// Copyright (c) 2021 The Chromium Authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #ifndef BASE_MEMORY_SAFE_REF_H_ #define BASE_MEMORY_SAFE_REF_H_ #include "base/check.h" #include "base/memory/weak_ptr.h" #include namespace base { // SafeRef smart pointers are used to represent a non-owning pointer to an // object, where the pointer is always intended to be valid. These are useful in // the same cases that a raw pointer `T*` (or a `T&`) would traditionally be // used, as the owner of the SafeRef knows the lifetime of the pointed-to object // from other means and will not use the pointer after the pointed-to object is // destroyed. However, unlike a `T*` or `T&`, a logic bug will manifest as a // benign crash instead of as a Use-after-Free. // // SafeRef pointers can not be null (as expressed by the "Ref" suffix instead of // "Ptr"). A SafeRef can be wrapped in an absl::optional if it should not always // point to something valid. (A SafePtr sibling type can be introduced if this // is problematic, or if consuming moves are needed!) // // If code wants to track the lifetime of the object directly through its // pointer, and dynamically handle the case of the pointer outliving the object // it points to, then base::WeakPtr should be used instead. // // The SafeRef pointer is constructed from a base::WeakPtrFactory's GetSafeRef() // method. Since it is tied to the base::WeakPtrFactory, it will consider its // pointee invalid when the base::WeakPtrFactory is invalidated, in the same way // as base::WeakPtr does, including after a call to InvalidateWeakPtrs(). // // THREAD SAFETY: SafeRef pointers (like base::WeakPtr) may only be used on the // sequence (or thread) where the associated base::WeakPtrFactory will be // invalidated and/or destroyed. They are safe to passively hold or to destroy // on any thread though. // // This class is expected to one day be replaced by a more flexible and safe // smart pointer abstraction which is not tied to base::WeakPtrFactory, such as // raw_ptr from the MiraclePtr project (though perhaps a non-nullable raw_ref // equivalent). template class SafeRef { public: // No default constructor, since there's no null state. Use an optional // SafeRef if the pointer may not be present. // Copy construction and assignment. SafeRef(const SafeRef& p) : w_(p.w_) { // Avoid use-after-move. CHECK(w_); } SafeRef& operator=(const SafeRef& p) { w_ = p.w_; // Avoid use-after-move. CHECK(w_); return *this; } // Move construction and assignment. SafeRef(SafeRef&& p) : w_(std::move(p.w_)) { CHECK(w_); } SafeRef& operator=(SafeRef&& p) { w_ = std::move(p.w_); // Avoid use-after-move. CHECK(w_); return *this; } // Copy conversion from SafeRef. template // NOLINTNEXTLINE(google-explicit-constructor) SafeRef(const SafeRef& p) : w_(p.w_) { // Avoid use-after-move. CHECK(w_); } template SafeRef& operator=(const SafeRef& p) { w_ = p.w_; // Avoid use-after-move. CHECK(w_); return *this; } // Move conversion from SafeRef. template // NOLINTNEXTLINE(google-explicit-constructor) SafeRef(SafeRef&& p) : w_(std::move(p.w_)) { // Avoid use-after-move. CHECK(w_); } template SafeRef& operator=(SafeRef&& p) { w_ = std::move(p.w_); // Avoid use-after-move. CHECK(w_); return *this; } // Call methods on the underlying T. Will CHECK() if the T pointee is no // longer alive. T* operator->() const { // We rely on WeakPtr to CHECK() on a bad deref; tests verify this. return w_.operator->(); } // Provide access to the underlying T as a reference. Will CHECK() if the T // pointee is no longer alive. T& operator*() const { return *operator->(); } private: template friend class SafeRef; template friend SafeRef internal::MakeSafeRefFromWeakPtrInternals( const internal::WeakReference& ref, U* ptr); // Construction from a from WeakPtr. Will CHECK() if the WeakPtr is already // invalid. explicit SafeRef(WeakPtr w) : w_(std::move(w)) { CHECK(w_); } WeakPtr w_; }; namespace internal { template SafeRef MakeSafeRefFromWeakPtrInternals(const internal::WeakReference& ref, T* ptr) { CHECK(ptr); return SafeRef(WeakPtr(ref, ptr)); } } // namespace internal } // namespace base #endif // BASE_MEMORY_SAFE_REF_H_