[Webkit-unassigned] [Bug 238871] New: Multiple uses of ThreadSafeRefCounted and CanMakeWeakPtr with non-thread-safe WeakPtr

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=238871

            Bug ID: 238871
           Summary: Multiple uses of ThreadSafeRefCounted and
                    CanMakeWeakPtr with non-thread-safe WeakPtr
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Web Template Framework
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: kkinnunen at apple.com

Multiple uses of ThreadSafeRefCounted and CanMakeWeakPtr with non-thread-safe WeakPtr

ThreadSafeRefCounted means:
- Object is used in multiple threads
- Last ref can be given up in thread B

WeakPtr means:
- This object cannot change its liveliness state in other thread than in which the WeakPtr lives


Consider case:
class ImageSource : public ThreadSafeRefCounted<ImageSource>, public CanMakeWeakPtr<ImageSource> 

Thread Main checks
 WeakPtr<ImageSource> weakImageA = ...; 
 if (weakImageA) { weakImageA->doSomething(); }

Thread B gives up the last ref:
 RefPtr<ImageSource> imageA = ...;
 imageA = nullptr;


Consider case:
class Connection : public ThreadSafeRefCounted<Connection, WTF::DestructionThread::MainRunLoop>, public CanMakeWeakPtr<Connection>

Thread Main checks
 WeakPtr<Connection> weakConnectionA = ...; 
 if (weakConnectionA) { weakConnection->send(msg, ...); } // Connection::send will promote 0-refcount object to +1 ref, but the run loop has a callback scheduled to run the ~Connection()

Thread B gives up the last ref:
 RefPtr<Connection> connectionA = ...;
 connectionA = nullptr;  // Gives up last ref, sends the callback to main runloop to delete the instance.

Conservative list, but not exhaustive

kkinnunen at mbp3 OpenSource % git grep "ThreadSafeRefCounted.*CanMakeWeakPtr"
Source/JavaScriptCore/wasm/WasmInstance.h:class Instance : public ThreadSafeRefCounted<Instance>, public CanMakeWeakPtr<Instance> {
Source/WebCore/Modules/webaudio/AudioWorkletProcessor.h:class AudioWorkletProcessor : public ScriptWrappable, public ThreadSafeRefCounted<AudioWorkletProcessor>, public CanMakeWeakPtr<AudioWorkletProcessor> {
Source/WebCore/page/AbstractFrame.h:class AbstractFrame : public ThreadSafeRefCounted<AbstractFrame, WTF::DestructionThread::Main>, public CanMakeWeakPtr<AbstractFrame> {
Source/WebCore/platform/graphics/ImageBuffer.h:class ImageBuffer : public ThreadSafeRefCounted<ImageBuffer, WTF::DestructionThread::Main>, public CanMakeWeakPtr<ImageBuffer> {
Source/WebCore/platform/graphics/ImageSource.h:class ImageSource : public ThreadSafeRefCounted<ImageSource>, public CanMakeWeakPtr<ImageSource> {
Source/WebCore/platform/graphics/MediaPlayer.h:class WEBCORE_EXPORT MediaPlayer : public MediaPlayerEnums, public ThreadSafeRefCounted<MediaPlayer, WTF::DestructionThread::Main>, public CanMakeWeakPtr<MediaPlayer> {
Source/WebCore/platform/graphics/NativeImage.h:class NativeImage : public ThreadSafeRefCounted<NativeImage, WTF::DestructionThread::Main>, public CanMakeWeakPtr<NativeImage> {
Source/WebCore/platform/graphics/gstreamer/ImageDecoderGStreamer.h:    class InnerDecoder : public ThreadSafeRefCounted<InnerDecoder>, public CanMakeWeakPtr<InnerDecoder> {
Source/WebCore/platform/mediarecorder/cocoa/MediaRecorderPrivateWriterCocoa.h:class WEBCORE_EXPORT MediaRecorderPrivateWriter : public ThreadSafeRefCounted<MediaRecorderPrivateWriter, WTF::DestructionThread::Main>, public CanMakeWeakPtr<MediaRecorderPrivateWriter, WeakPtrFactoryInitialization::Eager> {
Source/WebCore/platform/network/cocoa/RangeResponseGenerator.h:class RangeResponseGenerator : public ThreadSafeRefCounted<RangeResponseGenerator, WTF::DestructionThread::Main>, public CanMakeWeakPtr<RangeResponseGenerator> {
Source/WebCore/platform/xr/PlatformXR.h:class Device : public ThreadSafeRefCounted<Device>, public CanMakeWeakPtr<Device> {
Source/WebCore/storage/StorageQuotaManager.h:class StorageQuotaManager : public ThreadSafeRefCounted<StorageQuotaManager>, public CanMakeWeakPtr<StorageQuotaManager> {
Source/WebKit/NetworkProcess/NetworkDataTask.h:class NetworkDataTask : public ThreadSafeRefCounted<NetworkDataTask, WTF::DestructionThread::Main>, public CanMakeWeakPtr<NetworkDataTask> {
Source/WebKit/NetworkProcess/storage/QuotaManager.h:class QuotaManager : public ThreadSafeRefCounted<QuotaManager>, public CanMakeWeakPtr<QuotaManager> {
Source/WebKit/Platform/IPC/Connection.h:class Connection : public ThreadSafeRefCounted<Connection, WTF::DestructionThread::MainRunLoop>, public CanMakeWeakPtr<Connection> {
Source/WebKit/UIProcess/Cocoa/SOAuthorization/SOAuthorizationSession.h:class SOAuthorizationSession : public ThreadSafeRefCounted<SOAuthorizationSession, WTF::DestructionThread::MainRunLoop>, public CanMakeWeakPtr<SOAuthorizationSession> {
Source/WebKit/UIProcess/Launcher/ProcessLauncher.h:class ProcessLauncher : public ThreadSafeRefCounted<ProcessLauncher>, public CanMakeWeakPtr<ProcessLauncher> {
Source/WebKit/UIProcess/ProcessAssertion.h:class ProcessAssertion : public ThreadSafeRefCounted<ProcessAssertion>, public CanMakeWeakPtr<ProcessAssertion, WeakPtrFactoryInitialization::Eager> {
kkinnunen at mbp3 OpenSource % git grep "CanMakeWeakPtr.*ThreadSafeRefCounted"                
Source/WebCore/Modules/filesystemaccess/FileSystemHandle.h:class FileSystemHandle : public ActiveDOMObject, public CanMakeWeakPtr<FileSystemHandle>, public ThreadSafeRefCounted<FileSystemHandle> {
kkinnunen at mbp3 OpenSource %

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220406/226bdafc/attachment.htm>