I am investigating memory of an application running on 32-bit Win 7, built with mixed mode (VC++ and C#.net)
I've already gone through the following steps in trying to analyze the cause for the leak:
enabled user mode stack trace database in GFlags
by using UMDH.exe i have ran the difference between to 2 snapshots and i see the highest memory allocation is
+ 243040 ( 15884374 - 15641334) 872075 allocs BackTrace17A3C8
+ 243026 ( 872075 - 629049) BackTrace17A3C8 allocations
ntdll!RtlAllocateHeap+00000274
It contains only one line without any call stack. which is confusing me.
Further analysis using Windbg :
In Windbg, typing the following command: !heap -stat -h 02150000
(where 2150000 is the address of the heap that has the leak) After comparing multiple dumps, I see that a memory blocks of size 1 are increasing over time and are probably the memory that is leaked.
typing the following command: !heap -flt s 1
gives the UserPtr of those allocations and finally:
typing !heap -p -a address
on some of those addresses always shows the following allocation call stack:
address 0813fe08 found in
_HEAP @ 2150000
HEAP_ENTRY Size Prev Flags UserPtr UserSize - state
0813fdf0 0004 0000 [00] 0813fe08 00001 - (busy)
76ecd84c ntdll!RtlAllocateHeap+0x00000274
which is matching with the UMDH analysis. And here as well I don't see call stack.
Can anyone help me pointing me a direction here ?
User contributions licensed under CC BY-SA 3.0