Bug 1547218 Comment 0 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
BrowsingContext is refcounted, and using BrowsingContext[] would trigger us using IPDLParamTraits<nsTArray<RefPtr<BrowsingContext>>::WriteInternal which moves the elements of the array into WriteIPDLParam which in turn tries to invoke BrowsingContext::~delete and that is deleted due to it being refcounted.

That is, if we have:

template <typename T>
struct Strip {
  typedef T Type;
};

template <typename T>
struct Strip<RefPtr<T>> {
  typedef T Type;
};

template <typename T>
static void Baz(T* a) {

}

template <typename T>
struct Foo {
  template <typename U>
  static void Bar(U&& a) {
    Baz<typename Strip<T>::Type>(std::forward<U>(a));
  }
};

static void Qux() {
  RefPtr<BrowsingContext> c;
  Foo<RefPtr<BrowsingContext>>::Bar(std::move(c));
}

stuff breaks.
Revision 1 by
on 
`BrowsingContext` is refcounted, and using `BrowsingContext[]` would trigger us using `IPDLParamTraits<nsTArray<RefPtr<BrowsingContext>>::WriteInternal` which moves the elements of the array into `WriteIPDLParam` which in turn tries to invoke `BrowsingContext::~delete` and that is deleted due to it being refcounted.

That is, if we have:
```
template <typename T>
struct Strip {
  typedef T Type;
};

template <typename T>
struct Strip<RefPtr<T>> {
  typedef T Type;
};

template <typename T>
static void Baz(T* a) {

}

template <typename T>
struct Foo {
  template <typename U>
  static void Bar(U&& a) {
    Baz<typename Strip<T>::Type>(std::forward<U>(a));
  }
};

static void Qux() {
  RefPtr<BrowsingContext> c;
  Foo<RefPtr<BrowsingContext>>::Bar(std::move(c));
}
```
stuff breaks.

Back to Bug 1547218 Comment 0