c++ - 为什么我的结构在包含字符串时崩溃？

Question

我遇到了一个问题，我认为了解 std::string 是很有意义的。

我用c设计了一个队列(lockfree queue)，代码是:kfifo.c

#include <assert.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#define min(X,Y) ((X) < (Y) ? (X) : (Y))

struct kfifo{
    char* buffer;  // data address pointer
    unsigned int index[96];
};

static unsigned long roundup_pow_of_2(unsigned long n) {  // calculate the nearest pow(2) value of n
// so the % operation can be replaced by bit operation &, which is faster
  unsigned long rval = 1;
  while (rval < n) rval <<= 1;
  return rval;
}

static bool is_power_of_2(unsigned long n) {
  return (n != 0 && ((n & (n - 1)) == 0));
}

static void kfifo_init(struct kfifo* fifo,  char* buffer, unsigned int size, size_t elemSize) {
  // init struct
  assert(is_power_of_2(size));
  memset(fifo->index, 0, sizeof(fifo->index));
  fifo->buffer = buffer;
  fifo->index[51] = elemSize;
  fifo->index[34] = size < 2 ? 0: size;
}

int kfifo_alloc(struct kfifo* fifo, unsigned int size, size_t elemSize) {
  /* 
  * round up to the next power of 2, since our 'let the indices 
  * wrap' tachnique works only in this case. 
  */
  if (!is_power_of_2(size)) {
    size = roundup_pow_of_2(size);
  }

  // allocate memory
  char* buffer = (char*)malloc(size * elemSize);
  if (!buffer)
    return 0;

  // init struct
  kfifo_init(fifo, buffer, size, elemSize);
  return 1;
}

void kfifo_free(struct kfifo *fifo) {  // free resource
  free(fifo->buffer);
  fifo->index[17] = fifo->index[0] = fifo->index[34] = fifo->index[51] = 0;
  // fifo->buffer = NULL;
}

static inline unsigned int kfifo_avail_int(struct kfifo *fifo) {  // left space of fifo
    return fifo->index[34] - (fifo->index[17] - fifo->index[0]);
}

static inline unsigned int kfifo_in_data(struct kfifo *fifo, char *from) {
  unsigned int off_int = (fifo->index[17] & (fifo->index[34] - 1));  // next_in place, int
  unsigned int l = min(1, (fifo->index[34] - off_int));
  memcpy(fifo->buffer + off_int * fifo->index[51], from, l*fifo->index[51]);
  memcpy(fifo->buffer, from + l*fifo->index[51], (1 - l) * fifo->index[51]);
  if (fifo->buffer + off_int*fifo->index[51] == NULL) {  // if execute this in an unexpected order
    return 0;
  }
  return 1;
}

unsigned int kfifo_push(struct kfifo* fifo, char* buffer) {
  int len = min(kfifo_avail_int(fifo), 1);
  if (!kfifo_in_data(fifo, buffer)) {
    return 0;
  }
  fifo->index[17] += len;
  return len;
}

static inline unsigned int kfifo_out_data(struct kfifo *fifo, char *to) {
  unsigned int off = (fifo->index[0] & (fifo->index[34]-1));
  unsigned int l = min(1, (fifo->index[34] - off));
  memcpy(to, fifo->buffer + off * fifo->index[51], l*fifo->index[51]);
  memcpy(to + l*fifo->index[51], fifo->buffer, (1 - l)*fifo->index[51]);
  // char* p = fifo->buffer + off * fifo->index[51];
  // p = NULL;  // reset the out position as NULL
  return 1;
}

unsigned int kfifo_get(struct kfifo* fifo, char* buffer){
  int len = min(fifo->index[17] - fifo->index[0], 1);
  if (!kfifo_out_data(fifo, buffer)) {
    return 0;
  }
  fifo->index[0] += len;
  return len;
}

为了在 C++ 中使用它，我有一个包装器:fifo_queue.h

#include "kfifo_ing.c"

template <typename T>
class FIFO_Queue {
 public:
  FIFO_Queue(int size) {
    kfifo_alloc(&k, size, sizeof(T));
  }
  ~FIFO_Queue() {
    // kfifo_free(&k);
  }
  bool push(const T& t) {
    return kfifo_push(&k, (char*)(&t));
  }

  bool pop(T& t) {
    return kfifo_get(&k, (char*)(&t));
  }
 private:
  kfifo k;
};

我已经测试了这个队列，我认为当元素是简单结构的 int 时它是正确的。

但是当结构有 std::string 对象时会发生奇怪的事情，这是我的测试代码:

#include "fifo_queue.h"
#include <string>
using namespace std;

struct huang {
  int a;
  string b;  // if dont have b, everything is good, but once add it, crashed!!!!!!!!
  double c;
  void Show(FILE* stream) const {
    fprintf(stream, "%d %lf\n", a, c); 
  }
};

FIFO_Queue<huang>q(80);

int main() {
  huang h;
  h.a = 1;
  q.push(h);
  q.pop(h);
  q.pop(h); // if no this, wont crash!!!!
  return 0;
}

代码崩溃了，当我使用 gdb 检查堆栈时，它警告我错误发生在 ~basic_string() 中，我很困惑，我知道字符串是一个复杂的设计数据结构，它有两个指针。但是谁能解释一下呢？是double free引起的吗？有什么方法可以让它起作用吗？

Answer 1

int main()
{
    huang h;
    h.a = 1;
    q.push(h);
    q.pop(h);
    q.pop(h); // if no this, wont crash!!!!
    return 0;
}

在您的代码中，您只将 1 个 huang 推到了您的 q 上。但是你弹出两次。我怀疑您在第二个 pop 中放入 h 的内容在 huang 中没有正确构造的 string b。当您离开 h 的范围时，string b 会被破坏并可能访问不属于您的进程的内存并因此崩溃。