c++ - Valgrind 无效的读/写列表

Question

即使经过大量研究，我仍然不明白为什么我从 valgrind 得到这个错误。有一个类spike(实现了伪双链表)

class spike
{
  int s_cell;
  int s_begin;
  int s_number;
  int s_type;
  spike *s_previous;
  spike *s_next;

  spike *s_origin; // pointer for original spike or itself
                   // (in the very first spike_data )

  spike *s_derive; // pointer for the spike in the derived class
                   // (note, that sometimes there are 2 or more high
                   // order spike_data in parallel; the pointer is only to one)
public:
  spike(int c, int b, int n, int typ=c_normal)
  {
    s_cell = c;
    s_begin = b;
    s_number = n;
    s_previous = NULL;
    s_next = NULL;
    s_derive = NULL;
    s_origin = this;
    s_type = typ;
  }

  ~spike()
  {
    kill();
  }

还有 spike_data 类。

class spike_data
{
protected:
  int sd_mode;
  int sd_size;
  int sd_number;      // the whole number of spikes 
  int sd_file;        // the number of files for analysis
  int *sd_file_name;  // the names of files used in the analysis
  int sd_cells;       // the whole number of different cells

  spike **sd_array;   // array of all spikes
  spike *sd_first[c_maxcells]; // array of the first entries of spikes
  spike **sd_file_st; // spikes in array for indication of beginning of the new files

// And here is the part that's getting the error
// (it is happening when i try to release)
void spike::kill()
{
  // delete a cell from all references and t becomes "dead"
  // actual release of memory is done in renumerate
  try
  {
    if (s_previous != NULL)
      s_previous->s_next = s_next;
    if (s_next != NULL)
      s_next->s_previous = s_previous;
    if (s_origin && s_origin != this)
    {
      int tmp = 1;
    while(tmp == 1) {
        if (s_origin != NULL) {
            if (s_origin->s_derive != NULL) { // LINE 674
                if ( s_origin->s_derive != this ) { // LINE 675
                        s_origin=s_origin->s_derive;
                    }
                    else tmp = 0;
                }
            else tmp = 0;                       
                     }
             else tmp = 0;
    }

        s_origin->s_derive=NULL; // LINE 685
    }
  }
  catch (...)
  {
  }
  s_next = NULL;
  s_previous = NULL;
  s_origin = NULL;
}


spike_data::~spike_data()
{

if(sd_array!=NULL)
{
    for(int i=0;i<sd_number;i++)
        delete sd_array[i]; // LINE 697

    delete[] sd_array;
    sd_array=NULL;
}
if(sd_file_st!=NULL)
{
    delete[] sd_file_st;
    sd_file_st=NULL;
}
if(sd_file_name!=NULL)
{
    delete[] sd_file_name;
    sd_file_name=NULL;
}
}

抱歉，如果代码不消化，那不是我的，但还是可以的...

Invalid read of size 4
==2079==    at 0x806B0DF: spike::kill() (spikes.cpp:674)
==2079==    by 0x8067D26: spike::~spike() (spike.h:288)
==2079==    by 0x806B174: spike_data::~spike_data() (spikes.cpp:689)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C1E: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079==  Address 0x5d8f534 is 28 bytes inside a block of size 32 free'd
==2079==    at 0x4023881: operator delete(void*) (vg_replace_malloc.c:387)
==2079==    by 0x806B17C: spike_data::~spike_data() (spikes.cpp:697)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C06: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079== 
==2079== Invalid read of size 4
==2079==    at 0x806B0EC: spike::kill() (spikes.cpp:675)
==2079==    by 0x8067D26: spike::~spike() (spike.h:288)
==2079==    by 0x806B174: spike_data::~spike_data() (spikes.cpp:689)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C1E: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079==  Address 0x5d8f534 is 28 bytes inside a block of size 32 free'd
==2079==    at 0x4023881: operator delete(void*) (vg_replace_malloc.c:387)
==2079==    by 0x806B17C: spike_data::~spike_data() (spikes.cpp:697)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C06: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079== 
==2079== Invalid write of size 4
==2079==    at 0x806B10A: spike::kill() (spikes.cpp:685)
==2079==    by 0x8067D26: spike::~spike() (spike.h:288)
==2079==    by 0x806B174: spike_data::~spike_data() (spikes.cpp:689)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C1E: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079==  Address 0x5d8f534 is 28 bytes inside a block of size 32 free'd
==2079==    at 0x4023881: operator delete(void*) (vg_replace_malloc.c:387)
==2079==    by 0x806B17C: spike_data::~spike_data() (spikes.cpp:697)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C06: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)

原来如此。当我想杀死 spike_data 时，每次我调用 delete sd_array[i] ，它调用 spike => kill() 的析构函数最后的问题是这个代码错误。它在执行过程中使用了很多次，在某些时候，当所有计算完成并需要释放内存时，它不起作用。我认为当我输入 s_origin->s_derive=NULL 时有问题。却抓不住...

如果您需要更多代码，请询问 :)

非常感谢那些有勇气进入这段代码的人!!

周末愉快

妮可

Answer 1

spike 的默认复制构造函数 很可能在您没有注意到的情况下被调用。如果是这种情况，第一个析构函数可能会正确运行，但第二个调用将导致 valgrind 转储消息，就像您发布的那样。

为了查看是否是这种情况，如果您使用的是 C++11，请添加:

public:
  spike( const spike& rhs ) = delete;

并且您的代码应该无法编译，这表明您需要编写自己的复制构造函数。

如果您不使用 C++11，您可以编写自己的复制构造函数并在其中放置一个断点，以查看它是否在调试时停在那里。