存储到QList中的QNetworkReply包装器使程序意外完成？

Question

In order to learn Qt I'm testing some Qt (5.3.1) classes; for now I'm testing some of the classes provided on the network package such as QNetworkAccessManager , QNetworkReply , etc...

I'm using Qt creator (3.1.2) to compile a simple program which uses the following QNetworkReply wrapper:

struct Request {
    Request(QNetworkReply *const &a_reply) : m_reply(a_reply) {
        qDebug() << "Build  " << hex << int(this) << hex << int(m_reply);
    }
    ~Request() {
        if (m_reply) m_reply->deleteLater();
        qDebug() << "Destroy" << hex << int(this) << hex << int(m_reply);
    }
    QNetworkReply *m_reply;
};

All the wrapped network replies are stored on a QList named R :

QList<Request> R;

And are created through the following function:

void get(const QString &a_url) {
    QNetworkRequest request(a_url);
    R.push_back(NetworkAccessManager.get(request));
}

The NetworkAccessManager is an instance of QNetworkAccessManager which lies outside the main function (the same goes for the list R ):

QList<Request> R;

QNetworkAccessManager NetworkAccessManager;

void done(QNetworkReply *reply) {
    if (reply->error() == QNetworkReply::NoError) {
        qDebug() << "Reply!" << reply->readAll();
    } else {
        qDebug() << "Error!" << reply->errorString();
    }

    for (QList<Request>::iterator request = R.begin(), lastRequest = R.end(); request != lastRequest; ++request) {
        if (request->m_reply == reply) {
            R.erase(request);
        }
    }
}

int main(int argc, char *argv[]) {
    QGuiApplication app(argc, argv);

    QQmlApplicationEngine engine;
    // Default "hello world" qml file:
    engine.load(QUrl(QStringLiteral("qrc:///main.qml")));

    QObject::connect(&NetworkAccessManager, &QNetworkAccessManager::finished, done);

    get("http://us.battle.net/api/wow/achievement/2144");
    get("http://us.battle.net/api/wow/achievement/2145");
    get("http://us.battle.net/api/wow/achievement/2146");

    return app.exec();
}

The program pasted above, produces the following output:

Build   28fdc8 1be843b8
Destroy 28fdc8 1be843b8
Build   28fdc8 1be84558
Destroy 28fdc8 1be84558
Build   28fdc8 1be84638
Destroy 28fdc8 1be84638

So, it seems that the same instance of Request is managing different QNetworkReply pointers (the this pointer printed is the same while the QNetworkReply changes) and no "Reply!" nor "Error!" is shown; after click on the close button of the application window, the program crashes about 8 or 10 seconds later printing:

The program has unexpectedly finished. C:\\Code\\build-test-Desktop_Qt_5_3_MinGW_32bit-Debug\\debug\\test.exe crashed

Removing the deleteLater() instruction on ~Request produces the following output:

Build   28fdc8 1be78078
Destroy 28fdc8 1be78078
Build   28fdc8 1be78218
Destroy 28fdc8 1be78218
Build   28fdc8 1be782e8
Destroy 28fdc8 1be782e8
Reply! "the expected json for http://us.battle.net/api/wow/achievement/2145"
Destroy 1be782c8 1be78218
Reply! "the expected json for http://us.battle.net/api/wow/achievement/2146"
Destroy 1be78398 1be782e8
Reply! "the expected json for http://us.battle.net/api/wow/achievement/2144"
Destroy 1be781f8 1be78078

And the program does not crash anymore, but it seems that a copy of Request is made somewhere for each get call according to the 3 exttra Destroy messages. And to make things worse I'm not doing the deleteLater() anymore ( which seems to be mandatory ), so I've placed the deleteLater() at the end of the done function:

void done(QNetworkReply *reply) {
    // do stuf...

    reply->deleteLater();
}

With good results (no application crash), but I'm worried because I don't get what's happening, so I wonder if any of you would be so kind to answer the following questions:

• Why the function done isn't called if the deleteLater() is placed in ~Request ?
• Why the call to done ( "Reply!" output) is done AFTER the call to ~Request ( "Destroy" output)?
• Why the pointer this of Request (printed on construction) have the same value on each call? (maybe due to some optimization?).
• Where (and why) a copy of a Request is made?
• Where is the best location to call the deleteLater() of each QNetworkReply .

Thanks.

Answer 1

The Andrew Medico comment doesn't answer any of my questions but pointed me on the right direction.

In fact, according to the documentation linked by Andrew (emphasis mine):

The values stored in the various containers can be of any assignable data type. To qualify, a type must provide a default constructor, a copy constructor, and an assignment operator .

And so it did my Request struct (implicitly not explicity, that's Ok for me though), but in order to accomplish all the must of the QList contained type I've decided to provide the missing parts:

struct Request {
    Request() :
    m_reply(nullptr) {
        qDebug() << "Default" << hex << int(this) << hex << int(m_reply);
    }

    Request(QNetworkReply *const &a_reply) :
    m_reply(a_reply) {
        qDebug() << "Build  " << hex << int(this) << hex << int(m_reply);
    }

    Request(const Request &a_request) :
    m_reply(a_request.m_reply) {
        qDebug() << "Copy   " << hex << int(this) << hex << int(m_reply);
    }

    Request &operator =(const Request &a_request) {
        qDebug() << "Assign " << hex << int(this) << hex << int(m_reply = a_request.m_reply); return *this;
    }

    ~Request() {
        qDebug() << "Destroy" << hex << int(this) << hex << int(m_reply);
    }
    QNetworkReply *m_reply;
};

After that, the output changed and all becomes crystal clear:

Build   28fdc8 1ba5bda0
Copy    1ba5bf20 1ba5bda0
Destroy 28fdc8 1ba5bda0
Build   28fdc8 1ba5bf40
Copy    1ba5bff0 1ba5bf40
Destroy 28fdc8 1ba5bf40
Build   28fdc8 1ba5c020
Copy    1ba5c0c0 1ba5c020
Destroy 28fdc8 1ba5c020
Reply! "the expected json for http://us.battle.net/api/wow/achievement/2145"
Destroy 1ba5bff0 1ba5bf40
Reply! "the expected json for http://us.battle.net/api/wow/achievement/2144"
Destroy 1ba5bf20 1ba5bda0
Reply! "the expected json for http://us.battle.net/api/wow/achievement/2146"
Destroy 1ba5c0c0 1ba5c020

So, let's answer the questions:

Why the function done isn't called if the deleteLater() is placed in ~Request ?

Every time a new Request is pushed into the R container ( R.push_back(NetworkAccessManager.get(request)) ) happens the following:

1. A R-value Request object is created ( "Build" output).
2. The R-value is inserted in R via copy constructor ( "Copy" output).
3. The R-value which we copied from is destroyed ( "Destroy" output).

The destruction performed on the 3rd step causes all the problems: because the QNetworkReply pointer managed by the R-value and the copied contained Request are the same so, calling the deleteLater() placed in ~Request causes that the contained Request starts to manage a deleted (or future-deleted) resource! That's why done isn't called, the fact is that there's no QNetworkReply to wait to complete (it was deleted!).

It's kind of a shame that the QList doesn't provides an emplace_back .

Why the call to done ( "Reply!" output) is done AFTER the call to ~Request ( "Destroy" output)?

The "Destroy" output corresponds to the destruction of the R-value created in order to insert a Request into the R container, the "Reply!" output happens after the insertion, so it's after the destruction of the R-value and then, the contained Request is destroyed ( "Destroy" output AFTER the "Reply!" output).

Why the pointer this of Request (printed on construction) have the same value on each call? (maybe due to some optimization?).

The repeated address corresponds to the address of the R-value used to populate the R container, my guess is that the same address is used to construct this R-value at each call as a some kind of optimization.

Where (and why) a copy of a Request is made?

See the first answer.

Where is the best location to call the deleteLater() of each QNetworkReply .

At the end of the function done should be Ok.