Memory Leak Analysis

[bekz]

Hi All,

I was doing some memoy leak analysis using Windbg. But I am facing few
problems,

1. My application depends in jre so it loads verify.dll,
zip.dll...which comes along with JRE. When ever enable Application
Verifier and try to do !avrf it is saying that above speicified DLLs
don't have any debug infomation, and almost the !avrf fails. How to go
about this?

2. !avrf -h is saying that as i have enable full page heap it can't
display any thing. How to disable that? I searched for pageheap.exe but
was not able to find.

3. Is there any specific document which I can refer for how to go about
using Application Verifier and Windbg.

4. I have been using !heap -l (w/o application verifier enabled) and
found that few memory leaks are thr.

thanks in advance
bekz

[Ivan Brugiolo [MSFT]]

#1
Can you clarify that this sentence means
`My application depends in jre so it loads verify.dll, zip.dll...` ?

As far as `!avrf` goes: the type information of certain OS types
and for selected system binaries is placed in the PDBs for the public
symbols.
This mechanism was refined after WinXp was shipped, so, the type information
required to use certain debugger extensions commands may not be available
in the older OSes. Does it work with the public symbols for Win2003-SP1 ?

#2
You can use `gflags.exe -p /disable XXXX.exe` to disable full pageheap.
You can also use `!heap -p` to inspect that status of PageHeap in the
application.

#3
I'm not aware of any specific document, but, AppVerifier with
windbg/cdb/ntsd
is used internally in MS all days, so, its combined usage is quite well
tested.
[Disclaimer: we do use private sysmbols with full type information, and,
this may sometimes cause trouble with certain debugger extension commands
that relay on types that are not retrofitted in the public PDBs]

#4
`!heap -l` works best without any heap instrumentation.
The command works by calculating the reachability of each outstanding heap
allocation at the point in time of the invocation of the command.
With heap instrumentation actives, the heap blocks are referenced several
times
by heap metadata and tracking structires, so, the meaning of what you could
get
is diminuished.

However, there are different approaches to heap leak detection within
the debugging session. The basic process consists in:
-a- find the heap usage of all the heaps `!heap -stat`
-b- for the heap with the most blocks, `!heap -stat -h <handle>`
get the histogram of distribution of blocks per size
-c- from the full heap dump, filter out only the blocks of a given size.
`!heap -flt s <size>`
-d- for the blocks of a given size, obtain the stack backtrace information
of the allocation site.
`!heap -p -a <address of block>`

--
--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

"bekz" <beck...@gmail.com> wrote in message
news:1157880512....@h48g2000cwc.googlegroups.com...

[bekz]

Hi Ivan thank for your reply...

#1 What i meant was that whenever my service starts it also loads up
verify.dll, zip.dll that comes with JRE and it be in the JRE's bin
folder. And i am not having any symbols for that. So !avrf was
complaining that i need to resolve those to continue forward.
And i am doing this on WinXP Professional with latest Debugging tools
downloaded. I have the code compiled locally with debug symbols.

Thanks
bekz

[Ivan Brugiolo [MSFT]]

The lack of symbols for certain modules in your process
are going to make the debugger complain, at lest once, about them.
However, the instrumentation abilities of Full PageHeap are NOT
affected by the lack of symbols of non os modules.
Certain debugger extension commands are designed to work
without any symbols, even if they print out a good deal
of error messages the first time they are used.
Other debugger extensions commands requires ntdll.pdb and verifier.pdb.
You should be able to get everything working without those symbols.

--
--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

"bekz" <beck...@gmail.com> wrote in message

news:1157970922.1...@b28g2000cwb.googlegroups.com...

[bekz]

Hi Ivan,

>>-b- for the heap with the most blocks, `!heap -stat -h <handle>`
> > get the histogram of distribution of blocks per size

Do you mean to say the commited bytes?

i am getting some thing similar as below....
0:082> !heap -stat
_HEAP 01420000
Segments 00000001
Reserved bytes 00010000
Committed bytes 00006000
VirtAllocBlocks 00000000
VirtAlloc bytes 00000000

_HEAP 0dd60000
Segments 00000001
Reserved bytes 00010000
Committed bytes 00003000
VirtAllocBlocks 00000000
VirtAlloc bytes 00000000

0:082> !heap -stat -h 01420000
heap @ 01420000
group-by: TOTSIZE max-display: 20
size #blocks total ( %) (percent of total busy bytes)
50 42 - 14a0 (46.32)
42 b - 2d6 (6.37)
40 a - 280 (5.61)
7c 5 - 26c (5.44)
3e 8 - 1f0 (4.35)
7a 4 - 1e8 (4.28)

now for which size should i use the filter? Am i following the right
way?

thanks
bekz

[bekz]

You are right Ivan...i posted the earlier messages when i was at
home...
-------------------------------------------------------------------------------------------------------
Start of output
-------------------------------------------------------------------------------------------------------
0:082> !avrf
Verifier package version >= 3.00
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: vfbasics!_AVRF_EXCEPTION_LOG_ENTRY
***
***
***
*************************************************************************
No type information found for `_AVRF_EXCEPTION_LOG_ENTRY'.

This extension requires symbols with type information
for ntdll.dll and verifier.dll.

Please fix the symbols for `[verifier core DLL]'.
-------------------------------------------------------------------------------------------------------
End of output
-------------------------------------------------------------------------------------------------------
0:082> lm
7c900000 7c9b0000 ntdll (pdb symbols)
c:\bekz\symsrv\ntdll.pdb\36515FB5D04345E491F672FA2E2878C02\ntdll.pdb
5ad10000 5ad56000 verifier (pdb symbols)
c:\becks\symsrv\verifier.pdb\3B7D84BF1\verifier.pdb

Any thoughts?

thanks
bekz

[Ivan Brugiolo [MSFT]]

#1
You should look for CommittedBytes + VirtualAlloc Bytes

#2
the size `50` is responsible for the most of the allocations, so
`!heap -flt s 50` should give you all the blocks that are 0x50 bytes in size

--
--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

"bekz" <beck...@gmail.com> wrote in message

news:1157997103.0...@e3g2000cwe.googlegroups.com...

[Ivan Brugiolo [MSFT]]

Is this on WinXp ?
If yes, then, it should be expected.

--
--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

"bekz" <beck...@gmail.com> wrote in message

news:1157997551.0...@e3g2000cwe.googlegroups.com...

[bekz]

Thanks Ivan for the support...I am right now able to do stuffs with
!heap, where as !avrf is still a problem..Is thr a platform that
support !avrf as i said earlier mine is a WinXP box.

thanks

[chenlin8]

You can also try DebugDiag.
http://www.microsoft.com/downloads/details.aspx?FamilyID=9bfa49bc-376b-4a54-95aa-73c9156706e7&DisplayLang=en

Regards,
CL

"bekz" <beck...@gmail.com>
??????:1158050250....@p79g2000cwp.googlegroups.com...

[bekz]

I have used debug diag & purifybut both didn't prove well..but windbg
seems to help me..
As windbg is quiet lite weight and can be installed on any production
env...i prefer this rather any other...i am currently trying to use
boundschecker also...let me see how it goes..