Question

I have a class Foo, which has a (simple) destructor.

Some other class contains an array of Foo objects (called foolist), in the destructor of that class, I do:

delete[] foolist;

This crashes (gdb shows that it crashes in this exact line). However, by using printouts I see that all the elements in foolist are finishing their destructor without problems (the number of destructors that runned is also equal to the number of objects allocated in this array, so they all get destructed). There is also no other delete for foolist in the code.

I also made sure that foolist is indeed initialized as an array, in this way:

foolist = new Foo[number];

The error is:

*** glibc detected *** /home/bas/projects/trunk/main:
free(): invalid next size (fast): 0x080a0e80 ***

What could cause delete[] to crash in this case?

Thanks in advance!

As asked also the output of valgind here (statementNode is Foo, and programNode the class containing list of Foo’s)

==4111== 1 errors in context 1 of 2:
==4111== Invalid write of size 4
==4111==    at 0x804B6FA: Parser::parseProgram(std::string) (statementnode.h:35)
==4111==    by 0x80764D4: main (parser.h:35)
==4111==  Address 0x42d9bdc is 4 bytes after a block of size 32 alloc'd
==4111==    at 0x4025F53: operator new[](unsigned int) (vg_replace_malloc.c:299)
==4111==    by 0x804A81E: Parser::parseProgram(std::string) (programnode.h:21)
==4111==    by 0x80764D4: main (parser.h:35)

StatementNode:35 is the creation of a completly different object. ProgramNode:21 is the creation of foolist / list of StatementNodes.. Hope this helps.

Answer 1

The delete operator performs 2 functions under the hood

1. Run Destructors
2. Free Memory

Given the printout confirms #1 is happening the most likely cause is a crash during the actual freeing of memory (the message indicates this as well). This typically indicates that the memory is being corrupted by another part of your program.

Have you tried running your program under valgrind?