java - "malloc(): memory corruption"

Question

我的 jni 代码中有 malloc 问题。该代码旨在让我访问 java 中的 exiv2 库。我尝试使用 sun 和 openjdk 1.6.0 虚拟机以及 1.7.0(测试版)虚拟机破坏代码。

错误是:

    *** glibc detected *** /usr/lib/jvm/java-6-sun/bin/java: malloc(): memory corruption: 0x00000000418a48f0 ***
======= Backtrace: =========
/lib/libc.so.6(+0x774b6)[0x7f84b8aef4b6]
/lib/libc.so.6(+0x7b55f)[0x7f84b8af355f]
/lib/libc.so.6(__libc_malloc+0x6e)[0x7f84b8af438e]
/usr/lib/libstdc++.so.6(_Znwm+0x1d)[0x7f8469fc3ded]
/home/hjed/libExiv2LJB-C__.so(_ZN9__gnu_cxx13new_allocatorIPN5Exiv25ImageEE8allocateEmPKv+0x49)[0x7f846a601c83]
/home/hjed/libExiv2LJB-C__.so(_ZNSt12_Vector_baseIPN5Exiv25ImageESaIS2_EE11_M_allocateEm+0x2f)[0x7f846a601ab5]
/home/hjed/libExiv2LJB-C__.so(_ZNSt6vectorIPN5Exiv25ImageESaIS2_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS2_S4_EERKS2_+0x115)[0x7f846a60169f]
/home/hjed/libExiv2LJB-C__.so(_ZNSt6vectorIPN5Exiv25ImageESaIS2_EE6insertEN9__gnu_cxx17__normal_iteratorIPS2_S4_EERKS2_+0xcf)[0x7f846a601349]
/home/hjed/libExiv2LJB-C__.so(_Z13addExiv2ImagePN5Exiv25ImageE+0x2b)[0x7f846a601115]
/home/hjed/libExiv2LJB-C__.so(Java_Exiv2_ImageFactory_ImageFactory_1Open+0x193)[0x7f846a60214b]
[0x7f84b3dbcc88]
======= Memory map: ========
...
Java Result: 134

似乎导致错误的代码是(注意。此代码不在堆栈跟踪中，但在添加此代码之前未发生错误):

Exiv2::FileIo::AutoPtr io (new Exiv2::FileIo(env->GetStringUTFChars(str,false)));
Exiv2::JpegImage * img  =  ( new Exiv2::JpegImage::JpegImage(io, false));

在添加此代码之前，我使用以下方式分配 img 的值:

image *  img= Exiv2::ImageFactory::open(env->GetStringUTFChars(str,false)).get();

并且没有任何 malloc 问题(但是 Exiv2::ImageFactory::open() 返回一个 autoPtr，我不能将 autoPtr 用于我想做的事情)。

错误发生在这段代码中:

jint addExiv2Image(image * i) {
    vec.push_back(i);
    return vec.size();
}

当使用 gdb 运行时，错误发生在不同的位置:

gdb 回溯:

#0  0x00007ffff724eba5 in raise (sig=<value optimised out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff72526b0 in abort () at abort.c:92
#2  0x00007ffff728843b in __libc_message (do_abort=<value optimised out>, fmt=<value optimised out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#3  0x00007ffff72924b6 in malloc_printerr (action=3, str=0x7ffff7362eab "malloc(): memory corruption", ptr=<value optimised out>) at malloc.c:6283
#4  0x00007ffff729655f in _int_malloc (av=0x7fffa4000020, bytes=24) at malloc.c:4396
#5  0x00007ffff729738e in __libc_malloc (bytes=24) at malloc.c:3660
#6  0x00007ffff6cadbe7 in os::malloc(unsigned long) () from /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so
#7  0x00007ffff68f6bb1 in CHeapObj::operator new(unsigned long) () from /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so
#8  0x00007ffff6cef347 in PlaceholderTable::find_and_add(int, unsigned int, symbolHandle, Handle, PlaceholderTable::classloadAction, symbolHandle, Thread*) ()
   from /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so
#9  0x00007ffff6d89a6c in SystemDictionary::resolve_instance_class_or_null(symbolHandle, Handle, Handle, Thread*) ()
   from /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so
#10 0x00007ffff6d8a243 in SystemDictionary::resolve_or_fail(symbolHandle, Handle, Handle, bool, Thread*) () from /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so
#11 0x00007ffff6b4d537 in find_class_from_class_loader(JNIEnv_*, symbolHandle, unsigned char, Handle, Handle, unsigned char, Thread*) ()
   from /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so
#12 0x00007ffff6b1fc39 in jni_FindClass () from /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so
#13 0x00007fffa36f32cb in JNIEnv_::FindClass (this=0x6131c8, name=0x7fffa36f3628 "Exiv2/Exiv2Image") at /usr/lib/jvm/default-java/include/jni.h:794
#14 0x00007fffa36f3161 in Java_Exiv2_ImageFactory_ImageFactory_1Open (env=0x6131c8, cls=0x7ffff7fd6938, str=0x7ffff7fd6948) at src/ImageFactory.cpp:20
#15 0x00007ffff21d9cc8 in ?? ()
#16 0x0000000000613000 in ?? ()
#17 0x00007ffff7fd68e8 in ?? ()
#18 0x00007fffaa104998 in ?? ()
#19 0x00007ffff7fd6948 in ?? ()
#20 0x00007fffaa104d30 in ?? ()
#21 0x0000000000000000 in ?? ()

和运行 w/gdb 时 vm 崩溃报告回溯:

/lib/libc.so.6(+0x774b6)[0x7ffff72924b6]
/lib/libc.so.6(+0x7b55f)[0x7ffff729655f]
/lib/libc.so.6(__libc_malloc+0x6e)[0x7ffff729738e]
/usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so(+0x5cfbe7)[0x7ffff6cadbe7]
/usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so(+0x218bb1)[0x7ffff68f6bb1]
/usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so(+0x611347)[0x7ffff6cef347]
/usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so(+0x6aba6c)[0x7ffff6d89a6c]
/usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so(+0x6ac243)[0x7ffff6d8a243]
/usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so(+0x46f537)[0x7ffff6b4d537]
/usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server/libjvm.so(+0x441c39)[0x7ffff6b1fc39]
/home/hjed/libExiv2LJB-C__.so(_ZN7JNIEnv_9FindClassEPKc+0x2b)[0x7fffa36f32cb]
/home/hjed/libExiv2LJB-C__.so(Java_Exiv2_ImageFactory_ImageFactory_1Open+0x1a9)[0x7fffa36f3161]
[0x7ffff21d9cc8]

感谢您的帮助，
海杰德

编辑:按照评论中的建议将 vec 从数组更改为 vector 。
注意。我没有在我的任何代码中使用 malloc。

更新
我试过使用 valgrind 进行调试，但使用:

valgrind --show-emwarns=yes --smc-check=all /usr/bin/java -jar Exiv2LJB-test.jar

程序运行但没有提供额外信息和使用

valgrind --show-emwarns=yes --smc-check=all --trace-children=yes /usr/bin/java -jar Exiv2LJB-test.jar

我收到有关不支持 SSE2 的虚拟机错误。我已经阅读了有关将它与 java 一起使用的 valgrind 常见问题解答，并且我确实遵循了这些说明。

Answer 1

std::auto_ptr 是作用域指针包装器，它在离开作用域后销毁包装的对象。如果你想在 vector 中保留返回的对象并手动管理它的生命周期，改变这个:

image *  img= Exiv2::ImageFactory::open(env->GetStringUTFChars(str,false)).get();

到

image *  img= Exiv2::ImageFactory::open(env->GetStringUTFChars(str,false)).release();

然后不要忘记在不再需要它们时释放 vector 中的对象。

---

此外，如果您可以使用 C++11，请将 std::vector 与 std::unique_ptr 结合使用，它们将为您管理内存:

std::vector<std::unique_ptr<image>> vec;

jint addExiv2Image(image * i) {
    vec.push_back(std::unique_ptr<image>(i));
    return vec.size();
}