不知何故内存损坏并且 malloc 不起作用（检测到未对齐的 tcache 块）

Question

不知何故，内存被损坏，任何 malloc 都会给我：

malloc(): unaligned tcache chunk detected

我多次尝试调试它，但它完全没有给我任何信息。

它首先发生在向量push_back上，当容量需要增加时，当我让向量在它发生在另一行之前保留足够的空间时。

这是相关的片段（至少我认为它发生在那里）：

void BVHGenerator::generate(Mesh *mesh) {
    triangles.clear();
    triangle_indices.clear();
    nodes.clear();
    std::vector<t_shader_triangle> shader_triangles = mesh->getShaderTriangles();
    for (int i = 0; i < mesh->triangleCount(); ++i) {
        triangles.push_back(shader_triangles[i]);
    }

    t_bvh root_node = {};

    root_node.triangle_count = triangles.size();
    root_node.triangle_offset = triangle_indices.size();

    for (int triangle_index = 0; triangle_index < triangles.size(); ++triangle_index) {
        triangle_indices.push_back(triangle_index);
    }

    makeBounds(&root_node, getTriangles(&root_node));
    nodes.push_back(root_node);

    std::vector<int> current_nodes = {0};

    for (int i = 0; i < depth; ++i) {
        std::vector<int> new_nodes;
        for (int node_index : current_nodes) {
            t_bvh *node = &nodes[node_index];
            if (node->triangle_count < 2) {
                continue;
            }
            auto [split_side, split_middle] = chooseSplit(node_index);
            std::vector<int> left_triangles;
            std::vector<int> right_triangles;
            left_triangles.reserve(node->triangle_count);
            right_triangles.reserve(node->triangle_count);
            for (int j = 0; j < node->triangle_count; ++j) {
                int triangle_index = triangle_indices[node->triangle_offset + j];
                auto [include_left, include_right] = distributeTriangle(triangles[triangle_index], split_side, split_middle);
                if (include_left) {
                    left_triangles.push_back(triangle_index);
                }
                if (include_right) {
                    right_triangles.push_back(triangle_index);
                }
            }

            t_bvh left_node = {};
            t_bvh right_node = {};

            left_node.triangle_offset = triangle_indices.size();
            for (int triangle_index : left_triangles) {
                triangle_indices.push_back(triangle_index);
            }
            left_node.triangle_count = left_triangles.size();

            right_node.triangle_offset = triangle_indices.size();
            for (int triangle_index : right_triangles) {
                triangle_indices.push_back(triangle_index);
            }
            right_node.triangle_count = right_triangles.size();

            makeBounds(&left_node, getTriangles(&left_node));
            makeBounds(&right_node, getTriangles(&right_node));

            node->left_index = nodes.size();
            new_nodes.push_back(nodes.size());
            nodes.push_back(left_node);
            node->right_index = nodes.size();
            new_nodes.push_back(nodes.size());
            nodes.push_back(right_node);

            node->has_children = true;
        }

        current_nodes = new_nodes; // gl_rays/src/mesh/bvh.cpp:87
    }
}

在这里，它在

current_nodes = new_nodes;

上崩溃了。如果我删除

left_triangles.reserve(node->triangle_count);
right_triangles.reserve(node->triangle_count);

当它尝试增加 right_triangles 向量的上限时，它会在

right_triangles.push_back(triangle_index);

上崩溃。

gdb 回溯：

malloc(): unaligned tcache chunk detected

Thread 1 "gl_rays" received signal SIGABRT, Aborted.
__pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
44            return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0;
(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1  0x00007ffff78a86d3 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:78
#2  0x00007ffff784fc4e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007ffff7837902 in __GI_abort () at abort.c:79
#4  0x00007ffff7838767 in __libc_message_impl (fmt=fmt@entry=0x7ffff79c2330 "%s\n") at ../sysdeps/posix/libc_fatal.c:132
#5  0x00007ffff78b27e5 in malloc_printerr (str=str@entry=0x7ffff79c59b8 "malloc(): unaligned tcache chunk detected") at malloc.c:5772
#6  0x00007ffff78b70e4 in tcache_get_n (tc_idx=<optimized out>, ep=<optimized out>) at malloc.c:3183
#7  tcache_get (tc_idx=<optimized out>) at malloc.c:3199
#8  __GI___libc_malloc (bytes=64) at malloc.c:3320
#9  0x00007ffff7ab83ec in operator new (sz=64) at ../../../../libstdc++-v3/libsupc++/new_op.cc:50
#10 0x000000000040e2c8 in std::__new_allocator<int>::allocate (this=0x7fffffffcfc0, __n=16) at /usr/include/c++/14/bits/new_allocator.h:151
#11 0x000000000040ce83 in std::allocator_traits<std::allocator<int> >::allocate (__a=..., __n=16) at /usr/include/c++/14/bits/alloc_traits.h:478
#12 std::_Vector_base<int, std::allocator<int> >::_M_allocate (this=0x7fffffffcfc0, __n=16) at /usr/include/c++/14/bits/stl_vector.h:380
#13 0x000000000040d032 in std::vector<int, std::allocator<int> >::_M_allocate_and_copy<__gnu_cxx::__normal_iterator<int const*, std::vector<int, std::allocator<int> > > > (this=0x7fffffffcfc0, __n=16, __first=15, __last=18831264)
    at /usr/include/c++/14/bits/stl_vector.h:1621
#14 0x000000000040bde8 in std::vector<int, std::allocator<int> >::operator= (this=0x7fffffffcfc0, __x=std::vector of length 16, capacity 16 = {...}) at /usr/include/c++/14/bits/vector.tcc:238
#15 0x000000000040a8fb in BVHGenerator::generate (this=0x9fb578, mesh=0x7fffffffd140) at /home/aino/Documents/dev/gl_rays/src/mesh/bvh.cpp:87
#16 0x0000000000408891 in Renderer::init (this=0x9fb4f0) at /home/aino/Documents/dev/gl_rays/src/application/renderer.cpp:73
#17 0x0000000000405ed5 in App::init (this=0x7fffffffd3e0) at /home/aino/Documents/dev/gl_rays/src/application/app.cpp:23
#18 0x0000000000409f49 in main (argc=1, argv=0x7fffffffd5b8) at /home/aino/Documents/dev/gl_rays/src/main.cpp:7

Answer 1

正如 john 和 Pepijn Kramer 指出的那样，获取指向向量元素的指针是不好的 (

t_bvh *node = &nodes[node_index];

)。通过仅用

nodes[node_index]

替换节点并使用它来修复它。谢谢。