Marshal.FreeHGlobal STATUS_HEAP_CORRUPTION in TraceLog real-time mode

[wwh1004]

I tried to find where the heap corruption occurred by elimination, but to no avail.

[wwh1004]

I believe there should be a double free.

I dumped freed buffer and I found that there are the events having the same myBuffer.

Notes 0x0000017AB3B6DE80

0x0000017AB41C7F30 Image/Load
0x0000017AB41C7DF0 Image/Load
0x0000017AB41C7CA0 Image/Load
0x0000017AB41C7B60 Image/Load
0x0000017AB41C7A70 Thread/Start
0x0000017AB3B6DE80 Platform.Maps.ThreadCount
0x0000017AB41C7910 Process/Start
0x0000017AB41C7820 Thread/Start
0x0000017AB3B6EE00 Thread/Stop
0x0000017AB3B6ECC0 Image/Unload
0x0000017AB3B6EB80 Image/Load
0x0000017AB41D2CF0 Image/Unload
0x0000017AB41C76D0 Image/Load
0x0000017AB3B6EA40 Thread/Start
0x0000017AB3B6E950 Thread/Stop
0x0000017AB3B6E860 Thread/Stop
0x0000017AB3B6E770 Thread/Stop
0x0000017AB3B6E680 Thread/Stop
0x0000017AB3B6E590 Thread/Stop
0x0000017AB41C7590 Image/Load
0x0000017AB3B6E4A0 Thread/Stop
0x0000017AB3B6E2C0 Platform.LegacySampleSubmission
0x0000017AB3B6E180 Image/Unload
0x0000017AB3B6E040 Image/Load
0x0000017AB3B6DE80 Platform.Maps.ThreadCount

[wwh1004]

It seems that adding ret.myBuffer = IntPtr.Zero; in the Clone() function has made the crash disappear. I don't know if this is the root of the problem.

[brianrob]

I'm surprised that there is a double-free here because Clone is what allocates the buffer. How reliably does this repro for you? I'm wondering if you can share a minimal repro or a time travel trace of the crash.

[wwh1004]

Sorry. This is introduced by my unmerged pr #2160. I changed to

        public virtual unsafe TraceEvent Clone()
        {
            TraceEvent ret = (TraceEvent)MemberwiseClone();     // Clone myself. 
            ....
        }
        protected internal TraceEvent CloneToTemplate()
        {
            TraceEvent ret;
            var record = eventRecord;
            try
            {
                eventRecord = null;
                ret = Clone();
            }
            finally
            {
                eventRecord = record;
            }
            ret.traceEventSource = null;
            ret.Target = null;
            return ret;
        }

to optimize performance. MemberwiseClone will also copy myBuffer by reference, but I forget to set myBuffer to zero. This cause double free.

[wwh1004]

ETW provides a mechanism that allows me to track the status of Windows internal components, including its call stack information. The TraceEvent library offers the greatest convenience and acceptable resource usage compared to krabsetw. Perhaps my use case is not common, so I would like to provide some PRs to make this library more suitable for my use.