Bug 190449
| Summary: | makeWeakPtr() on a derived class provides a bad pointer if CanMakeWeakPtr<> is not its first base class | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Simon Fraser (smfr) <simon.fraser> |
| Component: | Web Template Framework | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW | ||
| Severity: | Normal | CC: | cdumez, ggaren, jiewen_tan, koivisto, lforschler, sam, simon.fraser |
| Priority: | P2 | ||
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Simon Fraser (smfr)
I changed RenderLayer to:
class RenderLayer final : public RenderLayerNode, public ScrollableArea {
...
}
where RenderLayerNode is a base class with virtual members
and ScrollableArea is:
class ScrollableArea : public CanMakeWeakPtr<ScrollableArea> {
...
}
This triggered crashes in code that referenced weak ptrs to RenderLayers. It seems that weak_reference_downcast() assumes that the pointers are reinterpret-castable, but that's not always true.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Geoffrey Garen
Related:
https://bugs.webkit.org/show_bug.cgi?id=188799
https://bugs.webkit.org/show_bug.cgi?id=179405
Simon Fraser (smfr)
This could probably be marked a dup of one of those. I'd like this to work soonish...
Geoffrey Garen
A short-term workaround is to list ScrollableArea first in the inheritance hierarchy:
class RenderLayer final : public ScrollableArea, public RenderLayerNode {
Simon Fraser (smfr)
Sadly that breaks some other casting I wanted to do (but may have to do differently).
Antti Koivisto
I'll try to fix WeakPtr at some point.