Details
-
Bug
-
Resolution: Duplicate
-
Not Evaluated
-
None
-
5.12.2
-
None
-
Qt v5.12.2 is compiled from source and statically linked to our C++ application built using Visual Studio 2017 (v15.8.6) and Windows SDK version 10.0.16299.0. Our application has no UI.
The first VM running the application is using Windows Server 2008R2, the second one is using Windows Server 2012. They were both using a Release build of our application.Qt v5.12.2 is compiled from source and statically linked to our C++ application built using Visual Studio 2017 (v15.8.6) and Windows SDK version 10.0.16299.0. Our application has no UI. The first VM running the application is using Windows Server 2008R2, the second one is using Windows Server 2012. They were both using a Release build of our application.
Description
Our application crashed when a worker thread was finishing an iteration and a struct containing some QByteArray was going out of scope. Microsoft's Application Verifier was enabled with the default family of checks.
Below is the stack trace from WinDbg:
0:003> k # Child-SP RetAddr Call Site 00 00000000`0175e098 000007fe`fd701420 ntdll!NtWaitForMultipleObjects+0xa 01 00000000`0175e0a0 00000000`77981273 KERNELBASE!WaitForMultipleObjectsEx+0xe8 02 00000000`0175e1a0 00000000`779fb655 kernel32!WaitForMultipleObjectsExImplementation+0xb3 03 00000000`0175e230 00000000`779fb7d7 kernel32!WerpReportFaultInternal+0x215 04 00000000`0175e2d0 00000000`779fb82f kernel32!WerpReportFault+0x77 05 00000000`0175e300 00000000`779fba4c kernel32!BasepReportFault+0x1f 06 00000000`0175e330 00000000`77af9015 kernel32!UnhandledExceptionFilter+0x1fc 07 00000000`0175e410 00000000`77ad7388 ntdll! ?? ::FNODOBFM::`string'+0x2025 08 00000000`0175e440 00000000`77aebf7d ntdll!_C_specific_handler+0x8c 09 00000000`0175e4b0 00000000`77ac043a ntdll!RtlpExecuteHandlerForException+0xd 0a 00000000`0175e4e0 00000000`77aeb61e ntdll!RtlDispatchException+0x45a 0b 00000000`0175ebc0 00000000`77aa9912 ntdll!KiUserExceptionDispatch+0x2e 0c 00000000`0175f2d0 00000000`77aa9da0 ntdll!RtlpInsertFreeBlock+0x272 0d 00000000`0175f3a0 00000000`77aab21d ntdll!RtlpDeCommitFreeBlock+0x190 0e 00000000`0175f470 00000000`77a9c6d2 ntdll!RtlpFreeHeap+0xa4d 0f 00000000`0175f7b0 00000000`77aaa65b ntdll!RtlpFreeUserBlock+0x1f2 10 00000000`0175f840 00000000`779815aa ntdll!RtlFreeHeap+0x49b 11 00000000`0175f8c0 00000001`3fe3e470 kernel32!HeapFree+0xa 12 00000000`0175f8f0 00000001`3fa824c9 <my_app>!_free_base+0x1c [minkernel\crts\ucrt\src\appcrt\heap\free_base.cpp @ 105] 13 (Inline Function) --------`-------- <my_app>!QTypedArrayData<char>::deallocate+0x12 [<path_to_qt>\7fba07\1\include\qtcore\qarraydata.h @ 239] 14 (Inline Function) --------`-------- <my_app>!QByteArray::{dtor}+0x33 [<path_to_qt>\7fba07\1\include\qtcore\qbytearray.h @ 476] 15 00000000`0175f920 00000001`3fa8209c <my_app>!CServicesWorker::run+0x349 [...\servicesworker.cpp @ 97] 16 (Inline Function) --------`-------- <my_app>!std::_Invoker_pmf_pointer::_Call+0x5 [c:\program files (x86)\microsoft visual studio\2017\professional\vc\tools\msvc\14.15.26726\include\thr\xthread @ 247] 17 (Inline Function) --------`-------- <my_app>!std::invoke+0x9 [c:\program files (x86)\microsoft visual studio\2017\professional\vc\tools\msvc\14.15.26726\include\thr\xthread @ 230] 18 (Inline Function) --------`-------- <my_app>!std::_LaunchPad<std::unique_ptr<std::tuple<void (__cdecl CServicesWorker::*)(void),CServicesWorker *>,std::default_delete<std::tuple<void (__cdecl CServicesWorker::*)(void),CServicesWorker *> > > >::_Execute+0x9 [c:\program files (x86)\microsoft visual studio\2017\professional\vc\tools\msvc\14.15.26726\include\thr\xthread @ 238] 19 (Inline Function) --------`-------- <my_app>!std::_LaunchPad<std::unique_ptr<std::tuple<void (__cdecl CServicesWorker::*)(void),CServicesWorker *>,std::default_delete<std::tuple<void (__cdecl CServicesWorker::*)(void),CServicesWorker *> > > >::_Run+0x55 [c:\program files (x86)\microsoft visual studio\2017\professional\vc\tools\msvc\14.15.26726\include\thr\xthread @ 245] 1a 00000000`0175fa70 00000001`3fa82029 <my_app>!std::_LaunchPad<std::unique_ptr<std::tuple<void (__cdecl CServicesWorker::*)(void),CServicesWorker *>,std::default_delete<std::tuple<void (__cdecl CServicesWorker::*)(void),CServicesWorker *> > > >::_Go+0x6c [c:\program files (x86)\microsoft visual studio\2017\professional\vc\tools\msvc\14.15.26726\include\thr\xthread @ 230] 1b 00000000`0175fab0 00000001`3fe27000 <my_app>!std::_Pad::_Call_func+0x9 [c:\program files (x86)\microsoft visual studio\2017\professional\vc\tools\msvc\14.15.26726\include\thr\xthread @ 209] 1c (Inline Function) --------`-------- <my_app>!invoke_thread_procedure+0xd [minkernel\crts\ucrt\src\appcrt\startup\thread.cpp @ 91] 1d 00000000`0175fae0 00000000`7797556d <my_app>!thread_start<unsigned int (__cdecl*)(void * __ptr64)>+0x50 [minkernel\crts\ucrt\src\appcrt\startup\thread.cpp @ 115] 1e 00000000`0175fb10 00000000`77ad385d kernel32!BaseThreadInitThunk+0xd 1f 00000000`0175fb40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
Here is the analysis from WinDbg:
0:003> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* DEBUG_FLR_EXCEPTION_CODE(c0000374) and the ".exr -1" ExceptionCode(c0000005) don't match KEY_VALUES_STRING: 1 Key : AV.Fault Value: Read Key : Analysis.CPU.Sec Value: 0 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on <my_machine_name> Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 1 Key : Analysis.Memory.CommitPeak.Mb Value: 114 Key : Analysis.System Value: CreateObject Key : Timeline.OS.Boot.DeltaSec Value: 2695 Key : Timeline.Process.Start.DeltaSec Value: 2661 NTGLOBALFLAG: 40000000 APPLICATION_VERIFIER_FLAGS: 0 CONTEXT: (.ecxr) rax=00000001206dd000 rbx=00000000002b0000 rcx=0000000000100000 rdx=0000000000100000 rsi=00000000024063f0 rdi=00000000023f93ff rip=0000000077aa9912 rsp=000000000175f2d0 rbp=0000000002406400 r8=00000000023f93ff r9=00000000002b4c88 r10=00000000002b0158 r11=00000000002b4c70 r12=0000000000001900 r13=0000000000001900 r14=00000000002b1900 r15=0000000002340000 iopl=0 nv up ei ng nz ac po cy cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010297 ntdll!RtlpInsertFreeBlock+0x272: 00000000`77aa9912 488b08 mov rcx,qword ptr [rax] ds:00000001`206dd000=???????????????? Resetting default scope EXCEPTION_RECORD: (.exr -1) ExceptionAddress: 0000000077aa9912 (ntdll!RtlpInsertFreeBlock+0x0000000000000272) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 00000001206dd000 Attempt to read from address 00000001206dd000 PROCESS_NAME: <my_app> READ_ADDRESS: 00000001206dd000 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE_STR: c0000005 EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 00000001206dd000 ADDITIONAL_DEBUG_TEXT: Enable Pageheap/AutoVerifer ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD] FAULTING_THREAD: 00000334 STACK_TEXT: 00000000`00000000 00000000`00000000 heap_corruption!<my_app>+0x0 SYMBOL_NAME: heap_corruption!<my_app> MODULE_NAME: heap_corruption IMAGE_NAME: heap_corruption STACK_COMMAND: ** Pseudo Context ** ManagedPseudo ** Value: 24cda8fe7a0 ** ; kb FAILURE_BUCKET_ID: HEAP_CORRUPTION_c0000005_heap_corruption!<my_app> OS_VERSION: 6.1.7601.24441 BUILDLAB_STR: win7sp1_ldr OSPLATFORM_TYPE: x64 OSNAME: Windows 7 FAILURE_ID_HASH: {1b15e921-1407-e80b-86f1-dd5a8b186860} Followup: MachineOwner ---------
I checked the "change files" of Qt 5.12.3, 5.12.4 and 5.12.5 (latest) under qtbase section without seeing any mention to an applicable bugfix.
There seems to be a corner case triggering this bug as dozens of VMs were running the same test and only 2 got a heap corruptions (not at the same place, so I will create a separate ticket for the second crash). We did not update Qt recently nor did code changes close to where the corruption happens.
EDIT: The second crash is in fact very similar since it happens precisely after QArrayData::deallocate is called (qt5\qtbase\src\corelib\tools\qarraydata.h @ 239). The original context for the 2nd crash is that our WebSocket connection seemed to have been terminated by the remote host and we were calling QWebSocket::close as a consequence, before attempting to reconnect. Note that Application Verifier was most likely not running for this particular crash.
At the stack level of [0x26] <my_app>!QAbstractSocketPrivate::setErrorAndEmit + 0x53, we can find the following error code stored in the dump: RemoteHostClosedError (1).
Here is the stack trace:
0:001> k # Child-SP RetAddr Call Site 00 00000020`07447328 000007ff`3ac7115c ntdll!NtWaitForSingleObject+0xa 01 00000020`07447330 000007ff`3ac7150b ntdll!RtlReportExceptionEx+0x22c 02 00000020`07447460 000007ff`3ac9a5b2 ntdll!RtlReportException+0xbb 03 00000020`074474f0 000007ff`3abd9e2e ntdll!RtlReportCriticalFailure$filt$0+0x33 04 00000020`07447520 000007ff`3aca8942 ntdll!_C_specific_handler+0x8e 05 00000020`07447590 000007ff`3abd948d ntdll!_GSHandlerCheck_SEH+0x76 06 00000020`074475c0 000007ff`3abda4b8 ntdll!RtlpExecuteHandlerForException+0xd 07 00000020`074475f0 000007ff`3abda95c ntdll!RtlDispatchException+0x392 08 00000020`07447d00 000007ff`3ac9a535 ntdll!RtlRaiseException+0x27e 09 00000020`074484e0 000007ff`3ac9f350 ntdll!RtlReportCriticalFailure+0x89 0a 00000020`074485f0 000007ff`3ac463b9 ntdll!RtlpLogHeapFailure+0xa4 0b 00000020`07448620 000007ff`3abc59c2 ntdll!RtlpFreeHeap+0x11d0 0c 00000020`07448880 000007f7`dfbde470 ntdll!RtlFreeHeap+0x6a4 0d 00000020`07448920 000007f7`df836c12 <my_app>!_free_base+0x1c [minkernel\crts\ucrt\src\appcrt\heap\free_base.cpp @ 105] 0e (Inline Function) --------`-------- <my_app>!QTypedArrayData<char>::deallocate+0x11 [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\tools\qarraydata.h @ 239] 0f 00000020`07448950 000007f7`df8db58e <my_app>!QByteArray::operator=+0x52 [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\tools\qbytearray.cpp @ 1289] 10 (Inline Function) --------`-------- <my_app>!QRingChunk::assign+0x19 [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\tools\qringbuffer_p.h @ 164] 11 (Inline Function) --------`-------- <my_app>!QRingChunk::clear+0x19 [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\tools\qringbuffer_p.h @ 174] 12 00000020`07448980 000007f7`df984108 <my_app>!QRingBuffer::clear+0x5e [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\tools\qringbuffer.cpp @ 241] 13 (Inline Function) --------`-------- <my_app>!QIODevicePrivate::QRingBufferRef::clear+0x11 [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\io\qiodevice_p.h @ 110] 14 00000020`074489b0 000007f7`dfb885a4 <my_app>!QSslSocket::close+0x88 [<path_to_qt>5cee31\1\qt5\qtbase\src\network\ssl\qsslsocket.cpp @ 834] 15 00000020`074489e0 000007f7`dfb85846 <my_app>!QWebSocketPrivate::close+0x394 [<path_to_qt>5cee31\1\qt5\qtwebsockets\src\websockets\qwebsocket_p.cpp @ 365] 16 00000020`07448a80 000007f7`dfa92c2e <my_app>!QWebSocket::close+0x36 [<path_to_qt>5cee31\1\qt5\qtwebsockets\src\websockets\qwebsocket.cpp @ 414] 17 00000020`07448ab0 000007f7`dfaa32a7 <my_app>!...disconnect+0x61e [<my_source_file> @ 436] 18 00000020`07448da0 000007f7`dfaa574c <my_app>!...reconnect+0x5f7 [<my_source_file> @ 470] 19 00000020`074490a0 000007f7`dfaa0950 <my_app>!...sockErrReconnect+0x61c [<my_source_file> @ 480] 1a 00000020`07449380 000007f7`df83cadd <my_app>!...onWebSockErrors+0x2830 [<my_source_file> @ 344] 1b (Inline Function) --------`-------- <my_app>!QtPrivate::QSlotObjectBase::call+0x24 [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qobjectdefs_impl.h @ 394] 1c 00000020`0744a780 000007f7`dfb86012 <my_app>!QMetaObject::activate+0x4fd [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qobject.cpp @ 3780] 1d 00000020`0744a8a0 000007f7`df83cadd <my_app>!QWebSocket::error+0x32 [<path_to_qt>aecc37\1\qtwebsockets\src\websockets\.moc\release\moc_qwebsocket.cpp @ 462] 1e (Inline Function) --------`-------- <my_app>!QtPrivate::QSlotObjectBase::call+0x24 [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qobjectdefs_impl.h @ 394] 1f 00000020`0744a8e0 000007f7`df9c79e3 <my_app>!QMetaObject::activate+0x4fd [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qobject.cpp @ 3780] 20 (Inline Function) --------`-------- <my_app>!QAbstractSocket::error+0x31 [<path_to_qt>aecc37\1\qtbase\src\network\.moc\release\moc_qabstractsocket.cpp @ 399] 21 00000020`0744aa00 000007f7`df982d89 <my_app>!QAbstractSocketPrivate::setErrorAndEmit+0x53 [<path_to_qt>5cee31\1\qt5\qtbase\src\network\socket\qabstractsocket.cpp @ 1438] 22 (Inline Function) --------`-------- <my_app>!QSslSocketPrivate::_q_errorSlot+0x61 [<path_to_qt>5cee31\1\qt5\qtbase\src\network\ssl\qsslsocket.cpp @ 2561] 23 00000020`0744aa40 000007f7`df83cbbe <my_app>!QSslSocket::qt_static_metacall+0x4c9 [<path_to_qt>aecc37\1\qtbase\src\network\.moc\release\moc_qsslsocket.cpp @ 184] 24 00000020`0744ab50 000007f7`df9c79e3 <my_app>!QMetaObject::activate+0x5de [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qobject.cpp @ 3796] 25 (Inline Function) --------`-------- <my_app>!QAbstractSocket::error+0x31 [<path_to_qt>aecc37\1\qtbase\src\network\.moc\release\moc_qabstractsocket.cpp @ 399] 26 00000020`0744ac70 000007f7`df9c753e <my_app>!QAbstractSocketPrivate::setErrorAndEmit+0x53 [<path_to_qt>5cee31\1\qt5\qtbase\src\network\socket\qabstractsocket.cpp @ 1438] 27 00000020`0744acb0 000007f7`df9c5aba <my_app>!QAbstractSocketPrivate::readFromSocket+0x19e [<path_to_qt>5cee31\1\qt5\qtbase\src\network\socket\qabstractsocket.cpp @ 1288] 28 00000020`0744bcf0 000007f7`df9f5e73 <my_app>!QAbstractSocketPrivate::canCloseNotification+0x5a [<path_to_qt>5cee31\1\qt5\qtbase\src\network\socket\qabstractsocket.cpp @ 766] 29 00000020`0744be60 000007f7`df84dfd6 <my_app>!QReadNotifier::event+0x33 [<path_to_qt>5cee31\1\qt5\qtbase\src\network\socket\qnativesocketengine.cpp @ 1278] 2a 00000020`0744be90 000007f7`df84dce7 <my_app>!QCoreApplicationPrivate::notify_helper+0x206 [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qcoreapplication.cpp @ 1225] 2b (Inline Function) --------`-------- <my_app>!doNotify+0x57 [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qcoreapplication.cpp @ 1150] 2c 00000020`0744bf10 000007f7`df84dda9 <my_app>!QCoreApplication::notify+0x67 [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qcoreapplication.cpp @ 1137] 2d 00000020`0744bf60 000007f7`df8f0858 <my_app>!QCoreApplication::notifyInternal2+0xb9 [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qcoreapplication.cpp @ 1060] 2e 00000020`0744bfe0 000007ff`3a7b171e <my_app>!qt_internal_proc+0x498 [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qeventdispatcher_win.cpp @ 201] 2f 00000020`0744c130 000007ff`3a7b14d7 user32!UserCallWinProcCheckWow+0x13a 30 00000020`0744c1f0 000007f7`df8f0079 user32!DispatchMessageWorker+0x1a7 31 00000020`0744c270 000007f7`df87c94b <my_app>!QEventDispatcherWin32::processEvents+0x5b9 [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qeventdispatcher_win.cpp @ 647] 32 (Inline Function) --------`-------- <my_app>!QEventLoop::processEvents+0x1f [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qeventloop.cpp @ 138] 33 00000020`0744f3f0 000007f7`df84cfff <my_app>!QEventLoop::exec+0x1fb [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qeventloop.cpp @ 225] 34 00000020`0744f470 000007f7`df808436 <my_app>!QCoreApplication::exec+0x13f [<path_to_qt>5cee31\1\qt5\qtbase\src\corelib\kernel\qcoreapplication.cpp @ 1363] 35 00000020`0744f4e0 000007ff`3a904ac5 <my_app>!CoordinatorServiceMain+0xc16 [<my_app>\src\<my_app>.cpp @ 252] 36 00000020`0744faf0 000007ff`39cd1842 sechost!ScSvcctrlThreadW+0x25 37 00000020`0744fb20 000007ff`3ac0e2f9 kernel32!BaseThreadInitThunk+0x1a 38 00000020`0744fb50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
and the analysis from WinDbg:
0:001> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* KEY_VALUES_STRING: 1 Key : Analysis.CPU.Sec Value: 1 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on <my_machine_name> Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 122 Key : Analysis.Memory.CommitPeak.Mb Value: 167 Key : Analysis.System Value: CreateObject Key : Timeline.OS.Boot.DeltaSec Value: 7457 Key : Timeline.Process.Start.DeltaSec Value: 7449 NTGLOBALFLAG: 40000000 APPLICATION_VERIFIER_FLAGS: 0 CONTEXT: (.ecxr) rax=000000000005d096 rbx=00000000c0000374 rcx=0000000000000000 rdx=0000000000000000 rsi=0000000000000000 rdi=000007ff3aceed30 rip=000007ff3ac9a535 rsp=00000020074484e0 rbp=000000ffffffffff r8=0000000000000000 r9=0000002007439000 r10=0000000000000000 r11=0000000000000003 r12=0000002008138140 r13=0000000000000000 r14=0000000000000003 r15=0000002008138100 iopl=0 nv up ei pl nz na po nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206 ntdll!RtlReportCriticalFailure+0x89: 000007ff`3ac9a535 eb00 jmp ntdll!RtlReportCriticalFailure+0x8b (000007ff`3ac9a537) Resetting default scope EXCEPTION_RECORD: (.exr -1) ExceptionAddress: 000007ff3ac9a535 (ntdll!RtlReportCriticalFailure+0x0000000000000089) ExceptionCode: c0000374 ExceptionFlags: 00000001 NumberParameters: 1 Parameter[0]: 000007ff3aceed30 PROCESS_NAME: <my_app> ERROR_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted. EXCEPTION_CODE_STR: c0000374 EXCEPTION_PARAMETER1: 000007ff3aceed30 ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD] FAULTING_THREAD: ffffffff STACK_TEXT: 00000000`00000000 00000000`00000000 heap_corruption!<my_app>+0x0 SYMBOL_NAME: heap_corruption!<my_app> MODULE_NAME: heap_corruption IMAGE_NAME: heap_corruption STACK_COMMAND: !heap ; ** Pseudo Context ** ManagedPseudo ** Value: 20b9ecfdf80 ** ; kb FAILURE_BUCKET_ID: HEAP_CORRUPTION_c0000374_heap_corruption!<my_app> OS_VERSION: 6.2.9200.16384 BUILDLAB_STR: win8_rtm OSPLATFORM_TYPE: x64 OSNAME: Windows 8 FAILURE_ID_HASH: {5215d6d2-2f0b-c3e1-1e12-577b9bdd562c} Followup: MachineOwner ---------
Thank you in advance for letting me know if any information is missing.
Attachments
Issue Links
- duplicates
-
QTBUG-61752 Exe with static linked Qt: Crash an start (Debug only, VS 2017<15.7.3): Invalid address specified to RtlValidateHeap
- Closed