False reports on CreateWindow #17
Comments
|
From timurrrr@google.com on August 04, 2010 07:20:37 Labels: Bug-FalsePositive |
|
From timurrrr@google.com on August 11, 2010 02:17:46 This may be related to unhandled syscalls: WARNING: unhandled system call #0x11e8Error Error Cc: derek.bruening |
|
From timurrrr@google.com on August 11, 2010 04:03:54 http://j00ru.vexillium.org/win32k_syscalls/ On XP, |
|
From timurrrr@google.com on August 11, 2010 06:36:43 Is this sane? thread initial stack: 0x00030000-0x00129000-0x00130000, TOS=0x0012fffc |
|
From derek.br...@gmail.com on August 11, 2010 07:25:16 this is what I mentioned in a prior email: the "ERROR: 0x........ popping unaddressable memory" is a bad sign. is this from the small sample code in the initial comment for this issue? is there a line "WARNING: unknown region..." in the global log? |
|
From timurrrr@google.com on August 11, 2010 07:36:28
There were 5 lines it is present the base_unittests .log I gave you yesterday: I'll try to create a small reproducer for the "unknown region" warnings and file a separate issue. |
|
From timurrrr@google.com on August 11, 2010 07:54:37 NB I always build tests with "cl /Zi <test_file_name>"
|
|
From derek.br...@gmail.com on August 11, 2010 12:34:58 no, not /Zi on my XPSP2x64 box the sample code raises one uninit, RtlMultiByteToUnicodeN, but no unaddrs at all, compiled /Zi |
|
From timurrrr@google.com on August 11, 2010 13:29:02 Hm... |
|
From derek.br...@gmail.com on August 20, 2010 16:06:02 I am using VS2005 sp1. I can't repro the "ERROR: 0x........ popping unaddressable memory" in base_unittests.exe either (using drmem r37 , DR r413 ) with --gtest_filter="Time*" on my XP VM. this is the base_unittests.exe from DR issue #251 . |
|
From timurrrr@google.com on July 19, 2011 03:26:22 Update: as of r397 , the reports look like this: [XP 32-bits with symbols] Error [without the symbols the uninit report looks like this] |
|
From rnk@google.com on January 10, 2012 12:33:20 The plfCreateLOCALFONT leak got fixed in issue #733 / r696 , but we should re-investigate the CreateWindowEx uninit. Owner: rnk@google.com |
|
From zhao...@google.com on September 10, 2012 20:59:04 uninit can be reproduced in handle.exe test with full Dr.Memory.
|
AArch64 port of drmemory. Only contains slowpath support with shared_slowpath off. Pattern mode and fastpath modes are being worked on separately. Depends on: https://github.com/DynamoRIO/dynamorio/tree/mem-ref-for-clean-calls-aarch64/core Current tests we have analysed: Test project /home/grecaw01/APD-testing/drmem-upstream3/drmemory/build Start 1: drmf_proj 1/49 Test #1: drmf_proj ......................... Passed 0.45 sec Start 2: unit_tests 2/49 Test #2: unit_tests ........................ Passed 0.02 sec Start 3: hello 3/49 Test #3: hello ............................. Passed 3.55 sec Start 4: free 4/49 Test #4: free .............................. Passed 3.67 sec Start 5: malloc 5/49 Test #5: malloc ............................ Passed 3.88 sec Start 6: leak_indirect 6/49 Test #6: leak_indirect ..................... Passed 3.52 sec Start 7: patterns 7/49 Test #7: patterns .......................... Passed 3.93 sec Start 8: free.exitcode 8/49 Test #8: free.exitcode ..................... Passed 3.64 sec Start 9: track_origins 9/49 Test #9: track_origins .....................***Failed 0.34 sec Start 10: free.pattern 10/49 Test #10: free.pattern ......................***Failed 0.35 sec Start 11: malloc.pattern 11/49 Test #11: malloc.pattern ....................***Failed 0.34 sec Start 12: track_origins.pattern 12/49 Test #12: track_origins.pattern .............***Failed 0.34 sec Start 13: fuzz_corpus 13/49 Test #13: fuzz_corpus ....................... Passed 3.56 sec Start 14: fuzz_buffer 14/49 Test #14: fuzz_buffer ....................... Passed 4.62 sec Start 15: fuzz_buffer.replace_buffer 15/49 Test #15: fuzz_buffer.replace_buffer ........ Passed 4.62 sec Start 16: fuzz_buffer.overflow 16/49 Test #16: fuzz_buffer.overflow ..............***Failed 0.34 sec Start 17: fuzz_buffer.mutator.o-b-s-3 17/49 Test #17: fuzz_buffer.mutator.o-b-s-3 ....... Passed 4.59 sec Start 18: fuzz_buffer.mutator.r-b-s-3 18/49 Test #18: fuzz_buffer.mutator.r-b-s-3 ....... Passed 4.63 sec Start 19: fuzz_buffer.mutator.o-b-3 19/49 Test #19: fuzz_buffer.mutator.o-b-3 ......... Passed 4.60 sec Start 20: fuzz_buffer.mutator.r-n 20/49 Test #20: fuzz_buffer.mutator.r-n ........... Passed 4.54 sec Start 21: fuzz_buffer.mutator.random_seed 21/49 Test #21: fuzz_buffer.mutator.random_seed ... Passed 4.57 sec Start 22: fuzz_buffer.one-input 22/49 Test #22: fuzz_buffer.one-input ............. Passed 3.82 sec Start 23: fuzz_buffer.load_input 23/49 Test #23: fuzz_buffer.load_input ............ Passed 3.81 sec Start 24: fuzz_buffer.skip_initial 24/49 Test #24: fuzz_buffer.skip_initial .......... Passed 4.01 sec Start 25: fuzz_buffer.fixed_size 25/49 Test #25: fuzz_buffer.fixed_size ............ Passed 5.36 sec Start 26: fuzz_buffer.offset 26/49 Test #26: fuzz_buffer.offset ................ Passed 5.42 sec Start 27: fuzz_buffer.module_name 27/49 Test #27: fuzz_buffer.module_name ........... Passed 4.58 sec Start 28: fuzz_buffer.dictionary 28/49 Test #28: fuzz_buffer.dictionary ............ Passed 4.20 sec Start 29: fuzz_buffer.cpp 29/49 Test #29: fuzz_buffer.cpp ................... Passed 17.77 sec Start 30: fuzz_custom_mutator 30/49 Test #30: fuzz_custom_mutator ............... Passed 4.57 sec Start 31: drsyscall_test 31/49 Test #31: drsyscall_test .................... Passed 0.22 sec Start 32: strace_test 32/49 Test #32: strace_test ....................... Passed 0.22 sec Start 33: drfuzz_test_empty 33/49 Test #33: drfuzz_test_empty ................. Passed 0.22 sec Start 34: drfuzz_test_mutator 34/49 Test #34: drfuzz_test_mutator ............... Passed 2.38 sec Start 35: drfuzz_test_repeat 35/49 Test #35: drfuzz_test_repeat ................***Failed Start 36: drfuzz_test_segfault 36/49 Test #36: drfuzz_test_segfault .............. Passed 0.20 sec Start 37: drfuzz_test_app_abort 37/49 Test #37: drfuzz_test_app_abort ............. Passed 0.22 sec Start 38: drfuzz_test_no_crash 38/49 Test #38: drfuzz_test_no_crash .............. Passed 0.22 sec Start 39: umbra_test_empty 39/49 Test #39: umbra_test_empty .................. Passed 0.22 sec Start 40: umbra_test_overlap 40/49 Test #40: umbra_test_overlap ................ Passed 0.23 sec Start 41: umbra_test_shadow_mem 41/49 Test #41: umbra_test_shadow_mem ............. Passed 0.30 sec Start 42: umbra_test_insert_app_to_shadow 42/49 Test #42: umbra_test_insert_app_to_shadow ... Passed 0.29 sec Start 43: umbra_test_consistency 43/49 Test #43: umbra_test_consistency ............ Passed 0.30 sec Start 44: umbra_test_allscales 44/49 Test #44: umbra_test_allscales .............. Passed 0.39 sec Start 45: drltrace 45/49 Test #45: drltrace .......................... Passed 0.35 sec Start 46: drltrace_libcalls 46/49 Test #46: drltrace_libcalls ................. Passed 0.36 sec Start 47: drltrace_symargs 47/49 Test #47: drltrace_symargs .................. Passed 0.36 sec Start 48: drltrace_libargs 48/49 Test #48: drltrace_libargs .................. Passed 0.35 sec Start 49: strace_sample 49/49 Test #49: strace_sample ..................... Passed 0.22 sec 88% tests passed, 6 tests failed out of 49
AArch64 port of drmemory. Only contains slowpath support with shared_slowpath off. Pattern mode and fastpath modes are being worked on separately. Currently this build does break some x86 functionality. Depends on: https://github.com/DynamoRIO/dynamorio/tree/mem-ref-for-clean-calls-aarch64/core Current tests we have analysed: Test project /home/grecaw01/APD-testing/drmem-upstream3/drmemory/build Start 1: drmf_proj 1/49 Test #1: drmf_proj ......................... Passed 0.45 sec Start 2: unit_tests 2/49 Test #2: unit_tests ........................ Passed 0.02 sec Start 3: hello 3/49 Test #3: hello ............................. Passed 3.55 sec Start 4: free 4/49 Test #4: free .............................. Passed 3.67 sec Start 5: malloc 5/49 Test #5: malloc ............................ Passed 3.88 sec Start 6: leak_indirect 6/49 Test #6: leak_indirect ..................... Passed 3.52 sec Start 7: patterns 7/49 Test #7: patterns .......................... Passed 3.93 sec Start 8: free.exitcode 8/49 Test #8: free.exitcode ..................... Passed 3.64 sec Start 9: track_origins 9/49 Test #9: track_origins .....................***Failed 0.34 sec Start 10: free.pattern 10/49 Test #10: free.pattern ......................***Failed 0.35 sec Start 11: malloc.pattern 11/49 Test #11: malloc.pattern ....................***Failed 0.34 sec Start 12: track_origins.pattern 12/49 Test #12: track_origins.pattern .............***Failed 0.34 sec Start 13: fuzz_corpus 13/49 Test #13: fuzz_corpus ....................... Passed 3.56 sec Start 14: fuzz_buffer 14/49 Test #14: fuzz_buffer ....................... Passed 4.62 sec Start 15: fuzz_buffer.replace_buffer 15/49 Test #15: fuzz_buffer.replace_buffer ........ Passed 4.62 sec Start 16: fuzz_buffer.overflow 16/49 Test #16: fuzz_buffer.overflow ..............***Failed 0.34 sec Start 17: fuzz_buffer.mutator.o-b-s-3 17/49 Test #17: fuzz_buffer.mutator.o-b-s-3 ....... Passed 4.59 sec Start 18: fuzz_buffer.mutator.r-b-s-3 18/49 Test #18: fuzz_buffer.mutator.r-b-s-3 ....... Passed 4.63 sec Start 19: fuzz_buffer.mutator.o-b-3 19/49 Test #19: fuzz_buffer.mutator.o-b-3 ......... Passed 4.60 sec Start 20: fuzz_buffer.mutator.r-n 20/49 Test #20: fuzz_buffer.mutator.r-n ........... Passed 4.54 sec Start 21: fuzz_buffer.mutator.random_seed 21/49 Test #21: fuzz_buffer.mutator.random_seed ... Passed 4.57 sec Start 22: fuzz_buffer.one-input 22/49 Test #22: fuzz_buffer.one-input ............. Passed 3.82 sec Start 23: fuzz_buffer.load_input 23/49 Test #23: fuzz_buffer.load_input ............ Passed 3.81 sec Start 24: fuzz_buffer.skip_initial 24/49 Test #24: fuzz_buffer.skip_initial .......... Passed 4.01 sec Start 25: fuzz_buffer.fixed_size 25/49 Test #25: fuzz_buffer.fixed_size ............ Passed 5.36 sec Start 26: fuzz_buffer.offset 26/49 Test #26: fuzz_buffer.offset ................ Passed 5.42 sec Start 27: fuzz_buffer.module_name 27/49 Test #27: fuzz_buffer.module_name ........... Passed 4.58 sec Start 28: fuzz_buffer.dictionary 28/49 Test #28: fuzz_buffer.dictionary ............ Passed 4.20 sec Start 29: fuzz_buffer.cpp 29/49 Test #29: fuzz_buffer.cpp ................... Passed 17.77 sec Start 30: fuzz_custom_mutator 30/49 Test #30: fuzz_custom_mutator ............... Passed 4.57 sec Start 31: drsyscall_test 31/49 Test #31: drsyscall_test .................... Passed 0.22 sec Start 32: strace_test 32/49 Test #32: strace_test ....................... Passed 0.22 sec Start 33: drfuzz_test_empty 33/49 Test #33: drfuzz_test_empty ................. Passed 0.22 sec Start 34: drfuzz_test_mutator 34/49 Test #34: drfuzz_test_mutator ............... Passed 2.38 sec Start 35: drfuzz_test_repeat 35/49 Test #35: drfuzz_test_repeat ................***Failed Start 36: drfuzz_test_segfault 36/49 Test #36: drfuzz_test_segfault .............. Passed 0.20 sec Start 37: drfuzz_test_app_abort 37/49 Test #37: drfuzz_test_app_abort ............. Passed 0.22 sec Start 38: drfuzz_test_no_crash 38/49 Test #38: drfuzz_test_no_crash .............. Passed 0.22 sec Start 39: umbra_test_empty 39/49 Test #39: umbra_test_empty .................. Passed 0.22 sec Start 40: umbra_test_overlap 40/49 Test #40: umbra_test_overlap ................ Passed 0.23 sec Start 41: umbra_test_shadow_mem 41/49 Test #41: umbra_test_shadow_mem ............. Passed 0.30 sec Start 42: umbra_test_insert_app_to_shadow 42/49 Test #42: umbra_test_insert_app_to_shadow ... Passed 0.29 sec Start 43: umbra_test_consistency 43/49 Test #43: umbra_test_consistency ............ Passed 0.30 sec Start 44: umbra_test_allscales 44/49 Test #44: umbra_test_allscales .............. Passed 0.39 sec Start 45: drltrace 45/49 Test #45: drltrace .......................... Passed 0.35 sec Start 46: drltrace_libcalls 46/49 Test #46: drltrace_libcalls ................. Passed 0.36 sec Start 47: drltrace_symargs 47/49 Test #47: drltrace_symargs .................. Passed 0.36 sec Start 48: drltrace_libargs 48/49 Test #48: drltrace_libargs .................. Passed 0.35 sec Start 49: strace_sample 49/49 Test #49: strace_sample ..................... Passed 0.22 sec 88% tests passed, 6 tests failed out of 49
From timurrrr@google.com on July 27, 2010 11:19:22
On Windows XP ( r378 / r24 ), the following code
#include <windows.h>
#include <stdio.h>
#include <assert.h>
#pragma comment(lib, "user32.lib")
#define kWndClass "Test wnd class name"
LRESULT CALLBACK WndProcThunk(HWND hwnd, UINT message, WPARAM wparam, LPARAM lparam) {
return DefWindowProc(hwnd, message, wparam, lparam);
}
int main() {
HWND hwnd = NULL;
HINSTANCE hinst = GetModuleHandle(NULL);
WNDCLASSEX wc = {0};
wc.cbSize = sizeof(wc);
wc.lpfnWndProc = WndProcThunk;
wc.hInstance = hinst;
wc.lpszClassName = kWndClass;
RegisterClassEx(&wc);
hwnd = CreateWindow(kWndClass, 0, 0, 0, 0, 0, 0, HWND_MESSAGE, 0, hinst, 0);
assert(hwnd);
DestroyWindow(hwnd);
UnregisterClass(kWndClass, GetModuleHandle(NULL));
}
Gives 7 error reports (attached).
Example:
Error
#4: UNADDRESSABLE ACCESS: reading 0x0012f4c8-0x0012f4c9 1 byte(s) within 0x0012f4c8-0x0012f4cc@0:00:03.750 in thread 2276
0x7e4184ce <USER32.dll+0x84ce> USER32.dll!?
??:0
0x5ad746f6 <UxTheme.dll+0x46f6> UxTheme.dll!GetThemeColor
??:0
0x5ad74693 <UxTheme.dll+0x4693> UxTheme.dll!GetThemeColor
??:0
0x5ad7a63e <UxTheme.dll+0xa63e> UxTheme.dll!IsThemePartDefined
??:0
0x5ad7985d <UxTheme.dll+0x985d> UxTheme.dll!IsThemeActive
??:0
0x5ad7960a <UxTheme.dll+0x960a> UxTheme.dll!IsThemeActive
??:0
0x5ad7ad7b <UxTheme.dll+0xad7b> UxTheme.dll!Ordinal25
??:0
0x7e427f06 <USER32.dll+0x17f06> USER32.dll!SetProcessWindowStation
??:0
0x7e428069 <USER32.dll+0x18069> USER32.dll!GetGUIThreadInfo
??:0
0x7c90e473 <ntdll.dll+0xe473> ntdll.dll!KiUserCallbackDispatcher
??:0
0x7e42e442 <USER32.dll+0x1e442> USER32.dll!GetScrollInfo
??:0
0x7e42e4dc <USER32.dll+0x1e4dc> USER32.dll!CreateWindowExA
??:0
0x004010b7 <test.exe+0x10b7> test.exe!main
Z:\dr-sandbox\issues\new\test.c:23
0x00401c70 <test.exe+0x1c70> test.exe!__tmainCRTStartup
f:\dd\vctools\crt_bld\self_x86\crt\src\crt0.c:327
0x7c817077 <KERNEL32.dll+0x17077> KERNEL32.dll!RegisterWaitForInputIdle
??:0
Attachment: results.txt
Original issue: http://code.google.com/p/drmemory/issues/detail?id=17
The text was updated successfully, but these errors were encountered: