Unhandled exception at address (ntdll.dll): A heap has been corrupted

[dasyad00]

First and foremost, apologies if this is the incorrect repository to submit this bug report.

I am in the middle of creating a Ghostscript Dart binding using dart:ffi, package:ffi/ffi.dart, and ffigen. I am basing my logic on a PdfScribe which contains a near identical binding to the Ghostscript C-API. The only difference is that the latest commit on the agpl branch has the instance pointer managed as a singleton in the C code. However, I am coming across intermittent crashes that appear unrelated to my code.

Sometimes when running the example Flutter app in Windows, calling the binding function ("Start" button) would work as intended (see expected print outputs).

flutter: The Dart VM service is listening on http://127.0.0.1:64764/s59weqmIGwk=/
flutter: [gs, -dBATCH, -dNOPAUSE, -dSAFER, -dAutoRotatePages=/None, -sDEVICE=pdfwrite, -sOutputFile=out.pdf, C:\src\ghostscript_dart\in.tmp, -c, [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark, -f]
flutter: argv = 21cd7c7ef00
flutter: argv[0] @ 21cd0894420 = gs
flutter: argv[1] @ 21cd0894160 = -dBATCH
flutter: argv[2] @ 21cd0824e60 = -dNOPAUSE
flutter: argv[3] @ 21cd0894190 = -dSAFER
flutter: argv[4] @ 21cd08253a0 = -dAutoRotatePages=/None
flutter: argv[5] @ 21cd0824e80 = -sDEVICE=pdfwrite
flutter: argv[6] @ 21cd0824ee0 = -sOutputFile=out.pdf
flutter: argv[7] @ 21cd83046c0 = C:\src\ghostscript_dart\in.tmp
flutter: argv[8] @ 21cd08941a0 = -c
flutter: argv[9] @ 21cd82681c0 = [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark
flutter: argv[10] @ 21cd08941f0 = -f
flutter: argv[11] @ 0 = nullptr (believe me)
flutter: -----------------------------------------------
argc=11
String 0 @ 0000021CD7C7EF00: gs
String 1 @ 0000021CD7C7EF08: -dBATCH
String 2 @ 0000021CD7C7EF10: -dNOPAUSE
String 3 @ 0000021CD7C7EF18: -dSAFER
String 4 @ 0000021CD7C7EF20: -dAutoRotatePages=/None
String 5 @ 0000021CD7C7EF28: -sDEVICE=pdfwrite
String 6 @ 0000021CD7C7EF30: -sOutputFile=out.pdf
String 7 @ 0000021CD7C7EF38: C:\src\ghostscript_dart\in.tmp
String 8 @ 0000021CD7C7EF40: -c
String 9 @ 0000021CD7C7EF48: [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark
String 10 @ 0000021CD7C7EF50: -f
GPL Ghostscript GIT PRERELEASE 10.04.0 (2024-02-20)
Copyright (C) 2024 Artifex Software, Inc.  All rights reserved.
This software is supplied under the GNU AGPLv3 and comes with NO WARRANTY:
see the file COPYING for details.
Loading NimbusMonoPS-Regular font from %rom%Resource/Font/NimbusMonoPS-Regular... 4015840 2684625 1807376 524005 1 done.
%%[ ProductName: GPL Ghostscript GIT PRERELEASE ]%%
%%[Page: 1]%%
%%[LastPage]%%
flutter: initWithArgs: 0
flutter:
-------------------

flutter: _onPressed done!

Unhandled exception: A heap has been corrupted

Other times (for reasons unknown), calling the same binding function would crash with the message "Lost connection to device.". When running the same Windows app with the Visual Studio debugger (open ghostscript_dart\example\build\windows\x64\ghostscript_dart_example.sln in Visual Studio and press "Local Windows Debugger"), I get the following error:

A breakpoint instruction (__debugbreak() statement or a similar call) was executed in ghostscript_dart_example.exe.

After clicking on "Continue" on the debugger, I get the following error dialog:

Unhandled exception at 0x00007FF9C037C7A9 (ntdll.dll) in ghostscript_dart_example.exe: 0xC0000374: A heap has been corrupted (parameters: 0x00007FF9C03F38A0).

After pressing "Continue" inside of Visual Studio, the app continues to run, however with corrupted arguments.

flutter: [gs, -dBATCH, -dNOPAUSE, -dSAFER, -dAutoRotatePages=/None, -sDEVICE=pdfwrite, -sOutputFile=out.pdf, C:\src\ghostscript_dart\in.tmp, -c, [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark, -f]
flutter: argv = 21cd7c7dbc0
flutter: argv[0] @ 21cd7fe1610 = gs
flutter: argv[1] @ 21cd7fe1390 = -dBATCH
flutter: argv[2] @ 21cd7c7dbe0 = -dNOPAUSE
flutter: argv[3] @ 21cd7fe15d0 = -dSAFER
flutter: argv[4] @ 21cd7c7df80 = -dAutoRotatePages=/None
flutter: argv[5] @ 21cd7c7dc00 = -sDEVICE=pdfwrite
flutter: argv[6] @ 21cd7c7dc20 = -sOutputFile=out.pdf
flutter: argv[7] @ 21cd082dcf0 = C:\src\ghostscript_dart\in.tmp
flutter: argv[8] @ 21cd7fe1580 = -c
flutter: argv[9] @ 21cd08b4290 = [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark
flutter: argv[10] @ 21cd7fe1640 = -f
flutter: argv[11] @ 0 = nullptr (believe me)
flutter: -----------------------------------------------
argc=11
String 0 @ 0000021CD7C7DBC0: gs
String 1 @ 0000021CD7C7DBC8: -dBATCH
String 2 @ 0000021CD7C7DBD0: Ç▀╟╫∟☻
String 3 @ 0000021CD7C7DBD8: -dSAFER
String 4 @ 0000021CD7C7DBE0: -dAutoRotatePages=/None
String 5 @ 0000021CD7C7DBE8: ǧ■╫∟☻
String 6 @ 0000021CD7C7DBF0: -sOutputFile=out.pdf
String 7 @ 0000021CD7C7DBF8: C:\src\ghostscript_dart\in.tmp
String 8 @ 0000021CD7C7DC00: -c
String 9 @ 0000021CD7C7DC08: [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark
String 10 @ 0000021CD7C7DC10: -f
GPL Ghostscript GIT PRERELEASE 10.04.0 (2024-02-20)
Copyright (C) 2024 Artifex Software, Inc.  All rights reserved.
This software is supplied under the GNU AGPLv3 and comes with NO WARRANTY:
see the file COPYING for details.
Error: /undefinedfilename in (\034\002)
Operand stack:
Execution stack:   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push
Dictionary stack:   --dict:744/1123(ro)(G)--   --dict:0/20(G)--   --dict:85/200(L)--
Current allocation mode is local
Last OS error: Invalid argumentGPL Ghostscript GIT PRERELEASE 10.04.0: Unrecoverable error, exit code 1
flutter: initWithArgs: -100
flutter:
-------------------

This memory corruption has lead to either:

• string parsing errors,
• pointer access violation

0x900001a751cabb20 -- access violation
0x000001a751cabb20 -- correct address

I have noticed a couple things I believe are worth noting and related questions:

• The crashes (access violations exceptions) are occurring intermittently. When running the example project in my repository, select any PostScript file (you can get one from Ghostscript website), press "Start" consecutively with the debugger on, and observe the exceptions thrown at seemingly random amounts of pressing the "Start" button (usually within 10 presses). Can someone confirm whether the exceptions thrown are due to bugs in my implementation of the SDK or the SDK itself?
• Pointer addresses of pointers created by malloc/calloc in Dart are not equivalent pointer addresses as can be seen in the printed logs (Please refer to the linked codebase to see the exact print statements used). I have long understood that pointers shall not be passed between isolates. However, this is occurring regardless of whether the pointer has been allocated in a Dart isolate, or whether the pointer has been allocated synchronously with the UI-thread. I see that Dart uses CoTaskMemAlloc and CoTaskMemFree on Windows for memory allocation. However, why does it appear the pointer addresses differ in Dart and in C? This concerned has been resolved,
• Can I see the function responsible for passing pointers between Dart and C?

Access violation in flutter_windows.dll

Sometimes, I would get this error instead:

Unhandled exception at 0x00007FF93FAEC1A6 (flutter_windows.dll) in ghostscript_dart_example.exe: 0xC0000005: Access violation reading location 0xFFFFFFFFFFFFFFFF.

Behavior: crashes

Call stack:

flutter_windows.dll!flutter::Engine::DispatchPointerDataPacket(std::unique_ptr<flutter::PointerDataPacket,std::default_delete<flutter::PointerDataPacket>> packet, unsigned __int64 trace_flow_id) Line 436
[Inline Frame] flutter_windows.dll!std::_Func_class<void>::operator()() Line 874
flutter_windows.dll!fml::MessageLoopWin::Run() Line 39
flutter_windows.dll!fml::MessageLoopImpl::DoRun() Line 94
[External Code]	
flutter_windows.dll!thread_start<unsigned int (__cdecl*)(void *),1>(void * const parameter) Line 97

Illegal instruction in flutter_windows.dll

Unhandled exception at 0x00007FF92CA95D89 (flutter_windows.dll) in ghostscript_dart_example.exe: 0xC000001D: Illegal Instruction.

Environment information

Windows 11 Home 23H2 build 22631.3155 running in Parallels on an Intel-based MacBook Pro from 2019.

Output of flutter doctor -v:

PS C:\src\ghostscript_dart> flutter doctor -v
[√] Flutter (Channel stable, 3.19.2, on Microsoft Windows [Version 10.0.22631.3155], locale en-NL)
    • Flutter version 3.19.2 on channel stable at C:\src\flutter
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision 7482962148 (10 days ago), 2024-02-27 16:51:22 -0500
    • Engine revision 04817c99c9
    • Dart version 3.3.0
    • DevTools version 2.31.1

[√] Windows Version (Installed version of Windows is version 10 or higher)

      (or visit https://flutter.dev/docs/get-started/install/windows#android-setup for detailed instructions).
      If the Android SDK has been installed to a custom location, please use
      `flutter config --android-sdk` to update to that location.


[X] Chrome - develop for the web (Cannot find Chrome executable at .\Google\Chrome\Application\chrome.exe)
    ! Cannot find Chrome. Try setting CHROME_EXECUTABLE to a Chrome executable.

[√] Visual Studio - develop Windows apps (Visual Studio Community 2022 17.8.6)
    • Visual Studio at C:\Program Files\Microsoft Visual Studio\2022\Community
    • Visual Studio Community 2022 version 17.8.34525.116
    • Windows 10 SDK version 10.0.22621.0

[!] Android Studio (not installed)
    • Android Studio not found; download from https://developer.android.com/studio/index.html
      (or visit https://flutter.dev/docs/get-started/install/windows#android-setup for detailed instructions).

[√] VS Code (version 1.87.0)
    • VS Code at C:\Users\dsrahmatullah\AppData\Local\Programs\Microsoft VS Code
    • Flutter extension version 3.84.0

[√] Connected device (2 available)
    • Windows (desktop) • windows • windows-x64    • Microsoft Windows [Version 10.0.22631.3155]
    • Edge (web)        • edge    • web-javascript • Microsoft Edge 122.0.2365.66

[√] Network resources
    • All expected network resources are available.

! Doctor found issues in 3 categories.

[dasyad00]

I can confirm the same behavior happens on a fresh Windows install on a bare metal machine (Thinkpad P1).

flutter: [gs, -dBATCH, -dNOPAUSE, -dSAFER, -dAutoRotatePages=/None, -sDEVICE=pdfwrite, -sOutputFile=out.pdf, C:\Program Files\gs\gs10.03.0\examples\alphabet.ps, -c, [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark, -f]
flutter: argv = 1d829ef9e10
flutter: argv[0] @ 1d81fce9d00 = gs
flutter: argv[1] @ 1d81fce9cc0 = -dBATCH
flutter: argv[2] @ 1d829ef9d10 = -dNOPAUSE
flutter: argv[3] @ 1d81fce9bf0 = -dSAFER
flutter: argv[4] @ 1d829ef9f10 = -dAutoRotatePages=/None
flutter: argv[5] @ 1d829ef98f0 = -sDEVICE=pdfwrite
flutter: argv[6] @ 1d829ef9bd0 = -sOutputFile=out.pdf
flutter: argv[7] @ 1d82a030760 = C:\Program Files\gs\gs10.03.0\examples\alphabet.ps
flutter: argv[8] @ 1d81fce9c80 = -c
flutter: argv[9] @ 1d82a030f20 = [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark
flutter: argv[10] @ 1d81fce9e10 = -f
flutter: argv[11] @ 0 = nullptr (believe me)
flutter: -----------------------------------------------
argc=11
String 0 @ 000001D829EF9E10: gs
String 1 @ 000001D829EF9E18: -dBATCH
String 2 @ 000001D829EF9E20: -dNOPAUSE
String 3 @ 000001D829EF9E28: -dSAFER
String 4 @ 000001D829EF9E30: -dAutoRotatePages=/None
String 5 @ 000001D829EF9E38: -sDEVICE=pdfwrite
String 6 @ 000001D829EF9E40: -sOutputFile=out.pdf
String 7 @ 000001D829EF9E48: C:\Program Files\gs\gs10.03.0\examples\alphabet.ps
String 8 @ 000001D829EF9E50: -c
String 9 @ 000001D829EF9E58: [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark
String 10 @ 000001D829EF9E60: -f
flutter: initWithArgs: 0
flutter:
-------------------

flutter: _onPressed done!
flutter: [gs, -dBATCH, -dNOPAUSE, -dSAFER, -dAutoRotatePages=/None, -sDEVICE=pdfwrite, -sOutputFile=out.pdf, C:\Program Files\gs\gs10.03.0\examples\alphabet.ps, -c, [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark, -f]
flutter: argv = 1d82a166830
flutter: argv[0] @ 1d81fb22080 = gs
flutter: argv[1] @ 1d81fb21ed0 = -dBATCH
flutter: argv[2] @ 1d82a166ab0 = -dNOPAUSE
flutter: argv[3] @ 1d81fb21ee0 = -dSAFER
flutter: argv[4] @ 1d82a166ad0 = -dAutoRotatePages=/None
flutter: argv[5] @ 1d82a166530 = -sDEVICE=pdfwrite
flutter: argv[6] @ 1d82a166930 = -sOutputFile=out.pdf
flutter: argv[7] @ 1d82a0307e0 = C:\Program Files\gs\gs10.03.0\examples\alphabet.ps
flutter: argv[8] @ 1d81fb22100 = -c
flutter: argv[9] @ 1d82a030060 = [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark
flutter: argv[10] @ 1d81fb21ef0 = -f
flutter: argv[11] @ 0 = nullptr (believe me)
flutter: -----------------------------------------------
argc=11
String 0 @ 000001D82A166830: gs
String 1 @ 000001D82A166838: -dBATCH
String 2 @ 000001D82A166840: -dNOPAUSE
String 3 @ 000001D82A166848: -dSAFER
String 4 @ 000001D82A166850: -dAutoRotatePages=/None
String 5 @ 000001D82A166858: -sDEVICE=pdfwrite
String 6 @ 000001D82A166860: -sOutputFile=out.pdf
String 7 @ 000001D82A166868: C:\Program Files\gs\gs10.03.0\examples\alphabet.ps
String 8 @ 000001D82A166870: -c
String 9 @ 000001D82A166878: [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark
String 10 @ 000001D82A166880: -f

Unhandled exception at 0x00007FF8B2FABE8D (ntdll.dll) in ghostscript_dart_example.exe: 0xC0000005: Access violation accessing location 0x0000000000000000.

PS C:\src\ghostscript_dart\example> flutter doctor -v
[√] Flutter (Channel stable, 3.19.3, on Microsoft Windows [Version 10.0.22621.2792], locale en-GB)
    • Flutter version 3.19.3 on channel stable at C:\src\flutter
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision ba39319843 (19 hours ago), 2024-03-07 15:22:21 -0600
    • Engine revision 2e4ba9c6fb
    • Dart version 3.3.1
    • DevTools version 2.31.1

[√] Windows Version (Installed version of Windows is version 10 or higher)

[X] Android toolchain - develop for Android devices
    X Unable to locate Android SDK.
      Install Android Studio from: https://developer.android.com/studio/index.html
      On first launch it will assist you in installing the Android SDK components.
      (or visit https://flutter.dev/docs/get-started/install/windows#android-setup for detailed instructions).
      If the Android SDK has been installed to a custom location, please use
      `flutter config --android-sdk` to update to that location.


[X] Chrome - develop for the web (Cannot find Chrome executable at .\Google\Chrome\Application\chrome.exe)
    ! Cannot find Chrome. Try setting CHROME_EXECUTABLE to a Chrome executable.

[√] Visual Studio - develop Windows apps (Visual Studio Community 2022 17.9.2)
    • Visual Studio at C:\Program Files\Microsoft Visual Studio\2022\Community
    • Visual Studio Community 2022 version 17.9.34622.214
    • Windows 10 SDK version 10.0.22621.0

[!] Android Studio (not installed)
    • Android Studio not found; download from https://developer.android.com/studio/index.html
      (or visit https://flutter.dev/docs/get-started/install/windows#android-setup for detailed instructions).

[√] VS Code (version 1.87.1)
    • VS Code at C:\Users\dasya\AppData\Local\Programs\Microsoft VS Code
    • Flutter extension can be installed from:
       https://marketplace.visualstudio.com/items?itemName=Dart-Code.flutter

[√] Connected device (2 available)
    • Windows (desktop) • windows • windows-x64    • Microsoft Windows [Version 10.0.22621.2792]
    • Edge (web)        • edge    • web-javascript • Microsoft Edge 122.0.2365.66

[√] Network resources
    • All expected network resources are available.

! Doctor found issues in 3 categories.

[dasyad00]

I found a bug in my address printing, but the same crashing behaviour still stands with the following print output:

flutter: The Dart VM service is listening on http://127.0.0.1:50380/zklAiqBcgHM=/
flutter: [gs, -dBATCH, -dNOPAUSE, -dSAFER, -dAutoRotatePages=/None, -sDEVICE=pdfwrite, -sOutputFile=out.pdf, C:\src\ghostscript_dart\in.tmp, -c, [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark, -f]
flutter: argv = 260a4cd10d0
flutter: argv[0] @ 26096033590 = gs
flutter: argv[1] @ 26096033400 = -dBATCH
flutter: argv[2] @ 260a4cd10f0 = -dNOPAUSE
flutter: argv[3] @ 26096033620 = -dSAFER
flutter: argv[4] @ 260a4cd1110 = -dAutoRotatePages=/None
flutter: argv[5] @ 260a4cd13d0 = -sDEVICE=pdfwrite
flutter: argv[6] @ 260a4cd0fb0 = -sOutputFile=out.pdf
flutter: argv[7] @ 260966c10c0 = C:\src\ghostscript_dart\in.tmp
flutter: argv[8] @ 260960335e0 = -c
flutter: argv[9] @ 260a4cd43f0 = [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark
flutter: argv[10] @ 260960335b0 = -f
flutter: argv[11] @ 0 = nullptr (believe me)
flutter: -----------------------------------------------
argc=11
String 0 @ 0000026096033590: gs
String 1 @ 0000026096033400: -dBATCH
String 2 @ 00000260A4CD10F0: ►◄═ñ`☻
String 3 @ 0000026096033620: -dSAFER
String 4 @ 00000260A4CD1110: α5♥û`☻
String 5 @ 00000260A4CD13D0: -sDEVICE=pdfwrite
String 6 @ 00000260A4CD0FB0: -sOutputFile=out.pdf
String 7 @ 00000260966C10C0: C:\src\ghostscript_dart\in.tmp
String 8 @ 00000260960335E0: -c
String 9 @ 00000260A4CD43F0: [/Creator(flutter (PSCRIPT5)) /DOCINFO pdfmark
String 10 @ 00000260960335B0: -f
flutter: initWithArgs: -100
flutter:
-------------------

flutter: _onPressed done!

[dcharkes]

Hey @dasyad00!

Unfortunately, we can't really help you on debugging your code.
If you can create a minimal example that shows a crash due to the FFI in Dart we can address the issue. You can try to make the example smaller by:

• Reproducing it in Dart standalone instead of Flutter
• Using your own C code instead of system APIs
• Using less code (both Dart and C)

In general, memory corruption can be due to use-after-free. If you happen to free native memory, it gets overwritten by new native code, and then you read that memory, then you'll read the overwritten value.

0x900001a751cabb20 -- access violation
0x000001a751cabb20 -- correct address

This looks suspicious, a byte written into an 8 byte pointer. It could be that the memory where 0x000001a751cabb20 is stored is freed, and then a new byte is allocated and on 0x9 is written to that byte.

[dasyad00]

Thanks for the suggestions. I narrowed down the bug to calling malloc/calloc incorrectly in Dart:

// This allocates `length` bytes instead of `sizeOf<Pointer<Char>> * length`
malloc.allocate<Pointer<Char>>(length);

// This is the idiomatic way to allocate space for `length` number of `char*`
malloc<Pointer<Char>>(length);
// The bottom is equivalent (calls extension function defined in `dart:ffi`
malloc.call<Pointer<Char>>(length);

I must note that the documentation for allocate() in the parent class Allocator is more comprehensive and helpful than in its child classes CallocAllocator and MallocAllocator. I'm not sure how the SDK developers can show the same level of guidance in the child classes, but for now, I'll close this issue.

References:

• dart:ffi Allocator allocate()
• dart:ffi AllocatorAlloc extension