2

I've been struggling with a heap corruption problem for a few days. I was first warned by the vs 2005 debugger that I may have corrupted the heap, after deleting an object I had previously new'ed. Doing research on this problem led me to gflags and the page heap setting. After enabling this setting for my particular image, it supposedly pointed me to the line that is actually causing the corruption.

Gflags identified the constructor for the object in question as the culprit. The object derives as follows:

class POPUPS_EXPORT MLUNumber :  public MLUBase
  {
...
  }
class POPUPS_EXPORT MLUBase : public BusinessLogicUnit
  {
...
  }

I can instantiate an MLUNumber in a separate thread, and no heap corruption occurs.

I can instantiate a different class, that also inherits from MLUBase, that does not cause heap corruption.

The access violation raises due to the corruption occurs on the opening brace of the constructor, which appears to be because of the implicit initializing of the object (?).

The base class constructor (MLUBase) successfully finishes.

From digging with the memory window in vs 2005, it appears that there was not enough space allocated for the actual object. My guess is that enough was allocated for the base class only.

The line causing the fault:

BusinessLogicUnit* biz = new MLUNumber();

I'm hoping for either a reason that might cause this, or another troubleshooting step to follow.

9
  • 1
    Can you please post a minimal example of the code that you can reproduce the problem with? With the information that you've provided all we might do is provide some educated guesses. Jun 24, 2011 at 19:47
  • I'd be quite surprised if you cannot work this out just by running the Debug version of your code inside the VS2005 debugger. This enables extra heap checking that should detect the error at time of occurrence rather than at a random later time. Jun 24, 2011 at 19:52
  • Do you have FULL pagheap enabled?
    – pepsi
    Jun 24, 2011 at 19:53
  • I've enabled full page heap through gflags.exe. I could not find a setting in vs2005 to enable it. Currently, vs2005 alone (without gflags) warns me when I destroy the object, that I corrupted the heap previously.
    – reuscam
    Jun 24, 2011 at 19:54
  • Creating objects does not cause heap corruption. It does, however, often make it possible to detect heap corruption which may have occurred at any previous time in the execution of your program. The thing about corrupt data is that you can't tell it's corrupt unless you do something that depends on it not being corrupt. Jun 24, 2011 at 19:56

5 Answers 5

6

Unfortunately, with the information given, it's not possible to definitively diagnose the problem.

Some things you may want to check:

  • Make sure BusinessLogicUnit has a virtual destructor. When deleteing objects through a base pointer, a virtual destructor must be present in the base class for the subclass to be properly destructed.
  • Make sure you're building all source files with the same preprocessor flags and compiler options. A difference in flags (perhaps between debug/release flags?) could result in a change in structure size, and thus an inconsistency between sizes reported in different source files.
  • It's possible for some types of heap corruption to go undetected, even with your gflags settings. Audit your other heap uses to try to find the source of your issues as well. Ideally you should put together a minimal test case that will reliably crash, but with a minimum amount of activity, so you can narrow down the cause.
  • Try a clean solution and rebuild; I've occasionally seen timestamps getting screwed up, and an old object file can get in with an out-of-date structure definition. Worth checking at least :)
3
  • All destructors are virtual. I will check the preprocessor flags. I'm definitely in debug on all builds though. I'm not sure how to better test for heap corruption than I already am. I can reproduce this every single time, but don't understand what could be causing it. I already tried the clean solution, I was crossing my fingers :)
    – reuscam
    Jun 24, 2011 at 20:05
  • @reuscam, the keyword here is 'minimal' - start removing code and see if it still reproduces. Eventually, hopefully, you should find the problem. Hopefully.
    – bdonlan
    Jun 24, 2011 at 20:10
  • 2
    The answer in the end was byte alignment differing between a dll, and the exe pulling a header from that DLL. This actually came from a #pragma pack statement, rather than a compiler option. #pragma pack(show) led me to the culprit. This was close to your bullet 2, so you get credit. Thanks
    – reuscam
    Jun 28, 2011 at 19:30
2
BusinessLogicUnit* biz = new MLUNumber();

How do you delete the memory? Using the base-class pointer? Have you made the destructor of BusinessLogicUnit virtual? It must be virtual.

class BusinessLogicUnit
{
  public:
      //..
      virtual ~BusinessLogicUnit(); //it must be virtual!
};

Otherwise deleting the derived class object through the base-class pointer invokes undefined behavior as per the C++ Standard.

1
  • 1
    Yes: virtual ~BusinessLogicUnit(void); Keep in mind that an access violation is raised (due to gflags and page heap setting) on construction rather than destruction. This points me towards the constructor as the culprit.
    – reuscam
    Jun 24, 2011 at 19:57
0

BusinessLogicUnit is not an MLUNumber. Why would you allocate this way? Instead BusinessLogicUnit* biz = new BusinessLogicUnit();

5
  • 2
    This is a perfectly reasonable thing to do - BusinessLogicUnit could be an abstract interface class. As long as the destructor is virtual it's perfectly safe in itself.
    – bdonlan
    Jun 24, 2011 at 19:49
  • No it's not: MLUNumber is not in the hierarchy of BusinessLogicUnit.
    – John
    Jun 24, 2011 at 19:51
  • Friday evening: I must not be awake.
    – John
    Jun 24, 2011 at 19:53
  • @John, that's not true - it is.
    – murrekatt
    Jun 24, 2011 at 19:54
  • This was really just for debug sanity. Originally the call was SomeObject->Switch(new BLUSecure);. I have confirmed that MLUNumber* biz5 = new MLUNumber(); also causes the crash.
    – reuscam
    Jun 24, 2011 at 19:57
0

Or maybe you do something like this?

struct A
{
    SomeType & m_param;

    A(SomeType & param) : m_param(param)
    {
        ...use m_param here...
    }
};

A a(SomeType()); // passing a temporary by reference

Then that's undefined behaviour, because the referenced temporary dies right after m_param(param) happens..

0

I agree with bdonlan that there isn't enough information yet to figure out what's wrong. There are a lot of good suggestions here, but just guessing possible reasons why an application is crashing is not a smart way to root cause an issue.

You've done the right thing by enabling instrumentation (pageheap) to help you narrow down the problem. I would continue down this path by finding out exactly which memory address is causing the access violation (and where the address came from).

1
  • I agree completely, and thats why I was really looking for more tools to use, than eyes on the source itself. As for the access violation, thats because of the page heap configuration. The real problem is that calling new does not appear to allocate enough memory for the object in question. Its just enough for the base object, I think.
    – reuscam
    Jun 27, 2011 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.