How to track down a double free or corruption error in C++ with gdb

Answer 1

You can use gdb, but I would first try Valgrind. See the quick start guide.

Answer 2

There are at least two possible situations:

1. you are deleting the same entity twice
2. you are deleting something that wasn't allocated

For the first one I strongly suggest NULL-ing all deleted pointers.

You have three options:

1. overload new and delete and track the allocations
2. yes, use gdb -- then you'll get a backtrace from your crash, and that'll probably be very helpful
3. as suggested -- use Valgrind -- it isn't easy to get into, but it will save you time thousandfold in the future...

Answer 3

Three basic rules:

1. Set pointer to NULL after free
2. Check for NULL before freeing.
3. Initialise pointer NULL in the start.

Combination of these three works quite well.

Answer 4

If you're using glibc, you can set the MALLOC_CHECK_ environment variable to 2, this will cause glibc to use an error tolerant version of malloc, which will cause your program to abort at the point where the double free is done.

You can set this from gdb by using the set environment MALLOC_CHECK_ 2 command before running your program; the program should abort, with the free() call visible in the backtrace.

see the man page for malloc() for more information

Answer 5

Are you using smart pointers such as Boost shared_ptr? If so, check if you are directly using the raw pointer anywhere by calling get(). I've found this to be quite a common problem.

For example, imagine a scenario where a raw pointer is passed (maybe as a callback handler, say) to your code. You might decide to assign this to a smart pointer in order to cope with reference counting etc. Big mistake: your code doesn't own this pointer unless you take a deep copy. When your code is done with the smart pointer it will destroy it and attempt to destroy the memory it points to since it thinks that no-one else needs it, but the calling code will then try to delete it and you'll get a double free problem.

Of course, that might not be your problem here. At it's simplest here's an example which shows how it can happen. The first delete is fine but the compiler senses that it's already deleted that memory and causes a problem. That's why assigning 0 to a pointer immediately after deletion is a good idea.

int main(int argc, char* argv[])
{
    char* ptr = new char[20];

    delete ptr;
    ptr = 0;  // Comment me out and watch me crash and burn.
    delete ptr;
}