我基於相當數量的代碼的雙向鏈表似乎有一個bug,它與我從列表中刪除節點的方式有關,但我無法察覺它。請看下面的代碼:正確使用函數指針
typedef struct DL_LIST
{
uint16 tag;
struct DL_LIST *previous;
struct DL_LIST *next;
void *object;
uint32 size;
} DL_LIST;
用於刪除節點的功能如下:
void dl_delete(DL_LIST *node, void (*destructor)(void*))
{
assert(destructor != NULL);
if (node != NULL)
{
dl_extract(node);
if (node->object != NULL)
{
destructor(node->object);
}
free(node);
}
}
其中:
DL_LIST *dl_extract(DL_LIST *node)
{
if (node != NULL)
{
if (node->previous != NULL)
{
node->previous->next = node->next;
}
if (node->next != NULL)
{
node->next->previous = node->previous;
}
node->previous = NULL;
node->next = NULL;
}
return node;
}
是任何人都能夠發現用我的方式問題刪除節點?我認爲存在問題的原因是我已經使用DL_LIST
作爲隊列結構的基礎,並且用於從隊列中刪除項目的函數破壞它,,除了,當我註釋掉dl_delete
的調用時。
EDIT 1.作爲評價請求,隊列代碼如下:
typedef struct QU_LIST
{
DL_LIST *list;
uint32 count;
} QU_LIST;
uint8 qu_remove(QU_LIST *queue, void *object, void (*destructor)(void*))
{
uint8 result = QU_SUCCESS;
uint32 size;
DL_LIST *first_node;
DL_LIST *next_node;
void *marker;
assert(queue != NULL && destructor != NULL);
if (queue->count > 0)
{
first_node = dl_get_first(queue->list);
next_node = dl_get_next(first_node);
marker = dl_get_object(first_node, NULL, &size);
if (marker != NULL)
{
if (object != NULL)
{
memcpy(object, marker, size);
}
}
else
{
result = QU_NO_MEMORY;
}
queue->list = next_node;
dl_delete(first_node, destructor); // this is the problem
--queue->count;
}
else
{
result = QU_EMPTY;
}
return result;
}
其中:
DL_LIST *dl_get_first(DL_LIST *list)
{
if (list != NULL)
{
while (list->previous != NULL)
{
list = list->previous;
}
}
return list;
}
DL_LIST *dl_get_next(DL_LIST *node)
{
if (node != NULL)
{
node = node->next;
}
return node;
}
void *dl_get_object(DL_LIST *node, uint16 *tag, uint32 *size)
{
void *marker = NULL;
if (node != NULL)
{
if (tag != NULL)
{
*tag = node->tag;
}
if (size != NULL)
{
*size = node->size;
}
marker = node->object;
}
return marker;
}
EDIT 2.由於上Wumpus Q. Wumbley的一部分的英鎊答案,問題的根源已被縮小到以下代碼,該代碼是嵌入式系統的導航按鈕庫的一部分。
void bu_test(void)
{
QU_LIST button_list = {0};
BU_OBJECT *object = NULL;
object = bu_create("O");
// object->identifier is "O" at this point.
bu_add(&button_list, "N");
bu_add(&button_list, "S");
bu_add(&button_list, "E");
bu_add(&button_list, "W");
qu_remove(&button_list, object, (void(*)(void*)) &_destructor);
// object->identifier should be "N" at this point, but is not.
}
其中:
typedef struct BU_OBJECT
{
char *identifier;
} BU_OBJECT;
uint8 bu_add(QU_LIST *queue, char *identifier)
{
uint8 result = BU_SUCCESS;
BU_OBJECT* object;
assert(queue != NULL && identifier != NULL);
object = bu_create(identifier);
if (object != NULL)
{
result = qu_add(queue, _TAG, object, sizeof(*object));
if (result == QU_NO_MEMORY)
{
_destructor(object);
result = BU_NO_MEMORY;
}
}
else
{
result = BU_NO_MEMORY;
}
return result;
}
和:
BU_OBJECT *bu_create(char *identifier)
{
BU_OBJECT *object = NULL;
char *p;
assert(identifier != NULL);
object = malloc(sizeof(*object));
if (object != NULL)
{
p = malloc(sizeof(*identifier));
if (p != NULL)
{
strcpy(p, identifier);
object->identifier = p;
}
else
{
free(object);
object = NULL;
}
}
return object;
}
最後:
void _destructor(BU_OBJECT *object)
{
free(object->identifier);
free(object);
}
對象被添加到button_list
沒有錯誤,但現在看來,_destructor
正在銷燬傳遞給函數qu_remove
的對象參數,這對我來說看起來很奇怪,因爲它應該是被銷燬的first_node
的對象,而不是參數的對象。
我讀過它沒有發現任何錯誤。發佈一些更多 –
代碼對我來說也很好看。假設所有的指針(next,previous和object)都是有效的或NULL,應該沒問題。 – Zenilogix
最微妙的部分似乎是memcpy。你確定'qu_remove'的第二個參數是指向一個足夠大的內存區域嗎? –