技术解码 | 内存问题的分析与定位

 void test() {      try {          int *p = new int[1ULL << 50U];          std::cout << p << '\n';          delete[] p;      } catch (const std::bad_alloc &e) {          std::cout << e.what() << '\n';      }
      int *p = new(std::nothrow) int[1ULL << 50U];      if (p == nullptr) {          std::cout << "Allocation returned nullptr\n";      }      delete[] p;  }

  void    g_system_thread_set_name (const gchar *name)    {    #if defined(HAVE_PTHREAD_SETNAME_NP_WITHOUT_TID)      pthread_setname_np (name); /* on OS X and iOS */    #elif defined(HAVE_PTHREAD_SETNAME_NP_WITH_TID)      pthread_setname_np (pthread_self (), name); /* on Linux and Solaris */    #elif defined(HAVE_PTHREAD_SETNAME_NP_WITH_TID_AND_ARG)      pthread_setname_np (pthread_self (), "%s", (gchar *) name); /* on NetBSD */    #elif defined(HAVE_PTHREAD_SET_NAME_NP)      pthread_set_name_np (pthread_self (), name); /* on FreeBSD, DragonFlyBSD, OpenBSD */    #endif    }

if (!is_nacl) {      if (exclude_unwind_tables) {        cflags += [          "-fno-unwind-tables",          "-fno-asynchronous-unwind-tables",        ]        defines += [ "NO_UNWIND_TABLES" ]      } else {        cflags += [ "-funwind-tables" ]      }    }

# Exclude unwind tables for official builds as unwinding can be done from stack# dumps produced by Crashpad at a later time "offline" in the crash server.# For unofficial (e.g. development) builds and non-Chrome branded (e.g. Cronet# which doesn't use Crashpad, crbug.com/479283) builds it's useful to be able# to unwind at runtime.exclude_unwind_tables =    is_official_build || (is_chromecast && !is_cast_desktop_build &&                          !is_debug && !cast_is_debug && !is_fuchsia)

   set(CMAKE_C_VISIBILITY_PRESET hidden)    set(CMAKE_CXX_VISIBILITY_PRESET hidden)

adb logcat > /tmp/foo.txt$NDK/ndk-stack -sym $PROJECT_PATH/obj/local/armeabi-v7a -dump foo.txt

  $ c++filt -n _Z1fv  f()

aarch64-linux-android-objdump -D -C libvlc.so > dump

0000000000091c04 <cricket::Connection::ToString() const>:  91c04:  a9bb7bfd   stp  x29, x30, [sp,#-80]!  91c08:  f9000bfc   str  x28, [sp,#16]  91c0c:  a9025ff8   stp  x24, x23, [sp,#32]  91c10:  a90357f6   stp  x22, x21, [sp,#48]  91c14:  a9044ff4   stp  x20, x19, [sp,#64]  91c18:  910003fd   mov  x29, sp  91c1c:    d104c3ff   sub  sp, sp, #0x130  91c20:  f9400009   ldr  x9, [x0]  91c24:  aa0003f4   mov  x20, x0  91c28:  aa0803f3   mov  x19, x8  91c2c:  f9400929   ldr  x9, [x9,#16]  91c30:  d63f0120   blr  x9

TA ("Tree Allocator") is a wrapper around malloc() and related functions,adding features like automatically freeing sub-trees of memory allocations ifa parent allocation is freed.
Generally, the idea is that every TA allocation can have a parent (indicatedby the ta_parent argument in allocation function calls). If a parent is freed,its child allocations are automatically freed as well. It is also allowed tofree a child before the parent, or to move a child to another parent withta_set_parent().
It also provides a bunch of convenience macros and debugging facilities.
The TA functions are documented in the implementation files (ta.c, ta_utils.c).
TA is intended to be useable as library independent from mpv. It doesn'tdepend on anything mpv specific.

export TOOLCHAINS_PATH=$ANDROID_NDK/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin    export AR=$TOOLCHAINS_PATH/arm-linux-androideabi-ar    export LD=$TOOLCHAINS_PATH/arm-linux-androideabi-ld    export CC=$TOOLCHAINS_PATH/arm-linux-androideabi-gcc    export RANLIB=$TOOLCHAINS_PATH/arm-linux-androideabi-ranlib    export CPPFLAGS="--sysroot=$ANDROID_NDK/platforms/android-9/arch-arm"    export CFLAGS="--sysroot=$ANDROID_NDK/platforms/android-9/arch-arm"    ./configure --prefix=/data/local/tmp/Inst \        --host=armv7-unknown-linux --target=armv7-unknown-linux \        --with-tmpdir=/sdcard    make -j8 && make -j8 install DESTDIR="$PWD/Inst"

   adb push Inst/data/local/tmp/Inst/ /data/local/tmp/

    #!/system/bin/sh    PACKAGE="com.example.helloworld"    # Callgrind tool    #VGPARAMS='-v --error-limit=no --trace-children=yes --log-file=/sdcard/valgrind.log.%p --tool=callgrind --callgrind-out-file=/sdcard/callgrind.out.%p'    # Memcheck tool    #VGPARAMS='-v --error-limit=no --trace-children=yes --tool=memcheck --leak-check=full --show-reachable=yes'    VGPARAMS='-v --error-limit=no --trace-children=yes --track-origins=yes --log-file=/sdcard/valgrind/log.%p --tool=memcheck --leak-check=full --show-reachable=yes'    export TMPDIR=/data/data/$PACKAGE    exec /data/local/tmp/Inst/bin/valgrind $VGPARAMS $*

    PACKAGE="com.example.helloworld"    setprop "wrap.$PACKAGE" 'logwrapper /data/local/tmp/start_valgrind.sh'    getprop "wrap.$PACKAGE" #make sure setprop success    am force-stop $PACKAGE    am start -a android.intent.action.MAIN -n $PACKAGE/.MainActivity

#include <iostream>int main(int argc, char *argv[]){    char *p = new char[2];    p[2] = 123;    if (p[0] > 'a')        std::cout << __LINE__ << std::endl;    else        std::cout << __LINE__ << std::endl;    return 0;}

==1157== Memcheck, a memory error detector==1157== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.==1157== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info==1157== Command: ./foo==1157== ==1157== Invalid write of size 1==1157==    at 0x40088B: main (foo.cpp:7)==1157==  Address 0x5ab6c82 is 0 bytes after a block of size 2 alloc'd==1157==    at 0x4C2E80F: operator new[](unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)==1157==    by 0x40087E: main (foo.cpp:5)==1157== ==1157== Conditional jump or move depends on uninitialised value(s)==1157==    at 0x400897: main (foo.cpp:9)==1157==  Uninitialised value was created by a heap allocation==1157==    at 0x4C2E80F: operator new[](unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)==1157==    by 0x40087E: main (foo.cpp:5)==1157== 12==1157== ==1157== HEAP SUMMARY:==1157==     in use at exit: 72,706 bytes in 2 blocks==1157==   total heap usage: 3 allocs, 1 frees, 73,730 bytes allocated==1157== ==1157== 2 bytes in 1 blocks are definitely lost in loss record 1 of 2==1157==    at 0x4C2E80F: operator new[](unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)==1157==    by 0x40087E: main (foo.cpp:5)==1157== ==1157== LEAK SUMMARY:==1157==    definitely lost: 2 bytes in 1 blocks==1157==    indirectly lost: 0 bytes in 0 blocks==1157==      possibly lost: 0 bytes in 0 blocks==1157==    still reachable: 72,704 bytes in 1 blocks==1157==         suppressed: 0 bytes in 0 blocks==1157== Reachable blocks (those to which a pointer was found) are not shown.==1157== To see them, rerun with: --leak-check=full --show-leak-kinds=all==1157== ==1157== For counts of detected and suppressed errors, rerun with: -v==1157== ERROR SUMMARY: 3 errors from 3 contexts (suppressed: 0 from 0)

 target_compile_options(${TARGET} PUBLIC -fsanitize=address -fno-omit-frame-pointer)  set_target_properties(${TARGET} PROPERTIES LINK_FLAGS -fsanitize=address)

 #!/system/bin/sh  HERE="$(cd "$(dirname "$0")" && pwd)"  export ASAN_OPTIONS=log_to_syslog=false,allow_user_segv_handler=1  ASAN_LIB=$(ls $HERE/libclang_rt.asan-*-android.so)  if [ -f "$HERE/libc++_shared.so" ]; then      # Workaround for https://github.com/android-ndk/ndk/issues/988.      export LD_PRELOAD="$ASAN_LIB $HERE/libc++_shared.so"  else      export LD_PRELOAD="$ASAN_LIB"  fi  "$@"

 <project root>└── app    └── src        └── main            ├── jniLibs            │   ├── arm64-v8a            │   │   └── libclang_rt.asan-aarch64-android.so            │   ├── armeabi-v7a            │   │   └── libclang_rt.asan-arm-android.so            │   ├── x86            │   │   └── libclang_rt.asan-i686-android.so            │   └── x86_64            │       └── libclang_rt.asan-x86_64-android.so            └── resources                └── lib                    ├── arm64-v8a                    │   └── wrap.sh                    ├── armeabi-v7a                    │   └── wrap.sh                    ├── x86                    │   └── wrap.sh                    └── x86_64                        └── wrap.sh

#include <stdlib.h>int main() {  char *x = (char*)malloc(10 * sizeof(char*));  free(x);  return x[5];}

/tmp$ ./foo===================================================================6145==ERROR: AddressSanitizer: heap-use-after-free on address 0x60700000dfb5 at pc 0x0000004007d4 bp 0x7ffcf79be420 sp 0x7ffcf79be410READ of size 1 at 0x60700000dfb5 thread T0    #0 0x4007d3 in main /tmp/foo.c:5    #1 0x7f84f366482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)    #2 0x4006a8 in _start (/tmp/foo+0x4006a8)0x60700000dfb5 is located 5 bytes inside of 80-byte region [0x60700000dfb0,0x60700000e000)freed by thread T0 here:    #0 0x7f84f3aa62ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)    #1 0x400797 in main /tmp/foo.c:4    #2 0x7f84f366482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)previously allocated by thread T0 here:    #0 0x7f84f3aa6602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)    #1 0x400787 in main /tmp/foo.c:3    #2 0x7f84f366482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)SUMMARY: AddressSanitizer: heap-use-after-free /tmp/foo.c:5 main...

#include <pthread.h>#include <stdio.h>int Global;void *Thread1(void *x) {  Global++;  return NULL;}void *Thread2(void *x) {  Global--;  return NULL;}int main() {  pthread_t t[2];  pthread_create(&t[0], NULL, Thread1, NULL);  pthread_create(&t[1], NULL, Thread2, NULL);  pthread_join(t[0], NULL);  pthread_join(t[1], NULL);}

/tmp$ gcc -fsanitize=thread -o foo foo.c -g -O0

/tmp$ ./foo==================WARNING: ThreadSanitizer: data race (pid=6761)  Read of size 4 at 0x00000060107c by thread T2:    #0 Thread2 /tmp/foo.c:12 (foo+0x000000400998)    #1 <null> <null> (libtsan.so.0+0x0000000230d9)  Previous write of size 4 at 0x00000060107c by thread T1:    #0 Thread1 /tmp/foo.c:7 (foo+0x00000040095b)    #1 <null> <null> (libtsan.so.0+0x0000000230d9)  Location is global 'Global' of size 4 at 0x00000060107c (foo+0x00000060107c)  Thread T2 (tid=6764, running) created by main thread at:    #0 pthread_create <null> (libtsan.so.0+0x000000027577)    #1 main /tmp/foo.c:19 (foo+0x000000400a23)  Thread T1 (tid=6763, finished) created by main thread at:    #0 pthread_create <null> (libtsan.so.0+0x000000027577)    #1 main /tmp/foo.c:18 (foo+0x000000400a04)SUMMARY: ThreadSanitizer: data race /tmp/foo.c:12 Thread2==================ThreadSanitizer: reported 1 warnings

#include <stdio.h>#include <stdlib.h>#include <string.h>int main(int argc, char *argv[]){    int n;    if (n > 0)        printf("%d\n", n);    return 0;}

/tmp$ clang -fsanitize=memory -fPIE -pie -fno-omit-frame-pointer -g bar.c -o bar

/tmp$ ./bar==201433==WARNING: MemorySanitizer: use-of-uninitialized-value    #0 0x494fc7 in main /tmp/bar.c:7:7    #1 0x7f9e2ba4b0b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16    #2 0x41c26d in _start (/tmp/bar+0x41c26d)SUMMARY: MemorySanitizer: use-of-uninitialized-value /tmp/bar.c:7:7 in mainExiting

$ ./configure --help |less...  --toolchain=NAME         set tool defaults according to NAME                           (gcc-asan, clang-asan, gcc-msan, clang-msan,                           gcc-tsan, clang-tsan, gcc-usan, clang-usan,                           valgrind-massif, valgrind-memcheck,                           msvc, icl, gcov, llvm-cov, hardened)...

 1 #include <iostream>  2 #include <memory>  3  4 class Foo {  5 public:  6   ~Foo() {  7       std::cout << __PRETTY_FUNCTION__ << '\n';  8   }  9 10   char buf[256]; 11 }; 12 13 void test() { 14   auto a = std::make_shared<Foo>(); 15   std::weak_ptr<Foo> b(a); 16   a = nullptr; 17   b.lock(); 18 } 19 20 int main() { 21   test(); 22   return 0; 23 }

(lldb) bt *   thread #1, name = 'foo', stop reason = breakpoint 1.2 *   frame #0: 0x00007ffff7af7260 libc.so.6`__GI___libc_malloc(bytes=272) at malloc.c:3023:1     frame #1: 0x00007ffff7e60c29 libstdc++.so.6`operator new(unsigned long) + 25     frame #2: 0x0000000000401d44 foo`__gnu_cxx::new_allocator<std::_Sp_counted_ptr_inplace<Foo, std::allocator<Foo>, (__gnu_cxx::_Lock_policy)2> >::allocate(this=0x00007fffffffdd50, __n=1, (null)=0x0000000000000000) at new_allocator.h:114:27     frame #3: 0x0000000000401cb4 foo`std::allocator_traits<std::allocator<std::_Sp_counted_ptr_inplace<Foo, std::allocator<Foo>, (__gnu_cxx::_Lock_policy)2> > >::allocate(__a=0x00007fffffffdd50, __n=1)2> >&, unsigned long) at alloc_traits.h:444:20     frame #4: 0x0000000000401aba foo`std::__allocated_ptr<std::allocator<std::_Sp_counted_ptr_inplace<Foo, std::allocator<Foo>, (__gnu_cxx::_Lock_policy)2> > > std::__allocate_guarded<std::allocator<std::_Sp_counted_ptr_inplace<Foo, std::allocator<Foo>, (__a=0x00007fffffffdd50)2> > >(std::allocator<std::_Sp_counted_ptr_inplace<Foo, std::allocator<Foo>, (__gnu_cxx::_Lock_policy)2> >&) at allocated_ptr.h:97:21     frame #5: 0x0000000000401950 foo`std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count<Foo, std::allocator<Foo> >(this=0x00007fffffffdea8, __p=0x00007fffffffdea0, __a=_Sp_alloc_shared_tag<std::allocator<Foo> > @ 0x00007fffffffdd68) at shared_ptr_base.h:677:19     frame #6: 0x00000000004018f0 foo`std::__shared_ptr<Foo, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<Foo> >(this=0x00007fffffffdea0, __tag=_Sp_alloc_shared_tag<std::allocator<Foo> > @ 0x00007fffffffdd98) at shared_ptr_base.h:1344:14     frame #7: 0x00000000004018a8 foo`std::shared_ptr<Foo>::shared_ptr<std::allocator<Foo> >(this=0x00007fffffffdea0, __tag=_Sp_alloc_shared_tag<std::allocator<Foo> > @ 0x00007fffffffddc8) at shared_ptr.h:359:4     frame #8: 0x000000000040182b foo`std::shared_ptr<Foo> std::allocate_shared<Foo, std::allocator<Foo> >(__a=0x00007fffffffde40) at shared_ptr.h:701:14     frame #9: 0x0000000000401494 foo`std::shared_ptr<Foo> std::make_shared<Foo>() at shared_ptr.h:717:14     frame #10: 0x0000000000401271 foo`test() at foo.cpp:14:12

(lldb) c  Process 206788 resumingProcess 206788 stopped  * thread #1, name = 'foo', stop reason = breakpoint 3.1     frame #0: 0x000000000040218c foo`Foo::~Foo(this=0x0000000000418ec0) at foo.cpp:7:17    4    class Foo {    5    public:    6      ~Foo() {  -> 7          std::cout << __PRETTY_FUNCTION__ << '\n';    8      }    9    10     char buf[256];  (lldb) bt  * thread #1, name = 'foo', stop reason = breakpoint 3.1   * frame #0: 0x000000000040218c foo`Foo::~Foo(this=0x0000000000418ec0) at foo.cpp:7:17     frame #1: 0x0000000000402179 foo`void __gnu_cxx::new_allocator<Foo>::destroy<Foo>(this=0x0000000000418ec0, __p=0x0000000000418ec0) at new_allocator.h:153:10     frame #2: 0x0000000000402110 foo`void std::allocator_traits<std::allocator<Foo> >::destroy<Foo>(__a=0x0000000000418ec0, __p=0x0000000000418ec0) at alloc_traits.h:497:8     frame #3: 0x0000000000401edf foo`std::_Sp_counted_ptr_inplace<Foo, std::allocator<Foo>, (__gnu_cxx::_Lock_policy)2>::_M_dispose(this=0x0000000000418eb0) at shared_ptr_base.h:557:2     frame #4: 0x00000000004016dc foo`std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release(this=0x0000000000418eb0) at shared_ptr_base.h:155:6     frame #5: 0x000000000040168a foo`std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count(this=0x00007fffffffddf8) at shared_ptr_base.h:730:11     frame #6: 0x000000000040252e foo`std::__shared_ptr<Foo, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr(this=0x00007fffffffddf0) at shared_ptr_base.h:1169:31     frame #7: 0x0000000000402423 foo`std::__shared_ptr<Foo, (__gnu_cxx::_Lock_policy)2>::operator=(this=0x00007fffffffdea0, __r=0x00007fffffffde80)2>&&) at shared_ptr_base.h:1265:2     frame #8: 0x0000000000401554 foo`std::shared_ptr<Foo>::operator=(this=0x00007fffffffdea0, __r=nullptr) at shared_ptr.h:335:27     frame #9: 0x0000000000401298 foo`test() at foo.cpp:16:5

* thread #1, name = 'foo', stop reason = breakpoint 2.2    frame #0: 0x00007ffff7af7850 libc.so.6`__GI___libc_free(mem=0x0000000000418eb0) at malloc.c:3087:1(lldb) bt  * thread #1, name = 'foo', stop reason = breakpoint 2.2    * frame #0: 0x00007ffff7af7850 libc.so.6`__GI___libc_free(mem=0x0000000000418eb0) at malloc.c:3087:1      frame #1: 0x00000000004022f0 foo`__gnu_cxx::new_allocator<std::_Sp_counted_ptr_inplace<Foo, std::allocator<Foo>, (__gnu_cxx::_Lock_policy)2> >::deallocate(this=0x00007fffffffddb0, __p=0x0000000000418eb0, (null)=1)2>*, unsigned long) at new_allocator.h:128:2      frame #2: 0x00000000004022c8 foo`std::allocator_traits<std::allocator<std::_Sp_counted_ptr_inplace<Foo, std::allocator<Foo>, (__gnu_cxx::_Lock_policy)2> > >::deallocate(__a=0x00007fffffffddb0, __p=0x0000000000418eb0, __n=1)2> >&, std::_Sp_counted_ptr_inplace<Foo, std::allocator<Foo>, (__gnu_cxx::_Lock_policy)2>*, unsigned long) at alloc_traits.h:470:13      frame #3: 0x0000000000401c44 foo`std::__allocated_ptr<std::allocator<std::_Sp_counted_ptr_inplace<Foo, std::allocator<Foo>, (__gnu_cxx::_Lock_policy)2> > >::~__allocated_ptr(this=0x00007fffffffdda0) at allocated_ptr.h:73:4      frame #4: 0x0000000000401f45 foo`std::_Sp_counted_ptr_inplace<Foo, std::allocator<Foo>, (__gnu_cxx::_Lock_policy)2>::_M_destroy(this=0x0000000000418eb0) at shared_ptr_base.h:567:7      frame #5: 0x00000000004017e9 foo`std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_weak_release(this=0x0000000000418eb0) at shared_ptr_base.h:194:6      frame #6: 0x000000000040179a foo`std::__weak_count<(__gnu_cxx::_Lock_policy)2>::~__weak_count(this=0x00007fffffffde98) at shared_ptr_base.h:823:11      frame #7: 0x000000000040175e foo`std::__weak_ptr<Foo, (__gnu_cxx::_Lock_policy)2>::~__weak_ptr(this=0x00007fffffffde90) at shared_ptr_base.h:1596:29      frame #8: 0x00000000004015e8 foo`std::weak_ptr<Foo>::~weak_ptr(this=0x00007fffffffde90) at shared_ptr_base.h:351:11      frame #9: 0x00000000004012c4 foo`test() at foo.cpp:18:1