Bugzilla

Here's [the older version of CanonicalBrowsingContext.cpp](https://hg.mozilla.org/mozilla-central/annotate/f8915b20f49f4d8849bef0c9ae1de258edc097c7/docshell/base/CanonicalBrowsingContext.cpp).

Both the use and the free are in NotifyOnHistoryReload. Based on the line numbers, it looks like this is what is happening:

```
    const LoadingSessionHistoryEntry& loadingEntry =
        mLoadingEntries.LastElement(); // <-- We get a reference into mLoadingEntries
    aLoadState.emplace(
        WrapMovingNotNull(RefPtr{CreateLoadInfo(loadingEntry.mEntry)})); // <--- This causes us to CreateLoadInfo, appending to mLoadingEntries and causing it to do a reallocation.
    aReloadActiveEntry.emplace(false);
    if (aForceReload) {
      SessionHistoryEntry::LoadingEntry* entry =
          SessionHistoryEntry::GetByLoadId(loadingEntry.mLoadId); // <-- Now we use the dead reference
      if (entry) {
        shistory->RemoveFrameEntries(entry->mEntry);
      }

    }
```

Here's [the older version of CanonicalBrowsingContext.cpp](https://hg.mozilla.org/mozilla-central/annotate/f8915b20f49f4d8849bef0c9ae1de258edc097c7/docshell/base/CanonicalBrowsingContext.cpp).

Both the use and the free are in NotifyOnHistoryReload. Based on the line numbers, it looks like this is what is happening:

```
    const LoadingSessionHistoryEntry& loadingEntry =
        mLoadingEntries.LastElement(); // <-- We get a reference into mLoadingEntries
    aLoadState.emplace(
        WrapMovingNotNull(RefPtr{CreateLoadInfo(loadingEntry.mEntry)})); // <--- This causes us to CreateLoadInfo, appending to mLoadingEntries and causing it to do a reallocation.
    aReloadActiveEntry.emplace(false);
    if (aForceReload) {
      SessionHistoryEntry::LoadingEntry* entry =
          SessionHistoryEntry::GetByLoadId(loadingEntry.mLoadId); // <-- Now we use the dead reference
```

Here's [the older version of CanonicalBrowsingContext.cpp](https://hg.mozilla.org/mozilla-central/annotate/f8915b20f49f4d8849bef0c9ae1de258edc097c7/docshell/base/CanonicalBrowsingContext.cpp).

Both the use and the free are in NotifyOnHistoryReload. Based on the line numbers, it looks like this is what is happening:

```
const LoadingSessionHistoryEntry& loadingEntry =
    mLoadingEntries.LastElement(); // <-- We get a reference into mLoadingEntries
aLoadState.emplace(
    WrapMovingNotNull(RefPtr{CreateLoadInfo(loadingEntry.mEntry)})); // <--- This causes us to CreateLoadInfo, appending to mLoadingEntries and causing it to do a reallocation.
aReloadActiveEntry.emplace(false);
if (aForceReload) {
  SessionHistoryEntry::LoadingEntry* entry =
      SessionHistoryEntry::GetByLoadId(loadingEntry.mLoadId); // <-- Now we use the dead reference
```

Here's [the older version of CanonicalBrowsingContext.cpp](https://hg.mozilla.org/mozilla-central/annotate/f8915b20f49f4d8849bef0c9ae1de258edc097c7/docshell/base/CanonicalBrowsingContext.cpp).

Both the use and the free are in NotifyOnHistoryReload. Based on the line numbers, it looks like this is what is happening:

```
// 1. We get a reference into mLoadingEntries.
const LoadingSessionHistoryEntry& loadingEntry =
    mLoadingEntries.LastElement();
// 2. This causes us to CreateLoadInfo, appending to mLoadingEntries and causing it to do a reallocation.
aLoadState.emplace(
    WrapMovingNotNull(RefPtr{CreateLoadInfo(loadingEntry.mEntry)})); 
aReloadActiveEntry.emplace(false);
if (aForceReload) {
  // 3. Now we use the dead reference loadingEntry.
  SessionHistoryEntry::LoadingEntry* entry =
      SessionHistoryEntry::GetByLoadId(loadingEntry.mLoadId);
```