C++ object API with union deallocation gotcha

[sketch34]

In this example the root is PxMsg, which contains a union Message.

The union implementation is in a MessageUnion class generated by flatc. Look at the destructor:

struct MessageUnion {
  Message type;
  void *value;
  
  ...
  
  ~MessageUnion() { Reset(); }
  
  inline void MessageUnion::Reset() {
    switch (type) {
      case Message_Subscribe: {
        auto ptr = reinterpret_cast<px::protocol::SubscribeT *>(value);
        delete ptr;
        break;
      }
      ...
  }

Now imagine we have a PxMsgT that we create like this:

{
  SubscribeT subscribe { ... };
  PxMsgT px_msg;
  px_msg.msg.type = Message::Message_Subscribe;
  px_msg.msg.value = &subscribe;
  fbb_.FinishSizePrefixed(PxMsg::Pack(fbb_, &px_msg));
} // Scope end ==> UB.

When the MessageUnion destructor is called when px_msg goes out of scope it will call delete on a stack-allocated pointer.

There are two workarounds:

• Always new any flatbuffers XxxT classes.
• Set the MessageUnion type to Message_NONE, which prevents delete being called.

I think the architectural issue is that flatbuffers is assuming any XxxT pointer is originating internally from its own generated functions:

inline SubscribeT *Subscribe::UnPack(const flatbuffers::resolver_function_t *_resolver) const {
  auto _o = std::unique_ptr<SubscribeT>(new SubscribeT());    // Side note: this unique_ptr seems redundant.
  UnPackTo(_o.get(), _resolver);
  return _o.release();
}

But it is nice to be able to use XxxT that you create in all sorts of ways -- including on the stack -- and that don't have their ownership "taken over" when they are put into a union type.