如何确定此分段故障发生的位置和原因？

Question

I'm having trouble figuring out the problem with my code...I'm in the early stages of prototyping a game (my first serious project). It frequently, but not always, crashes with a segmentation fault. Here's the flow of the program...

• title screen - press z to start new game
• player and enemy on screen...enemy takes a life when collided with, there are 4 lives.
• when character's life is 0, game goes back to title screen - press z to start new game

The last step is where the crash occurs...The crash only seems to happen after the player dies and is brought back to the title screen and the player presses z to start another game, but it doesn't always crash. Through gdb, I've determined that it happens when the deconstructor for Title is called...

Here's the debug info and relevant code...I'll provide any other code/info if requested.

*** glibc detected *** /home/rzrscm/code/demogamething/game: free(): invalid pointer: 0x080c6b98 ***

//memory map info omitted

0xb7c54537 in raise () from /lib/libc.so.6
(gdb) where
#0  0xb7c54537 in raise () from /lib/libc.so.6
#1  0xb7c57922 in abort () from /lib/libc.so.6
#2  0xb7c8afbd in ?? () from /lib/libc.so.6
#3  0xb7c950ca in ?? () from /lib/libc.so.6
#4  0xb7c96918 in ?? () from /lib/libc.so.6
#5  0xb7c99a5d in free () from /lib/libc.so.6
#6  0xb7f4e776 in SDL_FreeSurface () from /usr/lib/libSDL-1.2.so.0
#7  0x0804ac7f in ~Title (this=0x80b4250, __in_chrg=<value optimized out>) at title.cpp:13
#8  0x08049d3a in GameState::load (this=0x804e368, loadState=LEVEL) at gamestate.cpp:39
#9  0x08049c5c in GameState::change (this=0x804e368, changeTo=LEVEL) at gamestate.cpp:26
#10 0x08049753 in Player::handleEvent (this=0x804e300) at player.cpp:102
#11 0x080490c8 in main () at main.cpp:27

So, what I know is that the crash occurs when it's changing states from TITLE to LEVEL...Here's the class function that unloads and loads the states...currentState is a private vector in the GameState class...

std::vector<GameState *> currentState;

void GameState::load(STATE loadState) {
    if(state == TITLE) {
        while(!currentState.empty()) {
            delete currentState.back();
            currentState.pop_back();
        }
        currentState.push_back(new Title()); 
    }
    else if(state == LEVEL) {
        while(!currentState.empty()) {
            delete currentState.back();
            currentState.pop_back();
        }
        currentState.push_back(new Level(currentLevel));
   }
}

The crash happens when the deconstructor for the Title class is called...It happens whether it's freeing the music or the image...Whichever one is the first function is the one it crashes on.

Title::~Title() {
    SDL_FreeSurface(background);
    Mix_FreeMusic(music);
    background = NULL;
    music = NULL;
}

Here's the code for the image loading function...

SDL_Surface *loadImage(std::string imageFile) { 
    SDL_Surface *loadedImage;
    SDL_Surface *newImage; 

    loadedImage = IMG_Load(imageFile.c_str()); 
    newImage = SDL_DisplayFormatAlpha(loadedImage); 

    SDL_FreeSurface(loadedImage); 

    return newImage; 

}

[edit] I ran it through the debugger a couple more times without making changes to the code since I still can't find what's wrong...And each time the crash occurred while trying to free the music...

0xb7c54537 in raise () from /lib/libc.so.6
(gdb) backtrace
#0  0xb7c54537 in raise () from /lib/libc.so.6
#1  0xb7c57922 in abort () from /lib/libc.so.6
#2  0xb7c8afbd in ?? () from /lib/libc.so.6
#3  0xb7c950ca in ?? () from /lib/libc.so.6
#4  0xb7c9633e in ?? () from /lib/libc.so.6
#5  0xb79974e2 in ?? () from /usr/lib/libmikmod.so.2
#6  0xb7997640 in Player_Free () from /usr/lib/libmikmod.so.2
#7  0xb7ebb6e3 in Mix_FreeMusic () from /usr/lib/libSDL_mixer-1.2.so.0
#8  0x0804ac8d in ~Title (this=0x80c6bc0, __in_chrg=<value optimized out>) at title.cpp:14
#9  0x08049d3a in GameState::load (this=0x804e368, loadState=LEVEL) at gamestate.cpp:39
#10 0x08049c5c in GameState::change (this=0x804e368, changeTo=LEVEL) at gamestate.cpp:26
#11 0x08049753 in Player::handleEvent (this=0x804e300) at player.cpp:102
#12 0x080490c8 in main () at main.cpp:27

Answer 1

#5  0xb7c99a5d in free () from /lib/libc.so.6
#6  0xb7f4e776 in SDL_FreeSurface () from /usr/lib/libSDL-1.2.so.

You are probably freeing a pointer which is invalid. Now I read

free(): invalid pointer: 0x080c6b98 

You might be trying to free an object which was not allocated dynamically. How does background get his value?