{"id":108252,"date":"2023-05-26T07:00:00","date_gmt":"2023-05-26T14:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=108252"},"modified":"2023-05-26T06:52:07","modified_gmt":"2023-05-26T13:52:07","slug":"20230526-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20230526-00\/?p=108252","title":{"rendered":"Getting a strong reference from the this<\/CODE> pointer too late"},"content":{"rendered":"

It is a standard pattern for functions that are coroutines to promote the this<\/code> pointer to a strong reference (either a COM strong reference or a shared_ptr<\/code>), so that the object won’t be destructed while the coroutine is suspended. But it might be too late.<\/p>\n

Consider the following example:<\/p>\n

struct MyObject : winrt::implements<MyObject, winrt::IInspectable>\r\n{\r\n  MyObject() = default;\r\n  ~MyObject() = default;\r\n\r\n  winrt::Widget::Closed_revoker m_revoker;\r\n\r\n  void RegisterForWidgetEvents(Widget const& widget)\r\n  {\r\n      m_revoker = widget.Closed(winrt::auto_revoke,\r\n        { this, &MyObject::OnWidgetClosed });\r\n  }\r\n\r\n  winrt::fire_and_forget OnWidgetClosed(Widget const& sender, winrt::IInspectable const&)\r\n  {\r\n    auto lifetime = get_strong();\r\n\r\n    co_await DoStuffAsync();\r\n    co_await DoMoreStuffAsync();\r\n  }\r\n};\r\n<\/pre>\n
The idea here is that we register for the Widget’s Closed<\/code> event with a raw pointer. When the event is raised, the handle immediately promotes the raw pointer to a strong reference, so that the MyObject<\/code> does not destruct during the two asynchronous calls that follow.<\/p>\n
But there’s still a race condition:<\/p>\n\n\n\n\n\n\n\n\n\n
Thread 1<\/td>\nThread 2<\/td>\n<\/tr>\n
\u00a0<\/td>\nWidget closes<\/td>\n<\/tr>\n
Last reference released<\/td>\n <\/td>\n<\/tr>\n
\u00a0<\/td>\nWidget::OnWidgetClosed<\/code> begins<\/td>\n<\/tr>\n
Destruction begins<\/td>\n <\/td>\n<\/tr>\n
m_revoker<\/code> unregisters handler<\/td>\n <\/td>\n<\/tr>\n
\u00a0<\/td>\nget_strong()<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
If the last reference is released before the Widget::On\u00adWidget\u00adClosed<\/code> method reaches the get_strong()<\/code>, then the get_strong()<\/code> method runs against an object that has already started destructing. It will nevertheless produce a strong reference and increment the reference count, but that reference count does not have the power of time travel. The destructor is already running; you incremented the reference count too late. The result is  a mysterious crash<\/a>.<\/p>\n
A similar problem exists with std::shared_ptr<\/code>:<\/p>\n
struct MyObject : std::enable_shared_from_this<MyObject><\/span>\r\n{\r\n  MyObject() = default;\r\n  ~MyObject() = default;\r\n\r\n  winrt::Widget::Closed_revoker m_revoker;\r\n\r\n  void RegisterForWidgetEvents(Widget const& widget)\r\n  {\r\n      m_revoker = widget.Closed(winrt::auto_revoke,\r\n        { this, &MyObject::OnWidgetClosed });\r\n  }\r\n\r\n  winrt::fire_and_forget OnWidgetClosed(Widget const& sender, winrt::IInspectable const&)\r\n  {\r\n    auto lifetime = shared_from_this()<\/span>;\r\n\r\n    co_await DoStuffAsync();\r\n    co_await DoMoreStuffAsync();\r\n  }\r\n};\r\n<\/pre>\n\n\n\n\n\n\n\n\n\n
Thread 1<\/td>\nThread 2<\/td>\n<\/tr>\n
\u00a0<\/td>\nWidget closes<\/td>\n<\/tr>\n
Last reference released<\/td>\n <\/td>\n<\/tr>\n
\u00a0<\/td>\nWidget::OnWidgetClosed<\/code> begins<\/td>\n<\/tr>\n
Destruction begins<\/td>\n <\/td>\n<\/tr>\n
m_revoker<\/code> unregisters handler<\/td>\n <\/td>\n<\/tr>\n
\u00a0<\/td>\nshared_from_this()<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
The call to shared_from_this()<\/code> throws std::bad_weak_ptr<\/code> because the weak pointer cannot be converted to a shared_ptr<\/code>.<\/p>\n
In both cases, the problem is that the On\u00adWidget\u00adClosed<\/code> callback is registered with a raw pointer. Instead, use a weak pointer and try to promote it to a strong pointer in the callback.<\/p>\n
  \/\/ C++\/WinRT\r\n  void RegisterForWidgetEvents(Widget const& widget)\r\n  {\r\n    m_revoker = widget.Closed(winrt::auto_revoke,\r\n      [weak = get_weak()](auto&& sender, auto&& args)\r\n      {\r\n        if (auto strong = weak.get()) {\r\n          strong->OnWidgetClosed(sender, args);\r\n        }\r\n      });\r\n  }\r\n\r\n  \/\/ C++\/WinRT alternate version\r\n  void RegisterForWidgetEvents(Widget const& widget)\r\n  {\r\n    m_revoker = widget.Closed(winrt::auto_revoke,\r\n      { get_weak(), &MyObject::OnWidgetClosed });\r\n  }\r\n\r\n  \/\/ C++ standard library\r\n  void RegisterForWidgetEvents(Widget const& widget)\r\n  {\r\n    m_revoker = widget.Closed(winrt::auto_revoke,\r\n      [weak = weak_from_this()](auto&& sender, auto&& args)\r\n      {\r\n        if (auto strong = weak.lock()) {\r\n          strong->OnWidgetClosed(sender, args);\r\n        }\r\n      });\r\n  }\r\n<\/pre>\n
C++\/WinRT provides a helper constructor that does the auto strong = weak.get()<\/code> thing automatically.<\/p>\n
Since weak pointers will not promote to strong\/shared pointers once the last strong\/shared reference is destructed, you don’t have the race condition where the callback tries to do something with an object that has begun destructing.<\/p>\n\n\n\n\n\n\n\n\n\n
Thread 1<\/td>\nThread 2<\/td>\n<\/tr>\n
\u00a0<\/td>\nWidget closes<\/td>\n<\/tr>\n
Last reference released
\n(weak pointers are now expired)<\/td>\n		 <\/td>\n<\/tr>\n
\u00a0<\/td>\nWidget::OnWidgetClosed<\/code> begins<\/td>\n<\/tr>\n
Destruction begins<\/td>\n <\/td>\n<\/tr>\n
m_revoker<\/code> unregisters handler<\/td>\n <\/td>\n<\/tr>\n
\u00a0<\/td>\nweak.get()<\/code> fails<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"
Once destruction begins, strong references mean nothing.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-108252","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"
Once destruction begins, strong references mean nothing.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/108252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=108252"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/108252\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=108252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=108252"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=108252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}