c++ - 奇怪的堆损坏错误

Question

我从 Visual C++ 得到这个错误:

HEAP[ShockRay3.exe]:00557018 处的堆 block 已在 00557044 处修改，超过请求的大小 24

当我在函数中的两个递归调用之间添加一行代码时，就会发生这种情况。这行代码所做的只是更改一个指针，但出于某种原因，每次我将其放入时，都会出现此错误。

这是代码的简化版本(只有堆内存填充函数调用)

int KDTree::BuildBranch(int height, Mailbox** objs, int nObjects)
{
    {...}
        //Check for termination
    if(height == -1 || nObjects < minObjectsPerNode)
    {
        {...}

        return nodeIndex - 1;
    }

    //Save this node's index and increment the current index to save space for this node
    BoundingBox* tempBox = new BoundingBox();
    //If this is first voxel, we don't keep track of stradle counts
    if(nodeIndex == 1)
    {
        {...}

        for(int i = 0; i < nObjects; i++)
        {
            //Get bounding box
            objs[i]->prim->MakeBoundingBox(tempBox);

            //Add mins to split lists
            xMins[index] = tempBox->x0;
            yMins[index] = tempBox->y0;
            zMins[index] = tempBox->z0;

            //Add maxs
            xMaxs[index] = tempBox->x1;
            yMaxs[index] = tempBox->y1;
            zMaxs[index] = tempBox->z1;
            index++;
        }
    }
    else
    {
        for(int i = 0; i < nObjects; i++)
        {
            //Get bounding box
            objs[i]->prim->MakeBoundingBox(tempBox);

            //Add mins to split lists checking for straddle
            if(tempBox->x0 < curVoxelBounds->x0)
            {
                {...}
            }
            else
            {
                xMins[xMinCount] = tempBox->x0;
                {...}
            }

            if(tempBox->y0 < curVoxelBounds->y0)
            {
                {...}
            }
            else
            {
                yMins[yMinCount] = tempBox->y0;
                {...}
            }

            if(tempBox->z0 < curVoxelBounds->z0)
            {
                {...}
            }
            else
            {
                zMins[zMinCount] = tempBox->z0;
                {...}
            }

            //Add maxs to split lists checking for straddle
            if(tempBox->x1 > curVoxelBounds->x1)
            {
                {...}
            }
            else
            {
                xMaxs[xMaxCount] = tempBox->x1;
                {...}
            }

            if(tempBox->y1 > curVoxelBounds->y1)
            {
                {...}
            }
            else
            {
                yMaxs[yMaxCount] = tempBox->y1;
                {...}
            }

            if(tempBox->z1 > curVoxelBounds->z1)
            {
                {...}
            }
            else
            {           
                zMaxs[zMaxCount] = tempBox->z1;
                {...}   
            }
        }
    }

    //If this is the root node, construct the scene bounding box
    if(nodeIndex == 1)
    {
        bb = new BoundingBox(xMins[0], xMaxs[nObjects - 1], yMins[0], yMaxs[nObjects - 1], zMins[0], zMaxs[nObjects - 1]);
        curVoxelBounds = new BoundingBox(xMins[0], xMaxs[nObjects - 1], yMins[0], yMaxs[nObjects - 1], zMins[0], zMaxs[nObjects - 1]);
    }

    {...}

    //Allocate space for left and right lists
    Mailbox** leftList = new Mailbox*[minLeftCounter];
    Mailbox** rightList = new Mailbox*[minRightCounter];

    //Sort objects into lists of those to the left and right of the split plane
    //Bounding box for left and right
    BoundingBox* rightBox = NULL;
    BoundingBox* leftBox = NULL;
    //Saved pointer to current bounding box
    BoundingBox* savedBox = curVoxelBounds;

    int leftIndex = 0, rightIndex = 0;
    {...}
    switch(axis)
    {
    case 0:
        for(int i = 0; i < nObjects; i++)
        {
            //Get object bounding box
            objs[i]->prim->MakeBoundingBox(tempBox);

            //Add to left and right lists when necessary
            if(tempBox->x0 < splitLoc)
            {
                {...}
            }

            if(tempBox->x1 > splitLoc)
            {
                {...}
            }
        }

        //Construct new bounding boxes
        leftBox = new BoundingBox(curVoxelBounds->x0, splitLoc, curVoxelBounds->y0,
            curVoxelBounds->y1, curVoxelBounds->z0, curVoxelBounds->z1);
        rightBox = new BoundingBox(splitLoc, curVoxelBounds->x1, curVoxelBounds->y0,
            curVoxelBounds->y1, curVoxelBounds->z0, curVoxelBounds->z1);
        break;

    case 1:
        for(int i = 0; i < nObjects; i++)
        {
            //Get object bounding box
            objs[i]->prim->MakeBoundingBox(tempBox);

            //Add to left and right lists when necessary
            if(tempBox->y0 < splitLoc)
            {
                {...}
            }

            if(tempBox->y1 > splitLoc)
            {
                {...}
            }

        }

        //Construct new bounding boxes
        leftBox = new BoundingBox(curVoxelBounds->x0, curVoxelBounds->x1, curVoxelBounds->y0,
            splitLoc, curVoxelBounds->z0, curVoxelBounds->z1);
        rightBox = new BoundingBox(curVoxelBounds->x0, curVoxelBounds->x1, splitLoc,
            curVoxelBounds->y1, curVoxelBounds->z0, curVoxelBounds->z1);
        break;

    case 2:
        for(int i = 0; i < nObjects; i++)
        {
            //Get object bounding box
            objs[i]->prim->MakeBoundingBox(tempBox);

            //Add to left and right lists when necessary
            if(tempBox->z0 < splitLoc)
            {
                {...}
            }

            if(tempBox->z1 > splitLoc)
            {
                {...}
            }

        }

        //Construct new bounding boxes
        leftBox = new BoundingBox(curVoxelBounds->x0, curVoxelBounds->x1, curVoxelBounds->y0,
            curVoxelBounds->y1, curVoxelBounds->z0, splitLoc);
        rightBox = new BoundingBox(curVoxelBounds->x0, curVoxelBounds->x1, curVoxelBounds->y0,
            curVoxelBounds->y1, splitLoc, curVoxelBounds->z1);
        break;
    };

    //Delete the bounding box
    delete tempBox;

    //Delete old objects array
    delete[] objs;

    {...}

    //Change bounding box
    curVoxelBounds = leftBox;
    //Build the left branch
    BuildBranch(height - 1, leftList, leftCount);

    //Change bounding box
    curVoxelBounds = rightBox; //<----THIS IS THE LINE RESULTING IN THE ERROR
    //Build the right branch
    int rcNodeIndex = BuildBranch(height - 1, rightList, rightCount);

    //Restore bounding box
    curVoxelBounds = savedBox;

    //Delete left and right bounding boxes
    delete leftBox;
    delete rightBox;

    {...}

    return thisNodeIndex;
}

如果我在改变指针的地方去掉那一行，程序就可以运行。如果我把它留在里面，它就不起作用，调用堆栈显示这一行:

delete[] objs;

但在此之前，调用堆栈中的行似乎是导致此问题的原因。我不知道更改指针如何将代码跳转到该删除行。

Answer 1

我在您发布的代码中看不到任何明显的错误，但是一些省略的代码可能是相关的。因此，这里有一些要调查的想法:

• 是否正确计算了 leftCount 和 rightCount 以便它们不超出列表？
• leftList 和 rightList 是否正确填充了有效指针？
• 无论在何处从外部世界调用BuildBranch，第二个和第三个参数是否有效且正确？
• 外界是否期望此函数删除第二个参数？

如果这些想法对您没有任何帮助，那么请问几个问题:

• 当崩溃发生时，函数递归了多少次？它发生在开始还是内心深处？
• 是否可以重新排序递归调用，以便先处理右框，然后再处理左框？如果是这样，当您尝试这样做时，崩溃发生在哪一个？