segmentation fault at destruction of stl vector

[mblome]

Hi everybody!
I came across a very strange problem with stl vectors during
developement of a mesh creation program. As the program is quite large
I can only post small parts of it. Basically I have a
std::vector<SPoly> xtop;
where SPoly simply is:

struct SPoly
{
int start, end;
int bmarker;
};

In my function (code reduced):

void MeshModel::createDomain()
{
std::vector<SPoly> xtop;
std::vector<NPoint> trinodes;
// lots of code, left out
// filling of xtop via repeated calls to xtop.push_back()
sortlist(xtop,trinodes);
// some other code, no changes to xtop
}

where sortlist is defined as:
void MeshModel::sortlist(std::vector<SPoly> &polies,
std::vector<NPoint> nodes)
{
// simple selection sort
int n=polies.size(); int m=nodes.size();
for(int i=0; i<n; i++)
{
int imin = i;
for(int j=i; j<n; j++)
{
assert(polies[imin].start < m); assert(polies[j].start < m);
if (nodes[polies[imin].start].point.y <
nodes[polies[j].start].point.y)
imin = j;
}
SPoly temp=polies;
polies=polies[imin];
polies[imin]=temp;
}
}

at the last line of createDomain() I get a segmentation fault. Here the
backtrace from gdb:
----------------------------------------------------------------------
#0 0x40181057 in _int_free () from /lib/tls/libc.so.6
#1 0x40180048 in free () from /lib/tls/libc.so.6
#2 0x400bb233 in operator delete () from /usr/lib/libstdc++.so.5
#3 0x400a8dac in std::__default_alloc_template<true, 0>::deallocate ()
from /usr/lib/libstdc++.so.5
#4 0x0804aa8d in std::__simple_alloc<SPoly,
std::__default_alloc_template<true, 0> >::deallocate (
__p=0x80982d8, __n=32) at
/usr/include/c++/3.2.3/bits/stl_alloc.h:248
#5 0x0804aa08 in std::_Vector_alloc_base<SPoly, std::allocator<SPoly>,
true>::_M_deallocate (
this=0xfff93ca0, __p=0x80982d8, __n=32) at
/usr/include/c++/3.2.3/bits/stl_vector.h:123
#6 0x0804a990 in ~_Vector_base (this=0xfff93ca0) at
/usr/include/c++/3.2.3/bits/stl_vector.h:143
#7 0x0804a90a in ~vector (this=0xfff93ca0) at
/usr/include/c++/3.2.3/bits/stl_vector.h:375
#8 0x08055054 in MeshModel::createDomain (this=0x8081008) at
tetmesh.cpp:1021
#9 0x08049ff9 in main () at dcfemeshseries.cpp:66
----------------------------------------------------------------------
Why does the destrucion of the variable xtop fail ? I also changed the
struct into a class with appropriately defined assignment operator,
copy constructor and destructor (why should this be necessary?) - still
the same segm. fault!
I am lost here! Any help on this would be great!
Mark

 

[titancipher]

A couple of things you can do:

1. check that you are not getting an STL exception using a try catch
around the code. You check that you are accessing 'nodes' within
limits, but not 'polies'. If 'nodes' is larger than 'polies' it is
possible for 'imin' to go out of bounds.

2. Pass 'nodes' by reference (const reference if possible):

void MeshModel::sortlist(
std::vector<SPoly> &polies,
std::vector<NPoint> & nodes)

You do not modify 'nodes', and I believe the copy is undesirable. If
it is memory corruption outside the code above, then fixing this may
help you locate the cause of the corruption.

 

[Peter Koch Larsen]

Hi everybody!
I came across a very strange problem with stl vectors during
developement of a mesh creation program. As the program is quite large
I can only post small parts of it. Basically I have a
std::vector<SPoly> xtop;
where SPoly simply is:

struct SPoly
{
int start, end;
int bmarker;
};

In my function (code reduced):

void MeshModel::createDomain()
{
std::vector<SPoly> xtop;
std::vector<NPoint> trinodes;
// lots of code, left out
// filling of xtop via repeated calls to xtop.push_back()
sortlist(xtop,trinodes);
// some other code, no changes to xtop
}

where sortlist is defined as:
void MeshModel::sortlist(std::vector<SPoly> &polies,
std::vector<NPoint> nodes)
{
// simple selection sort

Why not use the built-in sort?

int n=polies.size(); int m=nodes.size();
for(int i=0; i<n; i++)
{
int imin = i;
for(int j=i; j<n; j++)
{
assert(polies[imin].start < m); assert(polies[j].start < m);
if (nodes[polies[imin].start].point.y <
nodes[polies[j].start].point.y)
imin = j;
}
SPoly temp=polies;
polies=polies[imin];
polies[imin]=temp;
}
}

at the last line of createDomain() I get a segmentation fault. Here the
backtrace from gdb:
----------------------------------------------------------------------
#0 0x40181057 in _int_free () from /lib/tls/libc.so.6
#1 0x40180048 in free () from /lib/tls/libc.so.6
#2 0x400bb233 in operator delete () from /usr/lib/libstdc++.so.5
#3 0x400a8dac in std::__default_alloc_template<true, 0>::deallocate ()
from /usr/lib/libstdc++.so.5
#4 0x0804aa8d in std::__simple_alloc<SPoly,
std::__default_alloc_template<true, 0> >::deallocate (
__p=0x80982d8, __n=32) at
/usr/include/c++/3.2.3/bits/stl_alloc.h:248
#5 0x0804aa08 in std::_Vector_alloc_base<SPoly, std::allocator<SPoly>,
true>::_M_deallocate (
this=0xfff93ca0, __p=0x80982d8, __n=32) at
/usr/include/c++/3.2.3/bits/stl_vector.h:123
#6 0x0804a990 in ~_Vector_base (this=0xfff93ca0) at
/usr/include/c++/3.2.3/bits/stl_vector.h:143
#7 0x0804a90a in ~vector (this=0xfff93ca0) at
/usr/include/c++/3.2.3/bits/stl_vector.h:375
#8 0x08055054 in MeshModel::createDomain (this=0x8081008) at
tetmesh.cpp:1021
#9 0x08049ff9 in main () at dcfemeshseries.cpp:66
----------------------------------------------------------------------
Why does the destrucion of the variable xtop fail ? I also changed the
struct into a class with appropriately defined assignment operator,
copy constructor and destructor (why should this be necessary?) - still
the same segm. fault!
I am lost here! Any help on this would be great!

This could very well be a fault introduced elsewhere. The heap seems to be
corrupted and this can happen in any number of situations - e.g. by using an
object you have deleted, by deleting an object twice or by writing past the
end of an array.

/Peter

 

[Old Wolf]

Hi everybody!
I came across a very strange problem with stl vectors during
developement of a mesh creation program. As the program is quite
large I can only post small parts of it. Basically I have a
std::vector<SPoly> xtop;
where SPoly simply is:

struct SPoly
{
int start, end;
int bmarker;
};

The problem isn't in the code you've shown. You will have to
try harder to make a code sample that does demonstrate the
problem. In fact, if you try and do this on your own machine
you will probably come across the problem anyway.

void MeshModel::createDomain()
{
std::vector<SPoly> xtop;
std::vector<NPoint> trinodes;

What is the definition of NPoint? It would be the culprit if
its copy constructor / assignment operator / destructor were
incorrect.

sortlist(xtop,trinodes);
}

void MeshModel::sortlist(std::vector<SPoly> &polies,
std::vector<NPoint> nodes)

Pass 'nodes' by const reference to avoid unnecessary copying.

{
// simple selection sort
int n=polies.size(); int m=nodes.size();
for(int i=0; i<n; i++)
{
int imin = i;
for(int j=i; j<n; j++)
{
assert(polies[imin].start < m);
assert(polies[j].start < m);
if (nodes[polies[imin].start].point.y <
nodes[polies[j].start].point.y)
imin = j;
}

What happens when your assert fails? Maybe that is what is
causing the crash? How about if polies[imon].start is negative?

SPoly temp=polies;
polies=polies[imin];
polies[imin]=temp;

You could do this more easily:
std::swap(polies, polies[imon]);

}
}

Why does the destrucion of the variable xtop fail ? I also changed
the struct into a class with appropriately defined assignment
operator, copy constructor and destructor (why should this be
necessary?)

You need those functions if a class contains handles to
resources that need to be freed or released. In your posted
code, SPoly does not need those functions.