why my struct crash when it contains string?

Question

I met a problem which i think it's very meaningful to know std::string.

I design a queue(lockfree queue) by c, code is: kfifo.c

#include <assert.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#define min(X,Y) ((X) < (Y) ? (X) : (Y))

struct kfifo{
    char* buffer;  // data address pointer
    unsigned int index[96];
};

static unsigned long roundup_pow_of_2(unsigned long n) {  // calculate the nearest pow(2) value of n
// so the % operation can be replaced by bit operation &, which is faster
  unsigned long rval = 1;
  while (rval < n) rval <<= 1;
  return rval;
}

static bool is_power_of_2(unsigned long n) {
  return (n != 0 && ((n & (n - 1)) == 0));
}

static void kfifo_init(struct kfifo* fifo,  char* buffer, unsigned int size, size_t elemSize) {
  // init struct
  assert(is_power_of_2(size));
  memset(fifo->index, 0, sizeof(fifo->index));
  fifo->buffer = buffer;
  fifo->index[51] = elemSize;
  fifo->index[34] = size < 2 ? 0: size;
}

int kfifo_alloc(struct kfifo* fifo, unsigned int size, size_t elemSize) {
  /* 
  * round up to the next power of 2, since our 'let the indices 
  * wrap' tachnique works only in this case. 
  */
  if (!is_power_of_2(size)) {
    size = roundup_pow_of_2(size);
  }

  // allocate memory
  char* buffer = (char*)malloc(size * elemSize);
  if (!buffer)
    return 0;

  // init struct
  kfifo_init(fifo, buffer, size, elemSize);
  return 1;
}

void kfifo_free(struct kfifo *fifo) {  // free resource
  free(fifo->buffer);
  fifo->index[17] = fifo->index[0] = fifo->index[34] = fifo->index[51] = 0;
  // fifo->buffer = NULL;
}

static inline unsigned int kfifo_avail_int(struct kfifo *fifo) {  // left space of fifo
    return fifo->index[34] - (fifo->index[17] - fifo->index[0]);
}

static inline unsigned int kfifo_in_data(struct kfifo *fifo, char *from) {
  unsigned int off_int = (fifo->index[17] & (fifo->index[34] - 1));  // next_in place, int
  unsigned int l = min(1, (fifo->index[34] - off_int));
  memcpy(fifo->buffer + off_int * fifo->index[51], from, l*fifo->index[51]);
  memcpy(fifo->buffer, from + l*fifo->index[51], (1 - l) * fifo->index[51]);
  if (fifo->buffer + off_int*fifo->index[51] == NULL) {  // if execute this in an unexpected order
    return 0;
  }
  return 1;
}

unsigned int kfifo_push(struct kfifo* fifo, char* buffer) {
  int len = min(kfifo_avail_int(fifo), 1);
  if (!kfifo_in_data(fifo, buffer)) {
    return 0;
  }
  fifo->index[17] += len;
  return len;
}

static inline unsigned int kfifo_out_data(struct kfifo *fifo, char *to) {
  unsigned int off = (fifo->index[0] & (fifo->index[34]-1));
  unsigned int l = min(1, (fifo->index[34] - off));
  memcpy(to, fifo->buffer + off * fifo->index[51], l*fifo->index[51]);
  memcpy(to + l*fifo->index[51], fifo->buffer, (1 - l)*fifo->index[51]);
  // char* p = fifo->buffer + off * fifo->index[51];
  // p = NULL;  // reset the out position as NULL
  return 1;
}

unsigned int kfifo_get(struct kfifo* fifo, char* buffer){
  int len = min(fifo->index[17] - fifo->index[0], 1);
  if (!kfifo_out_data(fifo, buffer)) {
    return 0;
  }
  fifo->index[0] += len;
  return len;
}

and in order to use it in c++, i have a wrapper: fifo_queue.h

#include "kfifo_ing.c"

template <typename T>
class FIFO_Queue {
 public:
  FIFO_Queue(int size) {
    kfifo_alloc(&k, size, sizeof(T));
  }
  ~FIFO_Queue() {
    // kfifo_free(&k);
  }
  bool push(const T& t) {
    return kfifo_push(&k, (char*)(&t));
  }

  bool pop(T& t) {
    return kfifo_get(&k, (char*)(&t));
  }
 private:
  kfifo k;
};

i have tested this queue, i think it is correct when the element is int of simple struct.

but the strange things happen when the struct has std::string object, here is my test code:

#include "fifo_queue.h"
#include <string>
using namespace std;

struct huang {
  int a;
  string b;  // if dont have b, everything is good, but once add it, crashed!!!!!!!!
  double c;
  void Show(FILE* stream) const {
    fprintf(stream, "%d %lf\n", a, c); 
  }
};

FIFO_Queue<huang>q(80);

int main() {
  huang h;
  h.a = 1;
  q.push(h);
  q.pop(h);
  q.pop(h); // if no this, wont crash!!!!
  return 0;
}

the code crashed, when i use gdb to check the stack,it warns me the error happens in ~basic_string(), I am confused, i know string is a complex design datastructure, which have two pointer. But can anyone explain this? Is it caused by double free? Is there any methods can make it works?

Answer 1

int main()
{
    huang h;
    h.a = 1;
    q.push(h);
    q.pop(h);
    q.pop(h); // if no this, wont crash!!!!
    return 0;
}

In your code, you pushed only 1 huang onto your q . But you pop twice. I suspect that what you're putting into h in the second pop does not have a properly constructed string b in huang . When you leave scope for h , string b gets destructed and likely accessing memory that doesn't belong to your process and crashes as a result.