1195834 - [Bluetooth] Remove redundant reference counting in derived class of BluetoothGattResultHandler

Status: RESOLVED DUPLICATE of bug 1181512

(Firefox OS Graveyard :: Bluetooth, defect)

Description

[Bruce Sun [:brsun]]

|BluetoothGattResultHandler| has reference counting mechanism already[1]. The derived classes of it shouldn't use another reference counting mechanism again[2][3].

In current implementation, both the base class and the derived class have its own reference counter. Both |BluetoothGattClientResultHandler.mRefCnt| and |BluetoothGattServerResultHandler.mRefCnt| hide |BluetoothGattResultHandler.mRefCnt|. If we use the pointer of the derived classes to add the reference count[4][5] but somehow we manage/release the reference count with the pointer of the base class[6], the object would be deleted unexpectedly. As a result, b2g would crash under such scenario.

[1] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/BluetoothInterface.h#746
[2] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/BluetoothInterface.h#763
[3] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/BluetoothInterface.h#803
[4] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/bluedroid/BluetoothDaemonGattInterface.cpp#46
[5] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/bluedroid/BluetoothDaemonGattInterface.cpp#55
[6] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/bluedroid/BluetoothDaemonGattInterface.cpp#1568

Comment 1

[Bruce Sun [:brsun]]

Attachment: bug1195834_gatt_result_handler_crash.patch

A feasible solution to this crash issue.

This issue could be resolved as well if bug 1181512 would remove the inheritance hierarchy of |BluetoothGattResultHandler|.

Comment 2

[Bruce Sun [:brsun]]

The inheritance hierarchy has been refined on bug 1181512, and the crash problem should also be solved as well. Mark this bug as duplicated.