Re: firstChance Sleep SecondChance operator new 这是不是表示堆破坏?

C/C++本地代码调试

firstChance Sleep SecondChance operator new 这是不是表示堆破坏?

fangxin 2010-12-03, 11:29 上午
我使用完全页堆来检查堆破坏
用adplus来获取崩溃转存
崩溃时虚拟内存使用1.1G左右
内存使用4,5百M, 应该不会出现申请内存失败这种情况
大家觉得这是什么情况?

firstChance
ntdll!KiFastSystemCallRet
ntdll!NtDelayExecution+0xc
kernel32!SleepEx+0x68
kernel32!Sleep+0xf

secondChance
kernel32!RaiseException+0x53
msvcr90!_CxxThrowException+0x48 [f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\throw.cpp @ 161]
msvcr90!operator new+0x64 [f:\dd\vctools\crt_bld\self_x86\crt\src\new.cpp @ 63]

这是firstChance的详情

fangxin 2010-12-03, 11:30 上午
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [F:\vss\Quote_Server\2.行情服务器系统test\PhoneQuoteServer\publish\release\FULLDUMP_FirstChance_epr_Process_Shut_Down_PhoneQuoteServer_console.exe__1780_2010-12-03_08-48-48-750_0a0c.dmp]
User Mini Dump File with Full Memory: Only application data is available

Comment: 'FirstChance_epr_Process_Shut_Down'
Symbol search path is: F:\vss\Quote_Server\2.行情服务器系统test\PhoneQuoteServer\publish\release;SRV*F:\debug\syssymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Machine Name:
Debug session time: Fri Dec 3 08:48:48.000 2010 (UTC + 8:00)
System Uptime: 20 days 16:22:44.703
Process Uptime: 1 days 21:01:53.000
..................................
eax=000000c0 ebx=025b8b64 ecx=25f0fe80 edx=7c9585ec esi=00000000 edi=25f0fec0
eip=7c9585ec esp=25f0fe80 ebp=25f0fee8 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
ntdll!KiFastSystemCallRet:
7c9585ec c3 ret
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

GetPageUrlData failed, server returned HTTP status 500
URL requested: http://watson.microsoft.com/StageOne/PhoneQuoteServer_console_exe/0_0_0_0/unknown/0_0_0_0/00000000.htm?Retriage=1

FAULTING_IP:
+2702faf011ddf58
00000000 ?? ???

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD: 000002cc

DEFAULT_BUCKET_ID: STATUS_BREAKPOINT

PROCESS_NAME: PhoneQuoteServer_console.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {

EXCEPTION_CODE: (NTSTATUS) 0x80000003 (2147483651) - {

MOD_LIST:

NTGLOBALFLAG: 2000000

APPLICATION_VERIFIER_FLAGS: 0

PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT

BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT

LAST_CONTROL_TRANSFER: from 7c956f4b to 7c9585ec

STACK_TEXT:
25f0fe7c 7c956f4b 7c801ed5 00000000 25f0fec0 ntdll!KiFastSystemCallRet
25f0fe80 7c801ed5 00000000 25f0fec0 00000000 ntdll!NtDelayExecution+0xc
25f0fee8 7c8024fd 000003e8 00000000 25f0ffb8 kernel32!SleepEx+0x68
25f0fef8 026c578e 000003e8 28e73531 78d47a70 kernel32!Sleep+0xf
25f0ffb8 7c82482f 025b8b64 00000000 00000000 ProxyAuthServer!CConnectionManager::ReleaseConnectionThread+0x6e [f:\vss\quote_server\2.ÐÐÇé·þÎñÆ÷ÏµÍ³\authserver_2_0\test_proxy_auth_server\proxyauthserver\proxyauthserver\connectionmanager.cpp @ 403]
25f0ffec 00000000 026c5720 025b8b64 00000000 kernel32!BaseThreadStart+0x34

STACK_COMMAND: ~0s; .ecxr ; kb

FOLLOWUP_IP:
ProxyAuthServer!CConnectionManager::ReleaseConnectionThread+6e [f:\vss\quote_server\2.ÐÐÇé·þÎñÆ÷ÏµÍ³\authserver_2_0\test_proxy_auth_server\proxyauthserver\proxyauthserver\connectionmanager.cpp @ 403]
026c578e 8b55b8 mov edx,dword ptr [ebp-48h]

FAULTING_SOURCE_CODE:
399: int iCount = 1;
400: while(!pthis->m_bStop && iCount小于uiCheckTime)
401: {
402: Sleep(1000);
> 403: ++iCount;
404: if (pthis->m_bNeedRestartListen)
405: {
406: pthis->m_bNeedRestartListen = false;
407: pthis->m_ServerSocket->StartListen(pthis->m_iListenPort, pthis);
408: }

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: proxyauthserver!CConnectionManager::ReleaseConnectionThread+6e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ProxyAuthServer

IMAGE_NAME: ProxyAuthServer.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 4ce0efd4

FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_ProxyAuthServer.dll!CConnectionManager::ReleaseConnectionThread

BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_proxyauthserver!CConnectionManager::ReleaseConnectionThread+6e

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/PhoneQuoteServer_console_exe/0_0_0_0/4cf4a39b/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1

Followup: MachineOwner
---------

secondChance的详情

fangxin 2010-12-03, 11:31 上午

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [F:\vss\Quote_Server\2.行情服务器系统test\PhoneQuoteServer\publish\release\MINIDUMP_SecondChance_eh_CPlusPlusEH_PhoneQuoteServer_console.exe__1780_2010-12-03_08-48-46-828_0a0c.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Comment: 'SecondChance_eh_CPlusPlusEH'
Symbol search path is: F:\vss\Quote_Server\2.行情服务器系统test\PhoneQuoteServer\publish\release;SRV*F:\debug\syssymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Machine Name:
Debug session time: Fri Dec 3 08:48:48.000 2010 (UTC + 8:00)
System Uptime: not available
Process Uptime: 1 days 21:01:53.000
..................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(a0c.16d0): C++ EH exception - code e06d7363 (first/second chance not available)
eax=07eefe9c ebx=4601c770 ecx=00000000 edx=7c9585ec esi=07eeff24 edi=000088e0
eip=7c80bef7 esp=07eefe98 ebp=07eefeec iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
kernel32!RaiseException+0x53:
7c80bef7 5e pop esi
0:010> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

Unable to load image C:\WINDOWS\system32\user32.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for user32.dll
Unable to load image C:\WINDOWS\system32\ws2_32.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ws2_32.dll
GetPageUrlData failed, server returned HTTP status 500
URL requested: http://watson.microsoft.com/StageOne/PhoneQuoteServer_console_exe/0_0_0_0/kernel32_dll/5_2_3790_4480/0000bef7.htm?Retriage=1

FAULTING_IP:
kernel32!RaiseException+53
7c80bef7 5e pop esi

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7c80bef7 (kernel32!RaiseException+0x00000053)
ExceptionCode: e06d7363 (C++ EH exception)
ExceptionFlags: 00000001
NumberParameters: 3
Parameter[0]: 19930520
Parameter[1]: 07eeff34
Parameter[2]: 785ad294

DEFAULT_BUCKET_ID: APPLICATION_FAULT

PROCESS_NAME: PhoneQuoteServer_console.exe

ERROR_CODE: (NTSTATUS) 0xe06d7363 -

EXCEPTION_CODE: (NTSTATUS) 0xe06d7363 -

EXCEPTION_PARAMETER1: 19930520

EXCEPTION_PARAMETER2: 07eeff34

EXCEPTION_PARAMETER3: 785ad294

MOD_LIST:

APPLICATION_VERIFIER_FLAGS: 0

FAULTING_THREAD: 000016d0

PRIMARY_PROBLEM_CLASS: APPLICATION_FAULT

BUGCHECK_STR: APPLICATION_FAULT_APPLICATION_FAULT

LAST_CONTROL_TRANSFER: from 7857dbf9 to 7c80bef7

STACK_TEXT:
07eefeec 7857dbf9 e06d7363 00000001 00000003 kernel32!RaiseException+0x53
07eeff24 78583b9d 07eeff34 785ad294 78522a10 msvcr90!_CxxThrowException+0x48 [f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\throw.cpp @ 161]
07eeff40 07bd1a27 000ac800 000088e0 00000000 msvcr90!operator new+0x64 [f:\dd\vctools\crt_bld\self_x86\crt\src\new.cpp @ 63]
07eeff50 07bd1aeb 000ac800 4601c798 7c81be79 NetEngine!CDataStream::ResizeBuf+0x17 [f:\vss\quote_server\2.ÐÐÇé·þÎñÆ÷ÏµÍ³test\public\datastream\datastream.cpp @ 94]
07eeff60 07bd2d70 4d3f6000 4601c770 000088e0 NetEngine!CDataStream::Write+0x6b [f:\vss\quote_server\2.ÐÐÇé·þÎñÆ÷ÏµÍ³test\public\datastream\datastream.cpp @ 132]
07eeff70 07bd2c52 4601ca6c 000088e0 000000e0 NetEngine!CSocketClient::DoRecv+0x30 [f:\vss\quote_server\2.ÐÐÇé·þÎñÆ÷ÏµÍ³test\public\netengine\netengine\netengine\socketclient.cpp @ 362]
07eeff80 07bd10a4 4601ca6c 000088e0 02632fdc NetEngine!CSocketClient::handle_recv+0x12 [f:\vss\quote_server\2.ÐÐÇé·þÎñÆ÷ÏµÍ³test\public\netengine\netengine\netengine\socketclient.cpp @ 302]
07eeff90 07bd1532 4601c770 000088e0 00000000 NetEngine!CAsyncRecvResult::complete+0x14 [f:\vss\quote_server\2.ÐÐÇé·þÎñÆ÷ÏµÍ³test\public\netengine\netengine\netengine\async_result.cpp @ 44]
07eeffb8 7c82482f 02632fdc 00000000 00000000 NetEngine!CCommxIocp::ThreadProc+0x82 [f:\vss\quote_server\2.ÐÐÇé·þÎñÆ÷ÏµÍ³test\public\netengine\netengine\netengine\commxiocp.cpp @ 83]
7c81be79 10ec83ec 8d1875ff e850f045 00005ae9 kernel32!BaseThreadStart+0x34
WARNING: Frame IP not in any known module. Following frames may be wrong.
7c81be85 00000000 f8458d50 18458d50 1075ff50 0x10ec83ec

FOLLOWUP_IP:
msvcr90!operator new+64 [f:\dd\vctools\crt_bld\self_x86\crt\src\new.cpp @ 63]
78583b9d cc int 3

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: msvcr90!operator new+64

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: msvcr90

IMAGE_NAME: msvcr90.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 488ef6c5

STACK_COMMAND: ~10s; .ecxr ; kb

FAILURE_BUCKET_ID: APPLICATION_FAULT_e06d7363_msvcr90.dll!operator_new

BUCKET_ID: APPLICATION_FAULT_APPLICATION_FAULT_msvcr90!operator_new+64

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/PhoneQuoteServer_console_exe/0_0_0_0/4cf4a39b/kernel32_dll/5_2_3790_4480/49c51ee2/e06d7363/0000bef7.htm?Retriage=1

Followup: MachineOwner
---------

Re: firstChance Sleep SecondChance operator new 这是不是表示堆破坏?

fangxin 2010-12-03, 11:47 上午
论坛对小于号显示会有错误，不知道要怎么写才能正确显示?

Re: firstChance Sleep SecondChance operator new 这是不是表示堆破坏?

格蠹老雷 2010-12-03, 12:45 下午
问题出在后者，因为这个内存异常无人处理，导致进程崩溃，触发了断点异常，断点异常发生时，0号线程正在内核态“睡眠”，很健康。
根据栈回溯，new运算符抛出异常，看了下代码，应该是下面这个_RAISE(nomem):
<PRE>
void *__CRTDECL operator new(size_t size) _THROW1(_STD bad_alloc)
{ // try to allocate size bytes
void *p;
while ((p = malloc(size)) == 0)
if (_callnewh(size) == 0)
{ // report no memory
static const std::bad_alloc nomem;
_RAISE(nomem);
}

return (p);
}
</PRE>
内存分配失败了，可能是进程的用户态空间用完，也可能是堆“腐败”了...

Re: firstChance Sleep SecondChance operator new 这是不是表示堆破坏?

fangxin 2010-12-03, 12:54 下午
我也知道应该是堆破坏或内存用完了.
我用了页堆检查，如果出现堆破坏应该会提前报错的.
只是不知道该怎么查这个问题.

Re: firstChance Sleep SecondChance operator new 这是不是表示堆破坏?

fangxin 2010-12-03, 14:17 下午
<BLOCKQUOTE><table width="85%"><tr><td class="txt4"><img src="/Themes/default/images/icon-quote.gif"> <strong>Raymond wrote:</strong></td></tr><tr><td class="quoteTable"><table width="100%"><tr><td width="100%" valign="top" class="txt4">问题出在后者，因为这个内存异常无人处理，导致进程崩溃，触发了断点异常，断点异常发生时，0号线程正在内核态“睡眠”，很健康。
根据栈回溯，new运算符抛出异常，看了下代码，应该是下面这个_RAISE(nomem):
<PRE>
void *__CRTDECL operator new(size_t size) _THROW1(_STD bad_alloc)
{ // try to allocate size bytes
void *p;
while ((p = malloc(size)) == 0)
if (_callnewh(size) == 0)
{ // report no memory
static const std::bad_alloc nomem;
_RAISE(nomem);
}

return (p);
}
</PRE>
内存分配失败了，可能是进程的用户态空间用完，也可能是堆“腐败”了...</td></tr></table></td></tr></table></BLOCKQUOTE>

如果第一个没有问题，怎么会记录转存文件呢?

Re: firstChance Sleep SecondChance operator new 这是不是表示堆破坏?

fangxin 2010-12-03, 17:51 下午
firstChance可能确实没有问题, 因为它是在后面生成的，可能是程序关闭时生成的.

Re: firstChance Sleep SecondChance operator new 这是不是表示堆破坏?

王宇 2010-12-03, 18:32 下午
第一个肯定没问题。

这就是低资源的悲剧所在，大部分人不会加异常处理，而它确实会抛异常。

Re: firstChance Sleep SecondChance operator new 这是不是表示堆破坏?

fangxin 2010-12-03, 18:39 下午
问题是现在内存使用总的只用了1.8G。不会申请不到内存的. 又不知道怎么才能找出哪里破坏了堆.

Re: firstChance Sleep SecondChance operator new 这是不是表示堆破坏?

fangxin 2010-12-03, 18:43 下午
<BLOCKQUOTE><table width="85%"><tr><td class="txt4"><img src="/Themes/default/images/icon-quote.gif"> <strong>WANGyu wrote:</strong></td></tr><tr><td class="quoteTable"><table width="100%"><tr><td width="100%" valign="top" class="txt4">第一个肯定没问题。

这就是低资源的悲剧所在，大部分人不会加异常处理，而它确实会抛异常。</td></tr></table></td></tr></table></BLOCKQUOTE>

你是说申请内存失败没有问题？
如果内存使用没有超过2G,
应该不会申请不到内存吧

Re: firstChance Sleep SecondChance operator new 这是不是表示堆破坏?

王宇 2010-12-03, 23:47 下午
是这样，我只是想表述某些函数会抛出异常，作为这些函数的调用者，大部分时间我们虽然可以无视这些风险，但是某些情况下，这些风险是灾难性的。例如，文件系统过滤驱动开发者如无视 I/O - Cache 管理器某些函数抛出的异常，等待他们的将是蓝屏。

呵呵，大道理大家都知道，只是您的这个问题需要具体分析一下 dump，个人感觉不像是低资源引起的：

ExceptionCode: e06d7363 (C++ EH exception)
ExceptionFlags: 00000001
NumberParameters: 3
Parameter[0]: 19930520
Parameter[1]: 07eeff34
Parameter[2]: 785ad294

Re: firstChance Sleep SecondChance operator new 这是不是表示堆破坏?

fangxin 2010-12-04, 09:35 上午
我已经转存了fulldump
windbg有命令可以验证堆是否破坏的?

Re: firstChance Sleep SecondChance operator new 这是不是表示堆破坏?

Forward 2010-12-22, 17:00 下午

我能够看出来，在firstChance的时候，线程在睡眠。secondChance的时抛出了异常，但是我不明白为什么会在睡眠的时候出现firstChance？？有人能说下么？

new出错，我的经验是考虑堆栈出错，一般很少会因为内存不足。