258608 2023-06-27 23:44:12 -0700 Generated IPC serializers for MoveOnlyBaseClass&& are incorrect 2023-10-27 00:22:08 -0700 1 1 1 Unclassified WebKit WebKit2 WebKit Local Build Unspecified Unspecified RESOLVED WORKSFORME https://bugs.webkit.org/show_bug.cgi?id=257581 InRadar P2 Normal --- 257580 1 kkinnunen mattwoodrow g_squelart kkinnunen webkit-bug-importer oldest_to_newest 1963960 0 kkinnunen 2023-06-27 23:44:12 -0700 Generated IPC serializers forMoveOnlyBaseClass&& are incorrect It appears that the code tries to implement move through base class rvalue reference. It is not possible in general case following c++ rvalue semantics, as rvalue constructors are not polymorphic. Move makes no sense: void ArgumentCoder<WebCore::MoveOnlyBaseClass>::encode(Encoder& encoder, WebCore::MoveOnlyBaseClass&& instance) { if (auto* subclass = dynamicDowncast<WebCore::MoveOnlyDerivedClass>(instance)) { encoder << WebCore_MoveOnlyBaseClass_Subclass::MoveOnlyDerivedClass; encoder << WTFMove(*subclass); return; } ASSERT_NOT_REACHED(); } 1965059 1 webkit-bug-importer 2023-07-04 23:45:17 -0700 <rdar://problem/111768907> 1987924 2 kkinnunen 2023-10-27 00:22:08 -0700 Maybe you're right that when using downcast, it is consistent with by-ref encoding. I don't remember what was the idea why it's bad. The only thing I could re-comeup with is that MoveOnlyDerivedClass might not be the final class, so then moving parts of the class is not ok. Comparing to by-ref encoding, copying only part of the class is ok from the safety perspective. However, it's not probably intended so both would be equally buggy and as such rvalue ref code would be consistent with ref code.