macos - 为什么这个与链表相关的程序在 x86 segfaulting 中？

Question

我想为链表分配一些节点。我有一个 alloc_pair似乎有效的功能。我加入了注释来解释每一行关于链表的意图。我的代码在某处给了我一个段错误，但我不知道在哪里。 GDB 没有帮助，如下所示:

Thread 2 hit Breakpoint 1, 0x0000000100003f63 in main ()
(gdb) c
Continuing.

Thread 2 hit Breakpoint 2, 0x0000000100003f4e in alloc_pair ()
(gdb) ni
0x0000000100003f55 in alloc_pair ()
(gdb) ni
0x0000000100003f59 in alloc_pair ()
(gdb) disassemble
Dump of assembler code for function alloc_pair:
   0x0000000100003f4e <+0>: mov    rdi,0x10
   0x0000000100003f55 <+7>: sub    rsp,0x8
=> 0x0000000100003f59 <+11>:    call   0x100003f96
   0x0000000100003f5e <+16>:    add    rsp,0x8
   0x0000000100003f62 <+20>:    ret    
End of assembler dump.
(gdb) c
Continuing.

Thread 2 received signal SIGSEGV, Segmentation fault.
0x00007fff731d970a in ?? ()
(gdb) bt
#0  0x00007fff731d970a in ?? ()
#1  0x00007ffeefbff828 in ?? ()
#2  0x0000000100008008 in ?? ()
#3  0x0000000000000000 in ?? ()
(gdb) 

如果你知道我犯的错误，请告诉我。

    .global _main
    .text

alloc_pair:
    push rbp
    mov rbp, rsp
    mov rdi, 16
    sub rsp, 8
    call _malloc
    add rsp, 8
    mov rsp, rbp
    pop rbp
    ret

_main:
    call alloc_pair

    mov r13, rax  # r13 stores the initial pair allocated

    mov qword ptr [rax], 29  # the node 1 head contains 29
    mov r12, [rax + 8]  # r12 stores the memory location of the node 1 tail

    call alloc_pair

    mov qword ptr [rax], 7  # the node 2 head contains 7
    mov qword ptr [r12], rax  # the node 1 tail points to the node 2 head

    mov rdi, 0
    mov rax, 0x2000001
    syscall

Answer 1

这一行:

mov r12, [rax + 8]  # r12 stores the memory location of the node 1 tail

不做您的评论所说的那样。此指令将内存的 64 位内容移动到 [rax+8]到 R12。它不会移动 [rax+8] 的地址到 R12。您要的是 Load Effective Address (LEA)获取 [rax+8]的地址进入 R12。该指令如下所示:

lea r12, [rax + 8]  # r12 stores the memory location of the node 1 tail