调整集合大小时出现内存错误

Question

这是我编写的一种集合结构：

struct state_set
{
    struct state ***state_array;
    size_t *slot_sizes;
    size_t *slot_memory;
};

这里是一个初始化器：

struct state_set *state_set_init()
{
    struct state_set *new_set =
            malloc(sizeof(struct state_set));
    new_set->state_array = malloc(ARRAY_SIZE * sizeof(struct state**));
    new_set->slot_sizes = malloc(ARRAY_SIZE * sizeof(size_t));
    new_set->slot_memory = malloc(ARRAY_SIZE * sizeof(size_t));
    for (int i = 0; i < ARRAY_SIZE; i++)
    {
        new_set->slot_sizes[i] = 0;
        new_set->slot_memory[i] = INITIAL_SLOT_SIZE;
    }
    for (int i = 0; i < ARRAY_SIZE; i++)
    {
        new_set->state_array[i] =
                malloc(new_set->slot_memory[i] * sizeof(struct state*));
        error_validate_pointer(new_set->state_array[i]);
    }

    return new_set;
}

还有一个会导致内存错误的调整大小函数：

void state_set_resize_slot(struct state_set *set, int slot_i)
{
    struct state **to_resize = set->state_array[slot_i];
    to_resize =
            realloc(to_resize, set->slot_memory[slot_i] * 2 * sizeof(struct state*));
    error_validate_pointer(to_resize);
    set->slot_memory[slot_i] *= 2;
}

问题是 - 为什么state_set_resize_slot() 不起作用？我看不出在 realloc 中有任何错误，而且我已经盯着这段代码至少一个小时了。（很明显 realloc 是我所有问题的根源）。或者说，调整大小的函数编写得很好，我应该在其他地方寻找错误？

编辑：如果有人想查看完整的代码，请参见此处：http://pastebin.com/bfH3arDi（哈希函数返回1而不是h，因为我正在测试冲突，另外初始化和销毁函数已过时，现在我正在为 slot_memory 和 slot_sizes 分配数据，而不是使用堆栈）。以下是运行添加多个状态到集合的程序的 valgrind 输出（错误发生在第三次调整大小左右）：

==20979== Invalid write of size 8
==20979==    at 0x400C21: state_set_add (state_set.c:93)
==20979==    by 0x400781: main (main.c:22)
==20979==  Address 0x51f2320 is 0 bytes inside a block of size 40 free'd
==20979==    at 0x4C2BB1C: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==20979==    by 0x4009CD: state_set_resize_slot (state_set.c:54)
==20979==    by 0x400B23: state_set_add (state_set.c:78)
==20979==    by 0x400781: main (main.c:22)
==20979== 
==20979== Invalid free() / delete / delete[] / realloc()
==20979==    at 0x4C2BB1C: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==20979==    by 0x4009CD: state_set_resize_slot (state_set.c:54)
==20979==    by 0x400B23: state_set_add (state_set.c:78)
==20979==    by 0x4007B2: main (main.c:23)
==20979==  Address 0x51f2320 is 0 bytes inside a block of size 40 free'd
==20979==    at 0x4C2BB1C: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==20979==    by 0x4009CD: state_set_resize_slot (state_set.c:54)
==20979==    by 0x400B23: state_set_add (state_set.c:78)
==20979==    by 0x400781: main (main.c:22)
==20979== 
a.out: state_set.c:20: error_validate_pointer: Assertion `ptr != ((void *)0)' failed.

- qiubit

Answer 1

在您的函数中，您将指针传递给 to_resize，然后您 realloc 了内存，但您从未将新指针设置回 set->state_array[slot_i]，因此它丢失了，您继续使用旧的已释放内存空间，并将指向其边界之外。

- Sami Kuhmonen