Assert sequence validity on non-thread-safe RefCount manipulations (2)

base/memory/ref_counted.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_MEMORY_REF_COUNTED_H_
 #define BASE_MEMORY_REF_COUNTED_H_
 
 #include <stddef.h>
 
 #include <cassert>
 #include <iosfwd>
 #include <type_traits>
 
 #include "base/atomic_ref_count.h"
 #include "base/base_export.h"
 #include "base/compiler_specific.h"
 #include "base/logging.h"
 #include "base/macros.h"
+#include "base/sequence_checker.h"
 #include "base/threading/thread_collision_warner.h"
 #include "build/build_config.h"
 
 namespace base {
-
 namespace subtle {
 
 class BASE_EXPORT RefCountedBase {
  public:
   bool HasOneRef() const { return ref_count_ == 1; }
 
  protected:
-  RefCountedBase()
-      : ref_count_(0)
+  RefCountedBase() {
 #if DCHECK_IS_ON()
-        , in_dtor_(false)
+    sequence_checker_.DetachFromSequence();
 #endif
-  {
   }
-
   ~RefCountedBase() {
 #if DCHECK_IS_ON()
     DCHECK(in_dtor_) << "RefCounted object deleted without calling Release()";
 #endif
   }
 
-
   void AddRef() const {
     // TODO(maruel): Add back once it doesn't assert 500 times/sec.
     // Current thread books the critical section "AddRelease"
     // without release it.
     // DFAKE_SCOPED_LOCK_THREAD_LOCKED(add_release_);
 #if DCHECK_IS_ON()
     DCHECK(!in_dtor_);
+    if (ref_count_ >= 1)
+      DCHECK(CalledOnValidSequence());
 #endif
+
     ++ref_count_;
   }
 
   // Returns true if the object should self-delete.
   bool Release() const {
+    --ref_count_;
+
     // TODO(maruel): Add back once it doesn't assert 500 times/sec.
     // Current thread books the critical section "AddRelease"
     // without release it.
     // DFAKE_SCOPED_LOCK_THREAD_LOCKED(add_release_);
+
 #if DCHECK_IS_ON()
     DCHECK(!in_dtor_);
+    if (ref_count_ == 0)
+      in_dtor_ = true;
+
+    if (ref_count_ >= 1)
+      DCHECK(CalledOnValidSequence());
+    if (ref_count_ == 1)
+      sequence_checker_.DetachFromSequence();
 #endif
-    if (--ref_count_ == 0) {
-#if DCHECK_IS_ON()
-      in_dtor_ = true;
-#endif
-      return true;
-    }
-    return false;
+
+    return ref_count_ == 0;
   }
 
  private:
-  mutable size_t ref_count_;
 #if DCHECK_IS_ON()
-  mutable bool in_dtor_;
+  bool CalledOnValidSequence() const;
+#endif
+
+  mutable size_t ref_count_ = 0;
+
+#if DCHECK_IS_ON()
+  mutable bool in_dtor_ = false;
+  mutable SequenceChecker sequence_checker_;
 #endif
 
   DFAKE_MUTEX(add_release_);
 
   DISALLOW_COPY_AND_ASSIGN(RefCountedBase);
 };
 
 class BASE_EXPORT RefCountedThreadSafeBase {
  public:
   bool HasOneRef() const;
@@ skipping 11 matching lines @@
   mutable AtomicRefCount ref_count_;
 #if DCHECK_IS_ON()
   mutable bool in_dtor_;
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(RefCountedThreadSafeBase);
 };
 
 }  // namespace subtle
 
+// See RefCounted class for documentation.
+class BASE_EXPORT ScopedAllowCrossThreadRefCountAccess final {
+ public:
+#if DCHECK_IS_ON()
+  ScopedAllowCrossThreadRefCountAccess();
+  ~ScopedAllowCrossThreadRefCountAccess();
+#else
+  ScopedAllowCrossThreadRefCountAccess() {}
+  ~ScopedAllowCrossThreadRefCountAccess() {}
+#endif
+};
+
 //
 // A base class for reference counted classes.  Otherwise, known as a cheap
 // knock-off of WebKit's RefCounted<T> class.  To use this, just extend your
 // class from it like so:
 //
 //   class MyFoo : public base::RefCounted<MyFoo> {
 //    ...
 //    private:
 //     friend class base::RefCounted<MyFoo>;
 //     ~MyFoo();
 //   };
 //
 // You should always make your destructor non-public, to avoid any code deleting
 // the object accidently while there are references to it.
+//
+// The ref count manipulation to RefCounted is NOT thread safe and has DCHECKs
+// to trap unsafe cross thread usage. A subclass instance of RefCounted can be
+// passed to the other thread or sequence only when its ref count is 1. If the

[gab, 2017/02/17 21:10:41]

s/the other/another/

[tzik, 2017/02/21 06:15:02]

Done.

+// ref count is more than 1, the ref count verifies the ref updates are made on

[gab, 2017/02/17 21:10:40]

s/the ref count/the RefCounted class/

[tzik, 2017/02/21 06:15:02]

Done.

+// the same execution sequence as the previous ones.
+// In rare cases where thread-safety is guaranteed through other means (e.g.
+// locks or explicit sequencing of calls across execution sequences):
+// ScopedAllowCrossThreadRefCountAccess can be used to explicitly indicate this
+// and disable the aforementioned check.
 template <class T>
 class RefCounted : public subtle::RefCountedBase {
  public:
   RefCounted() = default;
 
   void AddRef() const {
     subtle::RefCountedBase::AddRef();
   }
 
   void Release() const {
@@ skipping 321 matching lines @@
 bool operator!=(std::nullptr_t null, const scoped_refptr<T>& rhs) {
   return !operator==(null, rhs);
 }
 
 template <typename T>
 std::ostream& operator<<(std::ostream& out, const scoped_refptr<T>& p) {
   return out << p.get();
 }
 
 #endif  // BASE_MEMORY_REF_COUNTED_H_