如何使用gdb追踪C++中的double free或corruption错误

Question

当我运行我的C++程序时，它会因此错误而崩溃。

* glibc的检测* ./load：双重释放或腐败（上一个！）： 0x0000000000c6ed50 ***

我试图跟踪它使用的cout语句，但我发现很难。 gdb可以让这更容易吗？它是如何完成的？

Answer 1

您可以使用gdb，但我会先尝试Valgrind。请参阅quick start guide。

Answer 2

至少有两种可能的情况：

1. 要删除的同一个实体两次
2. 要删除，这不是分配

对于第一个我强烈建议的东西将所有删除的指针置空。

你有三个选择：

1. 重载new和delete和跟踪分配
2. 是，使用gdb的 - 那么你会从你的崩溃得到一个回溯，这很可能会很乐于助人
3. 的建议 - 使用Valgrind的 - 这是不容易进入，而且可以节省您的时间千倍在未来...

Answer 3

三条基本规律：

1. 免费后将指针设置为NULL
2. 释放前检查NULL。
3. 在开始时初始化指向NULL的指针。

这三个作品的组合很好。

Answer 4

如果您使用的glibc，你可以设置MALLOC_CHECK_环境变量2，这将导致的glibc使用的malloc的容错版本，这将导致你的程序在该点中止在双重释放完成。

您可以在运行程序之前使用set environment MALLOC_CHECK_ 2命令从gdb中设置此项;程序应该中止，在回溯中可以看到free()的调用。

看到man page for malloc()以获取更多信息

Answer 5

是否使用智能指针如boost shared_ptr？如果是这样，请通过调用get()来检查是否在任何地方直接使用原始指针。我发现这是一个相当普遍的问题。

例如，假设一个原始指针传递给代码的场景（可能是回调处理程序）。您可能会决定将其分配给智能指针以应对引用计数等。大错误：除非您进行深度复制，否则您的代码不拥有此指针。当你的代码与智能指针完成后，它会销毁它并试图销毁它指向的内存，因为它认为没有其他人需要它，但然后调用代码将尝试删除它，会有一个双重的免费问题。

当然，这可能不是你的问题。这是最简单的例子，它显示了它会如何发生。第一次删除是好的，但编译器意识到它已经删除了内存并导致了问题。这就是为什么在删除后立即将0指向一个指针是个好主意。

int main(int argc, char* argv[]) 
{ 
    char* ptr = new char[20]; 

    delete[] ptr; 
    ptr = 0; // Comment me out and watch me crash and burn. 
    delete[] ptr; 
} 

编辑：改变delete到delete[]，如PTR是字符数组。

Answer 6

您可以使用valgrind进行调试。

#include<stdio.h> 
#include<stdlib.h> 

int main() 
{ 
char *x = malloc(100); 
free(x); 
free(x); 
return 0; 
} 

[[email protected] testbox]$ vim t1.c 
[[email protected] testbox]$ cc -g t1.c -o t1 
[[email protected] testbox]$ ./t1 
*** glibc detected *** ./t1: double free or corruption (top): 0x00000000058f7010 *** 
======= Backtrace: ========= 
/lib64/libc.so.6[0x3a3127245f] 
/lib64/libc.so.6(cfree+0x4b)[0x3a312728bb] 
./t1[0x400500] 
/lib64/libc.so.6(__libc_start_main+0xf4)[0x3a3121d994] 
./t1[0x400429] 
======= Memory map: ======== 
00400000-00401000 r-xp 00000000 68:02 30246184       /home/sand/testbox/t1 
00600000-00601000 rw-p 00000000 68:02 30246184       /home/sand/testbox/t1 
058f7000-05918000 rw-p 058f7000 00:00 0         [heap] 
3a30e00000-3a30e1c000 r-xp 00000000 68:03 5308733      /lib64/ld-2.5.so 
3a3101b000-3a3101c000 r--p 0001b000 68:03 5308733      /lib64/ld-2.5.so 
3a3101c000-3a3101d000 rw-p 0001c000 68:03 5308733      /lib64/ld-2.5.so 
3a31200000-3a3134e000 r-xp 00000000 68:03 5310248      /lib64/libc-2.5.so 
3a3134e000-3a3154e000 ---p 0014e000 68:03 5310248      /lib64/libc-2.5.so 
3a3154e000-3a31552000 r--p 0014e000 68:03 5310248      /lib64/libc-2.5.so 
3a31552000-3a31553000 rw-p 00152000 68:03 5310248      /lib64/libc-2.5.so 
3a31553000-3a31558000 rw-p 3a31553000 00:00 0 
3a41c00000-3a41c0d000 r-xp 00000000 68:03 5310264      /lib64/libgcc_s-4.1.2-20080825.so.1 
3a41c0d000-3a41e0d000 ---p 0000d000 68:03 5310264      /lib64/libgcc_s-4.1.2-20080825.so.1 
3a41e0d000-3a41e0e000 rw-p 0000d000 68:03 5310264      /lib64/libgcc_s-4.1.2-20080825.so.1 
2b1912300000-2b1912302000 rw-p 2b1912300000 00:00 0 
2b191231c000-2b191231d000 rw-p 2b191231c000 00:00 0 
7ffffe214000-7ffffe229000 rw-p 7ffffffe9000 00:00 0      [stack] 
7ffffe2b0000-7ffffe2b4000 r-xp 7ffffe2b0000 00:00 0      [vdso] 
ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0     [vsyscall] 
Aborted 
[[email protected] testbox]$ 


[[email protected] testbox]$ vim t1.c 
[[email protected] testbox]$ cc -g t1.c -o t1 
[[email protected] testbox]$ valgrind --tool=memcheck ./t1 
==20859== Memcheck, a memory error detector 
==20859== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al. 
==20859== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info 
==20859== Command: ./t1 
==20859== 
==20859== Invalid free()/delete/delete[] 
==20859== at 0x4A05A31: free (vg_replace_malloc.c:325) 
==20859== by 0x4004FF: main (t1.c:8) 
==20859== Address 0x4c26040 is 0 bytes inside a block of size 100 free'd 
==20859== at 0x4A05A31: free (vg_replace_malloc.c:325) 
==20859== by 0x4004F6: main (t1.c:7) 
==20859== 
==20859== 
==20859== HEAP SUMMARY: 
==20859==  in use at exit: 0 bytes in 0 blocks 
==20859== total heap usage: 1 allocs, 2 frees, 100 bytes allocated 
==20859== 
==20859== All heap blocks were freed -- no leaks are possible 
==20859== 
==20859== For counts of detected and suppressed errors, rerun with: -v 
==20859== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4) 
[[email protected] testbox]$ 


[[email protected] testbox]$ valgrind --tool=memcheck --leak-check=full ./t1 
==20899== Memcheck, a memory error detector 
==20899== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al. 
==20899== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info 
==20899== Command: ./t1 
==20899== 
==20899== Invalid free()/delete/delete[] 
==20899== at 0x4A05A31: free (vg_replace_malloc.c:325) 
==20899== by 0x4004FF: main (t1.c:8) 
==20899== Address 0x4c26040 is 0 bytes inside a block of size 100 free'd 
==20899== at 0x4A05A31: free (vg_replace_malloc.c:325) 
==20899== by 0x4004F6: main (t1.c:7) 
==20899== 
==20899== 
==20899== HEAP SUMMARY: 
==20899==  in use at exit: 0 bytes in 0 blocks 
==20899== total heap usage: 1 allocs, 2 frees, 100 bytes allocated 
==20899== 
==20899== All heap blocks were freed -- no leaks are possible 
==20899== 
==20899== For counts of detected and suppressed errors, rerun with: -v 
==20899== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4) 
[[email protected] testbox]$ 

一个可能的解决办法：

#include<stdio.h> 
#include<stdlib.h> 

int main() 
{ 
char *x = malloc(100); 
free(x); 
x=NULL; 
free(x); 
return 0; 
} 

[[email protected] testbox]$ vim t1.c 
[[email protected] testbox]$ cc -g t1.c -o t1 
[[email protected] testbox]$ ./t1 
[[email protected] testbox]$ 

[[email protected] testbox]$ valgrind --tool=memcheck --leak-check=full ./t1 
==20958== Memcheck, a memory error detector 
==20958== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al. 
==20958== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info 
==20958== Command: ./t1 
==20958== 
==20958== 
==20958== HEAP SUMMARY: 
==20958==  in use at exit: 0 bytes in 0 blocks 
==20958== total heap usage: 1 allocs, 1 frees, 100 bytes allocated 
==20958== 
==20958== All heap blocks were freed -- no leaks are possible 
==20958== 
==20958== For counts of detected and suppressed errors, rerun with: -v 
==20958== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 4 from 4) 
[[email protected] testbox]$ 

检查出使用Valgrind的Link

Answer 7

我知道这是一个非常古老的线程，但它是这个错误的顶级的谷歌搜索的博客，没有一个答复提到了这个错误的常见原因。

哪个关闭已关闭的文件。

如果你不注意并且有两个不同的函数关闭同一个文件，那么第二个会产生这个错误。

Answer 8

使用现代C++编译器，您可以使用消毒剂进行跟踪。

样品例如：

我的程序：

$cat d_free.cxx 
#include<iostream> 

using namespace std; 

int main() 

{ 
    int * i = new int(); 
    delete i; 
    //i = NULL; 
    delete i; 
} 

编译地址消毒剂：

# g++-7.1 d_free.cxx -Wall -Werror -fsanitize=address -g 

执行：

# ./a.out 
================================================================= 
==4836==ERROR: AddressSanitizer: attempting double-free on 0x602000000010 in thread T0: 
    #0 0x7f35b2d7b3c8 in operator delete(void*, unsigned long) /media/sf_shared/gcc-7.1.0/libsanitizer/asan/asan_new_delete.cc:140 
    #1 0x400b2c in main /media/sf_shared/jkr/cpp/d_free/d_free.cxx:11 
    #2 0x7f35b2050c04 in __libc_start_main (/lib64/libc.so.6+0x21c04) 
    #3 0x400a08 (/media/sf_shared/jkr/cpp/d_free/a.out+0x400a08) 

0x602000000010 is located 0 bytes inside of 4-byte region [0x602000000010,0x602000000014) 
freed by thread T0 here: 
    #0 0x7f35b2d7b3c8 in operator delete(void*, unsigned long) /media/sf_shared/gcc-7.1.0/libsanitizer/asan/asan_new_delete.cc:140 
    #1 0x400b1b in main /media/sf_shared/jkr/cpp/d_free/d_free.cxx:9 
    #2 0x7f35b2050c04 in __libc_start_main (/lib64/libc.so.6+0x21c04) 

previously allocated by thread T0 here: 
    #0 0x7f35b2d7a040 in operator new(unsigned long) /media/sf_shared/gcc-7.1.0/libsanitizer/asan/asan_new_delete.cc:80 
    #1 0x400ac9 in main /media/sf_shared/jkr/cpp/d_free/d_free.cxx:8 
    #2 0x7f35b2050c04 in __libc_start_main (/lib64/libc.so.6+0x21c04) 

SUMMARY: AddressSanitizer: double-free /media/sf_shared/gcc-7.1.0/libsanitizer/asan/asan_new_delete.cc:140 in operator delete(void*, unsigned long) 
==4836==ABORTING 

要了解更多有关你可以检查消毒剂this或this或任何现代的C++编译器（例如， gcc，clang等）文件。

Answer 9

任何解决方案me.So没有工作，我开始乱搞找到一种方法，这为我工作的： 错误是显示每次我：

MyClass b(5); 
MyClass a = b; 

我改变了代码：

MyClass b(5); 
MyClass a; 
a = b; 

它只是为我工作，希望它也适用于你。