Hi guys!
Boy was I happy to see your post. I've been tearing my hair out all morning trying to isolate a heap corruption error I was getting. It matches the description you guys are seeing very closely: I'm getting a bad tail error, with comprehensive heap corruption detection on, which occurs after calling cJSON_Print. I had commented out a lot of my code trying to isolate it, and as it stands now, my code runs in a loop creating and destroying cJSON objects, calling heap_caps_check_integrity_all(true) each time. I get no errors for about 50 cycles, then no corrupt heap before cJSON_Print(), but heap corruption after cJSON_Print(), and then a crash when I try to free the chunk->data object later in the loop.
I just recently started experiencing this, and given that this issue was posted only a few days ago, I suspect it may be because of a recent change?
A snippet of the code around where the issue happens:
Code: Select all
...
printf("Before:\n");
heap_caps_check_integrity_all(true);
chunk->data = (uint8_t*)cJSON_Print(json_chunk); // Set attributes of this chunk
printf("After:\n");
heap_caps_check_integrity_all(true);
...
This results in:
Code: Select all
Before:
After:
Before:
After:
....... (repeats 50 times)......
Before:
After:
Before:
After:
Before:
After:
CORRUPT HEAP: Bad tail at 0x3ffe0cc5. Expected 0xbaad5678 got 0xfefefefe
CORRUPT HEAP: Bad head at 0x3ffe0cd0. Expected 0xabba1234 got 0xfefefefe
CORRUPT HEAP: Block 0xfefefefc is outside heap (last valid block 0x3ffe0ccc)
Before:
CORRUPT HEAP: Bad tail at 0x3ffe0cc5. Expected 0xbaad5678 got 0xfefefefe
CORRUPT HEAP: Bad head at 0x3ffe0cd0. Expected 0xabba1234 got 0xfefefefe
CORRUPT HEAP: Block 0xfefefefc is outside heap (last valid block 0x3ffe0ccc)
After:
CORRUPT HEAP: Bad tail at 0x3ffe0cc5. Expected 0xbaad5678 got 0xfefefefe
CORRUPT HEAP: Bad head at 0x3ffe0cd0. Expected 0xabba1234 got 0xfefefefe
CORRUPT HEAP: Block 0xfefefefc is outside heap (last valid block 0x3ffe0ccc)
CORRUPT HEAP: Bad tail at 0x3ffe0cc5. Expected 0xbaad5678 got 0xfefefefe
assertion "head != NULL" failed: file "/home/me/esp/esp-idf/components/heap/./multi_heap_poisoning.c", line 199, function: multi_heap_free
abort() was called at PC 0x400d346f on core 0
0x400d346f: __assert_func at /Users/ivan/e/newlib_xtensa-2.2.0-bin/newlib_xtensa-2.2.0/xtensa-esp32-elf/newlib/libc/stdlib/../../../.././newlib/libc/stdlib/assert.c:63 (discriminator 8)
Backtrace: 0x40087c64:0x3ffb55b0 0x40087e07:0x3ffb55d0 0x400d346f:0x3ffb55f0 0x4008788b:0x3ffb5620 0x400826be:0x3ffb5640 0x40082add:0x3ffb5660 0x4000bec7:0x3ffb5680 0x400d32fa:0x3ffb56a0 0x400d2b39:0x3ffb56d0 0x400d0c3a:0x3ffb5f30
0x40087c64: invoke_abort at /home/me/esp/esp-idf/components/esp32/./panic.c:648
0x40087e07: abort at /home/me/esp/esp-idf/components/esp32/./panic.c:648
0x400d346f: __assert_func at /Users/ivan/e/newlib_xtensa-2.2.0-bin/newlib_xtensa-2.2.0/xtensa-esp32-elf/newlib/libc/stdlib/../../../.././newlib/libc/stdlib/assert.c:63 (discriminator 8)
0x4008788b: multi_heap_free at /home/me/esp/esp-idf/components/heap/./multi_heap_poisoning.c:313
0x400826be: heap_caps_free at /home/me/esp/esp-idf/components/heap/./heap_caps.c:401
0x40082add: _free_r at /home/me/esp/esp-idf/components/newlib/./syscalls.c:42
0x400d32fa: receipt_buffer_add at <snip> receipt_buffer.c:601
0x400d2b39: app_main at <snip> main.c:137
0x400d0c3a: main_task at /home/me/esp/esp-idf/components/esp32/./cpu_start.c:455
There is a fair bit of code in my program, and while I know there could be an issue that I'm causing myself, the similarity and timing of this thread makes me think otherwise. I am running the latest git clone of the esp-idf.
I will see if I can get this to happen with a test case.