Bug 190449 – makeWeakPtr() on a derived class provides a bad pointer if CanMakeWeakPtr<> is not its first base class

• Status: NEW
• Component: Web Template Framework

[Simon Fraser (smfr)]

I changed RenderLayer to:

class RenderLayer final : public RenderLayerNode, public ScrollableArea {
...
}

where RenderLayerNode is a base class with virtual members
and ScrollableArea is:

class ScrollableArea : public CanMakeWeakPtr<ScrollableArea> {
...
}

This triggered crashes in code that referenced weak ptrs to RenderLayers. It seems that weak_reference_downcast() assumes that the pointers are reinterpret-castable, but that's not always true.

[Geoffrey Garen]

Related:

https://bugs.webkit.org/show_bug.cgi?id=188799
https://bugs.webkit.org/show_bug.cgi?id=179405

[Simon Fraser (smfr)]

This could probably be marked a dup of one of those. I'd like this to work soonish...

[Geoffrey Garen]

A short-term workaround is to list ScrollableArea first in the inheritance hierarchy:

class RenderLayer final : public ScrollableArea, public RenderLayerNode {

[Simon Fraser (smfr)]

Sadly that breaks some other casting I wanted to do (but may have to do differently).

[Antti Koivisto]

I'll try to fix WeakPtr at some point.