std::map::iterator crashes program on increment

Question

What could cause this?

Here's the stack trace:

#0  0x0645c0f5 in std::_Rb_tree_increment (__x=0x83ee5b0)
    at ../../../../libstdc++-v3/src/tree.cc:69
#1  0x0805409a in std::_Rb_tree_iterator<std::pair<std::string const, Widget*> >::operator++ (
    this=0xbffff144)
    at /usr/lib/gcc/i586-redhat-linux/4.4.1/../../../../include/c++/4.4.1/bits/stl_tree.h:192
#2  0x08053d32 in Generic::StartLayout (this=0x8287d68) at Generic.cpp:195
#3  0x0804f6e1 in LCDControl::ConfigSetup (this=0xbffff26c) at LCDControl.cpp:91
#4  0x0804ed7c in LCDControl::Start (this=0xbffff26c, argc=1, argv=0xbffff404) at LCDControl.cpp:21
#5  0x08050964 in main (argc=1, argv=0xbffff404) at Main.cpp:11

And here's the code:

    for(std::map<std::string,Widget *>::iterator w = widgets_.begin();
        w != widgets_.end(); w++){
        if( w->second->GetType() & WIDGET_TYPE_BAR) {
            w->second->SetupChars();
        }
        w->second->Start();

    }

Edit: This next problem is related, so I won't open a whole new question. I'll leave the answer acceptance like it is. I just need to know something. I have two iterators, one main and one within that main after a function call. They both relate to the same map. Well, the one inside gets all corrupted, and the main one's loop stops iterating.

Here's the code.

Here's StartLayout:

void Generic::StartLayout() {
    Error("StartLayout: %s", key.c_str());
    for(std::map<std::string,Widget *>::iterator w = widgets_.begin();
        w != widgets_.end(); w++){
        Error("Starting widget %s", w->first.c_str());
        if( w->second->GetType() & WIDGET_TYPE_SPECIAL) {
            w->second->SetupChars();
        }

        w->second->Start();
    }
}

And here's SetupChars():

void WidgetGif::SetupChars() {
    Error("SetupChars <%s> <%s>", name_.c_str(), widget_base_.c_str());
    Error("Size of widgets: %d", visitor_->Widgets().size());
    std::map<std::string, Widget *> widgets = visitor_->Widgets();
    for(std::map<std::string, Widget *>::iterator ii=visitor_->Widgets().begin();
        ii != visitor_->Widgets().end(); ii++) {
        Error("<%s> Widget base %s == %s", ii->first.c_str(), ii->second->GetWidgetBase().c_str(), widget_base_.c_str());
        if(ii->second->GetWidgetBase() == widget_base_ &&
            ((WidgetGif *)ii->second)->HasChars()) {
            Error("Using chars from %s", ii->first.c_str());
            for(unsigned int i = 0; i < rows_ * cols_; i++ ) {
                if(i >= visitor_->GetLCDText()->CHARS) {
                    Error("1) GIF too large: %s, %d", name_.c_str(), visitor_->GetLCDText()->CHARS);
                    if(update_) delete update_;
                    update_ = new Property(visitor_, section_, "", new Json::Value("-1"));
                    return;
                }
                    ch_[i] = ((WidgetGif *)widgets[ii->first])->GetChars()[i];
            }
            hasChars_ = true;
            return;
        }
    }
// It goes on, but I snipped it here.
}

And this is what happens:

StartLayout: display_qt
Starting widget widget_gif_american_flag:layout_american_flag:0
SetupChars <widget_gif_american_flag:layout_american_flag:0> <layout_american_flag>
Size of widgets: 5
<widget_gif_american_flag:layout_american_flag:1> Widget base layout_american_flag == layout_american_flag
<widget_gif_american_flag:layout_american_flag:4> Widget base layout_american_flag == layout_american_flag
<(n
(n
��S> Widget base ГS == layout_american_flag
^C

Last edit: I figured it out. I just needed a copy of the original map for the new iterator.

Answer 1

There could be quite a few reasons for that. For one, it may be that GetType or SetupChars or Start do something that causes your map to change - which would invalidate the current iterator (note that using operator[] on the map, even just to read the value, is technically a mutating operation, and can cause a crash with iterator debugging enabled!). Alternatively, your map could be corrupted in memory by some code that executed before, e.g. because of a buffer overrun overwriting part of the map's tree.

Answer 2

You must not modify widgets_ in any of your methods GetType, SetupChars, or Start. This is most likely your problem.

If you must modify widgets_, then you will need to restart the iterator whenever such a change is made. To avoid duplicating your changes, you can use a simple marker dictionary outside the loop, or a marker member of the Widget class.