malloc崩溃了嵌入式系统

Question

I am trying to multiply matrices of arbitrary sizes on a cortex M4-core. I DO need a malloc... But I don't understand why at the first call it works and at the second call it doesnt work any more. it just jumps to the default interrupt handler FaultISR.

hereby the dissasembly code:

It fails when executing the BL command

function calls:

multiplyMatrices( &transFRotMatrix[0][0],3, 3, &sunMeasurements[0][0], 3, 1, *orbitalSunVector); //Works fine

multiplyMatrices( &firstRotMatrix[0][0],3, 3, &orbitalTMFV[0][0], 3, 1, *inertialTMFV); //doesn t work fine

code:

void multiplyMatrices(float *transposedMatrix, int height1, int width1, float *iSunVector,int height2, int width2, float *orbitalSunVector)
{

    int y=0;
    int x = 0;
    int row=0;
    int column =0;
    int k=0;
    int k2=0;
    float result = 0;
    float *output2=NULL;

    int i=0;
    int j=0;

    i=0;
    k=0;
    k2 = 0;


    if(width1 != height2)
    {
        //printf("unmatching matrices, error.\n\n");
        return;
    }

    output2 = malloc(height1 * width2 * sizeof(float)); //<---- jumps o FaultISR


    while(k<width1) //aantal rijen 1ste matrix
    {
        for(j=0;j<height2;j++) //aantal rijen 2de matrix
        {
            result += (*((transposedMatrix+k*width1)+j)) * (*((iSunVector+j*width2)+k2));  //1ste var:aantal kolommen 2de matrix  --2de variabele na de plus = aantal kolommen 2de matrix
            //printf("%f * %f\t + ", (*((transposedMatrix+k*width1)+j)), (*((iSunVector+j*width2)+k2)));
        }

         output2[row* width1 + column] = result;

        k2++;
        x++;
        column++;

        if(x==width2) //aantal kolommen 2de Matrix
        {
            k2=0;
            x=0;
            column=0;
            row++;
            y++;
            k++;
        }
        result = 0;

    }

    //tussenresultaat
    for(i=0;i<height1;i++)
    {
        for(j=0;j<width2;j++)
        {
             orbitalSunVector[j * height1 + i] = output2[i* width1 + j]; //output2[i][j];

        }
    }

    free(output2);
}

Answer 1

You are overflowing your output2 matrix in both loops due to an incorrect index calculation. You have:

output2[row*width1 + column] = result;
...
orbitalSunVector[j*height1 + i] = output2[i*width1 + j];

but you should be using width2 in both cases since the final matrix is width2 * height1 in size (as it is allocated):

output2[row*width2 + column] = result;
...
orbitalSunVector[j*height1 + i] = output2[i*width2 + j];

I didn't check any of your other indexes but I would test the function with a few known cases to make sure it outputs the correct results. If you had done more debugging and checked the array indexes it should have been easy to spot.

Note that the reason it worked for you the first time but not the second time is due to undefined behaviour (UB). As soon as you write past the end of output2 you invoke UB and anything can happen. For you it happened to show up as a fault on the second call. For me it happened to fault on the first call. If you're really unlucky it may not ever fault and just silently corrupt data.

Answer 2

Do you use printf in other places of your code?

This page recommends starting at 0x400 for heap size, which is 1024 decimal:

It is recommended to start with a reasonable heap size like 0x400 when there is limited dynamic allocation (like printf() calls in the code), and increase it as needed depending on the application.

You have 512 today, you could at least try to double that if possible, as per TI's recommendation, and see where this leads you.

This is a related question. If you do not have a tool to watch heap allocation on the fly, try to manually fill the heap at startup ( memcpy it with known values, such as ASCII '#==#', 0xDEADBEEF, or whatever recognizable value), then run to just before you usually crash, and watch the content of the heap in the Memory window. My best guess is that you'll find the heap is full.

Please also look if you can see error flag registers while you are in the FaultISR. Often there is something somewhere telling you why you came here.

I am not sure about TI's implementation of malloc , but they may save an error value. I'd not bet on that one, since it would probably return NULL in that case, rather than crash.