当动态分配数组的函数被多次调用时，malloc 出错

malloc errors when function that dynamically allocates an array is called more than once?

本文关键字：调用 malloc 出错 数组 动态分配 函数      更新时间：2023-10-16

我有一个生成价格点的函数和一个使用该点阵为相关选项定价的函数。generate_lattice函数为数组动态分配空间，并返回指向该数组的指针。此指针是传递给price_from_tree 的指针。这是代码：

#include <iostream>
#include <math.h>
using std::cout;
using std::endl;
using std::max;
using std::nothrow;
double* generate_lattice(double asset_price, double u, double d, int periods)
{
    int nodes = (periods * (periods + 1)) / 2; //Number of nodes = sum(1, # of periods)
    double * lattice; 
    lattice = new (nothrow) double[nodes]; 
    double up, down;
    int price_index = 0;
    for (int period = 0; period < periods + 1; period++) {
        for (int exp = 0; exp < period + 1; exp++) {
            up = pow(1 + u, exp);
            down = pow(1 - d, period - exp);
            lattice[price_index] = asset_price * up * down;
            price_index++;
        }
    }
    return lattice;
}
double price_from_tree(double* lattice, int periods, double strike, double risk_free, double period_len_years, bool euro = true, bool call = true)
{
    int num_prices = ((periods + 1) * (periods + 2)) / 2;
    double asset_max = lattice[num_prices - 1];
    double asset_min = lattice[num_prices - (periods + 1)];
    double asset_t0 = lattice[0];
    double u = pow(asset_max / asset_t0, pow(periods, -1));
    double d = pow(asset_min / asset_t0, pow(periods, -1));
    double p = (exp(risk_free * period_len_years) - d) / (u - d);
    double p_minus1 = 1 - p;
    int start_node;
    if (euro == true) { start_node = num_prices - periods - 1; }
    else { start_node = 0; }
    int sign;
    if (call == true) { sign = 1; }
    else { sign = -1; }
    for (int node = start_node; node < num_prices; node++) {
        lattice[node] = max(sign * (lattice[node] - strike), 0.0);
    }
    int price_index = num_prices - 1;
    double pv_mult = exp(-risk_free * period_len_years);
    double down_payoff, up_payoff, prev_payoff;
    for (int period = periods + 1; period > 0; period--) {
        for (int node = 0; node < period - 1; node++) {
            down_payoff = lattice[price_index - (node + 1)];
            up_payoff = lattice[price_index - node];
            prev_payoff = pv_mult * (p * up_payoff + p_minus1 * down_payoff);
            if (euro == false) {
                prev_payoff = max(lattice[price_index - (node + 1) - (period - 1)], prev_payoff);
            }
            lattice[price_index - (node + 1) - (period - 1)] = prev_payoff;
        }
        price_index -= period;
    }
    return lattice[0];
}
int main(int argc, char** argv)
{
    double* lattice = generate_lattice(100, 0.10, 0.10, 2);
    double option1 = price_from_tree(lattice, 2, 105, 0.05, 1, true, true);
    cout<<"option 1: "<<option1<<endl;
    double* lattice2 = generate_lattice(100, 0.10, 0.10, 2);
    return 0;
}

当我运行代码时，我得到以下输出：

选项 1：8.28214 test： malloc.c：3096： sYSMALLOc： Assertion '(old_top == (((mbinptr( (((char *( &((av(->bins[(1( - 1( * 2](( - __builtin_offsetof (结构 malloc_chunk， fd(((( && old_size == 0( ||((未签名长( (old_size(

= (unsigned long((((__builtin_offsetof (struct malloc_chunk， fd_nextsize((+((2 * (sizeof(size_t(((

- 1(( & ~((2 * (sizeof(size_t((( - 1((( &&((old_top(->大小和0x1( &&((无符号长(old_end &pagemask( == 0(' 失败。 中止

------------------
(program exited with code: 134)

我在错误 134 上所能找到的只是以下描述 The job is killed with an abort signal. 在我尝试过的每种情况下，代码都会返回正确的price_from_tree值，但是如果我包含多个调用generate_lattice它会失败并出现所述错误。我的price_from_tree功能是否存在问题，导致内存混乱？在这种情况下，我使用向量更好吗？

你正在

严重破坏你的堆。 如果你使用 valgrind 运行(假设你在 Linux 机器上(，就会有大量的错误。

==23357== Invalid write of size 8
==23357==    at 0x400B9E: generate_lattice(double, double, double, int) (so.cpp:21)
==23357==    by 0x400FC4: main (so.cpp:68)
==23357==  Address 0x595b058 is 0 bytes after a block of size 24 alloc'd
==23357==    at 0x4C27FFB: operator new[](unsigned long, std::nothrow_t const&) (vg_replace_malloc.c:325)
==23357==    by 0x400B1A: generate_lattice(double, double, double, int) (so.cpp:14)
==23357==    by 0x400FC4: main (so.cpp:68)

你的数学是关闭的。在generate_lattice，price_index增长超越了(periods * (periods + 1)) / 2。尝试：

int nodes = ((periods+1) * (periods + 2)) / 2; //Number of nodes = sum(1, # of periods + 1)
将

索引计算到共享的一维数组中，lattice在两个函数中不一致： 

(periods * (periods + 1)) / 2;       // generate_lattice
((periods + 1) * (periods + 2)) / 2; // price_from_tree

这可能是相关 malloc 错误的根源。

generate_lattice创建一个大小为 n*(n+1(/2 的数组，但随后初始化该数组的 (n+1(*(n+1( 元素，对吗？ 这可能是破坏堆或类似奇怪的东西。

我没有看price_from_tree但是如果您只是将lattice用作数组，我怀疑它会导致问题(除非您离开最后(。

您错误地计算了节点数，因此您从数组的末尾运行。尝试使用句点 = 2。因为您正在执行

相关文章：