[Webkit-unassigned] [Bug 179405] New: Avoid using reinterpret_cast in WeakPtr downcasting

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=179405

            Bug ID: 179405
           Summary: Avoid using reinterpret_cast in WeakPtr downcasting
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Web Template Framework
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: jiewen_tan at apple.com

We should probably avoid using reinterpret_cast in WeakPtr downcasting as it might point to a wrong pointer if multiple inheritance is involved.

Examples:
class Base {
public:
    virtual ~Base()
    {
    }

    int foo()
    {
        return 0;
    }

    auto& weakPtrFactory() { return m_weakPtrFactory; }

private:
    WeakPtrFactory<Base> m_weakPtrFactory;
};

class ExtraBase {
public:
    virtual ~ExtraBase() { }
    int someExtraData { 1 };
};

class Multi : public ExtraBase, public Base {
public:
    int foo()
    {
        return 1;
    }
};

TEST(WTF_WeakPtr, MultiInheritance)
{
    Multi object;
    Multi* multiPtr = &object;
    Base* basePtr = static_cast<Base*>(&object);
    EXPECT_NE((void*)basePtr, (void*)multiPtr);

    WeakPtr<Base> baseWeakPtr = object.weakPtrFactory().createWeakPtr(object);
    WeakPtr<Multi> multiWeakPtr = makeWeakPtr(object);
    EXPECT_NE((void*)baseWeakPtr.get(), (void*)multiWeakPtr.get());
}

One can copy and paste the above example into API test of WeakPtr and run the test. The result is:
jwtan$ run-api-tests WTF_WeakPtr.MultiInheritance
Running build-api-tests
FAIL WTF_WeakPtr.MultiInheritance

/Users/jwtan/Documents/Source/OpenSource/Tools/TestWebKitAPI/Tests/WTF/WeakPtr.cpp:280
Expected: ((void*)baseWeakPtr.get()) != ((void*)multiWeakPtr.get()), actual: 0x7ffee36e7218 vs 0x7ffee36e7218


Tests that failed:
  WTF_WeakPtr.MultiInheritance

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20171108/ab683b79/attachment-0001.html>