Skip to content

Heap corruption crash during rawFree on x86_64-windows-msvc #14727

@kcbanner

Description

@kcbanner

Zig Version

c7f479c

Steps to Reproduce and Observed Behavior

I observed this crash while bootstrapping zig on windows via zig-bootstrap build.bat, with these changes:

  • Pointing at zig master, instead of the zig version in zig-boostrap
  • Passing ReleaseWithDebInfo to CMake (to get more info on the crash)

This is a crash of x86_64-windows-msvc zig.exe (built by zig2.exe) while building x86_64-windows-gnu zig: the last command of https://github.com/ziglang/zig-bootstrap/blob/a836b63c1ae8e734a0f94cc4031610adfb4bedf7/build.bat#L247).

Minidump:

CONTEXT:  (.ecxr)
rax=0000000000000000 rbx=00000000c0000374 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000001 rdi=00007ffcc1ab97f0
rip=00007ffcc1a4f6a9 rsp=000000e7f8fd6720 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=000002c1c2f0a7c0
r14=000002c1c2f0a7b0 r15=0000000000000001
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
ntdll!RtlReportFatalFailure+0x9:
00007ffc`c1a4f6a9 eb00            jmp     ntdll!RtlReportFatalFailure+0xb (00007ffc`c1a4f6ab)
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffcc1a4f6a9 (ntdll!RtlReportFatalFailure+0x0000000000000009)
   ExceptionCode: c0000374
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 00007ffcc1ab97f0

PROCESS_NAME:  zig.exe

ERROR_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted.

EXCEPTION_CODE_STR:  c0000374

EXCEPTION_PARAMETER1:  00007ffcc1ab97f0

STACK_TEXT:  
000000e7`f8fd6720 00007ffc`c1a4f673     : 00007ffc`c1a9764c 000000e7`f8fffaa0 000002c1`b94c0000 000000e7`f8fd67e9 : ntdll!RtlReportFatalFailure+0x9
000000e7`f8fd6770 00007ffc`c1a583f2     : 00000000`000004ea 00007ffc`c1ab97f0 00000000`00000003 000002c1`b94c0000 : ntdll!RtlReportCriticalFailure+0x97
000000e7`f8fd6860 00007ffc`c1a586da     : 00000000`00000003 00000000`00000000 000002c1`b94c0000 00000000`00000000 : ntdll!RtlpHeapHandleError+0x12
000000e7`f8fd6890 00007ffc`c1a5e361     : 000002c1`b94c0000 000002c1`b94c0000 00000000`00000150 00000000`00000000 : ntdll!RtlpHpHeapHandleError+0x7a
000000e7`f8fd68c0 00007ffc`c19f74c2     : 00000000`00008000 00000000`000003ff 000002c1`b94c0000 000002c1`c25ce000 : ntdll!RtlpLogHeapFailure+0x45
000000e7`f8fd68f0 00007ffc`c19747b1     : 000002c1`00000001 000002c1`b94c0000 000002c1`c2f43d70 00000000`00000000 : ntdll!RtlpFreeHeapInternal+0x81db2
000000e7`f8fd69b0 00007ffc`bf15f05b     : 00000000`000000d8 000002c1`c2f0a7c0 000002c1`b9690000 000002c1`b94c0000 : ntdll!RtlFreeHeap+0x51
000000e7`f8fd69f0 00007ff7`24977be5     : 000002c1`bb138900 000002c1`00000000 00000000`000b16b8 000002c1`c33ec040 : ucrtbase!_free_base+0x1b
000000e7`f8fd6a20 00007ff7`2496e2d4     : 00000000`00000000 00000000`00000000 000002c1`c0446f10 000002c1`000001eb : zig!clearValues+0x4a5
000000e7`f8fd6ad0 00007ff7`2496e07b     : 00000000`00000000 00000000`00000000 000002c1`c1bf0180 00007ffc`00000041 : zig!destroyDecl+0x5c4
000000e7`f8fd6be0 00007ff7`2496e17c     : 00000000`00000000 00007ffc`00000000 000002c1`be163880 000002c1`0000000a : zig!destroyDecl+0x36b
000000e7`f8fd6cf0 00007ff7`2495fb26     : 00000000`00000000 00007ff7`00000000 00000000`00000000 000002c1`b9514bb8 : zig!destroyDecl+0x46c
000000e7`f8fd6e00 00007ff7`24961fb0     : 00000000`00000000 00000000`00000000 00007ff7`248be99c 00000000`00000000 : zig!deinit+0x326
000000e7`f8fd6f60 00007ff7`248be9d1     : 00000000`00000028 00000000`00000000 00000000`00000000 00000000`00000000 : zig!destroy+0x30
000000e7`f8fd7020 00007ff7`248bfad0     : 00000000`00000000 00007ff7`258124a9 00007f00`00000000 00000001`00000001 : zig!main+0xd7e1
000000e7`f8fff9f0 00007ff7`2a1fbfe0     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : zig!main+0x40
000000e7`f8fffa30 00007ffc`c0af7614     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : zig!__scrt_common_main_seh+0x10c
000000e7`f8fffa70 00007ffc`c19a26a1     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14
000000e7`f8fffaa0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21


SYMBOL_NAME:  ucrtbase!_free_base+1b

MODULE_NAME: ucrtbase

IMAGE_NAME:  ucrtbase.dll

STACK_COMMAND:  ~0s ; .ecxr ; kb

FAILURE_BUCKET_ID:  HEAP_CORRUPTION_c0000374_ucrtbase.dll!_free_base

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

Running the same build command again succeeds, presumably because whatever is causing this is not run due to a cache hit.

I don't observe this behaviour when building zig with a prebuilt binary - so I think this may be a problem with how zig2 is compiling zig.exe. I also don't observe it when a x86_64-windows-gnu zig builds a x86_64-windows-msvc zig, which is then used to build itself.

Note: I also saw AccessDenied errors while linking some of the llvm binaries - but these go away on subsequent runs of build.bat - I think this is a separate issue.

Expected Behavior

No crash

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugObserved behavior contradicts documented or intended behavioros-windows

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions