Heap corruption when using wxArrayString on Win32

[mr1x]

I am getting heap corruption when using wxArrayString on Windows (wxWidgets version is 2.8.9).

Code: Select all

   int num = 0;
   wxArrayString    testLines;
   while (1) {
      wxString newLine = wxString::FromAscii("xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");
    
      testLines.Add(newLine);

      if (num == 10) {
         testLines.RemoveAt((size_t)0, (size_t)1);
         testLines.Shrink();
         num--;
      }
      num++;
   }

basically, heap is corrupted during first call to Shrink() (evidently), because the second time Shrink() runs - fails with heap corruption error.

(The code is a trivialization of string FIFO.)

Removing Shrink() call "solves" the problem, but then I am not sure if array does not keep growing and taking more memory?

Is this a bug?

[Auria]

This piece of code runs fine on my computer (wxmac 2.8.9), so you might want to look into platform-specific issues...

[mr1x]

This piece of code runs fine on my computer (wxmac 2.8.9), so you might want to look into platform-specific issues...

The platform is Windows XP SP3. Nothing special about it otherwise - vanilla installation, vanilla Visual Studio Express.

[tan]

Hi,
it looks like that is real bug!
Here sources of the wxArrayString::Shrink() (WXDIR/src/common/string.cpp, line 2322):

Code: Select all

// minimizes the memory usage by freeing unused memory
void wxArrayString::Shrink()
{
  // only do it if we have some memory to free
  if( m_nCount < m_nSize ) {
    // allocates exactly as much memory as we need
    wxChar **pNew = new wxChar *[m_nCount];

    // copy data to new location
    memcpy(pNew, m_pItems, m_nCount*sizeof(wxChar *));
    delete [] m_pItems;
    m_pItems = pNew;
  }
}

Actually, it must be:

Code: Select all

// minimizes the memory usage by freeing unused memory
void wxArrayString::Shrink()
{
  // only do it if we have some memory to free
  if( m_nCount < m_nSize ) {
    // allocates exactly as much memory as we need
    wxChar **pNew = new wxChar *[m_nCount];

    // copy data to new location
    memcpy(pNew, m_pItems, m_nCount*sizeof(wxChar *));
    delete [] m_pItems;
    m_pItems = pNew;
    m_nSize = m_nCount;  // <--- save new real size!
  }
}