[api] State the destructor trade-off as a codebase rule, not a language guarantee

This commit is contained in:
J. Nick Koston
2026-09-08 04:57:49 +02:00
parent 76100fec58
commit 3dea55368f
+4 -3
View File
@@ -739,9 +739,10 @@ class ProtoDecodableMessage : public ProtoMessage {
* @return Number of times the field appears in the buffer
*/
static uint32_t count_repeated_field(const uint8_t *buffer, size_t length, uint32_t target_field_id);
// No protected destructor here: without virtuals nothing can be deleted through this class, and the
// generated messages are aggregates whose sub message members are brace initialised, which needs an
// accessible destructor on the base temporary. ProtoMessage keeps its guard for the dump builds.
// The destructor stays accessible on purpose: the generated messages are aggregates that brace
// initialise sub message members, which copies a base temporary. That trades away the compile time
// guard against deleting through this type; messages are stack locals and never owned through a base
// pointer. ProtoMessage keeps its guard for the dump builds.
};
#ifndef HAS_PROTO_MESSAGE_DUMP
// decode() passes decode_field explicitly, so nothing here may add a vtable