ASSERT (AutomatedUITestBase.OpenCloseBrowserWindowWithAccelerator) app is using tool's memory: please report this!

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on August 16, 2011 17:13:56_

running ui_tests AutomatedUITestBase.OpenCloseBrowserWindowWithAccelerator
on win7 with full drmem

~/dr/git/exports/bin32/drrun.exe -quiet -ops "-no_hide -stderr_mask 15" ./ui_tests --ui-test-action-timeout=1200000 --ui-test-action-max-timeout=2800000 --ui-test-terminate-timeout=1200000 --gtest_filter="AutomatedUITestBase.OpenCloseBrowserWindowWithAccelerator"

ASSERT FAILURE (thread 5076): ..\src\drmemory\alloc_drmem.c:1943: !dr_memory_is_dr_internal(addr) && !dr_memory_is_in_client(addr) (app is using tool's memory: please report this!)

0:014> kb 20
ChildEBP RetAddr Args to Child
0fec8034 73547afc 50000018 00000004 00000003 ntdll!NtRaiseHardError+0x12
0fec8078 73531ecb 0fec85f4 7357c0fc 0b2bc4e8 dynamorio!nt_messagebox+0x7c [c:\src\dr\git\src\core\win32\ntdll.c @ 3296]
0fec90c0 1013eb1c 0fec90d8 0fec9118 1013eb63 dynamorio!dr_messagebox+0x8b [c:\src\dr\git\src\core\x86\instrument.c @ 3135]
0fec90cc 1013eb63 0fec90d8 202e7244 6f6d654d drmemorylib!wait_for_user+0xc [c:\src\drmemory\git\src\common\utils.c @ 82]
0fec9118 10100363 0b300000 0b2bc4e8 10333e8c drmemorylib!drmemory_abort+0x33 [c:\src\drmemory\git\src\common\utils.c @ 110]
0fec921c 100203f0 00000000 0fec9cd4 0b2bc4ea drmemorylib!check_unaddressable_exceptions+0xd43 [c:\src\drmemory\git\src\drmemory\alloc_drmem.c @ 1943]
0fec95c8 1001e630 00000008 0fec9cd4 0b2bc4ea drmemorylib!handle_mem_ref+0x19e0 [c:\src\drmemory\git\src\drmemory\readwrite.c @ 2940]
0fec9780 10012271 0000000c 00000008 0fec9cd4 drmemorylib!check_mem_opnd+0x1bf0 [c:\src\drmemory\git\src\drmemory\readwrite.c @ 2848]
0fec9d48 100184c6 0fca1780 77a52a00 77a52a00 drmemorylib!slow_path_with_mc+0x28e1 [c:\src\drmemory\git\src\drmemory\readwrite.c @ 1973]
0fec9eb0 18fc00b9 77a52a00 77a52a00 0b300000 drmemorylib!slow_path+0x46 [c:\src\drmemory\git\src\drmemory\readwrite.c @ 2138]
WARNING: Frame IP not in any known module. Following frames may be wrong.
1072f37c 77a52d07 0b300000 0b332248 1072f444 +0x18f600b8
1072f474 77a52bf2 0b332248 0b332250 0b332210 ntdll!RtlpFreeHeap+0x1f4
1072f494 75a214d1 0b300000 00000000 0b332250 ntdll!RtlFreeHeap+0x142
1072f4a8 6b6c5185 0b300000 00000000 0b332250 kernel32!HeapFree+0x14
1072f4b8 6b99cad1 0b332250 0ba7c418 0b332250 chrome_6b630000!free+0x25 [c:\src\chromium\src\base\allocator\allocator_shim.cc @ 154]
1072f4f4 6b99e8b5 1072f510 1072f800 1072f57c chrome_6b630000!v8::internal::Listv8::internal::MemoryAllocator::ChunkInfo,v8::internal::FreeStoreAllocationPolicy::ResizeAddInternal+0x61 [c:\src\chromium\src\v8\src\list-inl.h @ 82]
1072f520 6b970f9c 00001118 08000000 0b329e20 chrome_6b630000!v8::internal::MemoryAllocator::Setup+0xc5 [c:\src\chromium\src\v8\src\spaces.cc @ 332]
1072f530 6b94b92c 1072f800 00000000 0ba73ff8 chrome_6b630000!v8::internal::Heap::Setup+0x9c [c:\src\chromium\src\v8\src\heap.cc @ 5067]
1072f558 6b977c5f 1072f57c 6b977c9d 1072f57c chrome_6b630000!v8::internal::Isolate::Init+0x7c [c:\src\chromium\src\v8\src\isolate.cc @ 1720]
1072f560 6b977c9d 1072f57c 0ba73ff8 6cf49940 chrome_6b630000!v8::internal::V8::Initialize+0x7f [c:\src\chromium\src\v8\src\v8.cc @ 85]
1072f614 6b977d16 6cf49940 0004b851 6b937c61 chrome_6b630000!v8::internal::Snapshot::Deserialize+0x3d [c:\src\chromium\src\v8\src\snapshot-common.cc @ 43]
1072f620 6b937c61 00000000 6b88b346 6b794353 chrome_6b630000!v8::internal::Snapshot::Initialize+0x56 [c:\src\chromium\src\v8\src\snapshot-common.cc @ 56]
1072f628 6b88b346 6b794353 0ba73ff8 0ba136e4 chrome_6b630000!v8::V8::Initialize+0x21 [c:\src\chromium\src\v8\src\api.cc @ 3924]
1072f62c 6b794353 0ba73ff8 0ba136e4 0ba136d0 chrome_6b630000!WebKit::initialize+0x36 [c:\src\chromium\src\third_party\webkit\source\webkit\chromium\src\webkit.cpp @ 93]
1072f758 6be201a4 00000000 0ba136d0 0ba77fd0 chrome_6b630000!WebKitThread::InternalWebKitThread::Init+0xa3 [c:\src\chromium\src\content\browser\in_process_webkit\webkit_thread.cc @ 53]
1072f8a8 6be094d9 00000000 75a23677 0ba77fd0 chrome_6b630000!base::Thread::ThreadMain+0xd4 [c:\src\chromium\src\base\threading\thread.cc @ 160]
1072f8b0 75a23677 0ba77fd0 1072f8fc 77a59f02 chrome_6b630000!base::`anonymous namespace'::ThreadFunc+0x19 [c:\src\chromium\src\base\threading\platform_thread_win.cc @ 38]
1072f8bc 77a59f02 0ba77fd0 1bd58372 00000000 kernel32!BaseThreadInitThunk+0xe
1072f8fc 77a59ed5 6be094c0 0ba77fd0 00000000 ntdll!__RtlUserThreadStart+0x70
1072f914 00000000 6be094c0 0ba77fd0 00000000 ntdll!_RtlUserThreadStart+0x1b

ntdll!RtlpCoalesceFreeBlocks+0x35:
77a52a00 324e02 xor cl,[esi+0x2]

```
addr = 0x0b2bc4ea ""
sz = 1
```

0:014> ?? dynamorio!heapmgt->vmheap
struct vm_heap_t
+0x000 start_addr : 0x18d40000 ""
+0x004 end_addr : 0x20d40000 ""

```
sz = 0x40000
base = 0x0b280000 ""
```

0:014> ?? dynamorio!dynamo_areas->buf[49]
struct vm_area_t
+0x000 start : 0x0b280000 ""
+0x004 end : 0x0b2c0000 ""
+0x008 vm_flags : 0x11
+0x00c frag_flags : 0
+0x010 custom :

heap_tree has 0x0b300000
why does Rtl heap think 0b280000 is part of this Heap?

+0x000 size : 0x144
+0x004 xdi : 0xb300000
+0x004 edi : 0xb300000
+0x008 xsi : 0xb2bc4e8
+0x008 esi : 0xb2bc4e8
+0x00c xbp : 0x1072f37c
+0x00c ebp : 0x1072f37c
+0x010 xsp : 0x1072f354
+0x010 esp : 0x1072f354
+0x014 xbx : 0xb332248
+0x014 ebx : 0xb332248
+0x018 xdx : 0x7ff
+0x018 edx : 0x7ff
+0x01c xcx : 0
+0x01c ecx : 0
+0x020 xax : 0x100000
+0x020 eax : 0x100000

0:014> dd 0xb300000+4c
0b30004c 00100000 5ef26470 0000eb68 368982e1
0:014> dd 0xb332248
0b332248 b5001518 0b3000c4 00000000 00000000

ebx + 4 => 000000c4 ^ 0000eb68 = 0000ebac << 3 = 00075d60
that matches: 0xb332248 - 0x0b2bc4e8 = 00075d60
but how can it subtract that huge amount?

I'm stumped for now.

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=558_