Bug 226561

Summary: Stop using a RefPtr<IPC::Connection> as HashMap key in DisplayLink
Product: WebKit Reporter: Chris Dumez <cdumez>
Component: WebKit2Assignee: Chris Dumez <cdumez>
Status: RESOLVED FIXED    
Severity: Normal CC: ggaren, kkinnunen, pvollan, simon.fraser, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=238493
Bug Depends on:    
Bug Blocks: 226583    
Attachments:
Description Flags
Patch none

Description Chris Dumez 2021-06-02 17:01:15 PDT 
Stop using a RefPtr<IPC::Connection> as HashMap key in DisplayLink. Using a RefPtr as key is suboptimal and could leak to memory leaks.
We now store IPC::Connection::UniqueID instead and look up the IPC::Connection from its identifier when we need to send an IPC.
Comment 1 Chris Dumez 2021-06-02 17:24:34 PDT 
Created attachment 430421 [details]
Patch
Comment 2 Simon Fraser (smfr) 2021-06-02 21:15:05 PDT 
Comment on attachment 430421 [details]
Patch

Great!
Comment 3 EWS 2021-06-02 22:09:09 PDT 
Committed r278395 (238420@main): <https://commits.webkit.org/238420@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 430421 [details].
Comment 4 Radar WebKit Bug Importer 2021-06-02 22:10:17 PDT 
<rdar://problem/78798133>
Comment 5 Kimmo Kinnunen 2022-03-29 01:07:22 PDT 
This patch is not defined C++.

Single-threaded id to instance lookup can be implemented by maintaining the id map in constructor and destructor.

Multi-threaded id to instance lookup cannot be implemented by maintaining the id map in the constructor and destructor. One thread might do a lookup while other thread might have already entered into the destructor, ending the life-time of the object.
Comment 6 Kimmo Kinnunen 2022-03-29 01:08:23 PDT 
Comment on attachment 430421 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=430421&action=review

> Source/WebKit/Platform/IPC/Connection.cpp:309
>  

one thread here, object life time has ended

> Source/WebKit/Platform/IPC/Connection.h:530
> +    return connection->send(WTFMove(message), destinationID, sendOptions);

other thread here, using object that is not alive anymore