ASSERT (ui_tests AutomatedUITestBase.Home) pt->valloc_type == MEM_DECOMMIT || !is_in_heap_region(base), "heap region tracking bug"

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on October 24, 2011 14:07:41_

xref this same assert hit in issue #318 after some custom tweaks but there V8 is not involved, instead it's memory zones

this is V8 heap allocation calling VirtualFree on what we have marked as a
heap region

+0x02c valloc_type : 0x8000 <== MEM_RELEASE
+0x030 valloc_commit : 1 ''
+0x038 in_heap_routine : 0
+0x03c in_heap_adjusted : 0
+0x154 heap_handle : 0x030d0000
size = 0x6000
success = 1 ''
size_ptr = 0x057ef10c
base_ptr = 0x057ef108
base = 0x12750000 ""

0:009> kn 30
# ChildEBP RetAddr
00 05228b68 6ffa82ec ntdll!ZwRaiseHardError+0x12
01 05228bac 6ff9269b dynamorio!nt_messagebox+0x7c [c:\src\dr\git\src\core\win32\ntdll.c @ 3296]
02 05229bf4 10150b1c dynamorio!dr_messagebox+0x8b [c:\src\dr\git\src\core\x86\instrument.c @ 3161]
03 05229c00 10150b63 drmemorylib!wait_for_user+0xc [c:\src\drmemory\git\src\common\utils.c @ 96]
04 05229c4c 100cdea6 drmemorylib!drmemory_abort+0x33 [c:\src\drmemory\git\src\common\utils.c @ 124]
05 05229d34 100cc680 drmemorylib!handle_post_vfree+0xb26 [c:\src\drmemory\git\src\common\alloc.c @ 2915]
06 05229db0 1011707d drmemorylib!handle_post_alloc_syscall+0x4c0 [c:\src\drmemory\git\src\common\alloc.c @ 2990]
07 05229f38 6ff915f7 drmemorylib!event_post_syscall+0x4d [c:\src\drmemory\git\src\drmemory\syscall.c @ 1069]
08 05229f6c 6ff9f96a dynamorio!instrument_post_syscall+0x97 [c:\src\dr\git\src\core\x86\instrument.c @ 1702]
09 05229f98 6ff498a5 dynamorio!post_system_call+0x6ba [c:\src\dr\git\src\core\win32\syscall.c @ 3707]
0a 05229fa0 6ff4a23f dynamorio!handle_post_system_call+0x25 [c:\src\dr\git\src\core\dispatch.c @ 1855]
0b 05229fbc 6ff4a2f0 dynamorio!dispatch_enter_dynamorio+0x3ef [c:\src\dr\git\src\core\dispatch.c @ 727]
0c 057ef0fc 7738e542 dynamorio!dispatch+0x10 [c:\src\dr\git\src\core\dispatch.c @ 149]
0d 057ef114 6a2173c2 KERNELBASE!VirtualFree+0x15
0e 057ef124 6a26f64a chrome_69520000!v8::internal::OS::Free+0x12 [c:\src\chromium\src\v8\src\platform-win32.cc @ 889]
0f 057ef140 6a27007f chrome_69520000!v8::internal::MemoryAllocator::FreeRawMemory+0x3a [c:\src\chromium\src\v8\src\spaces.cc @ 412]
10 057ef164 6a270859 chrome_69520000!v8::internal::LargeObjectChunk::Free+0x5f [c:\src\chromium\src\v8\src\spaces.cc @ 2740]
11 057ef180 6a2a0e3c chrome_69520000!v8::internal::LargeObjectSpace::FreeUnmarkedObjects+0xc9 [c:\src\chromium\src\v8\src\spaces.cc @ 2937]
12 057ef198 6a237091 chrome_69520000!v8::internal::MarkCompactCollector::CollectGarbage+0x3c [c:\src\chromium\src\v8\src\mark-compact.cc @ 89]
13 057ef1a8 6a23e27c chrome_69520000!v8::internal::Heap::MarkCompact+0x91 [c:\src\chromium\src\v8\src\heap.cc @ 826]
14 057ef1d8 6a23e517 chrome_69520000!v8::internal::Heap::PerformGarbageCollection+0xdc [c:\src\chromium\src\v8\src\heap.cc @ 733]
15 057ef268 6a23e637 chrome_69520000!v8::internal::Heap::CollectGarbage+0x77 [c:\src\chromium\src\v8\src\heap.cc @ 510]
16 057ef27c 6a23e65f chrome_69520000!v8::internal::Heap::CollectGarbage+0x17 [c:\src\chromium\src\v8\src\heap-inl.h @ 427]
17 057ef28c 6a23e8e9 chrome_69520000!v8::internal::Heap::CollectAllGarbage+0x1f [c:\src\chromium\src\v8\src\heap.cc @ 452]
18 057ef2a0 6a3c6185 chrome_69520000!v8::internal::Heap::IdleNotification+0xd9 [c:\src\chromium\src\v8\src\heap.cc @ 4308]
19 057ef2ac 6a3c6478 chrome_69520000!net::ProxyResolverV8::Context::PurgeMemory+0x15 [c:\src\chromium\src\net\proxy\proxy_resolver_v8.cc @ 491]
1a 057ef2bc 6a3c6498 chrome_69520000!net::ProxyResolverV8::Context::~Context+0x28 [c:\src\chromium\src\net\proxy\proxy_resolver_v8.cc @ 350]
1b 057ef2c4 6a3c652d chrome_69520000!net::ProxyResolverV8::Context::`scalar deleting destructor'+0x8
1c 057ef2cc 6a3c66c9 chrome_69520000!scoped_ptr::~scoped_ptr+0xd [c:\src\chromium\src\base\memory\scoped_ptr.h @ 76]
1d 057ef2d4 6a3c6728 chrome_69520000!net::ProxyResolverV8::~ProxyResolverV8+0x19 [c:\src\chromium\src\net\proxy\proxy_resolver_v8.cc @ 690]
1e 057ef2dc 69803d5a chrome_69520000!net::ProxyResolverV8::`scalar deleting destructor'+0x8
1f 057ef2ec 6a3ccc38 chrome_69520000!scoped_ptr::reset+0x1a [c:\src\chromium\src\base\memory\scoped_ptr.h @ 85]
20 057ef398 6a3ce117 chrome_69520000!net::MultiThreadedProxyResolver::Executor::Destroy+0xb8 [c:\src\chromium\src\net\proxy\multi_threaded_proxy_resolver.cc @ 362]
21 057ef454 6a3ce1db chrome_69520000!net::MultiThreadedProxyResolver::ReleaseAllExecutors+0xb7 [c:\src\chromium\src\net\proxy\multi_threaded_proxy_resolver.cc @ 529]
22 057ef460 6a3ce448 chrome_69520000!net::MultiThreadedProxyResolver::~MultiThreadedProxyResolver+0x1b [c:\src\chromium\src\net\proxy\multi_threaded_proxy_resolver.cc @ 396]
23 057ef468 698a554e chrome_69520000!net::MultiThreadedProxyResolver::`scalar deleting destructor'+0x8
24 057ef470 6a36bd2a chrome_69520000!scoped_ptrprinting::PrintPreviewMessageHandler::~scoped_ptrprinting::PrintPreviewMessageHandler+0xe [c:\src\chromium\src\base\memory\scoped_ptr.h @ 76]
25 10f02c90 02f668a8 chrome_69520000!net::ProxyService::~ProxyService+0xfa [c:\src\chromium\src\net\proxy\proxy_service.cc @ 628]

OS::Allocate picks a random address from a large range and tries to alloc
there w/ commit+reserve:
LPVOID mbase = VirtualAlloc(reinterpret_cast(address),
msize,
MEM_COMMIT | MEM_RESERVE,
prot);
if (mbase == NULL && address != 0)
mbase = VirtualAlloc(NULL, msize, MEM_COMMIT | MEM_RESERVE, prot);

even if fails, the non-random is commit+reserve so we shouldn't think it's
a heap, right? plus wouldn't be in_heap_routine? unless new operator
interception causes that: but constructor should be before operator.

to be added to heap as non-arena: must be in_heap_routine > 0 and
valloc_commit.

valloc_commit: could happen on 2nd try w/ no base, or 1st if will succeed:
so seems reasonable.

0:009> ?? _heap_tree->root->right->left->left->right->left->right
struct _rb_node_t
+0x000 parent : 0x11d92894
+0x004 right : 0x10222d84
+0x008 left : 0x10222d84
+0x00c color : 1 ( BLACK )
+0x010 base : 0x12750000 ""
+0x014 size : 0x6000
+0x018 max : (null)
+0x01c client : 0x126f5500
0:009> ?? *(drmemorylib!heap_info_t_)heap_tree->root->right->left->left->right->left->right->client
struct _heap_info_t
+0x000 arena : 0 ''
+0x004 heap : 0xffffffff

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=641_