使用 delete [] 删除指针时崩溃

Question

我用来输出 pTemp 的代码：

if (m_pTImgFrame != NULL)
{
    for (int i = 0; i < m_nFrameNumber; i++)
    {
        TImage* pTemp = (TImage*)m_pTImgFrame[i];
        if (pTemp != NULL)
        {
            TCHAR buffer[256] = { 0 };
            _stprintf_s(buffer, 256, _T("%d,%d,%d,%d,%d,%d,%d,%d\n"), 
                pTemp->attrib,
                pTemp->h,
                pTemp->pitch,
                pTemp->w,
                pTemp->data[0],
                pTemp->data[1], 
                pTemp->data[2], 
                pTemp->data[3]);
            OutputDebugString(buffer);

            delete[] pTemp;
            m_pTImgFrame[i] = NULL;
        }
    }
    delete []m_pTImgFrame;
    m_pTImgFrame = NULL;
}

仍然崩溃

的origin代码

if (m_pTImgFrame != NULL)
{
    for (int i = 0; i < m_nFrameNumber; i++)
    {
        BYTE* pTemp = (BYTE*)m_pTImgFrame[i];
        if (pTemp != NULL)
        {
            delete[] pTemp;
            m_pTImgFrame[i] = NULL;
        }
    }
    delete []m_pTImgFrame;
    m_pTImgFrame = NULL;
}

变量声明：

typedef unsigned int        UINT;
typedef struct _TImage
{
    int  w;         
    int  h;         
    int  pitch;     
    int  attrib;    
    unsigned char data[4];  
} TImage;

UINT        m_nFrameNumber;     
UINT*       m_pnFrameDelay;     
TImage**    m_pTImgFrame;

PBITMAPINFOHEADER pbih; 
typedef struct tagBITMAPINFOHEADER{
    DWORD      biSize;
    LONG       biWidth;
    LONG       biHeight;
    WORD       biPlanes;
    WORD       biBitCount;
    DWORD      biCompression;
    DWORD      biSizeImage;
    LONG       biXPelsPerMeter;
    LONG       biYPelsPerMeter;
    DWORD      biClrUsed;
    DWORD      biClrImportant;
} BITMAPINFOHEADER, FAR *LPBITMAPINFOHEADER, *PBITMAPINFOHEADER;

分配：

    m_pTImgFrame = new TImage*[1];
    m_pTImgFrame[0] = (TImage*)new BYTE[sizeof(TImage) - 4 + 4 * width * pbih->biHeight];
    m_pTImgFrame[0]->attrib = imageAttrib8888;
    m_pTImgFrame[0]->w = width;
    m_pTImgFrame[0]->h = pbih->biHeight;
    m_pTImgFrame[0]->pitch = 4 * width;
    LOG(_T("32width=%d, height=%d"), width, pbih->biHeight);
    for(j=pbih->biHeight-1; j>=0; j--)
    {
        int indexDst = (pbih->biHeight-j-1) * width * 4;
        //int indexSrc = j * pbih->biWidth * 4;
        int indexSrc = j * ((pbmi->bmiHeader.biWidth * cClrBits +31) & ~31) /8/*bmpInfo.bmWidthBytes*/;
        for(i=0; i< width; i++)
        {
            m_pTImgFrame[0]->data[indexDst++] = lpBits[indexSrc++];
            m_pTImgFrame[0]->data[indexDst++] = lpBits[indexSrc++];
            m_pTImgFrame[0]->data[indexDst++] = lpBits[indexSrc++];
            m_pTImgFrame[0]->data[indexDst++] = 255;
            indexSrc++;
        }
    }

运行该行时代码会崩溃 delete [] pTemp如果m_nFrameNumber为1（我只看到它是1时发生了崩溃，但我不确定）；pTemp的每个值的输出都是正确的，为什么会崩溃？

Answer 1

如果m_nFrameNumber 为delete [] pTemp，代码会在运行时崩溃 1

鉴于你刚才所说的分配如下：

m_pTImgFrame = new TImage*[1];

m_pTImgFrame 的唯一有效索引是0，因为您只分配了大小为1 的数组。尝试访问 m_pTImgFrame[1] 是未定义的行为。

其次，您的新操作符需要与您的删除操作符匹配类型和标量。

您分配为字节数组：

m_pTImgFrame[0] = (TImage*)new BYTE[sizeof(TImage) - 4 + 4 * width * pbih->biHeight];

因此，释放元素的正确方法是这样的：

BYTE* allocation = (BYTE*)m_pTImgFrame[0];
delete [] allocaiton;

这是错误的：

    TImage* pTemp = (TImage*)m_pTImgFrame[i];
    if (pTemp != NULL)
    {
        ...
        delete[] pTemp; // deleting as an array of TImage, when it should be deleted as an array of bytes
    }

基于 yoru 代码的不相关切线 - 在调用 delete 之前不需要检查 NULL。一直很安全地说delete NULL。永远都是。