Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ASSERT (browser_tests -unaddr_only) alloc.c:3401: !TEST(MALLOC_VALID, old_e->flags #1081

Open
derekbruening opened this issue Nov 28, 2014 · 12 comments

Comments

@derekbruening
Copy link
Contributor

From zhao...@google.com on November 06, 2012 12:29:34

~/Workspace/DrMemory/builds/build_x86_dbg.svn/bin/drmemory.exe -dr_ops "-msgbox_mask 0x1" -suppress ../../tools/valgrind/drmemory/suppressions.txt -callstack_max_frames 40 -unaddr_only -check_gdi -- ./browser_tests.exe --gtest_filter=Canvas2DDisabledTest.Canvas2DDisabled --ui-test-action-timeout=60000000 -ui-test-action-max-timeout=60000000

WARNING: application is missing line number information.

Error #1: GDI USAGE ERROR: DC 0xec01266d that contains selected object being deleted
#0 system call NtGdiDeleteObjectApp
#1 GDI32.dll!? +0x0 (0x757c58c5 <GDI32.dll+0x158c5>)
#2 skia.dll!? +0x0 (0x05c307b3 <skia.dll+0x607b3>)
#3 skia.dll!? +0x0 (0x05c30687 <skia.dll+0x60687>)
#4 skia.dll!? +0x0 (0x05c3060f <skia.dll+0x6060f>)
#5 skia.dll!? +0x0 (0x05bea4b1 <skia.dll+0x1a4b1>)
#6 skia.dll!? +0x0 (0x05bea3ac <skia.dll+0x1a3ac>)
#7 skia.dll!? +0x0 (0x05c30da0 <skia.dll+0x60da0>)
#8 skia.dll!? +0x0 (0x05c303ad <skia.dll+0x603ad>)
#9 skia.dll!? +0x0 (0x05bea4b1 <skia.dll+0x1a4b1>)
#10 skia.dll!? +0x0 (0x05bea3ac <skia.dll+0x1a3ac>)
#11 skia.dll!? +0x0 (0x05c8f946 <skia.dll+0xbf946>)
#12 skia.dll!? +0x0 (0x05c8f8bf <skia.dll+0xbf8bf>)
#13 skia.dll!? +0x0 (0x05c8f7e5 <skia.dll+0xbf7e5>)
#14 skia.dll!? +0x0 (0x05c8e0b2 <skia.dll+0xbe0b2>)
#15 skia.dll!? +0x0 (0x05c3e2a8 <skia.dll+0x6e2a8>)
#16 surface.dll!? +0x0 (0x0a2f31f0 <surface.dll+0x131f0>)
#17 content.dll!? +0x0 (0x08898fab <content.dll+0x9c8fab>)
#18 content.dll!? +0x0 (0x08891f95 <content.dll+0x9c1f95>)
#19 content.dll!? +0x0 (0x0889085f <content.dll+0x9c085f>)
#20 content.dll!? +0x0 (0x0888e355 <content.dll+0x9be355>)
#21 content.dll!? +0x0 (0x0889aedc <content.dll+0x9caedc>)
#22 content.dll!? +0x0 (0x0888c12c <content.dll+0x9bc12c>)
#23 content.dll!? +0x0 (0x08849921 <content.dll+0x979921>)
#24 content.dll!? +0x0 (0x086b6668 <content.dll+0x7e6668>)
#25 content.dll!? +0x0 (0x086b660b <content.dll+0x7e660b>)
#26 content.dll!? +0x0 (0x084d73ed <content.dll+0x6073ed>)
#27 ipc.dll!? +0x0 (0x0a28a702 <ipc.dll+0xa702>)
#28 ipc.dll!? +0x0 (0x0a28f006 <ipc.dll+0xf006>)
#29 ipc.dll!? +0x0 (0x0a28ed27 <ipc.dll+0xed27>)
#30 ipc.dll!? +0x0 (0x0a28e8ba <ipc.dll+0xe8ba>)
#31 base.dll!? +0x0 (0x10047b8e <base.dll+0x47b8e>)
#32 base.dll!? +0x0 (0x1009db20 <base.dll+0x9db20>)
#33 base.dll!? +0x0 (0x1009dded <base.dll+0x9dded>)
#34 base.dll!? +0x0 (0x1009ea57 <base.dll+0x9ea57>)
#35 base.dll!? +0x0 (0x100a7fc8 <base.dll+0xa7fc8>)
#36 base.dll!? +0x0 (0x1009d6f3 <base.dll+0x9d6f3>)
#37 base.dll!? +0x0 (0x1009d4a4 <base.dll+0x9d4a4>)
#38 base.dll!? +0x0 (0x100e9222 <base.dll+0xe9222>)
#39 base.dll!? +0x0 (0x1009c96f <base.dll+0x9c96f>)
Note: @0:00:09.451 in thread 6108

Original issue: http://code.google.com/p/drmemory/issues/detail?id=1081

@derekbruening
Copy link
Contributor Author

From zhao...@google.com on November 06, 2012 09:31:22

The tests actually starts 4 process, and it is the last process produce this callstack.

When running it in debug build and attach on windbg, an assertion failure is seen instead:
ASSERT FAILURE
common\alloc.c:3401: !TEST(MALLOC_VALID, old_e->flags) (internal error in malloc tracking)

@derekbruening
Copy link
Contributor Author

From zhao...@google.com on November 06, 2012 09:32:06

0:000> kp
ChildEBP RetAddr
1c94d0a0 5a4e567e ntdll!NtRaiseHardError+0x12
1c94d0f0 5a49bfde dynamorio!nt_messagebox(unsigned short * msg = 0x1c94d108, unsigned short * title = 0x5a5bcfa0)+0xfe [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\dynamorio\core\win32\ntdll.c @ 3403]
1c94e910 126058fc dynamorio!dr_messagebox(char * fmt = 0x1284e30c "ASSERT FAILURE (thread %d): %s:%d: %s (%s)", char * ap = 0x1c94e91c "???")+0xee [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\dynamorio\core\x86\instrument.c @ 3546]
1c94ea50 12618815 drmemorylib!malloc_add_common(unsigned char * start = 0x11ec0e98 "???", unsigned char * end = 0x11ec0eac "???", unsigned char * real_end = 0x11ec0eb0 "???", unsigned int flags = 0, unsigned int client_flags = 0, struct _dr_mcontext_t * mc = 0x1c94ed60, unsigned char * post_call = 0x08020f91 "???", unsigned int alloc_type = 8)+0x12ac [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\common\alloc.c @ 3401]
1c94ea9c 1261785d drmemorylib!handle_malloc_post(void * drcontext = 0x1c8e8780, struct _cls_alloc_t * pt = 0x1cb9cb10, void * wrapcxt = 0x1c94ecf8, struct _dr_mcontext_t * mc = 0x1c94ed60, char realloc = 0 '', unsigned char * post_call = 0x5abe7db1 "???", struct _alloc_routine_entry_t * routine = 0x1cb0ae18)+0x165 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\common\alloc.c @ 5427]
1c94ebc4 12615f48 drmemorylib!handle_alloc_post_func(void * drcontext = 0x1c8e8780, struct _cls_alloc_t * pt = 0x1cb9cb10, void * wrapcxt = 0x1c94ecf8, struct _dr_mcontext_t * mc = 0x1c94ed60, unsigned char * func = 0x5abf9c40 "???", unsigned char * post_call = 0x5abe7db1 "???", struct _alloc_routine_entry_t * routine = 0x1cb0ae18)+0x11ad [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\common\alloc.c @ 6370]
1c94ecb4 127372a8 drmemorylib!handle_alloc_post(void * wrapcxt = 0x1c94ecf8, void * user_data = 0x1c8e8780)+0x5d8 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\common\alloc.c @ 6405]
1c94ed38 12736f40 drmemorylib!drwrap_after_callee_func(void * drcontext = 0x1c8e8780, struct _per_thread_t * pt = 0x1c953b8c, struct _dr_mcontext_t * mc = 0x1c94ed60, int level = 2, unsigned char * retaddr = 0x5abe7db1 "???", char unwind = 0 '', char only_requested_unwind = 0 '')+0x358 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\dynamorio\ext\drwrap\drwrap.c @ 1732]
1c94eeb0 1c902acb drmemorylib!drwrap_after_callee(unsigned char * retaddr = 0x5abe7db1 "???", unsigned int xsp = 0x18f08c)+0xd0 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\dynamorio\ext\drwrap\drwrap.c @ 1861]
WARNING: Frame IP not in any known module. Following frames may be wrong.
0018f0a0 08020f91 0x1c902acb
0018f0bc 0801fbd2 content!std::_Allocatestd::_Tree_nod<std::_Tset_traits<int,std::less<int,std::allocator,0> >::_Node>(unsigned int _Count = 0x14, struct std::_Tree_nodstd::_Tset_traits<int,std::less<int,std::allocator,0> >::_Node * __formal = 0x12c3a8b4)+0x31 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\xmemory @ 36]
0018f0d0 0801e8c8 content!std::allocatorstd::_Tree_nod<std::_Tset_traits<int,std::less<int,std::allocator,0> >::_Node>::allocate(unsigned int _Count = 1)+0x12 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\xmemory @ 187]
0018f0e4 0801dba4 content!std::_Tree_valstd::_Tset_traits<int,std::less<int,std::allocator,0> >::_Tree_valstd::_Tset_traits<int,std::less<int,std::allocator,0> >(struct std::less * _Parg = 0x0018f112, class std::allocator _Al = class std::allocator)+0x38 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\xtree @ 544]
0018f0fc 0801d41e content!std::_Treestd::_Tset_traits<int,std::less<int,std::allocator,0> >::_Treestd::_Tset_traits<int,std::less<int,std::allocator,0> >(struct std::less * _Parg = 0x0018f112, class std::allocator * _Al = 0x0018f113)+0x24 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\xtree @ 699]
0018f114 086ddf7b content!std::set<int,std::less,std::allocator >::set<int,std::less,std::allocator >(void)+0x1e [c:\program files (x86)\microsoft visual studio 10.0\vc\include\set @ 82]
0018f130 086dceda content!IDMapcontent::QuotaDispatcher::Callback,1::IDMapcontent::QuotaDispatcher::Callback,1(void)+0x4b [d:\src\chrome-int\src\base\id_map.h @ 40]
0018f14c 084d5fae content!content::QuotaDispatcher::QuotaDispatcher(void)+0x4a [d:\src\chrome-int\src\content\common\quota_dispatcher.cc @ 50]
0018f240 084d5af8 content!content::ChildThread::Init(void)+0x28e [d:\src\chrome-int\src\content\common\child_thread.cc @ 110]
0018f2a0 08837790 content!content::ChildThread::ChildThread(void)+0x178 [d:\src\chrome-int\src\content\common\child_thread.cc @ 88]
0018f2bc 088af84c content!content::RenderThreadImpl::RenderThreadImpl(void)+0x40 [d:\src\chrome-int\src\content\renderer\render_thread_impl.cc @ 251]

@derekbruening
Copy link
Contributor Author

From bruen...@google.com on November 06, 2012 10:01:26

is this a dup of issue #1066 ?

for the assert, what version of drmem is this? is that issue #1072 ?

@derekbruening
Copy link
Contributor Author

From zhao...@google.com on November 06, 2012 11:18:48

The assert is caused in DrM r1104 , and only happens when I attach the debugger.

It looks the callstack problem is similar. will merge them.

@derekbruening
Copy link
Contributor Author

From zhao...@google.com on November 06, 2012 11:19:29

Issue 1066 has been merged into this issue.

@derekbruening
Copy link
Contributor Author

From zhao...@google.com on November 06, 2012 14:22:57

For the assert:

0:000> kn

ChildEBP RetAddr

00 233ed0a0 5a95567e ntdll!NtRaiseHardError+0x12
01 233ed0f0 5a90bfde dynamorio!nt_messagebox+0xfe [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\dynamorio\core\win32\ntdll.c @ 3403]
02 233ee910 125558fc dynamorio!dr_messagebox+0xee [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\dynamorio\core\x86\instrument.c @ 3546]
03 233eea50 12568815 drmemorylib!malloc_add_common+0x12ac [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\common\alloc.c @ 3401]
04 233eea9c 1256785d drmemorylib!handle_malloc_post+0x165 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\common\alloc.c @ 5427]
05 233eebc4 12565f48 drmemorylib!handle_alloc_post_func+0x11ad [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\common\alloc.c @ 6370]
06 233eecb4 126872a8 drmemorylib!handle_alloc_post+0x5d8 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\common\alloc.c @ 6405]
07 233eed38 12686f40 drmemorylib!drwrap_after_callee_func+0x358 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\dynamorio\ext\drwrap\drwrap.c @ 1732]
08 233eeeb0 233a2acb drmemorylib!drwrap_after_callee+0xd0 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\dynamorio\ext\drwrap\drwrap.c @ 1861]
WARNING: Frame IP not in any known module. Following frames may be wrong.
09 0018f0a0 08030f91 0x233a2acb
0a 0018f0bc 0802fbd2 content!std::_Allocatestd::_Tree_nod<std::_Tset_traits<int,std::less<int,std::allocator,0> >::_Node>+0x31 [c:\program files (x86)\microsoft visual studio 10.0\vc\include\xmemory @ 36]

0:000> .frame 3
03 233eea50 12568815 drmemorylib!malloc_add_common+0x12ac [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\common\alloc.c @ 3401]

0:000> dv
start = 0x11af0d18 "???"
end = 0x11af0d2c "???"
real_end = 0x11af0d30 "???"
flags = 0
client_flags = 0
mc = 0x233eed60
post_call = 0x08030f91 "???"
alloc_type = 8
e = 0x27b0e18c
old_e = 0x2956def4
locked_by_me = 1 ''

0:000> dt old_e
Local var @ 0x233eea48 Type _malloc_entry_t*
0x2956def4
+0x000 start : 0x11af0d18 "???"
+0x004 end : 0x11af0d2c "???"
+0x008 usable_extra : 4
+0x00a flags : 9
+0x00c data : (null)

0:000> dt drmemorylib!e
Local var @ 0x233eea44 Type _malloc_entry_t*
0x27b0e18c
+0x000 start : 0x11af0d18 "???"
+0x004 end : 0x11af0d2c "???"
+0x008 usable_extra : 4
+0x00a flags : 9
+0x00c data : (null)

0x9: MALLOC_VALID | MALLOC_ALLOCATOR_NEW

0:000> .frame 4
04 233eea9c 1256785d drmemorylib!handle_malloc_post+0x165 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.svn\common\alloc.c @ 5427]

0:000> dv
top_pc = 0x08030f91 "???"
flags = 0
drcontext = 0x23388780
pt = 0x2363cb10
wrapcxt = 0x233eecf8
mc = 0x233eed60
realloc = 0 ''
post_call = 0x5abe7db1 "???"
routine = 0x235c9bcc
pad_size = 0x18
real_base = 0x11af0d18 "???"
real_size = 0x14
app_base = 0x11af0d18 "???"
zeroed = 0 ''

0:000> dt routine
Local var @ 0x233eeabc Type _alloc_routine_entry_t*
0x235c9bcc
+0x000 pc : 0x5abf9c40 "???"
+0x004 type : 2 ( HEAP_ROUTINE_MALLOC )
+0x008 name : 0x127915cc "malloc"
+0x00c set : 0x23892c74
+0x010 intercept_post : 1 ''

0:000> ?? *(drwrap_context_t *)wrapcxt
struct _drwrap_context_t
+0x000 drcontext : 0x23388780
+0x004 func : 0x5abf9c40 "???"
+0x008 mc : 0x233eed60
+0x00c retaddr : 0x5abe7db1 "???"
+0x010 mc_modified : 0 ''

0:000> U 0x5abf9c40
MSVCR100D!malloc:

0:000> U 0x5abe7db1-5
MSVCR100D!operator new+0xc:
5abe7dac e88f1e0100 call MSVCR100D!malloc (5abf9c40)

Looks like a valid memory block [0x11af0d18, 0x11af0d2c] is added twice.

@derekbruening
Copy link
Contributor Author

From zhao...@google.com on November 06, 2012 14:24:04

0:000> dd 11af0d10
11af0d10 00000000 fdfdfdfd cdcdcdcd cdcdcdcd
11af0d20 cdcdcdcd cdcdcdcd cdcdcdcd fdfdfdfd

@derekbruening
Copy link
Contributor Author

From bruen...@google.com on November 06, 2012 14:32:06

The assert is caused in DrM r1104 , and only happens when I attach the debugger.

Can you update the title if this is now just about the assert.

What do you mean "when I attach the debugger": when you execute the app under Dr. Memory inside the debugger's control? Or you attach and the debugger's injected thread hits this error? I assume the former as the callstack doesn't look like the injected thread. How long did you run it in the debugger before the assert fired?

@derekbruening
Copy link
Contributor Author

From zhao...@google.com on November 06, 2012 14:59:04

Because it is the 4th browser_tests process cause the problem, I use -msgbox_mask 0xf and attach the windbg to the 4th process is started, and the let it run.

It took a short time to hit this assert, saw a lot of illegal instr and access violation.

Summary: ASSERT (browser_tests -unaddr_only) alloc.c:3401: !TEST(MALLOC_VALID, old_e->flags

@derekbruening
Copy link
Contributor Author

From zhao...@google.com on November 07, 2012 11:40:04

For useless callstack, the failure to get symbol for skia.dll is because of failure in to open file in load_module.

0:000> kn

ChildEBP RetAddr

00 17eee23c 128b914a drmemorylib!load_module+0x33 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\dynamorio\ext\drsyms\drsyms_windows.c @ 283]
01 17eee254 128b8e80 drmemorylib!lookup_or_load+0x7a [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\dynamorio\ext\drsyms\drsyms_windows.c @ 343]
02 17eee2a0 128b8e2a drmemorylib!drsym_lookup_address_local+0x50 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\dynamorio\ext\drsyms\drsyms_windows.c @ 427]
03 17eee2b8 127cb796 drmemorylib!drsym_lookup_address+0x2a [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\dynamorio\ext\drsyms\drsyms_windows.c @ 1103]
04 17eee454 127d38a4 drmemorylib!lookup_func_and_line+0x366 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\common\callstack.c @ 415]
05 17eee590 127d5794 drmemorylib!packed_frame_to_symbolized+0x1244 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\common\callstack.c @ 1513]
06 17eee5d0 12808ea7 drmemorylib!packed_callstack_to_symbolized+0x324 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\common\callstack.c @ 1554]
07 17eee6f0 12818bde drmemorylib!report_error+0xbc7 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\drmemory\report.c @ 2177]
08 17eee730 12818c0e drmemorylib!report_misc_error+0x6e [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\drmemory\report.c @ 2483]
09 17eee758 12863962 drmemorylib!report_gdi_error+0x1e [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\drmemory\report.c @ 2498]
0a 17eee9ac 12863303 drmemorylib!gdicheck_report+0x392 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\drmemory\gdicheck.c @ 149]

in load_module
if (!stri_eq(ext, ".exe")) {
/* Any base will do, but we need the size /
HANDLE f = CreateFile(path, GENERIC_READ, FILE_SHARE_READ,
NULL, OPEN_EXISTING, 0, NULL);
if (f == INVALID_HANDLE_VALUE)
return 0;
0:000> dt path
Local var @ 0x17eee248 Type char

0x183ce024 "D:\src\chrome-int\src\out\Debug\skia.dll"

0:000> dt f
Symbol not found.
0:000> dt dynamorio!f
Local var @ 0x17eee224 Type void*
0xffffffff

0:000> dds esp
17eee1d4 124e53e4 KERNEL32_124d0000!CreateFileA+0x37
17eee1d8 12c81c38
17eee1dc 80000000
17eee1e0 00000001
17eee1e4 00000000
17eee1e8 00000003
17eee1ec 00000000
17eee1f0 00000000
17eee1f4 757c5758 GDI32!NtGdiDeleteObjectApp+0x15
17eee1f8 00520050 browser_tests!DownloadTest_CloseNewTab3_Test::RunTestOnMainThread+0x120 [d:\src\chrome-int\src\chrome\browser\download\download_browsertest.cc @ 1350]
17eee1fc 12c81c38
17eee200 17eee23c
17eee204 128b91ec drmemorylib!load_module+0x4c [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\dynamorio\ext\drsyms\drsyms_windows.c @ 283]
17eee208 183ce024

0:000> da 183ce024
183ce024 "D:\src\chrome-int\src\out\Debug"
183ce044 "skia.dll"

12c81c38 44 00 3a 00 5c 00 73 00 72 00 63 00 5c 00 63 00 D.:..s.r.c..c.
12c81c48 68 00 72 00 6f 00 6d 00 65 00 2d 00 69 00 6e 00 h.r.o.m.e.-.i.n.
12c81c58 74 00 5c 00 73 00 72 00 63 00 5c 00 6f 00 75 00 t..s.r.c..o.u.
12c81c68 74 00 5c 00 44 00 65 00 62 00 75 00 67 00 5c 00 t..D.e.b.u.g..
12c81c78 73 00 6b 00 69 00 61 00 2e 00 64 00 6c 00 6c 00 s.k.i.a...d.l.l.

@derekbruening
Copy link
Contributor Author

From bruen...@google.com on November 07, 2012 11:51:23

Issue 1066 has been merged into this issue.

@derekbruening
Copy link
Contributor Author

From zhao...@google.com on November 07, 2012 11:54:18

issue #1066 will be used for no-sym callstack and this issue will for the assert failure as shown in the title.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant