C++模板vector类报错：malloc释放未分配指针问题排查求助

Hey there, let's break down this malloc: error for object xxxxxxxxx: pointer being freed was not allocated error you're facing with your custom C++ vector template. This error almost always points to issues with how you're managing the raw T* data pointer—either trying to free a pointer that wasn't properly allocated, double-freeing memory, or corrupting the heap somehow. Let's go through the most likely culprits based on the code snippets you shared:

Common Causes & Fixes #

1. Uninitialized data in Default Constructor #

Looking at your default constructor:

vector() { numElements = 0; numCapacity = 0; }

You're setting the size and capacity to 0, but you never initialize data to nullptr. That means data holds a random garbage value. When your destructor runs and calls delete[] data, it's trying to free a wild pointer—exactly the error you're seeing.

Fix: Initialize data explicitly in the default constructor:

vector() : numElements(0), numCapacity(0), data(nullptr) {}

delete[] nullptr is perfectly safe, so this eliminates the wild pointer issue.

2. Shallow Copy in Copy Constructor #

If your copy constructor is doing a shallow copy (just assigning data = rhs.data instead of allocating new memory and copying elements), you'll end up with two vector objects pointing to the same heap memory. When both objects are destroyed, the first will free the memory, and the second will try to free it again—triggering the "pointer being freed was not allocated" error (since the memory is already deallocated).

Fix: Implement a proper deep copy in your copy constructor:

vector(const vector & rhs) throw (const char *) {
    numElements = rhs.numElements;
    numCapacity = rhs.numCapacity;
    // Allocate new memory matching the source's capacity
    data = new T[numCapacity];
    // Copy each element individually
    for (int i = 0; i < numElements; ++i) {
        data[i] = rhs.data[i];
    }
}

3. Missing or Broken Assignment Operator #

Even if you fix the copy constructor, if you haven't implemented the assignment operator (operator=), the compiler will generate a default one that does a shallow copy. This leads to the same double-free problem when you assign one vector to another.

Fix: Implement the copy-and-swap idiom for assignment (or a manual deep copy):

vector& operator=(vector rhs) {
    std::swap(numElements, rhs.numElements);
    std::swap(numCapacity, rhs.numCapacity);
    std::swap(data, rhs.data);
    return *this;
}

This is a safe, concise way to handle assignment and avoid memory issues.

4. Buggy Resizing/Expansion Logic #

If you have methods like push_back or reserve that reallocate memory, make sure you're:

• Allocating new memory correctly with new T[newCapacity]
• Copying all existing elements to the new memory block
• Freeing the old data pointer with delete[] data before reassigning it to the new block
• Not accidentally overwriting the data pointer without freeing the old memory (which would cause leaks and potential corruption)

For example, a correct push_back might look like:

void push_back(const T& val) {
    if (numElements >= numCapacity) {
        // Double capacity, or start at 1 if empty
        int newCapacity = numCapacity == 0 ? 1 : numCapacity * 2;
        T* newData = new T[newCapacity];
        
        // Copy existing elements
        for (int i = 0; i < numElements; ++i) {
            newData[i] = data[i];
        }
        
        // Free old memory
        delete[] data;
        
        // Update to new memory
        data = newData;
        numCapacity = newCapacity;
    }
    data[numElements++] = val;
}

5. Heap Corruption from Out-of-Bounds Access #

If you're writing to data beyond numElements or numCapacity, you'll corrupt the heap's internal metadata. This can cause malloc/free errors later that don't directly point to the original bug.

Fix: Double-check all places where you access data—make sure indices are always between 0 and numElements - 1 for reads/writes, and never exceed numCapacity - 1 when pre-allocating.

Debugging Tips #

• Use AddressSanitizer: Compile your code with -fsanitize=address (GCC/Clang) or the equivalent in MSVC. It will pinpoint exactly where the invalid free or heap corruption is happening, making it much easier to fix.
• Step through with a debugger: Set breakpoints in your destructor, copy constructor, and any methods that modify data. Watch the value of data and ensure it's always either nullptr or a valid pointer returned by new[].

内容的提问来源于stack exchange，提问作者Gama