ASSERT: common\alloc.c:1197: is_entirely_in_heap_region(start, end) (heap data struct inconsistency) #23
Comments
|
From [email protected] on August 13, 2010 05:00:36 Smaller repro with source code: |
|
From [email protected] on August 13, 2010 05:51:37 The attached binary shows "_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)" Abort/Retry/Ignore window under Dr.Memory (v1.2.1 downloaded from here) on Win XP 32-bit. The binary passes if run natively or under r33 . |
|
From [email protected] on August 13, 2010 06:14:15 <attached again - last time it has failed for unknown reason> Attachment: memory_unittest.zip |
|
From [email protected] on August 13, 2010 07:35:27 A similar crash is reproducible on a simlple googletest unittest, see issue #26 . Probably, it's worth fixing issue #26 as a first step. Labels: -Priority-Critical Priority-High |
|
From [email protected] on August 23, 2010 05:49:33 This has gone away with the issue #26 fix. Status: Duplicate |
|
From [email protected] on August 23, 2010 06:23:11 Sorry, my mistake - the assert is still present on the old base_unittests binary (from dr issue #251 ) Status: Accepted |
|
From [email protected] on August 23, 2010 08:12:18 I've been running the issue #251 binary on XPSP2 and have not seen this. Per your initial comment this happens right up front? can you run with "-verbose 2 -pause_at_assert", attach windbg at the assert, point it at the symbols (since drmemorylib.dll isn't on the loader list), get the address of the malloc in question, and then look in the logfile for "adding heap region" and "removing heap region" entries and figure out where the malloc sits in relation to the heap regions known to DrMem? to set symbols in windbg: |
|
From [email protected] on August 23, 2010 08:56:33 Now it passes the initial phase but then fails inside tests (example: MessageLoopTest.RecursiveDenial1) For the record, my XP is SP3. I'll try these flags and windbg now. Summary: ASSERT: common\alloc.c:1197: is_entirely_in_heap_region(start, end) (heap data struct inconsistency) |
|
From [email protected] on August 23, 2010 10:11:16 I'm not familiar with windbg yet, so I've just patched the sources locally to print 'start' and 'end': inside heap routine: adding nop-if-mem-unaddr checks |
|
From [email protected] on August 23, 2010 10:14:23 $ grep "heap region" <global.log> |
|
From [email protected] on August 23, 2010 10:29:05 can you attach the global.*.log (compress it to save space) |
|
From [email protected] on August 23, 2010 11:36:04 Sure. Attachment: 23.zip |
|
From [email protected] on August 23, 2010 13:59:45 intercepting malloc @0x77c2c407 size_func=0x77c2bf6c in module msvcrt.dll
PROBLEMS:
|
|
From [email protected] on August 24, 2010 05:35:13 (How) Can I provide some additional info/logs? |
|
From [email protected] on August 24, 2010 08:41:45 my testing has all been on 64-bit XPSP2. let me find a 32-bit XPSP3 (I assume yours is 32-bit? there is no 64-bit XPSP3 I don't think) and try to repro. this is big enough I would like to have it in front of me. |
|
From [email protected] on August 24, 2010 13:02:11 Yes, my XP SP3 is 32-bit running inside VMware player. |
|
From [email protected] on August 25, 2010 22:00:35 I still can't reproduce the assert. I have an XPSP3 VM (Version 5.1.2600 Service Pack 3 Build 2600). When I run the full test list I hit this assert which I will file separately: [----------] 4 tests from WMIUtilTest After fixing that, the full test list aborts at: If I explicitly run MessageLoopTest*, they all succeed |
|
From [email protected] on August 26, 2010 02:54:13 Can you please publish the fix for WMIUtilTest.TestLocalConnectionSecurityBlanket ? You can skip FileVersion tests by using --gtest_filter="-FileVersion*" as they fail when run natively as well |
|
From [email protected] on August 26, 2010 03:24:07 On my machine, the base_unittests from dr issue #251 pass WITHOUT Dr.Memory with |
|
From [email protected] on August 26, 2010 07:58:17
|
|
From [email protected] on August 26, 2010 18:07:37
Still working on generalizing it since I hit it in another form. Filed as issue #35 .
It is present: First let's see whether our msvcrt.dll versions are different. Here's mine, from windbg: What version do you have? |
|
From [email protected] on August 27, 2010 03:16:55 I got exactly the same results for "lm vm msvcrt". |
|
From [email protected] on August 27, 2010 05:32:20 I've reproduced the original assert on the Chromium bot (without AV) on media tests: $ drmemory.exe media_unittests --gtest_filter="*NoStreams" The media_unittests binary takes 13Mb in .zip so I'll send it to you via e-mail |
|
From [email protected] on August 29, 2010 12:03:30 hmmm it works for me, with or without icudt42.dll in the dir: C:\derek\media\build\Debug>c:\derek\DrMemory-Windows-1.2.1-1\bin\drmemory.exe -pause_at_assert -- media_unittests.exe --gtest_filter="*NoStreams" [----------] 1 test from FFmpegDemuxerTest [----------] Global test environment tear-down YOU HAVE 1 DISABLED TEST :::Dr.Memory::: ERRORS FOUND: |
Adds two separate jobs on Windows, 32-bit and 64-bit. We target a VS2017 Win10-1607 image to match what we had on Appveyor. Modifies the runsuite_wrapper.pl script to *not* fork, since there is no Cygwin perl available by default. Instead, we tee to a file. This is based on the similar work in progress for Dr. Memory: DynamoRIO/drmemory#23 Issue: #4131
AArch64 port of drmemory. Only contains slowpath support with shared_slowpath off. Pattern mode and fastpath modes are being worked on separately. Depends on: https://github.com/DynamoRIO/dynamorio/tree/mem-ref-for-clean-calls-aarch64/core Current tests we have analysed: Test project /home/grecaw01/APD-testing/drmem-upstream3/drmemory/build Start 1: drmf_proj 1/49 Test #1: drmf_proj ......................... Passed 0.45 sec Start 2: unit_tests 2/49 Test #2: unit_tests ........................ Passed 0.02 sec Start 3: hello 3/49 Test #3: hello ............................. Passed 3.55 sec Start 4: free 4/49 Test #4: free .............................. Passed 3.67 sec Start 5: malloc 5/49 Test #5: malloc ............................ Passed 3.88 sec Start 6: leak_indirect 6/49 Test #6: leak_indirect ..................... Passed 3.52 sec Start 7: patterns 7/49 Test #7: patterns .......................... Passed 3.93 sec Start 8: free.exitcode 8/49 Test #8: free.exitcode ..................... Passed 3.64 sec Start 9: track_origins 9/49 Test #9: track_origins .....................***Failed 0.34 sec Start 10: free.pattern 10/49 Test #10: free.pattern ......................***Failed 0.35 sec Start 11: malloc.pattern 11/49 Test #11: malloc.pattern ....................***Failed 0.34 sec Start 12: track_origins.pattern 12/49 Test #12: track_origins.pattern .............***Failed 0.34 sec Start 13: fuzz_corpus 13/49 Test #13: fuzz_corpus ....................... Passed 3.56 sec Start 14: fuzz_buffer 14/49 Test #14: fuzz_buffer ....................... Passed 4.62 sec Start 15: fuzz_buffer.replace_buffer 15/49 Test #15: fuzz_buffer.replace_buffer ........ Passed 4.62 sec Start 16: fuzz_buffer.overflow 16/49 Test #16: fuzz_buffer.overflow ..............***Failed 0.34 sec Start 17: fuzz_buffer.mutator.o-b-s-3 17/49 Test #17: fuzz_buffer.mutator.o-b-s-3 ....... Passed 4.59 sec Start 18: fuzz_buffer.mutator.r-b-s-3 18/49 Test #18: fuzz_buffer.mutator.r-b-s-3 ....... Passed 4.63 sec Start 19: fuzz_buffer.mutator.o-b-3 19/49 Test #19: fuzz_buffer.mutator.o-b-3 ......... Passed 4.60 sec Start 20: fuzz_buffer.mutator.r-n 20/49 Test #20: fuzz_buffer.mutator.r-n ........... Passed 4.54 sec Start 21: fuzz_buffer.mutator.random_seed 21/49 Test #21: fuzz_buffer.mutator.random_seed ... Passed 4.57 sec Start 22: fuzz_buffer.one-input 22/49 Test #22: fuzz_buffer.one-input ............. Passed 3.82 sec Start 23: fuzz_buffer.load_input 23/49 Test #23: fuzz_buffer.load_input ............ Passed 3.81 sec Start 24: fuzz_buffer.skip_initial 24/49 Test #24: fuzz_buffer.skip_initial .......... Passed 4.01 sec Start 25: fuzz_buffer.fixed_size 25/49 Test #25: fuzz_buffer.fixed_size ............ Passed 5.36 sec Start 26: fuzz_buffer.offset 26/49 Test #26: fuzz_buffer.offset ................ Passed 5.42 sec Start 27: fuzz_buffer.module_name 27/49 Test #27: fuzz_buffer.module_name ........... Passed 4.58 sec Start 28: fuzz_buffer.dictionary 28/49 Test #28: fuzz_buffer.dictionary ............ Passed 4.20 sec Start 29: fuzz_buffer.cpp 29/49 Test #29: fuzz_buffer.cpp ................... Passed 17.77 sec Start 30: fuzz_custom_mutator 30/49 Test #30: fuzz_custom_mutator ............... Passed 4.57 sec Start 31: drsyscall_test 31/49 Test #31: drsyscall_test .................... Passed 0.22 sec Start 32: strace_test 32/49 Test #32: strace_test ....................... Passed 0.22 sec Start 33: drfuzz_test_empty 33/49 Test #33: drfuzz_test_empty ................. Passed 0.22 sec Start 34: drfuzz_test_mutator 34/49 Test #34: drfuzz_test_mutator ............... Passed 2.38 sec Start 35: drfuzz_test_repeat 35/49 Test #35: drfuzz_test_repeat ................***Failed Start 36: drfuzz_test_segfault 36/49 Test #36: drfuzz_test_segfault .............. Passed 0.20 sec Start 37: drfuzz_test_app_abort 37/49 Test #37: drfuzz_test_app_abort ............. Passed 0.22 sec Start 38: drfuzz_test_no_crash 38/49 Test #38: drfuzz_test_no_crash .............. Passed 0.22 sec Start 39: umbra_test_empty 39/49 Test #39: umbra_test_empty .................. Passed 0.22 sec Start 40: umbra_test_overlap 40/49 Test #40: umbra_test_overlap ................ Passed 0.23 sec Start 41: umbra_test_shadow_mem 41/49 Test #41: umbra_test_shadow_mem ............. Passed 0.30 sec Start 42: umbra_test_insert_app_to_shadow 42/49 Test #42: umbra_test_insert_app_to_shadow ... Passed 0.29 sec Start 43: umbra_test_consistency 43/49 Test #43: umbra_test_consistency ............ Passed 0.30 sec Start 44: umbra_test_allscales 44/49 Test #44: umbra_test_allscales .............. Passed 0.39 sec Start 45: drltrace 45/49 Test #45: drltrace .......................... Passed 0.35 sec Start 46: drltrace_libcalls 46/49 Test #46: drltrace_libcalls ................. Passed 0.36 sec Start 47: drltrace_symargs 47/49 Test #47: drltrace_symargs .................. Passed 0.36 sec Start 48: drltrace_libargs 48/49 Test #48: drltrace_libargs .................. Passed 0.35 sec Start 49: strace_sample 49/49 Test #49: strace_sample ..................... Passed 0.22 sec 88% tests passed, 6 tests failed out of 49
AArch64 port of drmemory. Only contains slowpath support with shared_slowpath off. Pattern mode and fastpath modes are being worked on separately. Currently this build does break some x86 functionality. Depends on: https://github.com/DynamoRIO/dynamorio/tree/mem-ref-for-clean-calls-aarch64/core Current tests we have analysed: Test project /home/grecaw01/APD-testing/drmem-upstream3/drmemory/build Start 1: drmf_proj 1/49 Test #1: drmf_proj ......................... Passed 0.45 sec Start 2: unit_tests 2/49 Test #2: unit_tests ........................ Passed 0.02 sec Start 3: hello 3/49 Test #3: hello ............................. Passed 3.55 sec Start 4: free 4/49 Test #4: free .............................. Passed 3.67 sec Start 5: malloc 5/49 Test #5: malloc ............................ Passed 3.88 sec Start 6: leak_indirect 6/49 Test #6: leak_indirect ..................... Passed 3.52 sec Start 7: patterns 7/49 Test #7: patterns .......................... Passed 3.93 sec Start 8: free.exitcode 8/49 Test #8: free.exitcode ..................... Passed 3.64 sec Start 9: track_origins 9/49 Test #9: track_origins .....................***Failed 0.34 sec Start 10: free.pattern 10/49 Test #10: free.pattern ......................***Failed 0.35 sec Start 11: malloc.pattern 11/49 Test #11: malloc.pattern ....................***Failed 0.34 sec Start 12: track_origins.pattern 12/49 Test #12: track_origins.pattern .............***Failed 0.34 sec Start 13: fuzz_corpus 13/49 Test #13: fuzz_corpus ....................... Passed 3.56 sec Start 14: fuzz_buffer 14/49 Test #14: fuzz_buffer ....................... Passed 4.62 sec Start 15: fuzz_buffer.replace_buffer 15/49 Test #15: fuzz_buffer.replace_buffer ........ Passed 4.62 sec Start 16: fuzz_buffer.overflow 16/49 Test #16: fuzz_buffer.overflow ..............***Failed 0.34 sec Start 17: fuzz_buffer.mutator.o-b-s-3 17/49 Test #17: fuzz_buffer.mutator.o-b-s-3 ....... Passed 4.59 sec Start 18: fuzz_buffer.mutator.r-b-s-3 18/49 Test #18: fuzz_buffer.mutator.r-b-s-3 ....... Passed 4.63 sec Start 19: fuzz_buffer.mutator.o-b-3 19/49 Test #19: fuzz_buffer.mutator.o-b-3 ......... Passed 4.60 sec Start 20: fuzz_buffer.mutator.r-n 20/49 Test #20: fuzz_buffer.mutator.r-n ........... Passed 4.54 sec Start 21: fuzz_buffer.mutator.random_seed 21/49 Test #21: fuzz_buffer.mutator.random_seed ... Passed 4.57 sec Start 22: fuzz_buffer.one-input 22/49 Test #22: fuzz_buffer.one-input ............. Passed 3.82 sec Start 23: fuzz_buffer.load_input 23/49 Test #23: fuzz_buffer.load_input ............ Passed 3.81 sec Start 24: fuzz_buffer.skip_initial 24/49 Test #24: fuzz_buffer.skip_initial .......... Passed 4.01 sec Start 25: fuzz_buffer.fixed_size 25/49 Test #25: fuzz_buffer.fixed_size ............ Passed 5.36 sec Start 26: fuzz_buffer.offset 26/49 Test #26: fuzz_buffer.offset ................ Passed 5.42 sec Start 27: fuzz_buffer.module_name 27/49 Test #27: fuzz_buffer.module_name ........... Passed 4.58 sec Start 28: fuzz_buffer.dictionary 28/49 Test #28: fuzz_buffer.dictionary ............ Passed 4.20 sec Start 29: fuzz_buffer.cpp 29/49 Test #29: fuzz_buffer.cpp ................... Passed 17.77 sec Start 30: fuzz_custom_mutator 30/49 Test #30: fuzz_custom_mutator ............... Passed 4.57 sec Start 31: drsyscall_test 31/49 Test #31: drsyscall_test .................... Passed 0.22 sec Start 32: strace_test 32/49 Test #32: strace_test ....................... Passed 0.22 sec Start 33: drfuzz_test_empty 33/49 Test #33: drfuzz_test_empty ................. Passed 0.22 sec Start 34: drfuzz_test_mutator 34/49 Test #34: drfuzz_test_mutator ............... Passed 2.38 sec Start 35: drfuzz_test_repeat 35/49 Test #35: drfuzz_test_repeat ................***Failed Start 36: drfuzz_test_segfault 36/49 Test #36: drfuzz_test_segfault .............. Passed 0.20 sec Start 37: drfuzz_test_app_abort 37/49 Test #37: drfuzz_test_app_abort ............. Passed 0.22 sec Start 38: drfuzz_test_no_crash 38/49 Test #38: drfuzz_test_no_crash .............. Passed 0.22 sec Start 39: umbra_test_empty 39/49 Test #39: umbra_test_empty .................. Passed 0.22 sec Start 40: umbra_test_overlap 40/49 Test #40: umbra_test_overlap ................ Passed 0.23 sec Start 41: umbra_test_shadow_mem 41/49 Test #41: umbra_test_shadow_mem ............. Passed 0.30 sec Start 42: umbra_test_insert_app_to_shadow 42/49 Test #42: umbra_test_insert_app_to_shadow ... Passed 0.29 sec Start 43: umbra_test_consistency 43/49 Test #43: umbra_test_consistency ............ Passed 0.30 sec Start 44: umbra_test_allscales 44/49 Test #44: umbra_test_allscales .............. Passed 0.39 sec Start 45: drltrace 45/49 Test #45: drltrace .......................... Passed 0.35 sec Start 46: drltrace_libcalls 46/49 Test #46: drltrace_libcalls ................. Passed 0.36 sec Start 47: drltrace_symargs 47/49 Test #47: drltrace_symargs .................. Passed 0.36 sec Start 48: drltrace_libargs 48/49 Test #48: drltrace_libargs .................. Passed 0.35 sec Start 49: strace_sample 49/49 Test #49: strace_sample ..................... Passed 0.22 sec 88% tests passed, 6 tests failed out of 49
From [email protected] on August 12, 2010 08:42:01
-> asserts right away.
Looks like it doesn't support something done during googletest startup.
This happens on both r35 and v1.2.1 downloaded from here.
I'll continue using r33 until this is fixed.
Original issue: http://code.google.com/p/drmemory/issues/detail?id=23
The text was updated successfully, but these errors were encountered: