malloc: *** error for object: incorrect checksum for freed object

[Fabian Schuiki]

Hi everyone!

I'm not that experienced with C++, but in most cases, my code works as  
intended.
Now I've encountered the following error:

"malloc: *** error for object 0x129d90: incorrect checksum for freed  
object - object was probably modified after being freed"

This happens in this code segment (at least I tracked down the error  
to this segment):

//Remove all whitespaces
std::string str = input;
std::string sub = " ";
std::string rep = "";
std::string::size_type pos = str.find(sub, 0);
int len = sub.length();
while (std::string::npos != pos)
{
	str.replace(pos, len, rep);
	pos = str.find(sub, pos);
}

It seems to be the line

	str.replace(pos, len, rep);

that causes the problem — if I comment it out, the error message  
disappears.
If I set a breakpoint in "malloc_error_break" as the error suggests,  
the debugger breaks somewhere in NSApplicationMain:

#0	0x91280060 in malloc_error_break
#1	0x9127acc8 in szone_error
#2	0x91173078 in tiny_free_list_add_ptr
#3	0x9116fc20 in szone_free

#4	0x90046a5c in std::_Rb_tree<void const*, std::pair<void const*  
const, NotificationInformationStruct*>, std::_Select1st<std::pair<void  
const* const, NotificationInformationStruct*> >, std::less<void  
const*>, std::allocator<std::pair<void const* const,  
NotificationInformationStruct*> > >::destroy_node

#5	0x90046af4 in std::_Rb_tree<void const*, std::pair<void const*  
const, NotificationInformationStruct*>, std::_Select1st<std::pair<void  
const* const, NotificationInformationStruct*> >, std::less<void  
const*>, std::allocator<std::pair<void const* const,  
NotificationInformationStruct*> > >::_M_erase

#6	0x90046ae4 in std::_Rb_tree<void const*, std::pair<void const*  
const, NotificationInformationStruct*>, std::_Select1st<std::pair<void  
const* const, NotificationInformationStruct*> >, std::less<void  
const*>, std::allocator<std::pair<void const* const,  
NotificationInformationStruct*> > >::_M_erase

#7	0x90046bcc in std::_Rb_tree<void const*, std::pair<void const*  
const, NotificationInformationStruct*>, std::_Select1st<std::pair<void  
const* const, NotificationInformationStruct*> >, std::less<void  
const*>, std::allocator<std::pair<void const* const,  
NotificationInformationStruct*> > >::~_Rb_tree

#8	0x9117c2ac in __cxa_finalize
#9	0x9117c188 in exit
#10	0x936569d8 in NSApplicationMain
#11	0x00002784 in main at main.mm:14


After this code segment which is supposed to remove all whitespaces in  
the string "input", there are several substrings taken from the string  
"str" and are then filled into a std::map.
There are actually 4 key-value-pairs in the final std::map. The stack  
trace also lists 4 entries that seem to be related to std::pair —  
maybe this is a clue.


Does anyone know what the solution could be for this problem?

Thanks in advance,
Happy New Year,
Fabian


Fabian Schuiki
fabianschuiki at bluewin.ch