4

我一直在疯狂地追踪一个中型项目中的内存错误。我将一个最小化为以下代码，并验证这会导致 Valgrind 在注释行号处发出无效读取警告。我在项目中使用 g++ 4.8.2 (Debian 4.8.2-16)，使用 -std=c++11 -O0 编译。g++ 4.7.0 也会产生错误，4.4.6 在稍微修改的版本上也会产生错误（删除 C++11）。clang++ 不会导致错误，VS2013 也不会。

我的问题是：

  1. 我是否在不知不觉中参与了未定义的行为？

  2. 这是 Valgrind 的误报吗？如果是这样，我怎样才能让自己对未来的这种/情况感到放心？

这段代码相当脆弱——特别是，让 foo 通过引用获取坐标消除了这个问题，就像为 Coord 选择更大的类型以使其在内存中的大小大于 8 字节一样。

// Types are a little strange because I wanted the minimal failing
// case -- eg, row/col used to be ints.
#include <cassert>
#include <iostream>
#include <vector>

class Coord {
  public:
    bool row, col, layer;
};

void foo(Coord wtf) { }

std::vector<Coord> baz() {
  std::vector<Coord> bees;
  for (int i = 0; i < 4; ++i) {
    bees.push_back({1, 1, 1});
  }
  return bees;
}


int main(int argc, char** argv) {
  auto vec = baz();
  assert(vec.size() > 3);
  Coord bbb = vec[3];
  foo(bbb);
  static int i = 0;
  foo(vec.at(3)); // Causes Valgrind warning.

  Coord& ccc = vec[3];
  foo(ccc);      // causes Valgrind warning
}

Valgrind 输出：

==17700== Memcheck, a memory error detector
==17700== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==17700== Using Valgrind-3.9.0 and LibVEX; rerun with -h for copyright info
==17700== Command: ./a.out
==17700== 
==17700== Invalid read of size 8
==17700==    at 0x400BC9: main (in /home/alexr/projects/suncatcher/a.out)
==17700==  Address 0x59f80e9 is 9 bytes inside a block of size 12 alloc'd
==17700==    at 0x4C27A00: operator new(unsigned long) (vg_replace_malloc.c:319)
==17700==    by 0x40150A: __gnu_cxx::new_allocator<Coord>::allocate(unsigned long, void const*) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x4013A2: std::_Vector_base<Coord, std::allocator<Coord> >::_M_allocate(unsigned long) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x401061: void std::vector<Coord, std::allocator<Coord> >::_M_emplace_back_aux<Coord>(Coord&&) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400F02: void std::vector<Coord, std::allocator<Coord> >::emplace_back<Coord>(Coord&&) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400D25: std::vector<Coord, std::allocator<Coord> >::push_back(Coord&&) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400B17: baz() (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400B64: main (in /home/alexr/projects/suncatcher/a.out)
==17700== 
==17700== Invalid read of size 8
==17700==    at 0x400BEA: main (in /home/alexr/projects/suncatcher/a.out)
==17700==  Address 0x59f80e9 is 9 bytes inside a block of size 12 alloc'd
==17700==    at 0x4C27A00: operator new(unsigned long) (vg_replace_malloc.c:319)
==17700==    by 0x40150A: __gnu_cxx::new_allocator<Coord>::allocate(unsigned long, void const*) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x4013A2: std::_Vector_base<Coord, std::allocator<Coord> >::_M_allocate(unsigned long) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x401061: void std::vector<Coord, std::allocator<Coord> >::_M_emplace_back_aux<Coord>(Coord&&) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400F02: void std::vector<Coord, std::allocator<Coord> >::emplace_back<Coord>(Coord&&) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400D25: std::vector<Coord, std::allocator<Coord> >::push_back(Coord&&) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400B17: baz() (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400B64: main (in /home/alexr/projects/suncatcher/a.out)
==17700== 
==17700== 
==17700== HEAP SUMMARY:
==17700==     in use at exit: 0 bytes in 0 blocks
==17700==   total heap usage: 3 allocs, 3 frees, 21 bytes allocated
==17700== 
==17700== All heap blocks were freed -- no leaks are possible
==17700== 
==17700== For counts of detected and suppressed errors, rerun with: -v
==17700== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 2 from 2)
4

1 回答 1

1

这似乎是 gcc 关于加载“幽灵”数据以优化一些指令的假设，https://bugs.kde.org/show_bug.cgi?id=264936

我会添加一个宏，比如

#ifdef SOMETHING_SOMETHING
#define SUPRESS_VALGRIND_FALSE_POSITIVES __attribute__((__aligned__(8)))
#else
#define SUPRESS_VALGRIND_FALSE_POSITIVES
#endif

...
class Coord {
  public:
    bool row, col, layer;
} SUPRESS_VALGRIND_FALSE_POSITIVES ;

无论出于性能原因，实际上可能有利于强制对齐。

于 2014-05-06T07:16:01.557 回答