C++ boost:：smart_指针处的seg故障

我得到了以下分段错误：

Program terminated with signal 11, Segmentation fault.
#0  0x000000000040fbf6 in release (this=<value optimized out>, __in_chrg=<value optimized out>)
at /usr/local/include/boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp:145
145             dispose();
Missing separate debuginfos, use: debuginfo-install boost-filesystem-   1.41.0-11.el6_1.2.x86_64 boost-program-options-1.41.0-11.el6_1.2.x86_64 boost-system-1.41.0-11.el6_1.2.x86_64 bzip2-libs-1.0.5-7.el6_0.x86_64 glibc-2.12-1.80.el6.x86_64 libgcc-4.4.6-4.el6.x86_64 libstdc++-4.4.6-4.el6.x86_64 lzo-2.03-3.1.el6.x86_64
(gdb) bt
#0  0x000000000040fbf6 in release (this=<value optimized out>, __in_chrg=<value optimized out>)
at /usr/local/include/boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp:145
#1  boost::detail::shared_count::~shared_count (this=<value optimized out>, __in_chrg=<value optimized out>)
at /usr/local/include/boost/smart_ptr/detail/shared_count.hpp:217
#2  0x00007f13fad83dab in boost::detail::set_tss_data(void const*, boost::shared_ptr<boost::detail::tss_cleanup_function>, void*, bool) ()
 from /usr/local/lib/libboost_thread.so.1.40.0
#3  0x000000000042e191 in boost::thread_specific_ptr<infrastructure::tfeed::sequenced_data_queue_element_t::mem_prealloc>::release (this=<value optimized out>)
at /usr/local/include/boost/thread/tss.hpp:95
#4  0x000000000042ed43 in  infrastructure::tfeed::sequenced_data_queue_element_t::operator new (size=16)
at ../../../infrastructure/include/tfeed/tfeed_multicast_defs.h:120

此外，在sp_counted_base_gcc_x86.hpp（在dispose（）中）

我使用特定于线程的指针，同时对数据结构（sequenced_data_queue_element_t）进行专门的new和delete调用。由于此new和delete是从多个线程调用的：

  class sequenced_data_queue_element_t
  {
    public:
    sequenced_data_queue_element_t() {
    }
   ~sequenced_data_queue_element_t() {
        delete data;
    }

unsigned char* data;
uint32_t data_len;


typedef struct mem_prealloc
{
    struct mem_prealloc* next;
} mem_prealloc_t;

static boost::thread_specific_ptr<mem_prealloc_t> mem_prealloc_q_head;

static void* operator new(size_t size)
{
    mem_prealloc_t* q_elem;
    if (UNLIKELY(mem_prealloc_q_head.get() == NULL))
    {
        /* allocate PREALLOC_BATCH elems at a time */
        for (int i=0; i < MEM_PREALLOC_BATCH; i++)
        {
            q_elem = (mem_prealloc_t*)malloc(size);
            q_elem->next = mem_prealloc_q_head.release();
            mem_prealloc_q_head.reset(q_elem);
            cur_mem_prealloced += size;
        }
    }

    q_elem = mem_prealloc_q_head.release();
    mem_prealloc_q_head.reset(q_elem->next);
    return (void*)q_elem;
}

static void operator delete(void* q_elem)
{
   /* C++ guarantees that an object's destructor 
    * is automatically called just before delete executes. */
  /* next reuses the first pointer of sequenced_data_element_t */
    ((mem_prealloc_t*)q_elem)->next = mem_prealloc_q_head.release();
    mem_prealloc_q_head.reset((mem_prealloc_t*)q_elem);

    if (cur_mem_prealloced > MEM_PREALLOC_MAX_BYTES)
    {
        for (int i=0; i < MEM_PREALLOC_BATCH; i++)
        {
            mem_prealloc_t* qelem = mem_prealloc_q_head.release();
            mem_prealloc_q_head.reset(qelem->next);
            free(qelem);
            cur_mem_prealloced -= sizeof(sequenced_data_queue_element_t);
            if (mem_prealloc_q_head.get() == NULL)
                break;
        }
    }
}

---

在堆栈损坏的情况下，是否也会触发这些seg故障

拥有一个数据字段未由构造函数初始化的结构，并且没有复制构造函数或复制赋值函数（阅读关于的，或者关于的）对我来说似乎是一个灾难。一个通知可能与异常原因无关。全局变量

cur\u mem\u prealloced

是否声明为原子变量（类似于boost:：atomic）？否则就存在竞态条件。

    T* release()
    {
        T* const temp=get();
                   detail::set_tss_data(this,boost::shared_ptr<detail::tss_cleanup_function>(),0,false);
        return temp;
    }

void release() // nothrow
{
    if( atomic_exchange_and_add( &use_count_, -1 ) == 1 )
    {
        dispose();
        weak_release();
    }
}

  class sequenced_data_queue_element_t
  {
    public:
    sequenced_data_queue_element_t() {
    }
   ~sequenced_data_queue_element_t() {
        delete data;
    }

unsigned char* data;
uint32_t data_len;


typedef struct mem_prealloc
{
    struct mem_prealloc* next;
} mem_prealloc_t;

static boost::thread_specific_ptr<mem_prealloc_t> mem_prealloc_q_head;

static void* operator new(size_t size)
{
    mem_prealloc_t* q_elem;
    if (UNLIKELY(mem_prealloc_q_head.get() == NULL))
    {
        /* allocate PREALLOC_BATCH elems at a time */
        for (int i=0; i < MEM_PREALLOC_BATCH; i++)
        {
            q_elem = (mem_prealloc_t*)malloc(size);
            q_elem->next = mem_prealloc_q_head.release();
            mem_prealloc_q_head.reset(q_elem);
            cur_mem_prealloced += size;
        }
    }

    q_elem = mem_prealloc_q_head.release();
    mem_prealloc_q_head.reset(q_elem->next);
    return (void*)q_elem;
}

static void operator delete(void* q_elem)
{
   /* C++ guarantees that an object's destructor 
    * is automatically called just before delete executes. */
  /* next reuses the first pointer of sequenced_data_element_t */
    ((mem_prealloc_t*)q_elem)->next = mem_prealloc_q_head.release();
    mem_prealloc_q_head.reset((mem_prealloc_t*)q_elem);

    if (cur_mem_prealloced > MEM_PREALLOC_MAX_BYTES)
    {
        for (int i=0; i < MEM_PREALLOC_BATCH; i++)
        {
            mem_prealloc_t* qelem = mem_prealloc_q_head.release();
            mem_prealloc_q_head.reset(qelem->next);
            free(qelem);
            cur_mem_prealloced -= sizeof(sequenced_data_queue_element_t);
            if (mem_prealloc_q_head.get() == NULL)
                break;
        }
    }
}

  [7547]: segfault at 10 ip 000000000040fbf6 sp 00007f122e1fcd90 error 4
  [7531]: segfault at 10 ip 000000000040fbf6 sp 00007fffc94bcca0 error 4 in tbt[400000+a0000] in tbt[400000+a0000]