Preconditions:
- Class must be formed in a way which causes the compiler to call __cxa_vec_new with a prefix size of 8 when performing an array allocation
- Unclear what conditions cause this. In my sample, the class contains only two member variables, a std::string and a long long. If either of these is removed, or their types are changed, the compiler uses a prefix size of 4, which does not provoke the failure.
- Typedef alias created to said class
- Array of objects allocated via the typedef
Result:
Given the above scenario, calling delete[] on the pointer returned by new[] will cause SYS/BIOS to abort.
Cause:
The compiler generated a call to __cxa_vec_new with a prefix size of 8. However, for the delete, it generates the __cxa_vec_delete call with a prefix size of 4. The mismatched prefix sizes causes __cxa_vec_delete to calculate the incorrect array_ptr to delete/free.
Workaround:
Use the original class definition, not the typedef. In which case, both the new and the delete calls are made with the same prefix size of 8.
Tested Compilers:
Present in both 7.4.13 and 7.4.14.
Not present in 7.3.15 (does not generate calls to __cxa_vec_new/__cxa_vec_delete).
Sample Code:
#include <string>
class MyClass
{
private:
std::string mString;
long long mLongLong;
};
typedef class MyClass MyTypeDef;
void testFunc()
{
MyClass* myClass_ = new MyClass[2]; // Calls __cxa_vec_new w/ prefix = 8
delete[] myClass_; // Calls __cxa_vec_delete w/ prefix = 8; Succeeds
MyTypeDef* myTypeDef = new MyTypeDef[2]; // Calls __cxa_vec_new w/ prefix = 8
delete[] myTypeDef; // Calls __cxa_vec_delete w/ prefix = 4; ABORTS
}
Compiler Options:
-pden -mv6600 -qq -pds383 -@ C:\Git\in-sight-vision\In-Sight_FW\br\tools\build\\..\..\bin\SYSBios-elf-tda2xx_c66x-is8000-debug\generated/compiler.opt -as -mi10000 -mr1 -ms1 -qq -pds303 -pds238 -s -mi10000 -ml2 -mr1 -ms1 -pds112 -g -pds188 -eo=.obj