Valgrind读/写列表无效

时间:2012-02-10 18:29:54

标签: c++ memory-management valgrind

即使经过大量研究,我仍然不知道为什么我从valgrind那里得到了这个错误。 有一个类spike(实现伪双链表)

class spike
{
  int s_cell;
  int s_begin;
  int s_number;
  int s_type;
  spike *s_previous;
  spike *s_next;

  spike *s_origin; // pointer for original spike or itself
                   // (in the very first spike_data )

  spike *s_derive; // pointer for the spike in the derived class
                   // (note, that sometimes there are 2 or more high
                   // order spike_data in parallel; the pointer is only to one)
public:
  spike(int c, int b, int n, int typ=c_normal)
  {
    s_cell = c;
    s_begin = b;
    s_number = n;
    s_previous = NULL;
    s_next = NULL;
    s_derive = NULL;
    s_origin = this;
    s_type = typ;
  }

  ~spike()
  {
    kill();
  }

上课spike_data。

class spike_data
{
protected:
  int sd_mode;
  int sd_size;
  int sd_number;      // the whole number of spikes 
  int sd_file;        // the number of files for analysis
  int *sd_file_name;  // the names of files used in the analysis
  int sd_cells;       // the whole number of different cells

  spike **sd_array;   // array of all spikes
  spike *sd_first[c_maxcells]; // array of the first entries of spikes
  spike **sd_file_st; // spikes in array for indication of beginning of the new files

// And here is the part that's getting the error
// (it is happening when i try to release)
void spike::kill()
{
  // delete a cell from all references and t becomes "dead"
  // actual release of memory is done in renumerate
  try
  {
    if (s_previous != NULL)
      s_previous->s_next = s_next;
    if (s_next != NULL)
      s_next->s_previous = s_previous;
    if (s_origin && s_origin != this)
    {
      int tmp = 1;
    while(tmp == 1) {
        if (s_origin != NULL) {
            if (s_origin->s_derive != NULL) { // LINE 674
                if ( s_origin->s_derive != this ) { // LINE 675
                        s_origin=s_origin->s_derive;
                    }
                    else tmp = 0;
                }
            else tmp = 0;                       
                     }
             else tmp = 0;
    }

        s_origin->s_derive=NULL; // LINE 685
    }
  }
  catch (...)
  {
  }
  s_next = NULL;
  s_previous = NULL;
  s_origin = NULL;
}


spike_data::~spike_data()
{

if(sd_array!=NULL)
{
    for(int i=0;i<sd_number;i++)
        delete sd_array[i]; // LINE 697

    delete[] sd_array;
    sd_array=NULL;
}
if(sd_file_st!=NULL)
{
    delete[] sd_file_st;
    sd_file_st=NULL;
}
if(sd_file_name!=NULL)
{
    delete[] sd_file_name;
    sd_file_name=NULL;
}
}

对不起,如果代码是单纯的,那不是我的,但它仍然可以......

Invalid read of size 4
==2079==    at 0x806B0DF: spike::kill() (spikes.cpp:674)
==2079==    by 0x8067D26: spike::~spike() (spike.h:288)
==2079==    by 0x806B174: spike_data::~spike_data() (spikes.cpp:689)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C1E: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079==  Address 0x5d8f534 is 28 bytes inside a block of size 32 free'd
==2079==    at 0x4023881: operator delete(void*) (vg_replace_malloc.c:387)
==2079==    by 0x806B17C: spike_data::~spike_data() (spikes.cpp:697)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C06: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079== 
==2079== Invalid read of size 4
==2079==    at 0x806B0EC: spike::kill() (spikes.cpp:675)
==2079==    by 0x8067D26: spike::~spike() (spike.h:288)
==2079==    by 0x806B174: spike_data::~spike_data() (spikes.cpp:689)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C1E: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079==  Address 0x5d8f534 is 28 bytes inside a block of size 32 free'd
==2079==    at 0x4023881: operator delete(void*) (vg_replace_malloc.c:387)
==2079==    by 0x806B17C: spike_data::~spike_data() (spikes.cpp:697)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C06: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079== 
==2079== Invalid write of size 4
==2079==    at 0x806B10A: spike::kill() (spikes.cpp:685)
==2079==    by 0x8067D26: spike::~spike() (spike.h:288)
==2079==    by 0x806B174: spike_data::~spike_data() (spikes.cpp:689)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C1E: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079==  Address 0x5d8f534 is 28 bytes inside a block of size 32 free'd
==2079==    at 0x4023881: operator delete(void*) (vg_replace_malloc.c:387)
==2079==    by 0x806B17C: spike_data::~spike_data() (spikes.cpp:697)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C06: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)

所以在这里。当我想杀死spike_data时,每次调用delete sd_array [i],调用spike =&gt;的析构函数杀() 事情就是最后这个代码错误。它在执行期间多次使用,并且在某些时候,当所有计算完成并需要释放内存时,它不起作用。当我把s_origin-&gt; s_derive = NULL时,我觉得有问题。但是抓不住它......

如果您需要更多代码,请询问:)

非常感谢那些有勇气参与此代码的人!

好周末

尼科

1 个答案:

答案 0 :(得分:1)

很有可能在没有您注意到的情况下调用 spike 的默认复制构造函数。如果是这种情况,第一个析构函数可能正确运行,但第二个调用将导致valgrind转储消息,就像你发布的消息一样。

为了查看是否是这种情况,如果您使用的是C ++ 11,请添加:

public:
  spike( const spike& rhs ) = delete;

并且您的代码应该无法编译,表明您需要编写自己的复制构造函数。

如果您使用C ++ 11,您可以编写自己的复制构造函数并在其中放置一个断点,以查看它是否在调试时停止。