我一直在疯狂地追踪一个中型项目中的内存错误。我将一个代码最小化为以下代码，并验证这会导致 Valgrind 在注释行号处发出无效读取警告。我正在为项目使用 g++ 4.8.2 (Debian 4.8.2-16)，使用 -std=c++11 -O0 进行编译。 g++ 4.7.0 也会产生错误，4.4.6 在稍作修改的版本(删除 C++11)上也会产生错误。 clang++ 不会导致错误，VS2013 也不会。

我的问题是:

1. 我是否在不知不觉中从事未定义的行为？

2. 这是 Valgrind 误报吗？如果是，我如何才能让自己放心，以后会遇到这样的情况？

这段代码相当脆弱——特别是，让 foo 通过引用获取坐标可以消除这个问题，为 Coord 选择更大的类型以使其在内存中的大小大于 8 字节也是如此。

// Types are a little strange because I wanted the minimal failing
// case -- eg, row/col used to be ints.
#include <cassert>
#include <iostream>
#include <vector>

class Coord {
  public:
    bool row, col, layer;
};

void foo(Coord wtf) { }

std::vector<Coord> baz() {
  std::vector<Coord> bees;
  for (int i = 0; i < 4; ++i) {
    bees.push_back({1, 1, 1});
  }
  return bees;
}


int main(int argc, char** argv) {
  auto vec = baz();
  assert(vec.size() > 3);
  Coord bbb = vec[3];
  foo(bbb);
  static int i = 0;
  foo(vec.at(3)); // Causes Valgrind warning.

  Coord& ccc = vec[3];
  foo(ccc);      // causes Valgrind warning
}

Valgrind 输出:

==17700== Memcheck, a memory error detector
==17700== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==17700== Using Valgrind-3.9.0 and LibVEX; rerun with -h for copyright info
==17700== Command: ./a.out
==17700== 
==17700== Invalid read of size 8
==17700==    at 0x400BC9: main (in /home/alexr/projects/suncatcher/a.out)
==17700==  Address 0x59f80e9 is 9 bytes inside a block of size 12 alloc'd
==17700==    at 0x4C27A00: operator new(unsigned long) (vg_replace_malloc.c:319)
==17700==    by 0x40150A: __gnu_cxx::new_allocator<Coord>::allocate(unsigned long, void const*) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x4013A2: std::_Vector_base<Coord, std::allocator<Coord> >::_M_allocate(unsigned long) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x401061: void std::vector<Coord, std::allocator<Coord> >::_M_emplace_back_aux<Coord>(Coord&&) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400F02: void std::vector<Coord, std::allocator<Coord> >::emplace_back<Coord>(Coord&&) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400D25: std::vector<Coord, std::allocator<Coord> >::push_back(Coord&&) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400B17: baz() (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400B64: main (in /home/alexr/projects/suncatcher/a.out)
==17700== 
==17700== Invalid read of size 8
==17700==    at 0x400BEA: main (in /home/alexr/projects/suncatcher/a.out)
==17700==  Address 0x59f80e9 is 9 bytes inside a block of size 12 alloc'd
==17700==    at 0x4C27A00: operator new(unsigned long) (vg_replace_malloc.c:319)
==17700==    by 0x40150A: __gnu_cxx::new_allocator<Coord>::allocate(unsigned long, void const*) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x4013A2: std::_Vector_base<Coord, std::allocator<Coord> >::_M_allocate(unsigned long) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x401061: void std::vector<Coord, std::allocator<Coord> >::_M_emplace_back_aux<Coord>(Coord&&) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400F02: void std::vector<Coord, std::allocator<Coord> >::emplace_back<Coord>(Coord&&) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400D25: std::vector<Coord, std::allocator<Coord> >::push_back(Coord&&) (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400B17: baz() (in /home/alexr/projects/suncatcher/a.out)
==17700==    by 0x400B64: main (in /home/alexr/projects/suncatcher/a.out)
==17700== 
==17700== 
==17700== HEAP SUMMARY:
==17700==     in use at exit: 0 bytes in 0 blocks
==17700==   total heap usage: 3 allocs, 3 frees, 21 bytes allocated
==17700== 
==17700== All heap blocks were freed -- no leaks are possible
==17700== 
==17700== For counts of detected and suppressed errors, rerun with: -v
==17700== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 2 from 2)

最佳答案

这似乎是 gcc 做出的关于加载“幽灵”数据以优化少数指令的假设，https://bugs.kde.org/show_bug.cgi?id=264936

我会添加一个宏，比如

#ifdef SOMETHING_SOMETHING
#define SUPRESS_VALGRIND_FALSE_POSITIVES __attribute__((__aligned__(8)))
#else
#define SUPRESS_VALGRIND_FALSE_POSITIVES
#endif

...
class Coord {
  public:
    bool row, col, layer;
} SUPRESS_VALGRIND_FALSE_POSITIVES ;

无论出于性能原因，实际上都可能有益于强制对齐。

关于c++ - 最小程序在 g++ 上产生 Valgrind 警告，但在 clang 或 VS 上不产生警告，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/23487100/