Segfault with boost::ref

Environment: Ubuntu Maverick (10.10), libboost v1.42, Intel X5680 processors

Issue: When using boost::ref in conjunction with boost::thread and boost::thread_group, a segmentation fault appear after several loops (differing counts each time).

Question: Where might the issue be located? Thanks in advance.

To compile: c++ -lboost_thread -lpthread mttest.cpp -o mttest -g

Sample code: mttest.cpp

#include <iostream>
#include <string>
#include <vector>
#include <iterator>

#include <boost/dynamic_bitset.hpp>
#include <boost/thread.hpp>
#include <boost/bind.hpp>

using namespace std;
using namespace boost;
using namespace boost::this_thread;

void thousand(boost::dynamic_bitset<> &motifarray) {
    for(int i = 0; i < 1000; i++) {
        motifarray[i] = 1;
    }
}

int main (int argc, char* argv[]) {

    boost::dynamic_bitset<> motifarray(1000);
    vector< vector< boost::dynamic_bitset<> > > fbitarrays;
    vector< boost::dynamic_bitset<> > curfbitarray;

    for (int i = 0; i < 100; i++) {
        curfbitarray.push_back(motifarray);
    }

    for (int i = 0; i < 10; i++) {
        fbitarrays.push_back(curfbitarray);
    }

    for (int p = 0; p < 100; p++) {
        boost::thread_group* threadpool = new boost::thread_group();

        for(int j = 0; j < 10; j++) {           
            boost::thread a(boost::bind(&thousand, boost::ref(fbitarrays[p][j])));
            threadpool->add_thread(&a);
            cout << "inner loop: " << j << endl;
        }

        threadpool->join_all();
    }

return 0;
}

gdb backtrace:

#0  0x000000000040503a in boost::dynamic_bitset<unsigned long, std::allocator<unsigned long> >::reference::do_set (this=0x7fbcf8c1bd90)
    at /usr/include/boost/dynamic_bitset/dynamic_bitset.hpp:109
#1  0x0000000000404197 in boost::dynamic_bitset<unsigned long, std::allocator<unsigned long> >::reference::do_assign (this=0x7fbcf8c1bd90, x=true)
    at /usr/include/boost/dynamic_bitset/dynamic_bitset.hpp:112
#2  0x0000000000403a21 in boost::dynamic_bitset<unsigned long, std::allocator<unsigned long> >::reference::operator= (this=0x7fbcf8c1bd90, x=true)
    at /usr/include/boost/dynamic_bitset/dynamic_bitset.hpp:97
#3  0x0000000000401ffd in thousand (motifarray=...) at mttest.cpp:16
#4  0x0000000000408994 in boost::_bi::list1<boost::reference_wrapper<boost::dynamic_bitset<unsigned long, std::allocator<unsigned long> > > >::operator()<void (*)(boost::dynamic_bitset<unsigned long, std::allocator<unsigned long> >&), boost::_bi::list0> (this=0x7fbcf0000ed8, f=@0x7fbcf0000ed0, a=...)
    at /usr/include/boost/bind/bind.hpp:253
#5  0x0000000000408947 in boost::_bi::bind_t<void, void (*)(boost::dynamic_bitset<unsigned long, std::allocator<unsigned long> >&), boost::_bi::list1<boost::reference_wrapper<boost::dynamic_bitset<unsigned long, std::allocator<unsigned long> > > > >::operator() (this=0x7fbcf0000ed0)
    at /usr/include/boost/bind/bind_template.hpp:20
#6  0x0000000000408906 in boost::detail::thread_data<boost::_bi::bind_t<void, void (*)(boost::dynamic_bitset<unsigned long, std::allocator<unsigned long> >&), boost::_bi::list1<boost::reference_wrapper<boost::dynamic_bitset<unsigned long, s---Type <return> to continue, or q <return> to quit---
td::allocator<unsigned long> > > > > >::run (this=0x7fbcf0000da0)
    at /usr/include/boost/thread/detail/thread.hpp:56
#7  0x00007fbcfbb73230 in thread_proxy ()
   from /usr/lib/libboost_thread.so.1.42.0
#8  0x00007fbcfac28971 in start_thread (arg=<value optimized out>)
    at pthread_create.c:304
#9  0x00007fbcfb12c92d in clone ()
    at ../sysd开发者_如何学Ceps/unix/sysv/linux/x86_64/clone.S:112
#10 0x0000000000000000 in ?? ()

fbitarrays has only 10 vectors, while p iterates up to 99. When the thread given fbitarrays[10][0] or whichever p>9 thread happens to get scheduled first, runs, it segfaults attempting access to the broken boost::ref built from the nonexisting vector.

When iterating over a vector using indexed access, it helps to always go up to vector.size().

The use of thread_group has an error too, but that was not the cause of this crash.