diff --git a/ash/system/holding_space/holding_space_animation_registry.cc b/ash/system/holding_space/holding_space_animation_registry.cc index e76d0f3defd85..53b33227cfce8 100644 --- a/ash/system/holding_space/holding_space_animation_registry.cc +++ b/ash/system/holding_space/holding_space_animation_registry.cc @@ -148,8 +148,7 @@ class HoldingSpaceAnimationRegistry::ProgressIndicatorAnimationDelegate auto animation = ProgressRingAnimation::CreateOfType(type); animation->AddUnsafeAnimationUpdatedCallback(base::BindRepeating( &ProgressIndicatorAnimationDelegate::OnRingAnimationUpdatedForKey, - base::Unretained(this), base::UnsafeDanglingUntriaged(key), - animation.get())); + base::Unretained(this), key, animation.get())); registry_->SetProgressRingAnimationForKey(key, std::move(animation)) ->Start(); @@ -288,8 +287,7 @@ class HoldingSpaceAnimationRegistry::ProgressIndicatorAnimationDelegate if (registry->GetProgressRingAnimationForKey(key) == animation) registry->SetProgressRingAnimationForKey(key, nullptr); }, - weak_factory_.GetWeakPtr(), base::UnsafeDanglingUntriaged(key), - base::UnsafeDanglingUntriaged(animation))); + weak_factory_.GetWeakPtr(), key, animation)); } ProgressIndicatorAnimationRegistry* const registry_; diff --git a/base/allocator/partition_alloc_features.cc b/base/allocator/partition_alloc_features.cc index 304b1ede1d036..56571b566c853 100644 --- a/base/allocator/partition_alloc_features.cc +++ b/base/allocator/partition_alloc_features.cc @@ -11,24 +11,6 @@ namespace base { namespace features { -BASE_FEATURE(kPartitionAllocUnretainedDanglingPtr, - "PartitionAllocUnretainedDanglingPtr", - FEATURE_DISABLED_BY_DEFAULT); - -constexpr FeatureParam<UnretainedDanglingPtrMode>::Option - kUnretainedDanglingPtrModeOption[] = { - {UnretainedDanglingPtrMode::kCrash, "crash"}, - {UnretainedDanglingPtrMode::kDumpWithoutCrashing, - "dump_without_crashing"}, -}; -const base::FeatureParam<UnretainedDanglingPtrMode> - kUnretainedDanglingPtrModeParam = { - &kPartitionAllocUnretainedDanglingPtr, - "mode", - UnretainedDanglingPtrMode::kDumpWithoutCrashing, - &kUnretainedDanglingPtrModeOption, -}; - BASE_FEATURE(kPartitionAllocDanglingPtr, "PartitionAllocDanglingPtr", FEATURE_DISABLED_BY_DEFAULT); diff --git a/base/allocator/partition_alloc_features.h b/base/allocator/partition_alloc_features.h index 261b0723c6901..911f0eb13f01e 100644 --- a/base/allocator/partition_alloc_features.h +++ b/base/allocator/partition_alloc_features.h @@ -15,14 +15,6 @@ namespace base { namespace features { -extern const BASE_EXPORT Feature kPartitionAllocUnretainedDanglingPtr; -enum class UnretainedDanglingPtrMode { - kCrash, - kDumpWithoutCrashing, -}; -extern const BASE_EXPORT base::FeatureParam<UnretainedDanglingPtrMode> - kUnretainedDanglingPtrModeParam; - // See /docs/dangling_ptr.md // // Usage: diff --git a/base/allocator/partition_alloc_support.cc b/base/allocator/partition_alloc_support.cc index 1710c9dd6025f..8ede58bd6f106 100644 --- a/base/allocator/partition_alloc_support.cc +++ b/base/allocator/partition_alloc_support.cc @@ -14,7 +14,6 @@ #include "base/allocator/partition_allocator/allocation_guard.h" #include "base/allocator/partition_allocator/dangling_raw_ptr_checks.h" #include "base/allocator/partition_allocator/memory_reclaimer.h" -#include "base/allocator/partition_allocator/partition_alloc_base/debug/alias.h" #include "base/allocator/partition_allocator/partition_alloc_buildflags.h" #include "base/allocator/partition_allocator/partition_alloc_check.h" #include "base/allocator/partition_allocator/partition_alloc_config.h" @@ -23,9 +22,7 @@ #include "base/bind.h" #include "base/callback.h" #include "base/check.h" -#include "base/debug/dump_without_crashing.h" #include "base/debug/stack_trace.h" -#include "base/debug/task_trace.h" #include "base/feature_list.h" #include "base/immediate_crash.h" #include "base/metrics/histogram_functions.h" @@ -546,48 +543,5 @@ void InstallDanglingRawPtrChecks() { void InstallDanglingRawPtrChecks() {} #endif // BUILDFLAG(ENABLE_DANGLING_RAW_PTR_CHECKS) -void UnretainedDanglingRawPtrDetectedDumpWithoutCrashing(uintptr_t id) { - PA_NO_CODE_FOLDING(); - debug::DumpWithoutCrashing(); -} - -void UnretainedDanglingRawPtrDetectedCrash(uintptr_t id) { - debug::TaskTrace task_trace; - debug::StackTrace stack_trace; - if (!task_trace.empty()) { - LOG(ERROR) << "Detected dangling raw_ptr in unretained with id=" - << StringPrintf("0x%016" PRIxPTR, id) << ":\n\n" - << task_trace << ":\n Stack trace:\n" - << stack_trace; - } else { - LOG(ERROR) << "Detected dangling raw_ptr in unretained with id=" - << StringPrintf("0x%016" PRIxPTR, id) << ":\n\n" - << "Stack trace:\n" - << stack_trace; - } - IMMEDIATE_CRASH(); -} - -void InstallUnretainedDanglingRawPtrChecks() { - if (!FeatureList::IsEnabled(features::kPartitionAllocUnretainedDanglingPtr)) { - partition_alloc::SetUnretainedDanglingRawPtrDetectedFn([](uintptr_t) {}); - partition_alloc::SetUnretainedDanglingRawPtrCheckEnabled(/*enabled=*/false); - return; - } - - partition_alloc::SetUnretainedDanglingRawPtrCheckEnabled(/*enabled=*/true); - switch (features::kUnretainedDanglingPtrModeParam.Get()) { - case features::UnretainedDanglingPtrMode::kCrash: - partition_alloc::SetUnretainedDanglingRawPtrDetectedFn( - &UnretainedDanglingRawPtrDetectedCrash); - break; - - case features::UnretainedDanglingPtrMode::kDumpWithoutCrashing: - partition_alloc::SetUnretainedDanglingRawPtrDetectedFn( - &UnretainedDanglingRawPtrDetectedDumpWithoutCrashing); - break; - } -} - } // namespace allocator } // namespace base diff --git a/base/allocator/partition_alloc_support.h b/base/allocator/partition_alloc_support.h index 3a747e2a426bd..a9f81c484c210 100644 --- a/base/allocator/partition_alloc_support.h +++ b/base/allocator/partition_alloc_support.h @@ -35,7 +35,6 @@ BASE_EXPORT std::map<std::string, std::string> ProposeSyntheticFinchTrials(); // This is currently effective, only when compiled with // `enable_dangling_raw_ptr_checks` build flag. BASE_EXPORT void InstallDanglingRawPtrChecks(); -BASE_EXPORT void InstallUnretainedDanglingRawPtrChecks(); } // namespace allocator } // namespace base diff --git a/base/allocator/partition_allocator/dangling_raw_ptr_checks.cc b/base/allocator/partition_allocator/dangling_raw_ptr_checks.cc index f58bb80bdecfc..898c99ff60e52 100644 --- a/base/allocator/partition_allocator/dangling_raw_ptr_checks.cc +++ b/base/allocator/partition_allocator/dangling_raw_ptr_checks.cc @@ -12,9 +12,6 @@ namespace partition_alloc { namespace { DanglingRawPtrDetectedFn* g_dangling_raw_ptr_detected_fn = [](uintptr_t) {}; DanglingRawPtrReleasedFn* g_dangling_raw_ptr_released_fn = [](uintptr_t) {}; -DanglingRawPtrDetectedFn* g_unretained_dangling_raw_ptr_detected_fn = - [](uintptr_t) {}; -bool g_unretained_dangling_raw_ptr_check_enabled = false; } // namespace DanglingRawPtrDetectedFn* GetDanglingRawPtrDetectedFn() { @@ -37,21 +34,6 @@ void SetDanglingRawPtrReleasedFn(DanglingRawPtrReleasedFn fn) { g_dangling_raw_ptr_released_fn = fn; } -DanglingRawPtrDetectedFn* GetUnretainedDanglingRawPtrDetectedFn() { - return g_unretained_dangling_raw_ptr_detected_fn; -} - -void SetUnretainedDanglingRawPtrDetectedFn(DanglingRawPtrDetectedFn* fn) { - PA_DCHECK(fn); - g_unretained_dangling_raw_ptr_detected_fn = fn; -} - -bool SetUnretainedDanglingRawPtrCheckEnabled(bool enabled) { - bool old = g_unretained_dangling_raw_ptr_check_enabled; - g_unretained_dangling_raw_ptr_check_enabled = enabled; - return old; -} - namespace internal { PA_COMPONENT_EXPORT(PARTITION_ALLOC) void DanglingRawPtrDetected(uintptr_t id) { @@ -61,15 +43,5 @@ PA_COMPONENT_EXPORT(PARTITION_ALLOC) void DanglingRawPtrReleased(uintptr_t id) { g_dangling_raw_ptr_released_fn(id); } -PA_COMPONENT_EXPORT(PARTITION_ALLOC) -void UnretainedDanglingRawPtrDetected(uintptr_t id) { - g_unretained_dangling_raw_ptr_detected_fn(id); -} - -PA_COMPONENT_EXPORT(PARTITION_ALLOC) -bool IsUnretainedDanglingRawPtrCheckEnabled() { - return g_unretained_dangling_raw_ptr_check_enabled; -} - } // namespace internal } // namespace partition_alloc diff --git a/base/allocator/partition_allocator/dangling_raw_ptr_checks.h b/base/allocator/partition_allocator/dangling_raw_ptr_checks.h index 5c2d3057f268a..1572adfc75b49 100644 --- a/base/allocator/partition_allocator/dangling_raw_ptr_checks.h +++ b/base/allocator/partition_allocator/dangling_raw_ptr_checks.h @@ -35,13 +35,6 @@ DanglingRawPtrDetectedFn* GetDanglingRawPtrDetectedFn(); PA_COMPONENT_EXPORT(PARTITION_ALLOC) void SetDanglingRawPtrDetectedFn(DanglingRawPtrDetectedFn); -PA_COMPONENT_EXPORT(PARTITION_ALLOC) -DanglingRawPtrDetectedFn* GetUnretainedDanglingRawPtrDetectedFn(); -PA_COMPONENT_EXPORT(PARTITION_ALLOC) -void SetUnretainedDanglingRawPtrDetectedFn(DanglingRawPtrDetectedFn*); -PA_COMPONENT_EXPORT(PARTITION_ALLOC) -bool SetUnretainedDanglingRawPtrCheckEnabled(bool enabled); - // DanglingRawPtrReleased: Called after DanglingRawPtrDetected(id), once the // last dangling raw_ptr stops referencing the memory region. // @@ -56,10 +49,6 @@ namespace internal { PA_COMPONENT_EXPORT(PARTITION_ALLOC) void DanglingRawPtrDetected(uintptr_t id); PA_COMPONENT_EXPORT(PARTITION_ALLOC) void DanglingRawPtrReleased(uintptr_t id); -PA_COMPONENT_EXPORT(PARTITION_ALLOC) -void UnretainedDanglingRawPtrDetected(uintptr_t id); -PA_COMPONENT_EXPORT(PARTITION_ALLOC) -bool IsUnretainedDanglingRawPtrCheckEnabled(); } // namespace internal } // namespace partition_alloc diff --git a/base/allocator/partition_allocator/partition_alloc_unittest.cc b/base/allocator/partition_allocator/partition_alloc_unittest.cc index 93cd7500a699c..986cf44184e9c 100644 --- a/base/allocator/partition_allocator/partition_alloc_unittest.cc +++ b/base/allocator/partition_allocator/partition_alloc_unittest.cc @@ -3846,71 +3846,6 @@ TEST_P(PartitionAllocTest, RefCountRealloc) { } } -int g_unretained_dangling_raw_ptr_detected_count = 0; - -class UnretainedDanglingRawPtrTest : public PartitionAllocTest { - public: - void SetUp() override { - PartitionAllocTest::SetUp(); - g_unretained_dangling_raw_ptr_detected_count = 0; - old_detected_fn_ = partition_alloc::GetUnretainedDanglingRawPtrDetectedFn(); - - partition_alloc::SetUnretainedDanglingRawPtrDetectedFn( - &UnretainedDanglingRawPtrTest::DanglingRawPtrDetected); - old_unretained_dangling_ptr_enabled_ = - partition_alloc::SetUnretainedDanglingRawPtrCheckEnabled(true); - } - void TearDown() override { - partition_alloc::SetUnretainedDanglingRawPtrDetectedFn(old_detected_fn_); - partition_alloc::SetUnretainedDanglingRawPtrCheckEnabled( - old_unretained_dangling_ptr_enabled_); - PartitionAllocTest::TearDown(); - } - - private: - static void DanglingRawPtrDetected(uintptr_t) { - g_unretained_dangling_raw_ptr_detected_count++; - } - - partition_alloc::DanglingRawPtrDetectedFn* old_detected_fn_; - bool old_unretained_dangling_ptr_enabled_; -}; - -INSTANTIATE_TEST_SUITE_P(AlternateBucketDistribution, - UnretainedDanglingRawPtrTest, - testing::Values(false, true)); - -TEST_P(UnretainedDanglingRawPtrTest, UnretainedDanglingPtrNoReport) { - void* ptr = allocator.root()->Alloc(kTestAllocSize, type_name); - EXPECT_TRUE(ptr); - auto* ref_count = - PartitionRefCountPointer(allocator.root()->ObjectToSlotStart(ptr)); - ref_count->Acquire(); - EXPECT_TRUE(ref_count->IsAlive()); - // Allocation is still live, so calling ReportIfDangling() should not result - // in any detections. - ref_count->ReportIfDangling(); - EXPECT_EQ(g_unretained_dangling_raw_ptr_detected_count, 0); - EXPECT_FALSE(ref_count->Release()); - allocator.root()->Free(ptr); -} - -TEST_P(UnretainedDanglingRawPtrTest, UnretainedDanglingPtrShouldReport) { - void* ptr = allocator.root()->Alloc(kTestAllocSize, type_name); - EXPECT_TRUE(ptr); - auto* ref_count = - PartitionRefCountPointer(allocator.root()->ObjectToSlotStart(ptr)); - ref_count->Acquire(); - EXPECT_TRUE(ref_count->IsAlive()); - allocator.root()->Free(ptr); - // At this point, memory shouldn't be alive... - EXPECT_FALSE(ref_count->IsAlive()); - // ...and we should report the ptr as dangling. - ref_count->ReportIfDangling(); - EXPECT_EQ(g_unretained_dangling_raw_ptr_detected_count, 1); - EXPECT_TRUE(ref_count->Release()); -} - #endif // BUILDFLAG(ENABLE_BACKUP_REF_PTR_SUPPORT) #if BUILDFLAG(ENABLE_DANGLING_RAW_PTR_CHECKS) diff --git a/base/allocator/partition_allocator/partition_ref_count.h b/base/allocator/partition_allocator/partition_ref_count.h index 944f06c2dd076..ede10980efe25 100644 --- a/base/allocator/partition_allocator/partition_ref_count.h +++ b/base/allocator/partition_allocator/partition_ref_count.h @@ -8,7 +8,6 @@ #include <atomic> #include <cstdint> -#include "base/allocator/partition_allocator/dangling_raw_ptr_checks.h" #include "base/allocator/partition_allocator/partition_alloc_base/compiler_specific.h" #include "base/allocator/partition_allocator/partition_alloc_base/component_export.h" #include "base/allocator/partition_allocator/partition_alloc_base/debug/debugging_buildflags.h" @@ -21,6 +20,10 @@ #include "base/allocator/partition_allocator/tagging.h" #include "build/build_config.h" +#if BUILDFLAG(ENABLE_DANGLING_RAW_PTR_CHECKS) +#include "base/allocator/partition_allocator/dangling_raw_ptr_checks.h" +#endif + namespace partition_alloc::internal { #if BUILDFLAG(ENABLE_BACKUP_REF_PTR_SUPPORT) @@ -216,18 +219,6 @@ class PA_COMPONENT_EXPORT(PARTITION_ALLOC) PartitionRefCount { return alive; } - // Called when a raw_ptr is not banning dangling ptrs, but the user still - // wants to ensure the pointer is not currently dangling. This is currently - // used in UnretainedWrapper to make sure callbacks are not invoked with - // dangling pointers. If such a raw_ptr exists but the allocation is no longer - // alive, then we have a dangling pointer to a dead object. - PA_ALWAYS_INLINE void ReportIfDangling() { - if (!IsAlive()) { - partition_alloc::internal::UnretainedDanglingRawPtrDetected( - reinterpret_cast<uintptr_t>(this)); - } - } - // GWP-ASan slots are assigned an extra reference (note `kPtrInc` below) to // make sure the `raw_ptr<T>` release operation will never attempt to call the // PA `free` on such a slot. GWP-ASan takes the extra reference into account diff --git a/base/functional/bind.h b/base/functional/bind.h index 8f14346b3050a..53be94a9d1e52 100644 --- a/base/functional/bind.h +++ b/base/functional/bind.h @@ -116,20 +116,10 @@ struct BindFailedCheckPreviousErrors {}; BindFailedCheckPreviousErrors BindOnce(...); BindFailedCheckPreviousErrors BindRepeating(...); -// Unretained(), UnsafeDangling() and UnsafeDanglingUntriaged() allow binding a -// non-refcounted class, and to disable refcounting on arguments that are -// refcounted. The main difference is whether or not the raw pointers will be -// checked for dangling references (e.g. a pointer that points to an already -// destroyed object) when the callback is run. +// Unretained() allows binding a non-refcounted class, and to disable +// refcounting on arguments that are refcounted objects. // -// It is _required_ to use one of Unretained(), UnsafeDangling() or -// UnsafeDanglingUntriaged() for raw pointer receivers now. For other arguments, -// it remains optional. If not specified, default behavior is Unretained(). - -// Unretained() pointers will be checked for dangling pointers when the -// callback is run, *if* the callback has not been cancelled. -// -// Example of Unretained() usage: +// EXAMPLE OF Unretained(): // // class Foo { // public: @@ -144,31 +134,6 @@ BindFailedCheckPreviousErrors BindRepeating(...); // // Without the Unretained() wrapper on |&foo|, the above call would fail // to compile because Foo does not support the AddRef() and Release() methods. -// -// Unretained() does not allow dangling pointers, e.g.: -// class MyClass { -// public: -// OnError(int error); -// private: -// scoped_refptr<base::TaskRunner> runner_; -// std::unique_ptr<AnotherClass> obj_; -// }; -// -// void MyClass::OnError(int error) { -// // the pointer (which is also the receiver here) to `AnotherClass` -// // might dangle depending on when the task is invoked. -// runner_->PostTask(FROM_HERE, base::BindOnce(&AnotherClass::OnError, -// base::Unretained(obj_.get()), error)); -// // one of the way to solve this issue here would be: -// // runner_->PostTask(FROM_HERE, -// // base::BindOnce(&AnotherClass::OnError, -// // base::Owned(std::move(obj_)), error)); -// delete this; -// } -// -// the above example is a BAD USAGE of Unretained(), which might result in a -// use-after-free, as `AnotherClass::OnError` might be invoked with a dangling -// pointer as receiver. template <typename T> inline internal::UnretainedWrapper<T> Unretained(T* o) { return internal::UnretainedWrapper<T>(o); @@ -194,81 +159,6 @@ inline auto Unretained(raw_ref<T, I>&& o) { return internal::UnretainedRefWrapper(std::move(o)); } -// Similar to `Unretained()`, but allows dangling pointers, e.g.: -// -// class MyClass { -// public: -// DoSomething(HandlerClass* handler); -// private: -// void MyClass::DoSomethingInternal(HandlerClass::Id id, -// HandlerClass* handler); -// -// std::unordered_map<HandlerClass::Id, HandlerClass*> handlers_; -// scoped_refptr<base::SequencedTaskRunner> runner_; -// base::Lock lock_; -// }; -// void MyClass::DoSomething(HandlerClass* handler) { -// runner_->PostTask(FROM_HERE, -// base::BindOnce(&MyClass::DoSomethingInternal, -// base::Unretained(this), -// handler->id(), -// base::Unretained(handler))); -// } -// void MyClass::DoSomethingInternal(HandlerClass::Id id, -// HandlerClass* handler) { -// base::AutoLock locker(lock_); -// if (handlers_.find(id) == std::end(handlers_)) return; -// // Now we can use `handler`. -// } -// -// As `DoSomethingInternal` is run on a sequence (and we can imagine -// `handlers_` being modified on it as well), we protect the function from -// using a dangling `handler` by making sure it is still contained in the -// map. -// -// Strongly prefer `Unretained()`. This is useful in limited situations such as -// the one above. -template <typename T> -inline internal::UnretainedWrapper<T, DisableDanglingPtrDetection> -UnsafeDangling(T* o) { - return internal::UnretainedWrapper<T, DisableDanglingPtrDetection>(o); -} - -template <typename T, typename I> -internal::UnretainedWrapper<T, DisableDanglingPtrDetection> UnsafeDangling( - const raw_ptr<T, I>& o) { - return internal::UnretainedWrapper<T, DisableDanglingPtrDetection>(o); -} - -template <typename T, typename I> -internal::UnretainedWrapper<T, DisableDanglingPtrDetection> UnsafeDangling( - raw_ptr<T, I>&& o) { - return internal::UnretainedWrapper<T, DisableDanglingPtrDetection>( - std::move(o)); -} - -// Like `UnsafeDangling()`, but used to annotate places that still need to be -// triaged and either migrated to `Unretained()` and safer ownership patterns -// (preferred) or `UnsafeDangling()` if the correct pattern to use is the one -// in the `UnsafeDangling()` example above for example. -template <typename T> -inline internal::UnretainedWrapper<T, DanglingUntriaged> -UnsafeDanglingUntriaged(T* o) { - return internal::UnretainedWrapper<T, DanglingUntriaged>(o); -} - -template <typename T, typename I> -internal::UnretainedWrapper<T, DanglingUntriaged> UnsafeDanglingUntriaged( - const raw_ptr<T, I>& o) { - return internal::UnretainedWrapper<T, DanglingUntriaged>(o); -} - -template <typename T, typename I> -internal::UnretainedWrapper<T, DanglingUntriaged> UnsafeDanglingUntriaged( - raw_ptr<T, I>&& o) { - return internal::UnretainedWrapper<T, DanglingUntriaged>(std::move(o)); -} - // RetainedRef() accepts a ref counted object and retains a reference to it. // When the callback is called, the object is passed as a raw pointer. // diff --git a/base/functional/bind_internal.h b/base/functional/bind_internal.h index 42aa3a16ecc6f..2a5c904df7291 100644 --- a/base/functional/bind_internal.h +++ b/base/functional/bind_internal.h @@ -88,7 +88,7 @@ namespace internal { template <typename Functor, typename SFINAE = void> struct FunctorTraits; -template <typename T, typename RawPtrType = base::RawPtrBanDanglingIfSupported> +template <typename T> class UnretainedWrapper { public: explicit UnretainedWrapper(T* o) : ptr_(o) {} @@ -103,16 +103,7 @@ class UnretainedWrapper { template <typename U = T, typename I> explicit UnretainedWrapper(raw_ptr<U, I>&& o) : ptr_(std::move(o)) {} - T* get() const { - // `ptr_` is either a `raw_ptr` (if `T` is a supported type) or a regular - // C++ pointer otherwise. - if constexpr (std::is_same_v<RawPtrType, - base::RawPtrBanDanglingIfSupported> && - !std::is_same_v<ImplType, T*>) { - ptr_.ReportIfDangling(); - } - return ptr_; - } + T* get() const { return ptr_; } private: #if defined(PA_ENABLE_MTE_CHECKED_PTR_SUPPORT_WITH_64_BITS_POINTERS) @@ -127,16 +118,8 @@ class UnretainedWrapper { // than `raw_ptr`) when `raw_ptr` is `MTECheckedPtr`. using ImplType = T*; #else - // `Unretained()` arguments often dangle by design (common design patterns - // consists of managing objects lifetime inside the callbacks themselves using - // stateful information), so disable direct dangling pointer detection of - // `ptr_`. - // - // If the callback is invoked, dangling pointer detection will be triggered - // before invoking the bound functor (unless stated other wise, see - // `UnsafeDangling()`), when retrieving the pointer value via `get()` above. using ImplType = std::conditional_t<raw_ptr_traits::IsSupportedType<T>::value, - raw_ptr<T, DisableDanglingPtrDetection>, + raw_ptr<T, DanglingUntriaged>, T*>; #endif // defined(PA_ENABLE_MTE_CHECKED_PTR_SUPPORT_WITH_64_BITS_POINTERS) ImplType ptr_; @@ -807,42 +790,37 @@ using MakeStorageType = typename StorageTraits<std::decay_t<T>>::Type; // // WeakCalls need special syntax that is applied to the first argument to check // if they should no-op themselves. -template <bool is_weak_call, typename ReturnType, size_t... indices> +template <bool is_weak_call, typename ReturnType> struct InvokeHelper; -template <typename ReturnType, size_t... indices> -struct InvokeHelper<false, ReturnType, indices...> { - template <typename Functor, typename BoundArgsTuple, typename... RunArgs> - static inline ReturnType MakeItSo(Functor&& functor, - BoundArgsTuple&& bound, - RunArgs&&... args) { +template <typename ReturnType> +struct InvokeHelper<false, ReturnType> { + template <typename Functor, typename... RunArgs> + static inline ReturnType MakeItSo(Functor&& functor, RunArgs&&... args) { using Traits = MakeFunctorTraits<Functor>; - return Traits::Invoke( - std::forward<Functor>(functor), - Unwrap(std::get<indices>(std::forward<BoundArgsTuple>(bound)))..., - std::forward<RunArgs>(args)...); + return Traits::Invoke(std::forward<Functor>(functor), + std::forward<RunArgs>(args)...); } }; -template <typename ReturnType, size_t... indices> -struct InvokeHelper<true, ReturnType, indices...> { +template <typename ReturnType> +struct InvokeHelper<true, ReturnType> { // WeakCalls are only supported for functions with a void return type. // Otherwise, the function result would be undefined if the WeakPtr<> // is invalidated. static_assert(std::is_void_v<ReturnType>, "weak_ptrs can only bind to methods without return values"); - template <typename Functor, typename BoundArgsTuple, typename... RunArgs> + template <typename Functor, typename BoundWeakPtr, typename... RunArgs> static inline void MakeItSo(Functor&& functor, - BoundArgsTuple&& bound, + BoundWeakPtr&& weak_ptr, RunArgs&&... args) { - if (!std::get<0>(bound)) + if (!weak_ptr) return; using Traits = MakeFunctorTraits<Functor>; - Traits::Invoke( - std::forward<Functor>(functor), - Unwrap(std::get<indices>(std::forward<BoundArgsTuple>(bound)))..., - std::forward<RunArgs>(args)...); + Traits::Invoke(std::forward<Functor>(functor), + std::forward<BoundWeakPtr>(weak_ptr), + std::forward<RunArgs>(args)...); } }; @@ -884,7 +862,7 @@ struct Invoker<StorageType, R(UnboundArgs...)> { template <typename Functor, typename BoundArgsTuple, size_t... indices> static inline R RunImpl(Functor&& functor, BoundArgsTuple&& bound, - std::index_sequence<indices...> seq, + std::index_sequence<indices...>, UnboundArgs&&... unbound_args) { static constexpr bool is_method = MakeFunctorTraits<Functor>::is_method; @@ -901,18 +879,9 @@ struct Invoker<StorageType, R(UnboundArgs...)> { IsWeakMethod<is_method, std::tuple_element_t<indices, DecayedArgsTuple>...>(); - // Do not `Unwrap()` here, as that immediately triggers dangling pointer - // detection. Dangling pointer detection should only be triggered if the - // callback is not cancelled, but cancellation status is not determined - // until later inside the InvokeHelper::MakeItSo specialization for weak - // calls. - // - // Dangling pointers when invoking a cancelled callback are not considered - // a memory safety error because protecting raw pointers usage with weak - // receivers (where the weak receiver usually own the pointed objects) is a - // common and broadly used pattern in the codebase. - return InvokeHelper<is_weak_call, R, indices...>::MakeItSo( - std::forward<Functor>(functor), std::forward<BoundArgsTuple>(bound), + return InvokeHelper<is_weak_call, R>::MakeItSo( + std::forward<Functor>(functor), + Unwrap(std::get<indices>(std::forward<BoundArgsTuple>(bound)))..., std::forward<UnboundArgs>(unbound_args)...); } }; @@ -1523,11 +1492,9 @@ struct BindUnwrapTraits { } }; -template <typename T, typename ImplType> -struct BindUnwrapTraits<internal::UnretainedWrapper<T, ImplType>> { - static T* Unwrap(const internal::UnretainedWrapper<T, ImplType>& o) { - return o.get(); - } +template <typename T> +struct BindUnwrapTraits<internal::UnretainedWrapper<T>> { + static T* Unwrap(const internal::UnretainedWrapper<T>& o) { return o.get(); } }; template <typename T> diff --git a/base/functional/bind_unittest.cc b/base/functional/bind_unittest.cc index d442e3548d047..46d830abcca8a 100644 --- a/base/functional/bind_unittest.cc +++ b/base/functional/bind_unittest.cc @@ -9,10 +9,6 @@ #include <utility> #include <vector> -#include "base/allocator/partition_alloc_features.h" -#include "base/allocator/partition_alloc_support.h" -#include "base/allocator/partition_allocator/dangling_raw_ptr_checks.h" -#include "base/allocator/partition_allocator/partition_alloc.h" #include "base/functional/callback.h" #include "base/memory/ptr_util.h" #include "base/memory/raw_ptr.h" @@ -22,7 +18,6 @@ #include "base/strings/string_number_conversions.h" #include "base/test/bind.h" #include "base/test/gtest_util.h" -#include "base/test/scoped_feature_list.h" #include "build/build_config.h" #include "testing/gmock/include/gmock/gmock.h" #include "testing/gtest/include/gtest/gtest.h" @@ -1798,143 +1793,5 @@ TEST(BindDeathTest, BanFirstOwnerOfRefCountedType) { }); } -#if BUILDFLAG(USE_BACKUP_REF_PTR) - -void HandleOOM(size_t unused_size) { - LOG(FATAL) << "Out of memory"; -} - -// Basic set of options to mostly only enable `BackupRefPtr::kEnabled`. -// This avoids the boilerplate of having too much options enabled for simple -// testing purpose. -static constexpr partition_alloc::PartitionOptions kOpts = { - partition_alloc::PartitionOptions::AlignedAlloc::kDisallowed, - partition_alloc::PartitionOptions::ThreadCache::kDisabled, - partition_alloc::PartitionOptions::Quarantine::kDisallowed, - partition_alloc::PartitionOptions::Cookie::kAllowed, - partition_alloc::PartitionOptions::BackupRefPtr::kEnabled, - partition_alloc::PartitionOptions::BackupRefPtrZapping::kEnabled, - partition_alloc::PartitionOptions::UseConfigurablePool::kNo, -}; - -class BindUnretainedDanglingInternalFixture : public BindTest { - public: - void SetUp() override { - partition_alloc::PartitionAllocGlobalInit(HandleOOM); - allocator_.init(kOpts); - enabled_feature_list_.InitWithFeaturesAndParameters( - {{features::kPartitionAllocUnretainedDanglingPtr, {{"mode", "crash"}}}}, - {/* disabled_features */}); - allocator::InstallUnretainedDanglingRawPtrChecks(); - } - void TearDown() override { - enabled_feature_list_.Reset(); - allocator::InstallUnretainedDanglingRawPtrChecks(); - allocator_.root()->PurgeMemory( - partition_alloc::PurgeFlags::kDecommitEmptySlotSpans | - partition_alloc::PurgeFlags::kDiscardUnusedSystemPages); - partition_alloc::PartitionAllocGlobalUninitForTesting(); - } - - // In unit tests, allocations being tested need to live in a separate PA - // root so the test code doesn't interfere with various counters. Following - // methods are helpers for managing allocations inside the separate allocator - // root. - template <typename T, typename... Args> - raw_ptr<T> Alloc(Args&&... args) { - void* ptr = allocator_.root()->Alloc(sizeof(T), ""); - T* p = new (reinterpret_cast<T*>(ptr)) T(std::forward<Args>(args)...); - return raw_ptr<T>(p); - } - template <typename T> - void Free(raw_ptr<T>& ptr) { - allocator_.root()->Free(ptr); - } - - private: - test::ScopedFeatureList enabled_feature_list_; - partition_alloc::PartitionAllocator allocator_; -}; - -class BindUnretainedDanglingTest - : public BindUnretainedDanglingInternalFixture {}; -class BindUnretainedDanglingDeathTest - : public BindUnretainedDanglingInternalFixture {}; - -bool PtrCheckFn(int* p) { - return p != nullptr; -} - -class ClassWithWeakPtr { - public: - ClassWithWeakPtr() = default; - void RawPtrArg(int* p) { *p = 123; } - WeakPtr<ClassWithWeakPtr> GetWeakPtr() { return weak_factory_.GetWeakPtr(); } - - private: - WeakPtrFactory<ClassWithWeakPtr> weak_factory_{this}; -}; - -TEST_F(BindUnretainedDanglingTest, UnretainedNoDanglingPtr) { - raw_ptr<int> p = Alloc<int>(3); - auto callback = base::BindOnce(PingPong, base::Unretained(p)); - EXPECT_EQ(std::move(callback).Run(), 3); - Free(p); -} - -TEST_F(BindUnretainedDanglingTest, UnsafeDanglingPtr) { - raw_ptr<int> p = Alloc<int>(3); - auto callback = base::BindOnce(PtrCheckFn, base::UnsafeDangling(p)); - Free(p); - EXPECT_EQ(std::move(callback).Run(), true); -} - -TEST_F(BindUnretainedDanglingTest, UnsafeDanglingUntriagedPtr) { - raw_ptr<int> p = Alloc<int>(3); - auto callback = base::BindOnce(PtrCheckFn, base::UnsafeDanglingUntriaged(p)); - Free(p); - EXPECT_EQ(std::move(callback).Run(), true); -} - -TEST_F(BindUnretainedDanglingTest, UnretainedWeakReceiverValidNoDangling) { - raw_ptr<int> p = Alloc<int>(3); - std::unique_ptr<ClassWithWeakPtr> r = std::make_unique<ClassWithWeakPtr>(); - auto callback = base::BindOnce(&ClassWithWeakPtr::RawPtrArg, r->GetWeakPtr(), - base::Unretained(p)); - std::move(callback).Run(); - EXPECT_EQ(*p, 123); - Free(p); -} - -TEST_F(BindUnretainedDanglingTest, UnretainedWeakReceiverInvalidNoDangling) { - raw_ptr<int> p = Alloc<int>(3); - std::unique_ptr<ClassWithWeakPtr> r = std::make_unique<ClassWithWeakPtr>(); - auto callback = base::BindOnce(&ClassWithWeakPtr::RawPtrArg, r->GetWeakPtr(), - base::Unretained(p)); - r.reset(); - Free(p); - std::move(callback).Run(); - // Should reach this point without crashing; there is a dangling pointer, but - // the callback is cancelled because the WeakPtr is already invalidated. -} - -TEST_F(BindUnretainedDanglingDeathTest, UnretainedDanglingPtr) { - raw_ptr<int> p = Alloc<int>(3); - auto callback = base::BindOnce(PingPong, base::Unretained(p)); - Free(p); - EXPECT_DEATH(std::move(callback).Run(), ""); -} - -TEST_F(BindUnretainedDanglingDeathTest, UnretainedWeakReceiverDangling) { - raw_ptr<int> p = Alloc<int>(3); - std::unique_ptr<ClassWithWeakPtr> r = std::make_unique<ClassWithWeakPtr>(); - auto callback = base::BindOnce(&ClassWithWeakPtr::RawPtrArg, r->GetWeakPtr(), - base::Unretained(p)); - Free(p); - EXPECT_DEATH(std::move(callback).Run(), ""); -} - -#endif // BUILDFLAG(USE_BACKUP_REF_PTR) - } // namespace } // namespace base diff --git a/base/memory/raw_ptr.cc b/base/memory/raw_ptr.cc index 3adf7a8c265bf..77327277ca7ef 100644 --- a/base/memory/raw_ptr.cc +++ b/base/memory/raw_ptr.cc @@ -6,7 +6,6 @@ #include <cstdint> #include "base/allocator/buildflags.h" -#include "base/allocator/partition_allocator/dangling_raw_ptr_checks.h" #include "base/process/process.h" // USE_BACKUP_REF_PTR implies USE_PARTITION_ALLOC, needed for code under @@ -54,19 +53,6 @@ void BackupRefPtrImpl<AllowDangling>::ReleaseInternal(uintptr_t address) { } } -template <bool AllowDangling> -void BackupRefPtrImpl<AllowDangling>::ReportIfDanglingInternal( - uintptr_t address) { - if (partition_alloc::internal::IsUnretainedDanglingRawPtrCheckEnabled()) { - if (IsSupportedAndNotNull(address)) { - uintptr_t slot_start = - partition_alloc::PartitionAllocGetSlotStartInBRPPool(address); - partition_alloc::internal::PartitionRefCountPointer(slot_start) - ->ReportIfDangling(); - } - } -} - template <bool AllowDangling> bool BackupRefPtrImpl<AllowDangling>::IsPointeeAlive(uintptr_t address) { #if DCHECK_IS_ON() || BUILDFLAG(ENABLE_BACKUP_REF_PTR_SLOW_CHECKS) diff --git a/base/memory/raw_ptr.h b/base/memory/raw_ptr.h index bcceb87d91d1e..3bbc5c146c7c8 100644 --- a/base/memory/raw_ptr.h +++ b/base/memory/raw_ptr.h @@ -60,25 +60,6 @@ namespace base { // NOTE: All methods should be `ALWAYS_INLINE`. raw_ptr is meant to be a // lightweight replacement of a raw pointer, hence performance is critical. -// The following types are the different RawPtrType template option possible for -// a `raw_ptr`: -// - RawPtrMayDangle disables dangling pointers check when the object is -// released. -// - RawPtrBanDanglingIfSupported may enable dangling pointers check on object -// destruction. -// -// We describe those types here so that they can be used outside of `raw_ptr` as -// object markers, and their meaning might vary depending on where those markers -// are being used. For instance, we are using those in `UnretainedWrapper` to -// change behavior depending on RawPtrType. -struct RawPtrMayDangle {}; -struct RawPtrBanDanglingIfSupported {}; - -namespace raw_ptr_traits { -template <typename T> -struct RawPtrTypeToImpl; -} - namespace internal { // These classes/structures are part of the raw_ptr implementation. // DO NOT USE THESE CLASSES DIRECTLY YOURSELF. @@ -572,12 +553,6 @@ struct BackupRefPtrImpl { return WrapRawPtr(wrapped_ptr); } - // Report the current wrapped pointer if pointee isn't alive anymore. - template <typename T> - static ALWAYS_INLINE void ReportIfDangling(T* wrapped_ptr) { - ReportIfDanglingInternal(partition_alloc::UntagPtr(wrapped_ptr)); - } - // This is for accounting only, used by unit tests. static ALWAYS_INLINE void IncrementSwapCountForTest() {} static ALWAYS_INLINE void IncrementLessCountForTest() {} @@ -593,7 +568,6 @@ struct BackupRefPtrImpl { static BASE_EXPORT NOINLINE void AcquireInternal(uintptr_t address); static BASE_EXPORT NOINLINE void ReleaseInternal(uintptr_t address); static BASE_EXPORT NOINLINE bool IsPointeeAlive(uintptr_t address); - static BASE_EXPORT NOINLINE void ReportIfDanglingInternal(uintptr_t address); template <typename Z, typename = std::enable_if_t<offset_type<Z>, void>> static ALWAYS_INLINE bool IsValidDelta(uintptr_t address, Z delta_in_bytes) { if constexpr (std::is_signed_v<Z>) @@ -691,37 +665,35 @@ struct AsanBackupRefPtrImpl { }; template <class Super> -struct RawPtrCountingImplWrapperForTest - : public raw_ptr_traits::RawPtrTypeToImpl<Super>::Impl { - using SuperImpl = typename raw_ptr_traits::RawPtrTypeToImpl<Super>::Impl; +struct RawPtrCountingImplWrapperForTest : public Super { template <typename T> static ALWAYS_INLINE T* WrapRawPtr(T* ptr) { ++wrap_raw_ptr_cnt; - return SuperImpl::WrapRawPtr(ptr); + return Super::WrapRawPtr(ptr); } template <typename T> static ALWAYS_INLINE void ReleaseWrappedPtr(T* ptr) { ++release_wrapped_ptr_cnt; - SuperImpl::ReleaseWrappedPtr(ptr); + Super::ReleaseWrappedPtr(ptr); } template <typename T> static ALWAYS_INLINE T* SafelyUnwrapPtrForDereference(T* wrapped_ptr) { ++get_for_dereference_cnt; - return SuperImpl::SafelyUnwrapPtrForDereference(wrapped_ptr); + return Super::SafelyUnwrapPtrForDereference(wrapped_ptr); } template <typename T> static ALWAYS_INLINE T* SafelyUnwrapPtrForExtraction(T* wrapped_ptr) { ++get_for_extraction_cnt; - return SuperImpl::SafelyUnwrapPtrForExtraction(wrapped_ptr); + return Super::SafelyUnwrapPtrForExtraction(wrapped_ptr); } template <typename T> static ALWAYS_INLINE T* UnsafelyUnwrapPtrForComparison(T* wrapped_ptr) { ++get_for_comparison_cnt; - return SuperImpl::UnsafelyUnwrapPtrForComparison(wrapped_ptr); + return Super::UnsafelyUnwrapPtrForComparison(wrapped_ptr); } static ALWAYS_INLINE void IncrementSwapCountForTest() { @@ -844,42 +816,6 @@ struct IsSupportedType<T, #undef CHROME_WINDOWS_HANDLE_TYPE #endif -template <typename T> -struct RawPtrTypeToImpl {}; - -template <typename T> -struct RawPtrTypeToImpl<internal::RawPtrCountingImplWrapperForTest<T>> { - using Impl = internal::RawPtrCountingImplWrapperForTest<T>; -}; - -template <> -struct RawPtrTypeToImpl<RawPtrMayDangle> { -#if BUILDFLAG(USE_BACKUP_REF_PTR) - using Impl = internal::BackupRefPtrImpl</*AllowDangling=*/true>; -#elif BUILDFLAG(USE_ASAN_BACKUP_REF_PTR) - using Impl = internal::AsanBackupRefPtrImpl; -#elif defined(PA_ENABLE_MTE_CHECKED_PTR_SUPPORT_WITH_64_BITS_POINTERS) - using Impl = internal::MTECheckedPtrImpl< - internal::MTECheckedPtrImplPartitionAllocSupport>; -#else - using Impl = internal::RawPtrNoOpImpl; -#endif -}; - -template <> -struct RawPtrTypeToImpl<RawPtrBanDanglingIfSupported> { -#if BUILDFLAG(USE_BACKUP_REF_PTR) - using Impl = internal::BackupRefPtrImpl</*AllowDangling=*/false>; -#elif BUILDFLAG(USE_ASAN_BACKUP_REF_PTR) - using Impl = internal::AsanBackupRefPtrImpl; -#elif defined(PA_ENABLE_MTE_CHECKED_PTR_SUPPORT_WITH_64_BITS_POINTERS) - using Impl = internal::MTECheckedPtrImpl< - internal::MTECheckedPtrImplPartitionAllocSupport>; -#else - using Impl = internal::RawPtrNoOpImpl; -#endif -}; - } // namespace raw_ptr_traits // `raw_ptr<T>` is a non-owning smart pointer that has improved memory-safety @@ -908,12 +844,27 @@ struct RawPtrTypeToImpl<RawPtrBanDanglingIfSupported> { // non-default move constructor/assignment. Thus, it's possible to get an error // where the pointer is not actually dangling, and have to work around the // compiler. We have not managed to construct such an example in Chromium yet. +#if BUILDFLAG(USE_BACKUP_REF_PTR) +using RawPtrMayDangle = internal::BackupRefPtrImpl</*AllowDangling=*/true>; +using RawPtrBanDanglingIfSupported = + internal::BackupRefPtrImpl</*AllowDangling=*/false>; +#elif BUILDFLAG(USE_ASAN_BACKUP_REF_PTR) +using RawPtrMayDangle = internal::AsanBackupRefPtrImpl; +using RawPtrBanDanglingIfSupported = internal::AsanBackupRefPtrImpl; +#elif defined(PA_ENABLE_MTE_CHECKED_PTR_SUPPORT_WITH_64_BITS_POINTERS) +using RawPtrMayDangle = internal::MTECheckedPtrImpl< + internal::MTECheckedPtrImplPartitionAllocSupport>; +using RawPtrBanDanglingIfSupported = internal::MTECheckedPtrImpl< + internal::MTECheckedPtrImplPartitionAllocSupport>; +#else +using RawPtrMayDangle = internal::RawPtrNoOpImpl; +using RawPtrBanDanglingIfSupported = internal::RawPtrNoOpImpl; +#endif -using DefaultRawPtrType = RawPtrBanDanglingIfSupported; +using DefaultRawPtrImpl = RawPtrBanDanglingIfSupported; -template <typename T, typename RawPtrType = DefaultRawPtrType> +template <typename T, typename Impl = DefaultRawPtrImpl> class TRIVIAL_ABI GSL_POINTER raw_ptr { - using Impl = typename raw_ptr_traits::RawPtrTypeToImpl<RawPtrType>::Impl; using DanglingRawPtr = std::conditional_t< raw_ptr_traits::IsRawPtrCountingImpl<Impl>::value, raw_ptr<T, internal::RawPtrCountingImplWrapperForTest<RawPtrMayDangle>>, @@ -1004,7 +955,7 @@ class TRIVIAL_ABI GSL_POINTER raw_ptr { std::is_convertible<U*, T*>::value && !std::is_void<typename std::remove_cv<T>::type>::value>> // NOLINTNEXTLINE(google-explicit-constructor) - ALWAYS_INLINE raw_ptr(const raw_ptr<U, RawPtrType>& ptr) noexcept + ALWAYS_INLINE raw_ptr(const raw_ptr<U, Impl>& ptr) noexcept : wrapped_ptr_( Impl::Duplicate(Impl::template Upcast<T, U>(ptr.wrapped_ptr_))) {} // Deliberately implicit in order to support implicit upcast. @@ -1013,7 +964,7 @@ class TRIVIAL_ABI GSL_POINTER raw_ptr { std::is_convertible<U*, T*>::value && !std::is_void<typename std::remove_cv<T>::type>::value>> // NOLINTNEXTLINE(google-explicit-constructor) - ALWAYS_INLINE raw_ptr(raw_ptr<U, RawPtrType>&& ptr) noexcept + ALWAYS_INLINE raw_ptr(raw_ptr<U, Impl>&& ptr) noexcept : wrapped_ptr_(Impl::template Upcast<T, U>(ptr.wrapped_ptr_)) { #if BUILDFLAG(USE_BACKUP_REF_PTR) ptr.wrapped_ptr_ = nullptr; @@ -1036,7 +987,7 @@ class TRIVIAL_ABI GSL_POINTER raw_ptr { typename Unused = std::enable_if_t< std::is_convertible<U*, T*>::value && !std::is_void<typename std::remove_cv<T>::type>::value>> - ALWAYS_INLINE raw_ptr& operator=(const raw_ptr<U, RawPtrType>& ptr) noexcept { + ALWAYS_INLINE raw_ptr& operator=(const raw_ptr<U, Impl>& ptr) noexcept { // Make sure that pointer isn't assigned to itself (look at pointer address, // not its value). #if DCHECK_IS_ON() || BUILDFLAG(ENABLE_BACKUP_REF_PTR_SLOW_CHECKS) @@ -1052,7 +1003,7 @@ class TRIVIAL_ABI GSL_POINTER raw_ptr { typename Unused = std::enable_if_t< std::is_convertible<U*, T*>::value && !std::is_void<typename std::remove_cv<T>::type>::value>> - ALWAYS_INLINE raw_ptr& operator=(raw_ptr<U, RawPtrType>&& ptr) noexcept { + ALWAYS_INLINE raw_ptr& operator=(raw_ptr<U, Impl>&& ptr) noexcept { // Make sure that pointer isn't assigned to itself (look at pointer address, // not its value). #if DCHECK_IS_ON() || BUILDFLAG(ENABLE_BACKUP_REF_PTR_SLOW_CHECKS) @@ -1302,12 +1253,6 @@ class TRIVIAL_ABI GSL_POINTER raw_ptr { perfetto::WriteIntoTracedValue(std::move(context), get()); } - ALWAYS_INLINE void ReportIfDangling() const noexcept { -#if BUILDFLAG(USE_BACKUP_REF_PTR) - Impl::ReportIfDangling(wrapped_ptr_); -#endif - } - private: // This getter is meant for situations where the pointer is meant to be // dereferenced. It is allowed to crash on nullptr (it may or may not), @@ -1470,24 +1415,22 @@ namespace std { // Override so set/map lookups do not create extra raw_ptr. This also allows // dangling pointers to be used for lookup. -template <typename T, typename RawPtrType> -struct less<raw_ptr<T, RawPtrType>> { - using Impl = - typename base::raw_ptr_traits::RawPtrTypeToImpl<RawPtrType>::Impl; +template <typename T, typename Impl> +struct less<raw_ptr<T, Impl>> { using is_transparent = void; - bool operator()(const raw_ptr<T, RawPtrType>& lhs, - const raw_ptr<T, RawPtrType>& rhs) const { + bool operator()(const raw_ptr<T, Impl>& lhs, + const raw_ptr<T, Impl>& rhs) const { Impl::IncrementLessCountForTest(); return lhs < rhs; } - bool operator()(T* lhs, const raw_ptr<T, RawPtrType>& rhs) const { + bool operator()(T* lhs, const raw_ptr<T, Impl>& rhs) const { Impl::IncrementLessCountForTest(); return lhs < rhs; } - bool operator()(const raw_ptr<T, RawPtrType>& lhs, T* rhs) const { + bool operator()(const raw_ptr<T, Impl>& lhs, T* rhs) const { Impl::IncrementLessCountForTest(); return lhs < rhs; } diff --git a/base/memory/raw_ptr_asan_bound_arg_tracker.h b/base/memory/raw_ptr_asan_bound_arg_tracker.h index 962ba11675986..cd5dda42d69d8 100644 --- a/base/memory/raw_ptr_asan_bound_arg_tracker.h +++ b/base/memory/raw_ptr_asan_bound_arg_tracker.h @@ -22,7 +22,7 @@ namespace internal { template <typename, typename> struct Invoker; -template <typename T, typename Impl> +template <typename T> class UnretainedWrapper; template <typename T, bool> @@ -69,8 +69,8 @@ class BASE_EXPORT RawPtrAsanBoundArgTracker { // When argument is base::Unretained, add the argument to the set of // arguments protected in this scope. - template <typename T, typename Impl> - void AddArg(const internal::UnretainedWrapper<T, Impl>& arg) { + template <typename T> + void AddArg(const internal::UnretainedWrapper<T>& arg) { if constexpr (raw_ptr_traits::IsSupportedType<T>::value) { Add(reinterpret_cast<uintptr_t>(arg.get())); } diff --git a/base/memory/raw_ptr_unittest.cc b/base/memory/raw_ptr_unittest.cc index 3e758e71ca234..9b065474de134 100644 --- a/base/memory/raw_ptr_unittest.cc +++ b/base/memory/raw_ptr_unittest.cc @@ -92,7 +92,7 @@ static_assert( namespace { using RawPtrCountingImpl = - base::internal::RawPtrCountingImplWrapperForTest<base::DefaultRawPtrType>; + base::internal::RawPtrCountingImplWrapperForTest<base::DefaultRawPtrImpl>; using RawPtrCountingMayDangleImpl = base::internal::RawPtrCountingImplWrapperForTest<base::RawPtrMayDangle>; diff --git a/base/memory/raw_ref.h b/base/memory/raw_ref.h index 9cbb2857cba9f..445b18f6ad0f4 100644 --- a/base/memory/raw_ref.h +++ b/base/memory/raw_ref.h @@ -15,7 +15,7 @@ namespace base { -template <class T, class RawPtrType> +template <class T, class Impl> class raw_ref; namespace internal { @@ -51,10 +51,9 @@ constexpr inline bool is_raw_ref_v = is_raw_ref<T>::value; // Unlike a native `T&` reference, a mutable `raw_ref<T>` can be changed // independent of the underlying `T`, similar to `std::reference_wrapper`. That // means the reference inside it can be moved and reassigned. -template <class T, class RawPtrType = DefaultRawPtrType> +template <class T, class Impl = DefaultRawPtrImpl> class TRIVIAL_ABI GSL_POINTER raw_ref { - using Inner = raw_ptr<T, RawPtrType>; - using Impl = typename raw_ptr_traits::RawPtrTypeToImpl<RawPtrType>::Impl; + using Inner = raw_ptr<T, Impl>; // These impls do not clear on move, which produces an inconsistent behaviour. // We want consistent behaviour such that using a raw_ref after move is caught // and aborts. Failure to clear would be indicated by the related death tests @@ -107,14 +106,13 @@ class TRIVIAL_ABI GSL_POINTER raw_ref { // Deliberately implicit in order to support implicit upcast. template <class U, class = std::enable_if_t<std::is_convertible_v<U&, T&>>> // NOLINTNEXTLINE(google-explicit-constructor) - ALWAYS_INLINE raw_ref(const raw_ref<U, RawPtrType>& p) noexcept - : inner_(p.inner_) { + ALWAYS_INLINE raw_ref(const raw_ref<U, Impl>& p) noexcept : inner_(p.inner_) { CHECK(inner_.get()); // Catch use-after-move. } // Deliberately implicit in order to support implicit upcast. template <class U, class = std::enable_if_t<std::is_convertible_v<U&, T&>>> // NOLINTNEXTLINE(google-explicit-constructor) - ALWAYS_INLINE raw_ref(raw_ref<U, RawPtrType>&& p) noexcept + ALWAYS_INLINE raw_ref(raw_ref<U, Impl>&& p) noexcept : inner_(std::move(p.inner_)) { CHECK(inner_.get()); // Catch use-after-move. if constexpr (need_clear_after_move) @@ -123,13 +121,13 @@ class TRIVIAL_ABI GSL_POINTER raw_ref { // Upcast assignment template <class U, class = std::enable_if_t<std::is_convertible_v<U&, T&>>> - ALWAYS_INLINE raw_ref& operator=(const raw_ref<U, RawPtrType>& p) noexcept { + ALWAYS_INLINE raw_ref& operator=(const raw_ref<U, Impl>& p) noexcept { CHECK(p.inner_.get()); // Catch use-after-move. inner_.operator=(p.inner_); return *this; } template <class U, class = std::enable_if_t<std::is_convertible_v<U&, T&>>> - ALWAYS_INLINE raw_ref& operator=(raw_ref<U, RawPtrType>&& p) noexcept { + ALWAYS_INLINE raw_ref& operator=(raw_ref<U, Impl>&& p) noexcept { CHECK(p.inner_.get()); // Catch use-after-move. inner_.operator=(std::move(p.inner_)); if constexpr (need_clear_after_move) @@ -178,42 +176,42 @@ class TRIVIAL_ABI GSL_POINTER raw_ref { template <class U> friend ALWAYS_INLINE bool operator==(const raw_ref& lhs, - const raw_ref<U, RawPtrType>& rhs) { + const raw_ref<U, Impl>& rhs) { CHECK(lhs.inner_.get()); // Catch use-after-move. CHECK(rhs.inner_.get()); // Catch use-after-move. return lhs.inner_ == rhs.inner_; } template <class U> friend ALWAYS_INLINE bool operator!=(const raw_ref& lhs, - const raw_ref<U, RawPtrType>& rhs) { + const raw_ref<U, Impl>& rhs) { CHECK(lhs.inner_.get()); // Catch use-after-move. CHECK(rhs.inner_.get()); // Catch use-after-move. return lhs.inner_ != rhs.inner_; } template <class U> friend ALWAYS_INLINE bool operator<(const raw_ref& lhs, - const raw_ref<U, RawPtrType>& rhs) { + const raw_ref<U, Impl>& rhs) { CHECK(lhs.inner_.get()); // Catch use-after-move. CHECK(rhs.inner_.get()); // Catch use-after-move. return lhs.inner_ < rhs.inner_; } template <class U> friend ALWAYS_INLINE bool operator>(const raw_ref& lhs, - const raw_ref<U, RawPtrType>& rhs) { + const raw_ref<U, Impl>& rhs) { CHECK(lhs.inner_.get()); // Catch use-after-move. CHECK(rhs.inner_.get()); // Catch use-after-move. return lhs.inner_ > rhs.inner_; } template <class U> friend ALWAYS_INLINE bool operator<=(const raw_ref& lhs, - const raw_ref<U, RawPtrType>& rhs) { + const raw_ref<U, Impl>& rhs) { CHECK(lhs.inner_.get()); // Catch use-after-move. CHECK(rhs.inner_.get()); // Catch use-after-move. return lhs.inner_ <= rhs.inner_; } template <class U> friend ALWAYS_INLINE bool operator>=(const raw_ref& lhs, - const raw_ref<U, RawPtrType>& rhs) { + const raw_ref<U, Impl>& rhs) { CHECK(lhs.inner_.get()); // Catch use-after-move. CHECK(rhs.inner_.get()); // Catch use-after-move. return lhs.inner_ >= rhs.inner_; @@ -323,24 +321,22 @@ namespace std { // Override so set/map lookups do not create extra raw_ref. This also // allows C++ references to be used for lookup. -template <typename T, typename RawPtrType> -struct less<raw_ref<T, RawPtrType>> { - using Impl = - typename base::raw_ptr_traits::RawPtrTypeToImpl<RawPtrType>::Impl; +template <typename T, typename Impl> +struct less<raw_ref<T, Impl>> { using is_transparent = void; - bool operator()(const raw_ref<T, RawPtrType>& lhs, - const raw_ref<T, RawPtrType>& rhs) const { + bool operator()(const raw_ref<T, Impl>& lhs, + const raw_ref<T, Impl>& rhs) const { Impl::IncrementLessCountForTest(); return lhs < rhs; } - bool operator()(T& lhs, const raw_ref<T, RawPtrType>& rhs) const { + bool operator()(T& lhs, const raw_ref<T, Impl>& rhs) const { Impl::IncrementLessCountForTest(); return lhs < rhs; } - bool operator()(const raw_ref<T, RawPtrType>& lhs, T& rhs) const { + bool operator()(const raw_ref<T, Impl>& lhs, T& rhs) const { Impl::IncrementLessCountForTest(); return lhs < rhs; } diff --git a/base/memory/raw_ref_unittest.cc b/base/memory/raw_ref_unittest.cc index 2790a482171b2..8ec71282bcb6a 100644 --- a/base/memory/raw_ref_unittest.cc +++ b/base/memory/raw_ref_unittest.cc @@ -715,7 +715,7 @@ TEST(RawRef, CTAD) { } using RawPtrCountingImpl = - base::internal::RawPtrCountingImplWrapperForTest<base::DefaultRawPtrType>; + base::internal::RawPtrCountingImplWrapperForTest<base::DefaultRawPtrImpl>; template <typename T> using CountingRawRef = raw_ref<T, RawPtrCountingImpl>; diff --git a/base/observer_list_threadsafe.h b/base/observer_list_threadsafe.h index 5dcdfaae58644..1821e91aaf9d8 100644 --- a/base/observer_list_threadsafe.h +++ b/base/observer_list_threadsafe.h @@ -154,7 +154,7 @@ class ObserverListThreadSafe : public internal::ObserverListThreadSafeBase { task_runner->PostTask( current_notification->from_here, BindOnce(&ObserverListThreadSafe<ObserverType>::NotifyWrapper, this, - UnsafeDanglingUntriaged(observer), + observer, NotificationData(this, observer_id, current_notification->from_here, notification_data->method))); @@ -200,7 +200,7 @@ class ObserverListThreadSafe : public internal::ObserverListThreadSafeBase { observer.second.task_runner->PostTask( from_here, BindOnce(&ObserverListThreadSafe<ObserverType>::NotifyWrapper, this, - base::UnsafeDanglingUntriaged(observer.first), + observer.first, NotificationData(this, observer.second.observer_id, from_here, method))); } diff --git a/base/win/object_watcher.cc b/base/win/object_watcher.cc index eb9914c3f1bb5..dd9ab6488b3dd 100644 --- a/base/win/object_watcher.cc +++ b/base/win/object_watcher.cc @@ -93,7 +93,7 @@ bool ObjectWatcher::StartWatchingInternal(HANDLE object, // DoneWaiting can be synchronously called from RegisterWaitForSingleObject, // so set up all state now. callback_ = BindRepeating(&ObjectWatcher::Signal, weak_factory_.GetWeakPtr(), - base::UnsafeDanglingUntriaged(delegate)); + delegate); object_ = object; if (!RegisterWaitForSingleObject(&wait_object_, object, DoneWaiting, this, diff --git a/chrome/browser/chromeos/policy/dlp/dlp_data_transfer_notifier.cc b/chrome/browser/chromeos/policy/dlp/dlp_data_transfer_notifier.cc index 3c6f6749f6375..39be01fd171b0 100644 --- a/chrome/browser/chromeos/policy/dlp/dlp_data_transfer_notifier.cc +++ b/chrome/browser/chromeos/policy/dlp/dlp_data_transfer_notifier.cc @@ -207,12 +207,11 @@ void DlpDataTransferNotifier::ResizeAndShowWidget(const gfx::Size& bubble_size, widget_closing_timer_.Start( FROM_HERE, base::Milliseconds(timeout_duration_ms), - base::BindOnce( - &DlpDataTransferNotifier::CloseWidget, base::Unretained(this), - base::UnsafeDanglingUntriaged( - widget_.get()), // Safe as DlpClipboardNotificationHelper - // owns `widget_` and outlives it. - views::Widget::ClosedReason::kUnspecified)); + base::BindOnce(&DlpDataTransferNotifier::CloseWidget, + base::Unretained(this), + widget_.get(), // Safe as DlpClipboardNotificationHelper + // owns `widget_` and outlives it. + views::Widget::ClosedReason::kUnspecified)); } } // namespace policy diff --git a/chrome/browser/media/router/mojo/media_router_mojo_impl.cc b/chrome/browser/media/router/mojo/media_router_mojo_impl.cc index 89804f7a96f3a..9726dc679f580 100644 --- a/chrome/browser/media/router/mojo/media_router_mojo_impl.cc +++ b/chrome/browser/media/router/mojo/media_router_mojo_impl.cc @@ -580,8 +580,7 @@ void MediaRouterMojoImpl::RegisterMediaRoutesObserver( content::GetUIThreadTaskRunner({})->PostTask( FROM_HERE, base::BindOnce(&MediaRouterMojoImpl::NotifyOfExistingRoutesIfRegistered, - weak_factory_.GetWeakPtr(), - base::UnsafeDanglingUntriaged(observer))); + weak_factory_.GetWeakPtr(), observer)); } } diff --git a/chrome/browser/ui/browser_command_controller.cc b/chrome/browser/ui/browser_command_controller.cc index 56762e4de844e..6eece67e8548a 100644 --- a/chrome/browser/ui/browser_command_controller.cc +++ b/chrome/browser/ui/browser_command_controller.cc @@ -921,11 +921,10 @@ bool BrowserCommandController::ExecuteCommandWithDisposition( content::WebContents* const web_contents = browser_->tab_strip_model()->GetActiveWebContents(); if (web_contents) { - ShowPageInfoDialog( - web_contents, - base::BindOnce(&AppInfoDialogClosedCallback, - base::UnsafeDanglingUntriaged(web_contents)), - bubble_anchor_util::kAppMenuButton); + ShowPageInfoDialog(web_contents, + base::BindOnce(&AppInfoDialogClosedCallback, + base::Unretained(web_contents)), + bubble_anchor_util::kAppMenuButton); } break; } diff --git a/chrome/browser/ui/views/extensions/extensions_toolbar_container.cc b/chrome/browser/ui/views/extensions/extensions_toolbar_container.cc index 721f14ba4048d..4aff6947fa4fc 100644 --- a/chrome/browser/ui/views/extensions/extensions_toolbar_container.cc +++ b/chrome/browser/ui/views/extensions/extensions_toolbar_container.cc @@ -220,7 +220,7 @@ void ExtensionsToolbarContainer::ShowWidgetForExtension( UpdateIconVisibility(extension_id); GetAnimatingLayoutManager()->PostOrQueueAction(base::BindOnce( &ExtensionsToolbarContainer::AnchorAndShowWidgetImmediately, - weak_ptr_factory_.GetWeakPtr(), base::UnsafeDanglingUntriaged(widget))); + weak_ptr_factory_.GetWeakPtr(), widget)); } views::Widget* diff --git a/components/download/internal/common/download_path_reservation_tracker.cc b/components/download/internal/common/download_path_reservation_tracker.cc index 5e4defb37a9f5..b2fec20ea3904 100644 --- a/components/download/internal/common/download_path_reservation_tracker.cc +++ b/components/download/internal/common/download_path_reservation_tracker.cc @@ -465,8 +465,7 @@ void DownloadItemObserver::OnDownloadUpdated(DownloadItem* download) { // restarted. Holding on to the reservation now would prevent the name // from being used for a subsequent retry attempt. DownloadPathReservationTracker::GetTaskRunner()->PostTask( - FROM_HERE, base::BindOnce(&RevokeReservation, - base::UnsafeDanglingUntriaged(download))); + FROM_HERE, base::BindOnce(&RevokeReservation, download)); download->RemoveObserver(this); download->RemoveUserData(&kUserDataKey); break; @@ -481,8 +480,7 @@ void DownloadItemObserver::OnDownloadDestroyed(DownloadItem* download) { // Items should be COMPLETE/INTERRUPTED/CANCELLED before being destroyed. NOTREACHED(); DownloadPathReservationTracker::GetTaskRunner()->PostTask( - FROM_HERE, base::BindOnce(&RevokeReservation, - base::UnsafeDanglingUntriaged(download))); + FROM_HERE, base::BindOnce(&RevokeReservation, download)); } // static diff --git a/components/download/internal/common/in_progress_download_manager.cc b/components/download/internal/common/in_progress_download_manager.cc index d8986d3abd22d..1ea056110161b 100644 --- a/components/download/internal/common/in_progress_download_manager.cc +++ b/components/download/internal/common/in_progress_download_manager.cc @@ -236,8 +236,7 @@ void InProgressDownloadManager::OnUrlDownloadStarted( StartDownload(std::move(download_create_info), std::move(input_stream), std::move(url_loader_factory_provider), base::BindOnce(&InProgressDownloadManager::CancelUrlDownload, - weak_factory_.GetWeakPtr(), - base::UnsafeDanglingUntriaged(downloader)), + weak_factory_.GetWeakPtr(), downloader), std::move(callback)); } diff --git a/components/download/internal/common/resource_downloader.cc b/components/download/internal/common/resource_downloader.cc index a13cebc685274..a43a748a79a7b 100644 --- a/components/download/internal/common/resource_downloader.cc +++ b/components/download/internal/common/resource_downloader.cc @@ -286,7 +286,7 @@ void ResourceDownloader::Destroy() { delegate_task_runner_->PostTask( FROM_HERE, base::BindOnce(&UrlDownloadHandler::Delegate::OnUrlDownloadStopped, - delegate_, base::UnsafeDanglingUntriaged(this))); + delegate_, this)); } void ResourceDownloader::RequestWakeLock( diff --git a/components/history/core/browser/history_service.cc b/components/history/core/browser/history_service.cc index c5840764b78ec..480ff15f73c1c 100644 --- a/components/history/core/browser/history_service.cc +++ b/components/history/core/browser/history_service.cc @@ -195,8 +195,7 @@ void HistoryService::ClearCachedDataForContextID(ContextID context_id) { DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); ScheduleTask(PRIORITY_NORMAL, base::BindOnce(&HistoryBackend::ClearCachedDataForContextID, - history_backend_, - base::UnsafeDanglingUntriaged(context_id))); + history_backend_, context_id)); } void HistoryService::ClearAllOnDemandFavicons() { @@ -472,8 +471,7 @@ void HistoryService::UpdateWithPageEndTime(ContextID context_id, ScheduleTask( PRIORITY_NORMAL, base::BindOnce(&HistoryBackend::UpdateWithPageEndTime, history_backend_, - base::UnsafeDanglingUntriaged(context_id), nav_entry_id, - url, end_ts)); + context_id, nav_entry_id, url, end_ts)); } void HistoryService::SetBrowsingTopicsAllowed(ContextID context_id, diff --git a/components/performance_manager/freezing/freezing.cc b/components/performance_manager/freezing/freezing.cc index 49bcff82fd9d8..60bb0be30ad3b 100644 --- a/components/performance_manager/freezing/freezing.cc +++ b/components/performance_manager/freezing/freezing.cc @@ -205,7 +205,7 @@ void FreezingVoteTokenPMRegistry::UnregisterVote(FreezingVoteTokenImpl* token) { FreezingVoteTokenPMRegistry::GetOrCreateInstance(graph); registry->UnregisterVoteOnPMSequence(token); }, - base::UnsafeDanglingUntriaged(token))); + token)); } void FreezingVoteTokenPMRegistry::RegisterVoteOnPMSequence( diff --git a/components/spellcheck/browser/windows_spell_checker.cc b/components/spellcheck/browser/windows_spell_checker.cc index d2cf7deb5b5bc..09995b2e637dc 100644 --- a/components/spellcheck/browser/windows_spell_checker.cc +++ b/components/spellcheck/browser/windows_spell_checker.cc @@ -583,7 +583,7 @@ void WindowsSpellChecker::RecordChromeLocalesStats( base::BindOnce( &windows_spell_checker::BackgroundHelper::RecordChromeLocalesStats, base::Unretained(background_helper_.get()), std::move(chrome_locales), - base::UnsafeDanglingUntriaged(metrics))); + metrics)); } void WindowsSpellChecker::RecordSpellcheckLocalesStats( diff --git a/content/browser/metrics/histogram_controller.cc b/content/browser/metrics/histogram_controller.cc index 194739db9582f..f0bdf5a12537c 100644 --- a/content/browser/metrics/histogram_controller.cc +++ b/content/browser/metrics/histogram_controller.cc @@ -106,7 +106,7 @@ void HistogramController::InsertChildHistogramFetcherInterface( // the number of known processes child_histogram_fetcher.set_disconnect_handler(base::BindOnce( &HistogramController::RemoveChildHistogramFetcherInterface<T>, - base::Unretained(this), base::UnsafeDanglingUntriaged(host))); + base::Unretained(this), base::Unretained(host))); GetChildHistogramFetcherMap<T>()[host] = std::move(child_histogram_fetcher); } diff --git a/content/common/partition_alloc_support.cc b/content/common/partition_alloc_support.cc index 51038f42a296f..ab8244d074117 100644 --- a/content/common/partition_alloc_support.cc +++ b/content/common/partition_alloc_support.cc @@ -186,7 +186,6 @@ void PartitionAllocSupport::ReconfigureAfterZygoteFork( void PartitionAllocSupport::ReconfigureAfterFeatureListInit( const std::string& process_type) { base::allocator::InstallDanglingRawPtrChecks(); - base::allocator::InstallUnretainedDanglingRawPtrChecks(); { base::AutoLock scoped_lock(lock_); // Avoid initializing more than once. diff --git a/ipc/ipc_mojo_bootstrap.cc b/ipc/ipc_mojo_bootstrap.cc index b51bee29072e3..cede19534412f 100644 --- a/ipc/ipc_mojo_bootstrap.cc +++ b/ipc/ipc_mojo_bootstrap.cc @@ -817,10 +817,10 @@ class ChannelAssociatedGroupController client->NotifyError(reason); } else { endpoint->task_runner()->PostTask( - FROM_HERE, base::BindOnce(&ChannelAssociatedGroupController:: - NotifyEndpointOfErrorOnEndpointThread, - this, endpoint->id(), - base::UnsafeDanglingUntriaged(endpoint))); + FROM_HERE, + base::BindOnce(&ChannelAssociatedGroupController:: + NotifyEndpointOfErrorOnEndpointThread, + this, endpoint->id(), base::Unretained(endpoint))); } } diff --git a/net/http/http_cache.cc b/net/http/http_cache.cc index ecda8542e1c29..c58d26d9b5384 100644 --- a/net/http/http_cache.cc +++ b/net/http/http_cache.cc @@ -1108,9 +1108,8 @@ void HttpCache::ProcessQueuedTransactions(ActiveEntry* entry) { // Post a task instead of invoking the io callback of another transaction here // to avoid re-entrancy. base::ThreadTaskRunnerHandle::Get()->PostTask( - FROM_HERE, - base::BindOnce(&HttpCache::OnProcessQueuedTransactions, GetWeakPtr(), - base::UnsafeDanglingUntriaged(entry))); + FROM_HERE, base::BindOnce(&HttpCache::OnProcessQueuedTransactions, + GetWeakPtr(), entry)); } void HttpCache::ProcessAddToEntryQueue(ActiveEntry* entry) { diff --git a/net/nqe/network_quality_estimator.cc b/net/nqe/network_quality_estimator.cc index f01003fb857b9..494b147165ddf 100644 --- a/net/nqe/network_quality_estimator.cc +++ b/net/nqe/network_quality_estimator.cc @@ -903,8 +903,7 @@ void NetworkQualityEstimator::AddEffectiveConnectionTypeObserver( FROM_HERE, base::BindOnce(&NetworkQualityEstimator:: NotifyEffectiveConnectionTypeObserverIfPresent, - weak_ptr_factory_.GetWeakPtr(), - base::UnsafeDanglingUntriaged(observer))); + weak_ptr_factory_.GetWeakPtr(), observer)); } void NetworkQualityEstimator::RemoveEffectiveConnectionTypeObserver( @@ -925,8 +924,7 @@ void NetworkQualityEstimator::AddPeerToPeerConnectionsCountObserver( FROM_HERE, base::BindOnce(&NetworkQualityEstimator:: NotifyPeerToPeerConnectionsCountObserverIfPresent, - weak_ptr_factory_.GetWeakPtr(), - base::UnsafeDanglingUntriaged(observer))); + weak_ptr_factory_.GetWeakPtr(), observer)); } void NetworkQualityEstimator::RemovePeerToPeerConnectionsCountObserver( diff --git a/net/socket/transport_client_socket_pool.cc b/net/socket/transport_client_socket_pool.cc index 0c15469af9445..36afdc52b3320 100644 --- a/net/socket/transport_client_socket_pool.cc +++ b/net/socket/transport_client_socket_pool.cc @@ -1391,8 +1391,7 @@ void TransportClientSocketPool::InvokeUserCallbackLater( } base::ThreadTaskRunnerHandle::Get()->PostTask( FROM_HERE, base::BindOnce(&TransportClientSocketPool::InvokeUserCallback, - weak_factory_.GetWeakPtr(), - base::UnsafeDanglingUntriaged(handle))); + weak_factory_.GetWeakPtr(), handle)); } void TransportClientSocketPool::InvokeUserCallback(ClientSocketHandle* handle) { diff --git a/third_party/blink/renderer/platform/loader/tracked_child_url_loader_factory_bundle.cc b/third_party/blink/renderer/platform/loader/tracked_child_url_loader_factory_bundle.cc index c1d696e23fb82..8c206d4a52b63 100644 --- a/third_party/blink/renderer/platform/loader/tracked_child_url_loader_factory_bundle.cc +++ b/third_party/blink/renderer/platform/loader/tracked_child_url_loader_factory_bundle.cc @@ -105,7 +105,7 @@ void TrackedChildURLLoaderFactoryBundle::AddObserverOnMainThread() { FROM_HERE, base::BindOnce( &HostChildURLLoaderFactoryBundle::AddObserver, - main_thread_host_bundle_->first, base::UnsafeDanglingUntriaged(this), + main_thread_host_bundle_->first, base::Unretained(this), std::make_unique< HostChildURLLoaderFactoryBundle::ObserverPtrAndTaskRunner>( AsWeakPtr(), base::SequencedTaskRunnerHandle::Get()))); @@ -117,8 +117,7 @@ void TrackedChildURLLoaderFactoryBundle::RemoveObserverOnMainThread() { main_thread_host_bundle_->second->PostTask( FROM_HERE, base::BindOnce(&HostChildURLLoaderFactoryBundle::RemoveObserver, - main_thread_host_bundle_->first, - base::UnsafeDanglingUntriaged(this))); + main_thread_host_bundle_->first, base::Unretained(this))); } void TrackedChildURLLoaderFactoryBundle::OnUpdate(