为什么这种递归子集和算法会导致指针分配错误

好的，这是我的子集和算法实现：

std::vector<Key> Brute::subset_sum(const std::vector<Key>& Table, Key& target, const std::vector<Key>& solution) {
    Key sum = Key();
    for (std::vector<Key>::const_iterator it = solution.begin(); it != solution.end(); it++) {
        sum += *it;
    }
    if (sum == target) {
        return solution;
    }
    if (target < sum) {
        return std::vector<Key>();
    }
    Key key;
    for (std::vector<Key>::const_iterator it = Table.begin(); it != Table.end(); it++) {
        key = *it;
        std::vector<Key> remaining;
        for (std::vector<Key>::const_iterator jt = it; jt != Table.end(); jt++) {
            if (jt == it) {
                continue;
            }
            remaining.push_back(*it);
        }
        std::vector<Key> sol = solution;
        sol.push_back(key);
        subset_sum(remaining, target, sol);
    }
}

每个键都有一个数值，并且所需的比较和加法运算符已重载。

通过 lldb 运行它后，我得到以下输出：

(lldb)
brute(1465,0x7fffae14d3c0) malloc: *** error for object 0x7fff5fbff6b0: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug
Process 1465 stopped
* thread #1: tid = 0x9ee7, 0x00007fffa5307d42 libsystem_kernel.dylib`__pthread_kill + 10, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
    frame #0: 0x00007fffa5307d42 libsystem_kernel.dylib`__pthread_kill + 10
libsystem_kernel.dylib`__pthread_kill:
->  0x7fffa5307d42 <+10>: jae    0x7fffa5307d4c            ; <+20>
    0x7fffa5307d44 <+12>: movq   %rax, %rdi
    0x7fffa5307d47 <+15>: jmp    0x7fffa5300caf            ; cerror_nocancel
    0x7fffa5307d4c <+20>: retq

以下是回溯：

(lldb) bt
* thread #1: tid = 0x9ee7, 0x00007fffa5307d42 libsystem_kernel.dylib`__pthread_kill + 10, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
  * frame #0: 0x00007fffa5307d42 libsystem_kernel.dylib`__pthread_kill + 10
    frame #1: 0x00007fffa53f55bf libsystem_pthread.dylib`pthread_kill + 90
    frame #2: 0x00007fffa526d420 libsystem_c.dylib`abort + 129
    frame #3: 0x00007fffa535cfe7 libsystem_malloc.dylib`free + 530
    frame #4: 0x00000001000022a6 brute`Brute::subset_sum(std::__1::vector<Key, std::__1::allocator<Key> > const&, Key&, std::__1::vector<Key, std::__1::allocator<Key> > const&) [inlined] std::__1::__deallocate(__ptr=<unavailable>) + 822 at new:177 [opt]
    frame #5: 0x00000001000022a1 brute`Brute::subset_sum(std::__1::vector<Key, std::__1::allocator<Key> > const&, Key&, std::__1::vector<Key, std::__1::allocator<Key> > const&) [inlined] std::__1::allocator<Key>::deallocate(__p=<unavailable>) at memory:1731 [opt]
    frame #6: 0x00000001000022a1 brute`Brute::subset_sum(std::__1::vector<Key, std::__1::allocator<Key> > const&, Key&, std::__1::vector<Key, std::__1::allocator<Key> > const&) [inlined] std::__1::allocator_traits<std::__1::allocator<Key> >::deallocate(__p=<unavailable>) at memory:1496 [opt]
    frame #7: 0x00000001000022a1 brute`Brute::subset_sum(std::__1::vector<Key, std::__1::allocator<Key> > const&, Key&, std::__1::vector<Key, std::__1::allocator<Key> > const&) [inlined] std::__1::__vector_base<Key, std::__1::allocator<Key> >::~__vector_base() + 21 at vector:452 [opt]
    frame #8: 0x000000010000228c brute`Brute::subset_sum(std::__1::vector<Key, std::__1::allocator<Key> > const&, Key&, std::__1::vector<Key, std::__1::allocator<Key> > const&) [inlined] std::__1::vector<Key, std::__1::allocator<Key> >::~vector() at vector:457 [opt]
    frame #9: 0x000000010000228c brute`Brute::subset_sum(std::__1::vector<Key, std::__1::allocator<Key> > const&, Key&, std::__1::vector<Key, std::__1::allocator<Key> > const&) [inlined] std::__1::vector<Key, std::__1::allocator<Key> >::~vector() at vector:457 [opt]
    frame #10: 0x000000010000228c brute`Brute::subset_sum(this=0x0000000100400000, Table=<unavailable>, target=<unavailable>, solution=size=1) + 796 at brute.cpp:56 [opt]
    frame #11: 0x0000000100002269 brute`Brute::subset_sum(this=0x0000000100400000, Table=<unavailable>, target=<unavailable>, solution=size=0) + 761 at brute.cpp:56 [opt]
    frame #12: 0x0000000100002884 brute`main [inlined] Brute::decrypt(this=0x0000000100400000) + 56 at brute.cpp:27 [opt]
    frame #13: 0x000000010000284c brute`main(argc=<unavailable>, argv=<unavailable>) + 44 at brute.cpp:97 [opt]
    frame #14: 0x00007fffa51d9235 libdyld.dylib`start + 1
    frame #15: 0x00007fffa51d9235 libdyld.dylib`start + 1

自从我用C++编码以来已经有一段时间了，所以如果熟悉该语言的人可以指出我的方法中的错误，我将不胜感激。