Strange crash with QObject hierarchy deletion

[pozdnyakov]

I have an app without main window - tray-only application which shows some notifications from time to time. This app has a main QApplication-derived class, which stores QObject-derived "manager" component as a data member. Manager component is created dynamically in application constructor, and is initialized with application object as a QObject parent. This manager component has a QWidget-derived data member (simple notification window) - stored by value.
This window has no parent (since there is no main window or other suitable widget).

I have a simple tray menu with two actions - to show a notification window and to quit the application. The problem is, when I quit the app while the notification window is still on screen, I get a crash with the following info and call stack:

Exception thrown: read access violation.
this was 0x8.

Qt5Widgetsd.dll!QScopedPointer<QObjectData,QScopedPointerDeleter<QObjectData> >::data() Line 140 C++
Qt5Widgetsd.dll!qGetPtrHelper<QScopedPointer<QObjectData,QScopedPointerDeleter<QObjectData> > >(const QScopedPointer<QObjectData,QScopedPointerDeleter<QObjectData> > & p) Line 1038 C++
Qt5Widgetsd.dll!QApplication::d_func() Line 209 C++
Qt5Widgetsd.dll!QWidget::~QWidget() Line 1652 C++
QtTest.exe!NotificationWindow::~NotificationWindow() Line 15 C++
QtTest.exe!NotificationManager::~NotificationManager() Line 13 C++

The crash is in Qt code, with internal QObjectData pointer for QApplication being corrupted for some reason.
If I create manager component without passing QApplication-derived parent in constructor (and then delete manager manually in application destructor), everything works fine.
The same is true if I just store the manager component by value (instead of a pointer).
So, the workaround is simple, but I really don't understand - what is wrong with the original code?
It should work just fine.

I use Qt 5.11.2 (msvc2017_64). I've narrowed the code to the minimum example which reproduces the problem (shown below). I would really appreciate some help with understanding the problem.

//main.cpp
#include "Application.h"

int main(int argc, char *argv[])
{
	Application app(argc, argv);
	return app.exec();
}
// end of main.cpp


// Application.h
#pragma once

#include <QApplication>
#include <QPointer>

class NotificationManager;

class Application : 
    public QApplication
{
    Q_OBJECT

public:
	Application(int& argc, char** argv);
	virtual ~Application();
	
private:
	QPointer<NotificationManager> m_notificationManager;
};
// end of Application.h


// Application.cpp
#include <QTimer>

#include "Application.h"
#include "NotificationManager.h"

Application::Application(int& argc, char** argv) :
    QApplication(argc, argv)
{
	setQuitOnLastWindowClosed(false);

	//m_notificationManager = new NotificationManager();
	m_notificationManager = new NotificationManager(this);

	m_notificationManager->showNotification();
	QTimer::singleShot(5000, this, SLOT(quit()));
}

Application::~Application()
{
	//delete m_notificationManager;
}
// end of Application.cpp


// NotificationManager.h
#pragma once

#include <QObject>

#include "NotificationWindow.h"

class NotificationManager : public QObject
{
	Q_OBJECT

public:
	NotificationManager(QObject* parent = 0);
	virtual ~NotificationManager();

public slots:
	void showNotification();

private:
	NotificationWindow m_notification;
};
// end of NotificationManager.h


// NotificationManager.cpp
#include "NotificationManager.h"

NotificationManager::NotificationManager(QObject *parent) :
	QObject(parent)
{
}

NotificationManager::~NotificationManager()
{
}

void NotificationManager::showNotification()
{
	m_notification.show();
}
// end of NotificationManager.cpp


// NotificationWindow.h
#pragma once

#include <QWidget>

#include "ui_NotificationWindow.h"

class NotificationWindow : public QWidget
{
	Q_OBJECT

public:
	NotificationWindow(QWidget* parent = 0);
	virtual ~NotificationWindow();

private:
	Ui::NotificationWindow m_ui;
};
// end of NotificationWindow.h


// NotificationWindow.cpp
#include "NotificationWindow.h"

NotificationWindow::NotificationWindow(QWidget *parent)	:
	QWidget(parent)
{
	m_ui.setupUi(this);
}

NotificationWindow::~NotificationWindow()
{
}
// end of NotificationWindow.cpp

[koahnig]

@pozdnyakov

Hi and welcome to devnet forum

You hand over the control of your object to the parent
in this statement

	m_notificationManager = new NotificationManager(this);

When you call delete in the destructor you basically delete it a second time and this is causing the crash.

[pozdnyakov]

@koahnig No, you've misunderstood me a bit. As you can see, the delete in the destructor is commented out, so it's not the cause of the crash. I either use (1) constructor with a parent and no manual delete (causes crash) or (2) constructor with no parent and manual delete (no crash).

[kshegunov]

@pozdnyakov said in Strange crash with QObject hierarchy deletion:

I use Qt 5.11.2 (msvc2017_64). I've narrowed the code to the minimum example which reproduces the problem (shown below). I would really appreciate some help with understanding the problem.

Could you package that in a zip, together with the project file, so I can run it directly?
(any download site should be fine)

[pozdnyakov]

@kshegunov I wanted to attach the source code with project file to the post, but couldn't do it because I was not allowed to (because of my novice status I guess). I placed it here: https://www.dropbox.com/s/mthhgc37hqgm6vz/test.zip

[kshegunov]

@pozdnyakov said in Strange crash with QObject hierarchy deletion:

because of my novice status I guess

Nope, not at all. We don't have arbitrary file uploads in the forum, only images can be uploaded.

I placed it here

Ok, thanks. I'll check it out.

[Christian Ehrlicher]

Q(Core|Gui)Application is a special object and I would pass it as parent to an object for automatic destruction. The QApplication dtor is cleaning up a lot of stuff internally and then wants to delete it's children. This may work but since all is cleaned up already it may crash as you've noticed. The problem here is that the global 'qApp' instance is already set to nullptr when your widget finally gets destroyed which results in a nullptr access.

[kshegunov]

I'm not convinced, it should be working in my opinion.

[Christian Ehrlicher]

qApp is set to nullptr in the second line of QCoreApplication dtor. Here's the backtrace

1652            qApp->d_func()->sendSyntheticEnterLeave(this);
(gdb) bt
#0  QWidget::~QWidget (this=0x6abef0, __in_chrg=<optimized out>) at /home/chehrlic/kde/qt5/qtbase/src/widgets/kernel/qwidget.cpp:1652
#1  0x000000000040352d in NotificationManager::~NotificationManager() ()
#2  0x0000000000403599 in NotificationManager::~NotificationManager() ()
#3  0x00007ffff6e07eda in QObjectPrivate::deleteChildren (this=this@entry=0x61f1d0) at /home/chehrlic/kde/qt5/qtbase/src/corelib/kernel/qobject.cpp:2004
#4  0x00007ffff6e09362 in QObject::~QObject (this=<optimized out>, __in_chrg=<optimized out>) at /home/chehrlic/kde/qt5/qtbase/src/corelib/kernel/qobject.cpp:1030
#5  0x00007ffff6dd29e3 in QCoreApplication::~QCoreApplication (this=0x7fffffffd960, __in_chrg=<optimized out>) at /home/chehrlic/kde/qt5/qtbase/src/corelib/kernel/qcoreapplication.cpp:894
#6  0x00007ffff7237790 in QGuiApplication::~QGuiApplication (this=0x7fffffffd960, __in_chrg=<optimized out>) at /home/chehrlic/kde/qt5/qtbase/src/gui/kernel/qguiapplication.cpp:641

feel free to create a bug report and ask thiago :)

[kshegunov]

@Christian-Ehrlicher said in Strange crash with QObject hierarchy deletion:

feel free to create a bug report and ask thiago

I just may.

[kshegunov]

Workarounds:

1. Move the object to the stack:

class Application : public QApplication
{
    Q_OBJECT

public:
    Application(int& argc, char** argv);
    virtual ~Application();

private:
    NotificationManager m_notificationManager;
};

Application::Application(int& argc, char** argv) :
    QApplication(argc, argv), m_notificationManager(this)
{
}

2. Delete manually in Application::~Application.

[kshegunov]

Reported as QTBUG-71545.

[SGaist]

Hi,

QScopedPointer might also be of interest.

[JKSH]

@kshegunov said in Strange crash with QObject hierarchy deletion:

Workarounds:

1. Move the object to the stack:

...

2. Delete manually in Application::~Application.

3. (For programs that don't subclass QApplication) Delete manually in a lambda connected to QCoreApplication::aboutToQuit()

[pozdnyakov]

@kshegunov Thank you for taking your time to investigate this. I've already tried these workarounds, as stated in the original post. But it's nice to know that I've found a bug and it's not just some misunderstanding on my side. It's been making me crazy for the last day or so :)

[kshegunov]

@pozdnyakov said in Strange crash with QObject hierarchy deletion:

But it's nice to know that I've found a bug and it's not just some misunderstanding on my side. It's been making me crazy for the last day or so :)

Thiago says it won't be fixed. So act accordingly.