读取一个json文档后，在文档中追加对象，出现崩溃

[hyhtemple]

我的代码如下：

string CpssVehicleSqlObjFactory::CpssVehicleSqlObj::AppendDh1400RelatedList(string& value)
{
	if (value.empty())
	{
		LOGEXCOMM_E(CPSS_APPEND_1400_PARAMETER, ("The vehicle json is empty!"));
		return "";
	}

	if (m_Relateds.empty())
	{
		LOGEXCOMM_E(CPSS_APPEND_1400_PARAMETER, ("The Relateds info is empty!"));
		return "";
	}

	Document doc;
	if (doc.Parse<0>(value.c_str(), value.size()).HasParseError())
	{
		LOGEXCOMM_E(CPSS_APPEND_1400_PARAMETER, ("parse json failed! json=%s", value.c_str()));
		return "";
	}

	//获取分配器
	Document::AllocatorType &allocator = doc.GetAllocator();

	//1.创建RelatedID和RelatedType对象
	Value vRelatedObjAry(kArrayType);
	
	vector<ICpssDh1400RelatedObj*>::iterator iter = m_Relateds.begin();
	Value vRelatedNode(kObjectType);  
	for (; iter != m_Relateds.end(); ++iter)
	{
 //执行到下面的这行出现崩溃		
  vRelatedNode.AddMember(rapidjson::Value(RELATEDID,allocator).Move(),rapidjson::Value((*iter)->GetRelatedIDs().c_str(),allocator).Move(),allocator);
		vRelatedNode.AddMember(rapidjson::Value(RELATEDTYPE,allocator).Move(),rapidjson::Value((*iter)->GetRelatedType().c_str(),allocator).Move(),allocator);
		vRelatedObjAry.PushBack(vRelatedNode,allocator);
	}

	//2.创建RelatedObject对象
	Value vRelatedObj(kObjectType);
	vRelatedObj.AddMember(rapidjson::Value(RELATEDOBJECT,allocator).Move(), vRelatedObjAry, allocator);

	//3.合并RelatedObject对象到Doc对象中
	doc.AddMember(rapidjson::Value(RELATEDLIST,allocator).Move(), vRelatedObj, allocator);

	using rapidjson::StringBuffer;
	using rapidjson::Writer;

	StringBuffer buffer;
	Writer<StringBuffer> writer(buffer);

	doc.Accept(writer);
	value =  buffer.GetString();

	return value;
}

core栈信息如下：

Core was generated by `./tdahuacpss'.
Program terminated with signal 6, Aborted.
#0  0x00007fa1a1545207 in raise () from /usr/lib64/libc.so.6
Missing separate debuginfos, use: debuginfo-install glibc-2.17-260.el7.x86_64 libgcc-4.8.5-36.el7.x86_64 lib
stdc++-4.8.5-36.el7.x86_64 libuuid-2.23.2-59.el7.x86_64 nss-softokn-freebl-3.36.0-5.el7_5.x86_64(gdb) bt
#0  0x00007fa1a1545207 in raise () from /usr/lib64/libc.so.6
#1  0x00007fa1a15468f8 in abort () from /usr/lib64/libc.so.6
#2  0x00007fa1a153e026 in __assert_fail_base () from /usr/lib64/libc.so.6
#3  0x00007fa1a153e0d2 in __assert_fail () from /usr/lib64/libc.so.6
#4  0x00000000006304fa in rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapi
djson::CrtAllocator> >::AddMember (this=0x7fa0fc5f3930, name=..., value=..., allocator=...)    at ../export/rapidjson/document.h:1237
#5  0x000000000078a7e3 in CpssVehicleSqlObjFactory::CpssVehicleSqlObj::AppendDh1400RelatedList (
    this=0x7fa11400b240, 
    value="{\"MotorVehicleID\":\"140000000013200000010220200528154217197410219742\",\"TollgateID\":\"NullVal
ue\",\"TollgateName\":\"\",\"LaneNo\":1,\"DeviceID\":\"14000000001320000001\",\"EquipmentType\":\"09\",\"PassTime\":\"2020-05-28"...) at components/db/CpssSqlObj.cpp:4678#6  0x0000000000805b7c in CtsBuffer::AppendVehicleData (this=0x290e4b0, pcBody=0x7fa1143aefd0 "", 
    uiBodyLen=1029745, index="", obj=0x7fa11400b240, nMsgType=13) at components/storage/CtsBuffer.cpp:300
#7  0x0000000000727985 in StorageComponent::HandleVehicleMessage (this=0x7ffea5858e30, message=
    0x7fa11400aeb0) at components/storage/StorageComponent.cpp:724
#8  0x000000000072ad83 in StorageComponent::HandleVspMessage (this=0x7ffea5858e30, message=0x7fa11400aeb0)
    at components/storage/StorageComponent.cpp:1659
#9  0x000000000072b2ad in StorageComponent::rcvMessage (this=0x7ffea5858e30, cc=..., 
    message=0x7fa11400aeb0) at components/storage/StorageComponent.cpp:1713
#10 0x00000000008574f0 in YapiComponentContainer::deliverMessage (this=0x2934a00, msg=0x7fa11400aeb0)
    at YapiComponentContainer.cpp:430
#11 0x000000000083ed6a in YapiQueueMgr::handleMessage (this=0x2912cd0, msg=0x7fa11400aeb0)
    at YapiQueueMgr.cpp:62
#12 0x00000000008542ff in YapiThreadQueue::Loop() ()
#13 0x00000000008557a1 in YapiThread::Run (this=0x2909170) at YapiThread.cpp:40
#14 0x000000000086bc9a in Yapisys::LinuxThreadStartFunction (param=0x2909170) at yapisyslinuxthread.cpp:18
#15 0x000000000086bcd0 in (anonymous namespace)::YapiLinuxThreadStart (param=0x2909170)
    at yapisyslinuxthread.cpp:28

这个成员函数被执行了3次后，就崩溃了，好像是访问非法内存， 但是我把
Value vRelatedNode(kObjectType);
挪到for循环内，程序就不在崩溃了，但是我想知道这是为什么？

这个函数结束 vRelatedNode的声明周期应该到达了，就会释放内存，

[miloyip]

从代码上看不出问题。会不会有可能是同一个项目里用到了两个版本的 RapidJSON？

[hyhtemple]

没有，这个版本一致没有变过，用户现场用的版本也是一样的

[miloyip]

我看到另一个可能性，会不会有可能是 doc 不是 object，然后在 //3.合并RelatedObject对象到Doc对象中 里 AddMember 做成 assert？

[hyhtemple]

vector<ICpssDh1400RelatedObj*>::iterator iter = m_Relateds.begin();
//Value vRelatedNode(kObjectType);  //注释掉这行
for (; iter != m_Relateds.end(); ++iter)
{
          Value vRelatedNode(kObjectType);  // 这里是我加的	

vRelatedNode.AddMember(rapidjson::Value(RELATEDID,allocator).Move(),rapidjson::Value((*iter)->GetRelatedIDs().c_str(),allocator).Move(),allocator);
vRelatedNode.AddMember(rapidjson::Value(RELATEDTYPE,allocator).Move(),rapidjson::Value((*iter)->GetRelatedType().c_str(),allocator).Move(),allocator);
vRelatedObjAry.PushBack(vRelatedNode,allocator);
}

我这么修改，把 Value vRelatedNode(kObjectType);挪到for循环里面去，程序就不在崩溃了，我就是想问问这个是为什么？这个和内存的使用有关系吗？

[basecoding]

换成debug版本，看看是不是assert了