Re: Crash in Virtual destructor

From:

=?Utf-8?B?TWFoZXNo?= <Mahesh@discussions.microsoft.com>

Newsgroups:

microsoft.public.vc.atl

Date:

Thu, 30 Apr 2009 21:15:01 -0700

Message-ID:

<C81ACEE5-9360-4953-A4E3-EE7AA00C8D92@microsoft.com>

Thanks for your reply.
Here is the code

The same code was working before Outlook 2007 SP2 was applied

=================================

////////////////////
STDMETHODIMP CCustomTable::Advise(ULONG ulEventMask, LPMAPIADVISESINK
lpAdviseSink, ULONG FAR * lpulConnection)
{

LPMAPIADVISESINK wrapperSink =
CCustomAdviseSink::WrapOriginalSink(lpAdviseSink, m_lpPropTagArray, m_lpCustomPropTagArray);

    HRESULT hr = m_lpMAPITable->Advise(ulEventMask, wrapperSink,
lpulConnection);//crashes within this call

    ///////////////////

    return hr;
}

//////////////////////////////////
class CCustomAdviseSink : public IMAPIAdviseSink
{
public:
    STDMETHODIMP QueryInterface(REFIID riid, LPVOID *ppvObj);
    STDMETHODIMP_(ULONG) AddRef();
    STDMETHODIMP_(ULONG) Release();
    MAPI_IMAPIADVISESINK_METHODS(IMPL);

    static LPMAPIADVISESINK WrapOriginalSink(LPMAPIADVISESINK lpOrigSink,
                                            LPSPropTagArray lpPropTagArray,
                                            LPSPropTagArray lpCustomPropTagArray);
    virtual ~CCustomAdviseSink();

private:
    CCustomAdviseSink(LPMAPIADVISESINK lpOrigSink,
                LPSPropTagArray lpPropTagArray,
                LPSPropTagArray lpCustomPropTagArray);

    LPMAPIADVISESINK m_lpOrigSink;
    LPSPropTagArray m_lpPropTagArray;
    LPSPropTagArray m_lpCustomPropTagArray;

};

///////////////////////////////

STDMETHODIMP CCustomAdviseSink::QueryInterface(REFIID riid, LPVOID * ppvObj)
{
    HRESULT hr = S_OK;

   *ppvObj = NULL;

    hr = m_lpOrigSink->QueryInterface(riid, ppvObj);
    if(*ppvObj == m_lpOrigSink)
        *ppvObj = (LPVOID)this;
    return hr;
}

STDMETHODIMP_(ULONG) CCustomAdviseSink::AddRef()
{

    ULONG ulCount = m_lpOrigSink->AddRef();

    return ulCount;
}

STDMETHODIMP_(ULONG) CCustomAdviseSink::Release()
{

    ULONG ulCount = m_lpOrigSink->Release();
    if(ulCount == 0)
        delete this;

    return ulCount;
}

LPMAPIADVISESINK CCustomAdviseSink::WrapOriginalSink(LPMAPIADVISESINK
lpOrigSink, LPSPropTagArray lpPropTagArray, LPSPropTagArray
lpCustomPropTagArray)
{
    CCustomAdviseSink* lpSink = new CCustomAdviseSink(lpOrigSink,
lpPropTagArray, lpCustomPropTagArray);
    return (LPMAPIADVISESINK)lpSink;
}

CCustomAdviseSink::CCustomAdviseSink(LPMAPIADVISESINK lpOrigSink,
                            LPSPropTagArray lpPropTagArray,
                            LPSPropTagArray lpCustomPropTagArray)
{
    m_lpOrigSink = lpOrigSink;
}

CCustomAdviseSink::~CCustomAdviseSink()
{//crashes here - before executing any code within destructor

.....
    //free some stuff
}

///////////////////////////////////////
========================================

Thanks,
Mahesh

"Igor Tandetnik" wrote:

"Mahesh" <Mahesh@discussions.microsoft.com> wrote in message
news:9D1CBA85-562F-474C-9FE7-0163ACDAC0DE@microsoft.com

I am working on a MAPI provider and have implemented one of the MAPI
Interface IMAPIAdviseSink. I have implemented a virtual destructor in
the derived class (CCustomAdviseSink) to cleanup memory.

Note(If it matters): my code is built in VC6 and the destructor is
called by MSPST32.dll from the latest Outlook 2007 SP2.

Somehow, you reinterpet_cast a pointer to your derived class to an
interface pointer, or something like that. Bottom line is, you are
giving your client a bad vtable. The client calls (through a vtable
slot) what it thinks is a regular method on the interface, but instead
ends up calling the destructor (passing a bogus 'this' pointer, too -
the crashing assembly instruction attempts to dereference 'this').

Show declarations of your classes, as well as the code where you create
an instance of your object and provide it to the client.
--
With best wishes,
Igor Tandetnik

With sufficient thrust, pigs fly just fine. However, this is not
necessarily a good idea. It is hard to be sure where they are going to
land, and it could be dangerous sitting under them as they fly
overhead. -- RFC 1925