COM學習：delete pIUnknown時異常與IUnknown順序

話起於《COM技術內幕》第3章的例子，具體代碼如下：

#include "stdafx.h"
//
// IUnknown.cpp
// To compile use: cl IUnknown.cpp UUID.lib
//
#include <iostream>
#include <objbase.h>
using namespace std;
void trace(const char* msg) { cout << msg << endl ;}


// Interfaces
interface IX : IUnknown
{
	virtual void __stdcall Fx() = 0 ;
} ;

interface IY : IUnknown
{
	virtual void __stdcall Fy() = 0 ;
} ;

interface IZ : IUnknown
{
	virtual void __stdcall Fz() = 0 ;
} ;

// Forward references for GUIDs
extern const IID IID_IX ;
extern const IID IID_IY ;
extern const IID IID_IZ ;

//
// Component
//
class CA : public IX,
	public IY
{
	//IUnknown implementation
	virtual HRESULT __stdcall QueryInterface(const IID& iid, void** ppv) ;			
	virtual ULONG __stdcall AddRef() { return 0 ;}
	virtual ULONG __stdcall Release() { return 0 ;}

	// Interface IX implementation
	virtual void __stdcall Fx() { cout << "Fx" << endl ;}

	// Interface IY implementation
	virtual void __stdcall Fy() { cout << "Fy" << endl ;}
} ;

HRESULT __stdcall CA::QueryInterface(const IID& iid, void** ppv)
{ 	
	if (iid == IID_IUnknown)
	{
		trace("QueryInterface: Return pointer to IUnknown.") ;
		*ppv = static_cast<IX*>(this) ;
	}
	else if (iid == IID_IX)
	{
		trace("QueryInterface: Return pointer to IX.") ;
		*ppv = static_cast<IX*>(this) ;
	}
	else if (iid == IID_IY)
	{
		trace("QueryInterface: Return pointer to IY.") ;
		*ppv = static_cast<IY*>(this) ;
	}
	else
	{  	   
		trace("QueryInterface: Interface not supported.") ;
		*ppv = NULL ;
		return E_NOINTERFACE ;
	}
	reinterpret_cast<IUnknown*>(*ppv)->AddRef() ; // See Chapter 4.
	return S_OK ;
}

//
// Creation function
//
IUnknown* CreateInstance()
{
	IUnknown* pI = static_cast<IY*>(new CA) ;
	pI->AddRef() ;
	return pI ;
}

//
// IIDs
//
// {32bb8320-b41b-11cf-a6bb-0080c7b2d682}
static const IID IID_IX = 
{0x32bb8320, 0xb41b, 0x11cf,
{0xa6, 0xbb, 0x0, 0x80, 0xc7, 0xb2, 0xd6, 0x82}} ;

// {32bb8321-b41b-11cf-a6bb-0080c7b2d682}
static const IID IID_IY = 
{0x32bb8321, 0xb41b, 0x11cf,
{0xa6, 0xbb, 0x0, 0x80, 0xc7, 0xb2, 0xd6, 0x82}} ;

// {32bb8322-b41b-11cf-a6bb-0080c7b2d682}
static const IID IID_IZ = 
{0x32bb8322, 0xb41b, 0x11cf,
{0xa6, 0xbb, 0x0, 0x80, 0xc7, 0xb2, 0xd6, 0x82}} ;

//
// Client
//


int _tmain(int argc, _TCHAR* argv[])
{


	HRESULT hr ;

	trace("Client:         Get an IUnknown pointer.") ;
	IUnknown* pIUnknown = CreateInstance() ;


	trace("Client:         Get interface IX.") ;

	IX* pIX = NULL ; 
	hr = pIUnknown->QueryInterface(IID_IX, (void**)&pIX) ;
	if (SUCCEEDED(hr))
	{
		trace("Client:         Succeeded getting IX.") ;
		pIX->Fx() ;          // Use interface IX.
	}


	trace("Client:         Get interface IY.") ;

	IY* pIY = NULL ;
	hr = pIUnknown->QueryInterface(IID_IY, (void**)&pIY) ;
	if (SUCCEEDED(hr))
	{
		trace("Client:         Succeeded getting IY.") ;
		pIY->Fy() ;          // Use interface IY.
	}


	trace("Client:         Ask for an unsupported interface.") ;

	IZ* pIZ = NULL ;
	hr = pIUnknown->QueryInterface(IID_IZ, (void**)&pIZ) ;
	if (SUCCEEDED(hr))
	{
		trace("Client:         Succeeded in getting interface IZ.") ;
		pIZ->Fz() ;
	}
	else
	{
		trace("Client:         Could not get interface IZ.") ;
	}


	trace("Client:         Get interface IY from interface IX.") ;

	IY* pIYfromIX = NULL ;
	hr = pIX->QueryInterface(IID_IY, (void**)&pIYfromIX) ;
	if (SUCCEEDED(hr))
	{	
		trace("Client:         Succeeded getting IY.") ;
		pIYfromIX->Fy() ;
	}


	trace("Client:         Get interface IUnknown from IY.") ;

	IUnknown* pIUnknownFromIY = NULL ;
	hr = pIY->QueryInterface(IID_IUnknown, (void**)&pIUnknownFromIY) ;
	if (SUCCEEDED(hr))
	{
		cout << "Are the IUnknown pointers equal?  " ;
		if (pIUnknownFromIY == pIUnknown)
		{
			cout << "Yes, pIUnknownFromIY == pIUnknown." << endl ;
		}
		else
		{
			cout << "No, pIUnknownFromIY != pIUnknown." << endl ;
		}
	}

	// Delete the component.
	delete pIUnknown ;
	//pIUnknown->Release();

	return 0 ;
}

上面的例子運行起來沒有任何問題，但有一個疑問，如果我把CreateInstance()修改成

IUnknown* CreateInstance()
{
	IUnknown* pI = static_cast<IY*>(new CA) ;
	pI->AddRef() ;
	return pI ;
}

會有什麼影響？

從分析上來看沒有任何問題，只是將多繼承的對象強轉成哪個父類對象，但是在運行到delete pIUnknown時出現ASSERT異常，F10進去發現_ASSERTE(_BLOCK_TYPE_IS_VALID(pHead->nBlockUse));出錯。

因爲此時pIUnknown指針並不指向當初分配的整個內存塊，在new的時候會給內存寫頭信息，此時pIUnknown無法找到頭信息，導致delete失敗。

要想delete成功，必須修改繼承順序，即

class CA : public IY, public IX{...}

當然，在這還有一個疑問，如果是pIUnknown->Release()會是怎樣的結果？

本例Release()函數沒有進行任何處理，肯定會造成內存泄漏，如果Release()裏面也是delete的話，那麼強轉的類型真的很重要。