SandboxHost.h File Reference

Host-side driver for the sandbox child process. See docs/design_docs/0023-editor_sandbox.md (S1 for the process model, S2 for the wire format, S3 for the host-side replay path). More...

#include <cstdint>
#include <string>
#include <string_view>
#include <vector>
#include "donner/svg/renderer/RendererInterface.h"

Include dependency graph for SandboxHost.h:

Classes
struct	donner::editor::sandbox::RenderResult
	Result payload for a render call. Fields are populated according to status — see each field comment for when it's valid. More...
class	donner::editor::sandbox::SandboxHost
	Spawns and communicates with the sandbox child binary. Not thread-safe: construct one instance per thread that needs to render. More...

Namespaces
namespace	donner
	Top-level Donner namespace, which is split into different sub-namespaces such as donner::svg and donner::css.

Enumerations
enum class	donner::editor::sandbox::SandboxStatus {   kOk ,   kSpawnFailed ,   kWriteFailed ,   kReadFailed ,   kParseError ,   kUsageError ,   kRenderError ,   kCrashed ,   kUnknownExit ,   kWireMalformed }
	Outcome of a single render invocation on SandboxHost. More...

Detailed Description

Host-side driver for the sandbox child process. See docs/design_docs/0023-editor_sandbox.md (S1 for the process model, S2 for the wire format, S3 for the host-side replay path).

SandboxHost spawns donner_parser_child as a subprocess, pipes SVG bytes to its stdin, reads a RendererInterface wire stream from its stdout, and either replays the stream into a caller-provided backend (renderToBackend) or runs the full host-side rasterizer + PNG encode (render) as a convenience wrapper.

The host process never crashes on adversarial SVG input — the worst failure mode is a SandboxStatus::kCrashed result with the previous document left intact on the caller side.

Enumeration Type Documentation

SandboxStatus

enum class donner::editor::sandbox::SandboxStatus

strong

Outcome of a single render invocation on SandboxHost.

Enumerator
kOk	Child exited 0 and the replay consumed the stream cleanly.
kSpawnFailed	posix_spawn or pipe setup failed before the child ran.
kWriteFailed	Host could not deliver the full SVG payload to the child.
kReadFailed	Host could not read stdout/stderr from the child.
kParseError	Child returned kExitParseError — malformed SVG.
kUsageError	Child returned kExitUsageError — bad argv/dimensions.
kRenderError	Child returned kExitRenderError — encoder bailed out.
kCrashed	Child died via signal (SIGSEGV, SIGABRT, ...).
kUnknownExit	Child exited with an unrecognized non-zero code.
kWireMalformed	Child exited 0 but its wire stream failed to decode.