On Wed, Jan 21, 2015 at 3:29 PM, John Scipione <jscipione@xxxxxxxxx> wrote: > I wrote the following program to test whether or not it is possible to > delete the message after assigning it to an Invoker via SetMessage(). [...] That program proves absolutely nothing, since it doesn't actually try to use the memory in question in any interesting way, ergo doesn't actually exercise any possible way for things to go wrong. If you had actually looked at http://cgit.haiku-os.org/haiku/tree/src/kits/app/Invoker.cpp#n46 , you would see that BInvoker in fact does delete its stored message, ergo the code sample you pasted contains a double delete. The fact that it happens to not crash/cause any problems in such a simple/contrived case is pure luck, and certainly would not be true in any program of non-trivial complexity. Rene