c++ - program crash in std::sort() sometimes, can't reproduce -

description:

my program crash in std::sort(), write minimal program reproduce situation, alright. here minimal example:

typedef struct st {     int it;     char ch;     char charr[100];     vector<string *> *vs; } st;  bool function(st *&s1, st *&s2) {     static int = 1;     cout<<i<<" "<<&s1<<" "<<&s2<<endl;     ++i;     return s1->it > s2->it; }  int main(int argc, char **argv) {     vector<st *> ar;     (int = 0; < 100; ++i) {         st *s = new st;         s->it = urandom32();         ar.push_back(s);     }      ar.clear();      (int = 0; < 100; ++i) {         st *s = new st;         s->it = urandom32();         ar.push_back(s);     }      sort(ar.begin(), ar.end(), function);      return 0; } 

here gdb stack info:

• 0 0x00007f24244d9602 in article_cmp (cand_article_1=0x7f23fd297010, cand_article_2=0x4015) @ src/recom_frame_worker.h:47
• 1 0x00007f24244fc41b in std::__unguarded_partition<__gnu_cxx::__normal_iterator > >, cand_article*, bool ()(cand_article, cand_article*)> (__first=, __last=, __pivot=@0x7f230412b350: 0x7f23fd297010, __comp=0x7f24244d95e1 ) @ /usr/include/c++/4.8.3/bits/stl_algo.h:2266
• 2 0x00007f24244f829c in std::__unguarded_partition_pivot<__gnu_cxx::__normal_iterator > >, bool ()(cand_article, cand_article*)> (__first=, __last=, __comp=0x7f24244d95e1 ) @ /usr/include/c++/4.8.3/bits/stl_algo.h:2296
• 3 0x00007f24244f1d88 in std::__introsort_loop<__gnu_cxx::__normal_iterator > >, long, bool ()(cand_article, cand_article*)> (__first=, __last=, __depth_limit=18, __comp=0x7f24244d95e1 ) @ /usr/include/c++/4.8.3/bits/stl_algo.h:2337
• 4 0x00007f24244ed6e5 in std::sort<__gnu_cxx::__normal_iterator > >, bool ()(cand_article, cand_article*)> ( __first=, __last=, __comp=0x7f24244d95e1 ) @ /usr/include/c++/4.8.3/bits/stl_algo.h:5489

article_cmp called in sort(article_result->begin(), article_result->end(), article_cmp); , article_result vector<cand_article*> *. cand_article struct.
here definition of article_cmp:

bool article_cmp(cand_article* cand_article_1, cand_article* cand_article_2) {     return cand_article_1 -> display_time >= cand_article_2 -> display_time; } 

here piece of code crash happens:

 article_result->clear();  for(vec_iter = _channel_data -> begin(); vec_iter != _channel_data -> end(); vec_iter++) {      cand_article* cand = to_cand_group(*vec_iter);      if(cand == null) continue;      // refresh open loadmore      if(m_request.req_type == 1) {          if(cand -> display_time > m_request.start){              article_result->push_back(cand);          }      }else if(m_request.req_type == 2){          if(cand -> display_time < m_request.end){              article_result->push_back(cand);          }      }else{          article_result->push_back(cand);      }  }   sort(article_result->begin(), article_result->end(), article_cmp); 

question:

i don't know how handle kind of coredump, cause 0x4015 kernel space address? suggestions on how fix kind of bug? sorry, can't reproduce situation minimal program. , happened in single thread, don't need think multi-thread situation.

the rule "if std::sort crashes, have invalid comparison function". comparison function is:

bool article_cmp(cand_article* lhs, cand_article* rhs) {     return lhs -> display_time >= rhs -> display_time; } 

this not strict weak ordering. in particular, if display times equal returns true, means if swap arguments still return true ... , not allowed. need:

bool article_cmp(cand_article* lhs, cand_article* rhs) {     return lhs -> display_time > rhs -> display_time; } 

the reason simplified example works (congratulations @ least trying simplify), simplified comparison function valid. if return statement return s1->it >= s2->it;, , used smaller range of values, crash.

incidentally, more natural c++ declaration of example structure like:

struct st {                       // no need typedef in c++     int it;     char ch;     std::string charr;            // ... or *possibly* std::array<char,100>.     std::vector<std::string> vs;  // strings , vectors best held value }; 

also note have used std:: prefix.