ASSERT (unit_tests /MDd) alloc.c:4509: !pt->expect_lib_to_fail || pt->alloc_base == NULL (free() success unexpected)

[derekbruening]

From bruen...@google.com on August 08, 2012 14:21:09

is this issue #534 ? neither callstack there is a clear match though

Dr.M Error #201: INVALID HEAP ARGUMENT to RtlFreeHeap() 0x00aa4fe8
Dr.M # 0 ntdll.dll!RtlpFreeUserBlock
Dr.M # 1 ntdll.dll!RtlpLowFragHeapFree
Dr.M # 2 ntdll.dll!RtlFreeHeap
Dr.M # 3 KERNEL32.dll!HeapFree
Dr.M # 4 MSVCR100D.dll!_free_base
Dr.M # 5 MSVCR100D.dll!_free_dbg_nolock
Dr.M # 6 MSVCR100D.dll!_free_dbg
Dr.M # 7 MSVCR100D.dll!operator delete
Dr.M # 8 webkit.dll!testing::TestInfo::scalar deleting destructor' \~~Dr.M~~ # 9 webkit.dll!testing::internal::Delete<testing::TestInfo> [d:\derek\chromium\src\testing\gtest\src\gtest-internal-inl.h:338] \~~Dr.M~~#10webkit.dll!std::_For_each<testing::TestInfo * const *,void (__cdecl*)(testing::TestInfo *)> [c:\program files (x86)\microsoft visual studio 10.0\vc\include\algorithm:22] \~~Dr.M~~#11` webkit.dll!std::for_each<std::_Vector_const_iterator<std::_Vector_val<testing::TestInfo *,std::allocator<testing::TestInfo > > >,void (__cdecl)(testing::TestInfo *)> [c:\program files (x86)\microsoft visual studio 10.0\vc\include\algorithm:32]
Dr.M Note: @0:05:45.808 in thread 11068
Dr.M Note: prev lower malloc: 0x00aa4fc8-0x00aa4fd0
Dr.M ASSERT FAILURE (thread 11068): D:\derek\drmemory\git\src\common\alloc.c:4509: !pt->expect_lib_to_fail || pt->alloc_base == NULL (free() success unexpected)

0:001> dd 0x00aa4fe8-20
00aa4fc8 608681f0 000000b4 fdfdfdfd 00000000
00aa4fd8 00000000 00000000 59dc8407 00083004
00aa4fe8 49d7ffd8 4c358288 0000000d 00000000
00aa4ff8 0b8aa9a9 8000b000 ddddffff dddddddd
00aa5008 dddddddd dddddddd dddddddd dddddddd
00aa5018 dddddddd dddddddd dddddddd dddddddd
00aa5028 dddddddd dddddddd dddddddd dddddddd

looks like an LFH free (issue #301)?

in windbg I'm in post so maybe the flags got clobbered but shows up as 0:

0:000> dds @@(mc->esp)-10
002ef360 77af2400 ntdll!RtlpFreeUserBlock+0xbf
002ef364 006b0000 <Unloaded_>+0x640000
002ef368 00000000
002ef36c 00aa4fe8 <Unloaded_>+0xa34fe8

currently in the code I only check the RTL_LFH_BLOCK_FLAG on alloc, not
free.

xref issue #432 : not supposed to report invalid arg when on heap tangent, and:
+0x0b9 heap_tangent : 1 ''
though handle_free_pre() directly reports instead of calling
check_valid_heap_block() which is where the tangent check is.
=> that fixes it!

Original issue: http://code.google.com/p/drmemory/issues/detail?id=962

[derekbruening]

From derek.br...@gmail.com on August 14, 2012 11:23:27

This issue was closed by revision r952 .

Status: Fixed

[derekbruening]

From bruen...@google.com on August 28, 2012 14:22:26

Issue 534 has been merged into this issue.