Bug 226561 - Stop using a RefPtr<IPC::Connection> as HashMap key in DisplayLink
Summary: Stop using a RefPtr<IPC::Connection> as HashMap key in DisplayLink
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
Depends on:
Blocks: 226583
  Show dependency treegraph
 
Reported: 2021-06-02 17:01 PDT by Chris Dumez
Modified: 2022-03-29 01:13 PDT (History)
5 users (show)

See Also:


Attachments
Patch (12.00 KB, patch)
2021-06-02 17:24 PDT, Chris Dumez
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2021-06-02 17:01:15 PDT
Stop using a RefPtr<IPC::Connection> as HashMap key in DisplayLink. Using a RefPtr as key is suboptimal and could leak to memory leaks.
We now store IPC::Connection::UniqueID instead and look up the IPC::Connection from its identifier when we need to send an IPC.
Comment 1 Chris Dumez 2021-06-02 17:24:34 PDT
Created attachment 430421 [details]
Patch
Comment 2 Simon Fraser (smfr) 2021-06-02 21:15:05 PDT
Comment on attachment 430421 [details]
Patch

Great!
Comment 3 EWS 2021-06-02 22:09:09 PDT
Committed r278395 (238420@main): <https://commits.webkit.org/238420@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 430421 [details].
Comment 4 Radar WebKit Bug Importer 2021-06-02 22:10:17 PDT
<rdar://problem/78798133>
Comment 5 Kimmo Kinnunen 2022-03-29 01:07:22 PDT
This patch is not defined C++.

Single-threaded id to instance lookup can be implemented by maintaining the id map in constructor and destructor.

Multi-threaded id to instance lookup cannot be implemented by maintaining the id map in the constructor and destructor. One thread might do a lookup while other thread might have already entered into the destructor, ending the life-time of the object.
Comment 6 Kimmo Kinnunen 2022-03-29 01:08:23 PDT
Comment on attachment 430421 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=430421&action=review

> Source/WebKit/Platform/IPC/Connection.cpp:309
>  

one thread here, object life time has ended

> Source/WebKit/Platform/IPC/Connection.h:530
> +    return connection->send(WTFMove(message), destinationID, sendOptions);

other thread here, using object that is not alive anymore