And the message always says "user breakpoint called at xyz". Why does it
call it user breakpoint. I haven't set any breakpoints in my application.
Sorry if I conveyed it wrong in the previous post. I would like to know if
Thank you.
"Joseph M. Newcomer" wrote:
See below...
On Thu, 3 May 2007 08:12:03 -0700, Punit Kaur <PunitKaur@discussions.microsoft.com> wrote:
ok.. here are more details: the message box says "User Breakpoint called from
code at 0x10212ad0", and it breaks into the dbgheap.c file in the following
function :
void * __cdecl _heap_alloc_dbg(size_t nSize, int nBlockUse, const char *
szFileName, int nLine)
{
long lRequest;
size_t blockSize;
int fIgnore = FALSE;
_CrtMemBlockHeader * pHead;
/* verify heap before allocation */
if (_crtDbgFlag & _CRTDBG_CHECK_ALWAYS_DF) //*** THIS LINE (see at end)
_ASSERTE(_CrtCheckMemory());
lRequest = _lRequestCurr;
/***********************************************
this is where it breaks, at the "if" statement. , the values of lRequest and
_crtBreakAlloc =-1
*************************************************/
/* break into debugger at specific memory allocation */
if (lRequest == _crtBreakAlloc)
_CrtDbgBreak();
*****
This looks like the contents of the block, which are expected to be 0xDFDFDFDF...DFDFDF
are in fact not that value. This can be caused by either of two problems. The first is
that you have done something like
whatever * p = new whatever;
... use it
delete whatever;
p->field = ...;
which is called the "dangling pointer" problem. One way to avoid this is that immediately
after doing a delete, you set the pointer field to NULL, which will catch such errors.
Another possible cause is that you did an allocation of n bytes and wrote m > n bytes,
overwriting the 0xDFDFDF...DFDF of a free block. Look for memory overwrites.
Beyond this point, nothing else is interesting. The heap is trashed.
I suggest trying the Application Verifier to help track this down. Download it from the
Microsoft Web site (search for Application Verifier)
joe
*****
/********************************************************
here onwards it does not execute the stmts inside "if"
*******************************************************/
****
At this point, single stepping into the call might have been informative.
****
/* forced failure */
if (!(*_pfnAllocHook)(_HOOK_ALLOC, NULL, nSize, nBlockUse, lRequest,
szFileName, nLine))
{
if (szFileName)
_RPT2(_CRT_WARN, "Client hook allocation failure at file %hs
line %d.\n",
szFileName, nLine);
else
_RPT0(_CRT_WARN, "Client hook allocation failure.\n");
return NULL;
}
/* cannot ignore CRT allocations */
if (_BLOCK_TYPE(nBlockUse) != _CRT_BLOCK &&
!(_crtDbgFlag & _CRTDBG_ALLOC_MEM_DF))
fIgnore = TRUE;
/* Diagnostic memory allocation from this point on */
if (nSize > (size_t)_HEAP_MAXREQ ||
nSize + nNoMansLandSize + sizeof(_CrtMemBlockHeader) >
(size_t)_HEAP_MAXREQ)
{
_RPT1(_CRT_ERROR, "Invalid allocation size: %u bytes.\n", nSize);
return NULL;
}
if (!_BLOCK_TYPE_IS_VALID(nBlockUse))
{
_RPT0(_CRT_ERROR, "Error: memory allocation: bad memory block
type.\n");
}
/******************************************************
until here in all the above "if" statements, the stmts inside "if" are not
executed
******************************************************/
/****** it allocates block size ***************/
blockSize = sizeof(_CrtMemBlockHeader) + nSize + nNoMansLandSize;
#ifndef WINHEAP
/* round requested size */
blockSize = _ROUND2(blockSize, _GRANULARITY);
#endif /* WINHEAP */
pHead = (_CrtMemBlockHeader *)_heap_alloc_base(blockSize);
if (pHead == NULL)
return NULL;
/* commit allocation */
++_lRequestCurr;
/**** at this point after applying the increment operator, the value of
_lRequestCurr = 0********/
/***** does not execute the stmts in the following if block since fIgnore =0
***/
if (fIgnore)
{
pHead->pBlockHeaderNext = NULL;
pHead->pBlockHeaderPrev = NULL;
pHead->szFileName = NULL;
pHead->nLine = IGNORE_LINE;
pHead->nDataSize = nSize;
pHead->nBlockUse = _IGNORE_BLOCK;
pHead->lRequest = IGNORE_REQ;
}
else {
/* keep track of total amount of memory allocated */
_lTotalAlloc += nSize;
_lCurAlloc += nSize;
if (_lCurAlloc > _lMaxAlloc)
_lMaxAlloc = _lCurAlloc;
if (_pFirstBlock)
_pFirstBlock->pBlockHeaderPrev = pHead;
else
_pLastBlock = pHead;
pHead->pBlockHeaderNext = _pFirstBlock;
pHead->pBlockHeaderPrev = NULL;
pHead->szFileName = (char *)szFileName;
/**** Here the szFileName has strcore.cpp as its value *****/
pHead->nLine = nLine;
pHead->nDataSize = nSize;
pHead->nBlockUse = nBlockUse;
pHead->lRequest = lRequest;
/* link blocks together */
_pFirstBlock = pHead;
}
/*** executes everything below with no problems ****/
/* fill in gap before and after real block */
memset((void *)pHead->gap, _bNoMansLandFill, nNoMansLandSize);
memset((void *)(pbData(pHead) + nSize), _bNoMansLandFill,
nNoMansLandSize);
/* fill data with silly value (but non-zero) */
memset((void *)pbData(pHead), _bCleanLandFill, nSize);
return (void *)pbData(pHead);
}
Here are the values of the variables after this function is executed:
nSize 15
nBlockUse 1
szFileName 0x5f4ccb18 "strcore.cpp"
nLine 118
blockSize 51
fIgnore 0
lRequest -1
pHead 0x015f55c0
_bCleanLandFill 205 '??'
nSize 15
pHead 0x015f55c0
And after this it returns to the following function where it was called :
void * __cdecl _nh_malloc_dbg (
size_t nSize,
int nhFlag,
int nBlockUse,
const char * szFileName,
int nLine
)
{
// some stmts
....
....
/***** this is where it was called *****/
pvBlk = _heap_alloc_dbg(nSize, nBlockUse, szFileName, nLine);
// some more stmts
/*******Values of variables
Values of variables after exec this function.
nhFlag 0
pvBlk 0x015f55e0
*******************/
/******* the following if stmt is executed to return the value pvBlk *******/
if (pvBlk || nhFlag == 0)
return pvBlk;
/* call installed new handler */
if (!_callnewh(nSize))
return NULL;
/* new handler was successful -- try to allocate again */
}
}
/******After executing the above function, it returns to the following
caller function
****************/
_CRTIMP void * __cdecl _malloc_dbg (
size_t nSize,
int nBlockUse,
const char * szFileName,
int nLine
)
{
void *res = _nh_malloc_dbg(nSize, _newmode, nBlockUse, szFileName,
nLine);
return res;
}
/*******************************************************
This returns res which is a non zero value res=0x015f55e0
******************************************************/
/*****After this it returns to the following function in AFXMEM.CPP******/
void* __cdecl operator new(size_t nSize, int nType, LPCSTR lpszFileName, int
nLine)
{
// some stmts
for (;;)
{
pResult = _malloc_dbg(nSize, nType, lpszFileName, nLine);
if (pResult != NULL)
return pResult;
/**** returns pResult - a non zero value in the stmt above
**********/
// some more stmts
......
.....
}
/******Then returns to the following function********/
void* AFX_CDECL operator new(size_t nSize, LPCSTR lpszFileName, int nLine)
{
return ::operator new(nSize, _NORMAL_BLOCK, lpszFileName, nLine);
/******* Then returns to the function in strcore.cpp file ************/
void CString::AllocBuffer(int nLen)
{
// some stmts
{
/********* it was called in this stmt **********/
pData = (CStringData*)
new BYTE[sizeof(CStringData) + (nLen+1)*sizeof(TCHAR)];
pData->nAllocLength = nLen;
}
pData->nRefs = 1;
pData->data()[nLen] = '\0';
pData->nDataLength = nLen;
m_pchData = pData->data();
}
}
/*******Values of variables after function finishes exec
m_pchData 0x015f55ec "????"
pData 0x015f55e0
this 0x01ecfb8c {"????"}
CStringData::data returned 0x015f55ec "????"
********************/
/***** returns to the following function *****/
CString::CString(LPCTSTR lpsz)
{
//some stmts
.......
if (nLen != 0)
{
/***** called in the stmts below ******/
AllocBuffer(nLen);
memcpy(m_pchData, lpsz, nLen*sizeof(TCHAR));