Desctuction of object is causing the crash of the program

Question

Here is a snippet of a considerably big C++ program:

map<int, int>::iterator class_it = docsCountPerClass.begin();
for( ;class_it !=  docsCountPerClass.end(); class_it++) {
    cout << "classid: " << class_it->first << '\n';
    vector<term_importance> ti;
    ti.reserve(termids.size());
    vector<int>::iterator term_it = termids.begin();
    for( ;(term_it != termids.end()); term_it++) {
        term_importance tmp;
        tmp.termid = *term_it;
        tmp.importnaceMeasure = chiSquareTest(*term_it, class_it->first);
        ti.push_back(tmp);
    }
    if(ti.size() != 0)
        std::sort(ti.begin(), ti.end());
    for(int i = 0; i < ti.size(); i++)
        cout << (ti.at(i)).termid << " -- " << (ti.at(i)).importnaceMeasure << '\n';
    int ti_size_tmp = ti.size();
    for(int i = 0; i < std::min(maxFeaturesPerClass, int(ti.size()) ); i++) {
        cout << "* index access: " << ti_size_tmp - 1 - i << '\n';
        usefulTerms[class_it->first].push_back( (ti.at(ti_size_tmp - 1 - i)).termid );
    }

The problem I am facing when the loop completes its cycle and returns the vector ti should destruct. It does but while cleaning up the objects inside it it crashes, and it reports that its trying to call free() on invalid pointer.. I am unable to reproduce the problem using simpler code. Here is the backtrace using gdb:

#0  0x0012d422 in __kernel_vsyscall ()
#1  0x00341651 in *__GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0x00344a82 in *__GI_abort () at abort.c:92
#3  0x0037849d in __libc_message (do_abort=2, fmt=0x44cf98 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#4  0x00382591 in malloc_printerr (action=<value optimized out>, str=0x6 <Address 0x6 out of bounds>, ptr=0x81dc5e0) at malloc.c:6264
#5  0x00383de8 in _int_free (av=<value optimized out>, p=<value optimized out>) at malloc.c:4792
#6  0x00386ecd in *__GI___libc_free (mem=0x81dc5e0) at malloc.c:3738
#7  0x00297741 in operator delete(void*) () from /usr/lib/libstdc++.so.6
#8  0x08054377 in __gnu_cxx::new_allocator<NaiveBayesClassifier::term_importance>::deallocate (this=0xbffff194, __p=0x81dc5e0)
    at /usr/include/c++/4.4/ext/new_allocator.h:95
#9  0x080522db in std::_Vector_base<NaiveBayesClassifier::term_importance, std::allocator<NaiveBayesClassifier::term_importance> >::_M_deallocate (this=0xbffff194, 
    __p=0x81dc5e0, __n=4433) at /usr/include/c++/4.4/bits/stl_vector.h:146
#10 0x0805219e in ~_Vector_base (this=0xbffff194, __in_chrg=<value optimized out>) at /usr/include/c++/4.4/bits/stl_vector.h:132
#11 0x08050139 in ~vector (this=0xbffff194, __in_chrg=<value optimized out>) at /usr/include/c++/4.4/bits/stl_vector.h:313
#12 0x0804d32d in NaiveBayesClassifier::buildModel (this=0xbffff28c, maxFeaturesPerClass=100) at NaiveBayesClassifier.cpp:106
#13 0x0805c357 in main (argc=2, argv=0xbffff3d4) at nbClassifyMain.cpp:15

Edit 1: NaiveBayesClassifier.cpp : http://paste.bradleygill.com/index.php?paste_id=49445 NaiveBayesClassifier.h : http://paste.bradleygill.com/index.php?paste_id=49446

Edit 2: I commented out std::sort(ti.begin(), ti.end()); and found the error is gone. Now I am confused how std::sort() works.

Answer 1

Line 9 of that stack trace leads me to believe that the vector mentioned is doing a double delete. I would look into the classes you are putting into that vector and make sure they follow the rule of three, or at least set pointers to null after you delete them.

Answer 2

Run your program under valgrind, it should help you diagnose what is wrong.