190449 2018-10-10 15:22:22 -0700 makeWeakPtr() on a derived class provides a bad pointer if CanMakeWeakPtr<> is not its first base class 2018-10-11 11:13:28 -0700 1 1 1 Unclassified WebKit Web Template Framework WebKit Nightly Build Unspecified Unspecified NEW P2 Normal --- 1 simon.fraser webkit-unassigned cdumez ggaren jiewen_tan koivisto lforschler sam simon.fraser oldest_to_newest 1467853 0 simon.fraser 2018-10-10 15:22:22 -0700 I changed RenderLayer to: class RenderLayer final : public RenderLayerNode, public ScrollableArea { ... } where RenderLayerNode is a base class with virtual members and ScrollableArea is: class ScrollableArea : public CanMakeWeakPtr<ScrollableArea> { ... } This triggered crashes in code that referenced weak ptrs to RenderLayers. It seems that weak_reference_downcast() assumes that the pointers are reinterpret-castable, but that's not always true. 1467940 1 ggaren 2018-10-10 20:17:25 -0700 Related: https://bugs.webkit.org/show_bug.cgi?id=188799 https://bugs.webkit.org/show_bug.cgi?id=179405 1467949 2 simon.fraser 2018-10-10 20:44:50 -0700 This could probably be marked a dup of one of those. I'd like this to work soonish... 1467951 3 ggaren 2018-10-10 20:59:17 -0700 A short-term workaround is to list ScrollableArea first in the inheritance hierarchy: class RenderLayer final : public ScrollableArea, public RenderLayerNode { 1468057 4 simon.fraser 2018-10-11 09:39:53 -0700 Sadly that breaks some other casting I wanted to do (but may have to do differently). 1468088 5 koivisto 2018-10-11 11:13:28 -0700 I'll try to fix WeakPtr at some point.