why does not "g++ -Wall" give warning message when compiling the following code?When u run the code, you will get segmentation fault as "flag" is used after the memory released, however, the segmentation fault happens at the "delete [] darray" sentence, why is it so? I thought it should happen at "flag[i] = 8".

the compiler should be able to detect such mistake, why does not "g++ -Wall" give any warning message?
please reply.

#include <iostream>

using namespace std;

int main ()
{
bool * flag = new bool[8];
delete [] flag;
double * darray = new double[10];
for (int i = 0; i < 8; i ++)
flag[i] = true;
cout << "before releasing darray" << endl;
delete [] darray;
cout << "darray released" << endl;
return 0;
}

[icky (10-30 0:44, Long long ago)] [ 传统版 | sForum ][登录后回复]1楼

using linux/glibc? Segfault because you damaged the link listof freed memory chunks.

bype 0-8 of a freed memory chunk contains pointers to the previous/next freed chunks. in

for (int i = 0; i < 8; i ++)
flag[i] = true;

you destroyed the link list. When you try to free the next chunk (darray), free() tries to merge the two adjacent freed chunks. As the link list is corrupted, you see a segfault.

There are two ways to avoid segfault with you wrong program:
1.
#include <iostream>

using namespace std;

int main ()
{
bool * flag = new bool[16];
delete [] flag;
double * darray = new double[10];
for (int i = 0; i < 8; i ++)
flag[8+i] = true;
cout << "before releasing darray" << endl;
delete [] darray;
cout << "darray released" << endl;
return 0;
}

In this case, you didn't touch the first 8bytes, so you don't get a segfault.


2.

#include <iostream>

using namespace std;

int main ()
{
bool * flag = new bool[8];
delete [] flag;
double * darray = new double[1];
for (int i = 0; i < 8; i ++)
flag[i] = true;
cout << "before releasing darray" << endl;
delete [] darray;
cout << "darray released" << endl;
return 0;
}

In this case, size of darray chunk is too small, free() choose not to merger the two chunks. No segfault, for the moment.

tested on gcc4/glibc2.3

for more details, take a look at this article: http://www.phrack.org/show.php?p=57&a=9

[hash (10-30 6:28, Long long ago)] [ 传统版 | sForum ][登录后回复]2楼

(引用 hash:using linux/glibc? Segfault because you damaged the link listof freed memory chunks. bype 0-8 of a freed memory chunk contains ...)but afterbut after delete [] flag, when u try to access flag[i], it is wrong, the compiler should be aware of it[icky (10-30 10:20, Long long ago)] [ 传统版 | sForum ][登录后回复]3楼

delete array; not delete [] array;delete [] arr;

is equivalant to

delete arr[0]; delete arr[1]; ... delete arr[k];


------------------------------------------------

defination from msdn:
The delete operator destroys the object created with new by deallocating the memory associated with the object.
------------------------------------------------

however your array is array of primative type bool


now try this

Class Bool
{
public bool myBool;
};

Bool *flag2 = new Bool[8];
delete [] flat2;[simon (10-30 11:15, Long long ago)] [ 传统版 | sForum ][登录后回复]4楼

(引用 simon:delete array; not delete [] array;delete [] arr; is equivalant to delete arr[0]; delete arr[1]; ... delete arr[k]; -----...)different btw 'object' and 'primitive data type'[simon (10-30 11:16, Long long ago)] [ 传统版 | sForum ][登录后回复]5楼

(引用 hash:using linux/glibc? Segfault because you damaged the link listof freed memory chunks. bype 0-8 of a freed memory chunk contains ...)a mistake2nd case:
double * darray = new double[1];
should be:
double * darray = new double[2];

double[1] needs only 8 bytes, so first chunk (released when you delete flag) is reused.

change double[2] still does not generate segfault.

[hash (10-30 15:21, Long long ago)] [ 传统版 | sForum ][登录后回复]6楼

(引用 simon:delete array; not delete [] array;delete [] arr; is equivalant to delete arr[0]; delete arr[1]; ... delete arr[k]; -----...)do u mean"delete [] arr" deletes each cell
and
"delete arr" deletes the pointer itself

after "delete [] arr", the pointer "arr" still exists[icky (10-30 15:44, Long long ago)] [ 传统版 | sForum ][登录后回复]7楼

(引用 icky:but afterbut after delete [] flag, when u try to access flag[i], it is wrong, the compiler should be aware of it)The default libstdc++ operator new and delete use the libc malloc and free.since it boils down to function call, i guess g++ is not supposed to do such checking.[hash (10-30 15:48, Long long ago)] [ 传统版 | sForum ][登录后回复]8楼

(引用 icky:do u mean"delete [] arr" deletes each cell and "delete arr" deletes the pointer itself after "delete [] arr", the pointer "arr")no la...as simon said, object vs primitive data type[sarah (10-30 20:03, Long long ago)] [ 传统版 | sForum ][登录后回复]9楼

(引用 sarah:no la...as simon said, object vs primitive data type)。。。。。。ok...[simon (10-31 1:04, Long long ago)] [ 传统版 | sForum ][登录后回复]10楼