samedi 26 septembre 2015

INVALID_POINTER_WRITE access violation in std::make_shared

I have a custom class TraceInfo that I construct using std::make_shared. The construction led to a crash on one occasion with the following stack trace

00 00000099`1bb8d108 000007ff`8953129e ntdll!ZwWaitForMultipleObjects+0xa [e:\obj.amd64fre\minkernel\ntdll\daytona\objfre\amd64\usrstubs.asm @ 884]
01 00000099`1bb8d110 000007ff`8977c37a KERNELBASE!WaitForMultipleObjectsEx+0xe5 [d:\win8_gdr\minkernel\kernelbase\synch.c @ 1471]
02 (Inline Function) --------`-------- kernel32!WaitForMultipleObjects+0x1e [d:\win8_gdr\base\win32\client\synch.c @ 260]
03 00000099`1bb8d3f0 000007ff`8977c14e kernel32!WerpReportFaultInternal+0x245 [d:\win8_gdr\windows\feedback\faultrep\faultrep.cpp @ 490]
04 00000099`1bb8d490 000007ff`8959d6d4 kernel32!WerpReportFault+0x76 [d:\win8_gdr\windows\feedback\faultrep\faultrep.cpp @ 707]
05 00000099`1bb8d4c0 000007ff`8c404797 KERNELBASE!UnhandledExceptionFilter+0x23a [d:\win8_gdr\minkernel\kernelbase\xcpt.c @ 614]
06 00000099`1bb8d5c0 000007ff`8c404b4d ntdll!TppExceptionFilter+0x1f [d:\win8_ldr\minkernel\threadpool\ntdll\tp.c @ 115]
07 00000099`1bb8d5f0 000007ff`8c40a3a8 ntdll!TppWorkerpInnerExceptionFilter+0x15 [d:\win8_ldr\minkernel\threadpool\ntdll\worker.c @ 101]
08 00000099`1bb8d620 000007ff`8c32ad8e ntdll!TppWorkerThread$filt$5+0x19 [d:\win8_ldr\minkernel\threadpool\ntdll\worker.c @ 1073]
09 00000099`1bb8d660 000007ff`8c40880a ntdll!__C_specific_handler+0x8e [d:\win8_ldr\minkernel\crts\crtw32\misc\amd64\chandler.c @ 168]
0a 00000099`1bb8d6d0 000007ff`8c32a3ed ntdll!__GSHandlerCheck_SEH+0x76 [d:\win8_ldr\minkernel\crts\crtw32\misc\amd64\gshandlerseh.c @ 102]
0b 00000099`1bb8d700 000007ff`8c32b420 ntdll!RtlpExecuteHandlerForException+0xd [d:\win8_ldr\minkernel\ntos\rtl\amd64\xcptmisc.asm @ 131]
0c 00000099`1bb8d730 000007ff`8c314b7a ntdll!RtlDispatchException+0x392 [d:\win8_ldr\minkernel\ntos\rtl\amd64\exdsptch.c @ 456]
0d 00000099`1bb8de40 000007f7`d182fe18 ntdll!KiUserExceptionDispatch+0x2e [d:\win8_ldr\minkernel\ntos\rtl\amd64\trampoln.asm @ 609]
0e (Inline Function) --------`-------- Service!std::_Ptr_base<Service::Common::TraceInfo>::{ctor}+0x5 [d:\dbs\cxcache\.visualcpp.corext.0lxpiyeuee2pj95cxybknw\include\memory @ 279]
0f (Inline Function) --------`-------- Service!std::shared_ptr<Service::Common::TraceInfo>::{ctor}+0x5 [d:\dbs\cxcache\.visualcpp.corext.0lxpiyeuee2pj95cxybknw\include\memory @ 475]
10 00000099`1bb8e570 000007f7`d1846188 Service!std::make_shared<Service::Common::TraceInfo,apsdk::CustomLogID const & __ptr64,char const (& __ptr64)[19],std::basic_string<char,std::char_traits<char>,std::allocator<char> > const & __ptr64,std::shared_ptr<Service::Common::TraceInfo> const & __ptr64>+0x68 [d:\dbs\cxcache\.visualcpp.corext.0lxpiyeuee2pj95cxybknw\include\memory @ 1005]
11 00000099`1bb8e5d0 000007f7`d1c64520 Service!ns::Wrapper::MappingClient::EnumerateDirectory+0x78 [d:\dbs\sh\cs\0918_125500_0\cmd\1\Service\core\nswrapper\native\lib\nsMappingClient.cpp @ 3659]
12 00000099`1bb8e730 000007f7`d1c63710 Service!Service::Core::StoreManager::SeEnumerateDirectoryWithPaging+0xdd0 [d:\dbs\sh\cs\0918_125500_0\cmd\2\Service\core\lib\seenumeratedirectory.cpp @ 584]
13 00000099`1bb8f630 000007f7`d1ae9cef Service!Service::Core::StoreManager::SeEnumerateDirectoryChunkEx+0xa0 [d:\dbs\sh\cs\0918_125500_0\cmd\2\Service\core\lib\seenumeratedirectory.cpp @ 409]
14 00000099`1bb8f6d0 000007f7`d1aea244 Service!<lambda_d669c1bdedc796f719caaf1d82dc1df7>::operator()+0x8f [d:\dbs\sh\cs\0918_125500_0\cmd\1\Service\service\lib\Service.cpp @ 568]
15 (Inline Function) --------`-------- Service!std::_Func_class<void>::operator()+0x16 [d:\dbs\cxcache\.visualcpp.corext.0lxpiyeuee2pj95cxybknw\include\functional @ 315]
16 00000099`1bb8f940 000007f7`d1a0cb2b Service!<lambda_d81057a01a156b9bef2b713ff248a780>::operator()+0x124 [d:\dbs\sh\cs\0918_125500_0\cmd\1\Service\service\lib\requestscheduler.h @ 218]
17 00000099`1bb8f9b0 000007f7`d1a7ac18 Service!Service::Service::HandleException<Service::Protocol::EnumerateDirectoryResponse,<lambda_d81057a01a156b9bef2b713ff248a780> >+0x2b [d:\dbs\sh\cs\0918_125500_0\cmd\1\Service\service\lib\requestscheduler.h @ 60]
18 (Inline Function) --------`-------- Service!Service::Service::RequestScheduler::RequestThreadPoolCallback+0x2c [d:\dbs\sh\cs\0918_125500_0\cmd\1\Service\service\lib\requestscheduler.h @ 211]
19 00000099`1bb8fa40 000007ff`8c322253 Service!Service::Service::RequestScheduler::RequestThreadPoolCallbackW<Service::Protocol::EnumerateDirectoryChunkExRequest,Service::Protocol::EnumerateDirectoryResponse>+0x48 [d:\dbs\sh\cs\0918_125500_0\cmd\1\Service\service\lib\requestscheduler.h @ 199]
1a 00000099`1bb8fa90 000007ff`8c3172f8 ntdll!TppWorkpExecuteCallback+0x103 [d:\win8_ldr\minkernel\threadpool\ntdll\work.c @ 706]
1b 00000099`1bb8fbe0 000007ff`896e1842 ntdll!TppWorkerThread+0x604 [d:\win8_ldr\minkernel\threadpool\ntdll\worker.c @ 1070]
1c 00000099`1bb8fe80 000007ff`8c34d421 kernel32!BaseThreadInitThunk+0x1a [d:\win8_gdr\base\win32\client\thread.c @ 65]
1d 00000099`1bb8feb0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d [d:\win8_ldr\minkernel\ntdll\rtlstrt.c @ 1021]

In particular, note that the function that triggered the crash was

[d:\dbs\cxcache.visualcpp.corext.0lxpiyeuee2pj95cxybknw\include\memory @ 279]

Here is the text of that function

enter image description here

!analyze -v in windbg tells me that this was an INVALID_POINTER_WRITE.

What could have caused an invalid pointer write in std::make_shared?

Here is a snippet of the constructor of the TraceInfo class

TraceInfo::TraceInfo(
    LogInfo logInfo,
    std::string functionName,
    std::string correlation,
    const std::shared_ptr<TraceInfo>& parent,
    std::string instance
    ):
    m_logInfo(std::move(logInfo)),
    m_functionName(std::move(functionName)),
    m_correlation(std::move(correlation)),
    m_parent(parent),
    m_Id(NewGuid()),
    m_instance(std::move(instance)),
    m_work(std::numeric_limits<uint64_t>::max()),
    m_maxExpectedLatency(std::numeric_limits<uint64_t>::max()),
    m_error(CsError_OK),
    m_latencyInfo(std::make_unique<LatencyInfo>()),
    m_callInfo(m_parent == nullptr ? std::make_shared<CallInfo>() : m_parent->m_callInfo)
{

Aucun commentaire:

Enregistrer un commentaire