c - OS X 10.5 malloc中的错误？

Question

我正在用C编写程序。我有两个主要的开发机器，都是Mac。一个正在运行OS X 10.5，是32位计算机，另一个正在运行OS X 10.6，是64位。该程序在64位计算机上编译并运行时运行良好。但是，当我在32位计算机上编译完全相同的程序时，它会运行一段时间，然后在malloc内部某个地方崩溃。这是回溯:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0xeeb40fe0
0x9036d598 in small_malloc_from_free_list ()
(gdb) bt
#0  0x9036d598 in small_malloc_from_free_list ()
#1  0x90365286 in szone_malloc ()
#2  0x903650b8 in malloc_zone_malloc ()
#3  0x9036504c in malloc ()
#4  0x0000b14c in xmalloc (s=2048) at Common.h:185
...

xmalloc是我的自定义包装器，如果 exit返回 malloc，它只会调用 NULL，因此它不会耗尽内存。

如果我将相同的代码与 -ltcmalloc链接起来，则效果很好，因此我强烈怀疑这是OS X 10.5的默认分配器内部的错误。可能是我的程序在某处导致了内存损坏，并且 tcmalloc不被它绊倒。我尝试通过在不同程序中执行相同的 malloc和 free序列来重现故障，但效果很好。

所以我的问题是:

以前有没有人见过此错误？或者，或者

如何调试类似的东西？例如，是否有OS X的malloc的调试版本？

顺便说一句，这些是链接的库:

$ otool -L ./interp 
./interp:
    /usr/lib/libgcc_s.1.dylib (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 111.1.5)

更新:是的，由于在数组末尾进行写操作，导致堆损坏，现在可以正常工作。我应该在发布问题之前运行 valgrind。尽管如此，我对除valgrind之外的技术如何保护免受此类损坏感兴趣，因此，我对此表示感谢。

Answer 1

您是否已阅读MacOS X上malloc()的手册页？它在某种程度上说:

调试分配错误

A number of facilities are provided to aid in debugging allocation errors in applications. These facilities are primarily controlled via environment variables. The recognized environment variables and their meanings are documented below.

环境

The following environment variables change the behavior of the allocation-related functions.

• MallocLogFile <f>

  Create/append messages to the given file path instead of writing to the standard error.

• MallocGuardEdges

  If set, add a guard page before and after each large block.

• MallocDoNotProtectPrelude

  If set, do not add a guard page before large blocks, even if the MallocGuardEdges environment variable is set.

• MallocDoNotProtectPostlude

  If set, do not add a guard page after large blocks, even if the MallocGuardEdges environment variable is set.

• MallocStackLogging

  If set, record all stacks, so that tools like leaks can be used.

• MallocStackLoggingNoCompact

  If set, record all stacks in a manner that is compatible with the malloc_history program.

• MallocStackLoggingDirectory

  If set, records stack logs to the directory specified instead of saving them to the default location (/tmp).

• MallocScribble

  If set, fill memory that has been allocated with 0xaa bytes. This increases the likelihood that a program making assumptions about the contents of freshly allocated memory will fail. Also if set, fill memory that has been deallocated with 0x55 bytes. This increases the likelihood that a program will fail due to accessing memory that is no longer allocated.

• MallocCheckHeapStart <s>

  If set, specifies the number of allocations <s> to wait before begining periodic heap checks every <n> as specified by MallocCheckHeapEach. If MallocCheckHeapStart is set but MallocCheckHeapEach is not specified, the default check repetition is 1000.

• MallocCheckHeapEach <n>

  If set, run a consistency check on the heap every <n> operations. MallocCheckHeapEach is only meaningful if MallocCheckHeapStart is also set.

• MallocCheckHeapSleep <t>

  Sets the number of seconds to sleep (waiting for a debugger to attach) when MallocCheckHeapStart is set and a heap corruption is detected. The default is 100 seconds. Setting this to zero means not to sleep at all. Setting this to a negative number means to sleep (for the positive number of seconds) only the very first time a heap corruption is detected.

• MallocCheckHeapAbort <b>

  When MallocCheckHeapStart is set and this is set to a non-zero value, causes abort(3) to be called if a heap corruption is detected, instead of any sleeping.

• MallocErrorAbort

  If set, causes abort(3) to be called if an error was encountered in malloc(3) or free(3) , such as a calling free(3) on a pointer previously freed.

• MallocCorruptionAbort

  Similar to MallocErrorAbort but will not abort in out of memory conditions, making it more useful to catch only those errors which will cause memory corruption. MallocCorruptionAbort is always set on 64-bit processes.

也就是说，我仍然会先使用 valgrind。