.io>2024-12-03 09:55:46 +0100
commit60cedb86cad9c3fc275e305e9615d67a2363d269 (patch)
tree3ede806284515f8a256c4c41e71fb7faa24fed56 /src/qmlcompiler/qqmljsfunctioninitializer.cpp
parent558e0f4240a6283ddb1c014eb57d2b7ac6c0101f (diff)
qmlls: fix crash in QLanguageServerPrivate destruction order
Fix crash where the shutdownResponse and protocol members of QLanguageServerPrivate where destroyed in the wrong order by reordering the members. ShutdownResponse is initialized with a pointer to protocol, and uses protocol in its destructor to send a message on destruction. During the destruction of QLanguageServerPrivate, protocol gets destroyed before shutdownResponse because of the member order in the QLanguageServerPrivate class definition, leading to a heap-use-after-free with the previous member order. Responses are usually constructed after protocol, and have a pointer to protocol to be able to send messages and errors. They have a short lifetime, are constructed on the stack and used in handlers via temporary refs (&&). They are supposed to be sent to the protocol quickly after they were constructed, and then destroyed, so I think responses should not take ownership of the protocol. The current code assumes that the protocol is outliving all responses, there is code in the response destructor to send an error if the response was not used to send anything on the protocol, for example. Therefore not sending a response because the protocol was already destroyed does sound like an error or misuse of the response, and making the response using a weak pointer just for this weird case does sound unappropriate to me. Add a comment stating that protocol has to be destroyed last. Pick-to: 6.8 Task-number: QTBUG-131702 Change-Id: I329ecf4d9954e20e2868e21cc0663c19963f1643 Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
Diffstat (limited to 'src/qmlcompiler/qqmljsfunctioninitializer.cpp')
0 files changed, 0 insertions, 0 deletions