gdb獲取到的錯誤，幫忙看下

jd808

1. * 1    Thread 0x7ffd8657c740 (LWP 2138) "Xgateway" pthread_once () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_once.S:94
   
2. (gdb) thread 1
   
3. [Switching to thread 1 (Thread 0x7ffd8657c740 (LWP 2138))]
   
4. #0  pthread_once () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_once.S:94
   
5. 94              jmp     6b
   
6. (gdb) bt
   
7. #0  pthread_once () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_once.S:94
   
8. #1  0x00007ffd84dd414c in __GI___backtrace (array=array@entry=0x7fff36168e90, size=size@entry=64) at ../sysdeps/x86_64/backtrace.c:103
   
9. #2  0x00007ffd84d3fdd4 in __libc_message (do_abort=2, fmt=fmt@entry=0x7ffd84e48928 "*** Error in `%s': %s: 0x%s ***\n")
   
10.     at ../sysdeps/unix/sysv/linux/libc_fatal.c:176
    
11. #3  0x00007ffd84d48b5c in malloc_printerr (ptr=0x1102530, str=0x7ffd84e4607e "malloc(): memory corruption", action=<optimized out>)
    
12.     at malloc.c:4972
    
13. #4  _int_malloc (av=0x7ffd85084760 <main_arena>, bytes=56) at malloc.c:3426
    
14. #5  0x00007ffd84d4a11c in __GI___libc_malloc (bytes=56) at malloc.c:2869
    
15. #6  0x00007ffd86381388 in _dl_map_object_deps (map=map@entry=0x7ffd86580000, preloads=preloads@entry=0x0,
    
16.     npreloads=npreloads@entry=0, trace_mode=trace_mode@entry=0, open_mode=open_mode@entry=-2147483648) at dl-deps.c:515
    
17. #7  0x00007ffd8638792c in dl_open_worker (a=a@entry=0x7fff36169a28) at dl-open.c:265
    
18. #8  0x00007ffd86383314 in _dl_catch_error (objname=objname@entry=0x7fff36169a18, errstring=errstring@entry=0x7fff36169a20,
    
19.     mallocedp=mallocedp@entry=0x7fff36169a10, operate=operate@entry=0x7ffd863877b0 <dl_open_worker>, args=args@entry=0x7fff36169a28)
    
20.     at dl-error.c:177
    
21. #9  0x00007ffd8638725b in _dl_open (file=0x7ffd84e44ea6 "libgcc_s.so.1", mode=-2147483647, caller_dlopen=<optimized out>, nsid=-2,
    
22.     argc=1, argv=0x7fff3616aab8, env=0x7fff3616aac8) at dl-open.c:656
    
23. #10 0x00007ffd84dfa9b2 in do_dlopen (ptr=ptr@entry=0x7fff36169c30) at dl-libc.c:87
    
24. #11 0x00007ffd86383314 in _dl_catch_error (objname=0x7fff36169c10, errstring=0x7fff36169c20, mallocedp=0x7fff36169c00,
    
25.     operate=0x7ffd84dfa970 <do_dlopen>, args=0x7fff36169c30) at dl-error.c:177
    
26. #12 0x00007ffd84dfaa72 in dlerror_run (args=0x7fff36169c30, operate=0x7ffd84dfa970 <do_dlopen>) at dl-libc.c:46
    
27. #13 __GI___libc_dlopen_mode (name=name@entry=0x7ffd84e44ea6 "libgcc_s.so.1", mode=mode@entry=-2147483647) at dl-libc.c:163
    
28. #14 0x00007ffd84dd4035 in init () at ../sysdeps/x86_64/backtrace.c:52
    
29. #15 0x00007ffd86164be0 in pthread_once () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_once.S:103
    
30. #16 0x00007ffd84dd414c in __GI___backtrace (array=array@entry=0x7fff36169ef0, size=size@entry=64) at ../sysdeps/x86_64/backtrace.c:103
    
31. #17 0x00007ffd84d3fdd4 in __libc_message (do_abort=2, fmt=fmt@entry=0x7ffd84e48928 "*** Error in `%s': %s: 0x%s ***\n")
    
32.     at ../sysdeps/unix/sysv/linux/libc_fatal.c:176
    
33. #18 0x00007ffd84d48b5c in malloc_printerr (ptr=0x1102530, str=0x7ffd84e4607e "malloc(): memory corruption", action=<optimized out>)
    
34.     at malloc.c:4972
    
35. #19 _int_malloc (av=0x7ffd85084760 <main_arena>, bytes=1024) at malloc.c:3426
    
36. #20 0x00007ffd84d4a11c in __GI___libc_malloc (bytes=1024) at malloc.c:2869
    
37. #21 0x00007ffd85cd1baf in evbuffer_chain_new (size=140726835383584, size@entry=200) at buffer.c:177
    
38. #22 0x00007ffd85cd6b60 in evbuffer_expand_fast_ (buf=buf@entry=0x1165a20, datlen=datlen@entry=200, n=n@entry=4) at buffer.c:2044
    
39. #23 0x00007ffd85cd7238 in evbuffer_read (buf=buf@entry=0x1165a20, fd=fd@entry=101, howmuch=200, howmuch@entry=16384) at buffer.c:2292
    
40. #24 0x00007ffd85cde175 in bufferevent_readcb (fd=101, event=<optimized out>, arg=0x1124ed0) at bufferevent_sock.c:167
    
41. #25 0x00007ffd85ce3849 in event_persist_closure (ev=<optimized out>, base=0x106f880) at event.c:1531
    
42. ---Type <return> to continue, or q <return> to quit---
    
43. #26 event_process_active_single_queue (base=base@entry=0x106f880, activeq=0xf6f470, max_to_process=max_to_process@entry=2147483647,
    
44.     endtime=endtime@entry=0x0) at event.c:1590
    
45. #27 0x00007ffd85ce40ff in event_process_active (base=0x106f880) at event.c:1689
    
46. #28 event_base_loop (base=0x106f880, flags=0) at event.c:1912
    
47. #29 0x000000000040f531 in MultiServer::StartRun (this=0x1022880) at gateway/src/MultiServer.cpp:366
    
48. #30 0x000000000040c8e1 in TControl::Run (this=this@entry=0x7fff3616a9a0) at gateway/src/TControl.cpp:21
    
49. #31 0x00000000004061f0 in main (argc=1, argv=0x7fff3616aab8) at gateway/src/node_gateway.cpp:64

復(fù)制代碼

這是一個什么錯誤？

VIP_fuck

感覺你是 庫 用錯了，內(nèi)存分配上除了問題。瞎猜的。

#29 0x000000000040f531 in MultiServer::StartRun (this=0x1022880) at gateway/src/MultiServer.cpp:366
從這里入手說不定是個方法

jd808

#22 0x00007ffd85cd6b60 in evbuffer_expand_fast_ (buf=buf@entry=0x1165a20, datlen=datlen@entry=200, n=n@entry=4) at buffer.c:2044
2044行是
2044                    chain = evbuffer_chain_new(datlen);
(gdb) p datlen
$8 = 200
(gdb) down 1
#21 0x00007ffd85cd1baf in evbuffer_chain_new (size=140726835383584, size@entry=200) at buffer.c:177
177             if ((chain = mm_malloc(to_alloc)) == NULL)
(gdb) p size
$9 = 140726835383584

怎么會這樣？
調(diào)用evbuffer_chain_new的時候，參數(shù)datlen是正常，一旦進(jìn)入evbuffer_chain_new內(nèi)部，他有兩個參數(shù)size=140726835383584, size@entry=200，一個正確，一個不正確，打印size的時候 值是140726835383584，搞不明白

jd808

VIP_fuck 發(fā)表于 2016-04-21 11:30
感覺你是 庫 用錯了，內(nèi)存分配上除了問題。瞎猜的。

#29 0x000000000040f531 in MultiServer::StartRun  ...

bool MultiServer::StartRun()
{
    evconnlistener *listener=NULL;
//    evconnlistener *listener1=NULL;

    LISTER_TYPE * a=new LISTER_TYPE;
//    LISTER_TYPE * b=new LISTER_TYPE;
    a->p_ser=this;
    a->port=m_Port;

    printf("======監(jiān)聽端口=====%d==\n",m_Port);
        //timer event process
        m_runTimerFlag = 1;

        //創(chuàng)建一個定時線程,主要功能是匯報本服務(wù)器的情況
        pthread_create(&m_timerTid, NULL, WorkerTimerEvent, (void *)m_TimeThreadInfo);

        //開啟各個子線程
        for(int i=0; i<m_ThreadCount; i++)
                pthread_create(&m_tid, NULL, WorkerLibevent, (void *)&m_pThreadInfo);

        pthread_create(&m_timerCDTid, NULL, WorkerTimerCDEvent, (void *)m_TimeCDThreadInfo);

        if(Listener(&listener,a)==-1){
                fprintf(stderr, "listen error: %s\n", strerror(errno));
                exit(1);
        }

//        if(g_pConf->OPEN_ROUTING==0){
//                if(Listener(&listener1,b)==-1){
//                                fprintf(stderr, "listen error: %s\n", strerror(errno));
//                                exit(1);
//                }
//        }

    //開啟主線程的事件循環(huán)
    event_base_dispatch(m_EventBase);

    //事件循環(huán)結(jié)果，釋放監(jiān)聽者的內(nèi)存
    evconnlistener_free(listener);
//    if(g_pConf->OPEN_ROUTING==0)
//            evconnlistener_free(listener1);

    return true;
}

這是哪行的代碼     event_base_dispatch(m_EventBase);，這里看不出來任何問題。

jd808

猜測應(yīng)該是程序在運行過程中，內(nèi)存越界了，但奇怪的時
#21 0x00007ffd85cd1baf in evbuffer_chain_new (size=140726835383584, size@entry=200) at buffer.c:177
這里為什么有個size是錯的，一個是對的（200那個是對的）
內(nèi)存越界應(yīng)該會導(dǎo)致這個函數(shù)段錯誤吧，怎么會出這種奇怪的錯誤？

VIP_fuck

回復(fù) 4# jd808


    這么看我是看不出來123的，只能提供個參考方向，代碼還得擼主自己慢慢擼啊。說不定我說的是錯的訥。

jd808

VIP_fuck 發(fā)表于 2016-04-21 11:41
回復(fù) 4# jd808

1. static struct evbuffer_chain *
   
2. evbuffer_chain_new(size_t size)
   
3. {
   
4.         struct evbuffer_chain *chain;
   
5.         size_t to_alloc;
   
6. 
   
7.         if (size > EVBUFFER_CHAIN_MAX - EVBUFFER_CHAIN_SIZE)
   
8.                 return (NULL);
   
9. 
   
10.         size += EVBUFFER_CHAIN_SIZE;
    
11. 
    
12.         /* get the next largest memory that can hold the buffer */
    
13.         if (size < EVBUFFER_CHAIN_MAX / 2) {
    
14.                 to_alloc = MIN_BUFFER_SIZE;
    
15.                 while (to_alloc < size) {
    
16.                         to_alloc <<= 1;
    
17.                 }
    
18.         } else {
    
19.                 to_alloc = size;
    
20.         }
    
21. 
    
22.         /* we get everything in one chunk */
    
23.         if ((chain = mm_malloc(to_alloc)) == NULL)
    
24.                 return (NULL);
    
25. 
    
26.         memset(chain, 0, EVBUFFER_CHAIN_SIZE);
    
27. 
    
28.         chain->buffer_len = to_alloc - EVBUFFER_CHAIN_SIZE;
    
29. 
    
30.         /* this way we can manipulate the buffer to different addresses,
    
31.          * which is required for mmap for example.
    
32.          */
    
33.         chain->buffer = EVBUFFER_CHAIN_EXTRA(u_char, chain);
    
34. 
    
35.         chain->refcnt = 1;
    
36. 
    
37.         return (chain);
    
38. }

復(fù)制代碼

能幫我解釋下這個函數(shù)么？傳進(jìn)來怎么會有兩個參數(shù)》？
#21 0x00007ffd85cd1baf in evbuffer_chain_new (size=140726835383584, size@entry=200) at buffer.c:177
size@entry=200這個是對的

VIP_fuck

回復(fù) 7# jd808


    前提是，我不知道這個庫怎么用。所以都是猜。

    看起來是編譯器插進(jìn)去的一個值，不過沒明白這個值是干啥的。錯誤不應(yīng)該出在這里。或者你加打印，一步步的走，逐步縮小錯誤的范圍。

yulihua49

0x00007ffd84d3fdd4 in __libc_message (do_abort=2, fmt=fmt@entry=0x7ffd84e48928 "*** Error in `%s': %s: 0x%s ***\n")

0x%X吧？0x%s錯了？

jd808

yulihua49 發(fā)表于 2016-04-21 12:07
0x00007ffd84d3fdd4 in __libc_message (do_abort=2, fmt=fmt@entry=0x7ffd84e48928 "*** Error in `%s': % ...

這個是libevent里面的