System crash with the function Malloc

[gaojianxu]

I transplanted some old source code ran on K10 to Kv31 (KV31F512M12). The IDE is Kinetis Design Studio 3.2.0.

The debug interface is GDB PEMicro. The compilation and download is ok. But in the debug mode, the system crash and enter into DefaultISR every time the system enconter the function malloc. As below:

Excute this:

This = (struct evt_queue_ty *)malloc(sizeof(struct evt_queue_ty) + size*sizeof(struct evt_event_ty)); 

Crash and jump to：

DefaultISR:
b DefaultISR
.size DefaultISR, . - DefaultISR

What's wrong? Is it failed with source code or IDE configuration?

[harshpatel]

Hello gaojian xu

i agree with ZhangJennie.  Can you create demo code and share? Chance to find problem will increase....

Thanks & regards

Harsh

Einfochips INDIA

[gaojianxu]

I try to build a demo code and share. But when I tailor the source code to a minimal project which keep the malloc and the project conifgurations. The function call of malloc sucess and the crash disappear. 

[bobpaddock]

In the real code I'd check for a collision between the Heap and the Stack.
Demo project probably uses less of both, so they don't collide.

Are We Shooting Ourselves in the Foot with Stack Overflow? « State Space 

GNU Static Stack Usage Analysis | MCU on Eclipse 

[harshpatel]

Great...!!

If in future still found issue than share a demo code. We have faced such isseue so we may help to solve it.

Thanks & regards

Harsh

Einfochips INDIA

[ZhangJennie]

Hi,

If the problem is not because of optimization, I suggest you create a demo project to showcase your problem.

This problem is easier to be investigated with reproduction, but hard if not.

Have a great day,
Jennie Zhang

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[bobpaddock]

Is the compiler optimization set to -Os for 'Small'?

If the problem goes away with '-O2' it is crashing due to alignment issues.

[gaojianxu]

The optimization set is -O0 and I changed it to -O2 but the problem do not disapear.

[bobpaddock]

Only -Os has the alignment issue.

-O0 generates really inefficient code.

Is there enough memory available for malloc to work?
Depending on the implementation it may fault rather than return NULL.

Is the linker script setup proper ally to have a heap that is large enough?

"This->evt_buffer = (t_event*)(This+1);"

The +1 to the pointer This does not give me the warm fuzzies even with the cast.

[gaojianxu]

The heap set as:

HEAP_SIZE = DEFINED(__heap_size__) ? __heap_size__ : 0x4000;
STACK_SIZE = DEFINED(__stack_size__) ? __stack_size__ : 0x1000;
M_VECTOR_RAM_SIZE = DEFINED(__ram_vector_table__) ? 0x0800 : 0x0000;

/* Specify the memory areas */
MEMORY
{
m_interrupts (RX) : ORIGIN = 0x00000000, LENGTH = 0x00000400
m_flash_config (RX) : ORIGIN = 0x00000400, LENGTH = 0x00000010
m_text (RX) : ORIGIN = 0x00000410, LENGTH = 0x0007FBF0
m_data (RW) : ORIGIN = 0x1FFF8000, LENGTH = 0x00008000
m_data_2 (RW) : ORIGIN = 0x20000000, LENGTH = 0x00010000
}

[bobpaddock]

Can't tell from that were the heap is located nor the actual heap size.
If __heap_size__ is defined earlier than the line shown then that value will be used, not the 0x4000 (half of the m_data space) value shown.

In a normal linker script everything will use m_data by default.

[harshpatel]

Hello gaojian xu 

Can you share your source code? So i can look into it.

Thanks & regards

Harsh

Enginner

Einfochips, INDIA

[gaojianxu]

Hi, Harsh

I can't share all the project source code with you. It is a large project with so many source code files and also limited by my company policy. I post the function where it crashes. Hope it helps.

typedef struct evt_event_ty
{
 EVT_CONTENT
} t_event;

// The Event Queue object type:
typedef struct evt_queue_ty
{
 t_event    *evt_buffer; // the address of the event buffer
 word    evtqsize;  // and size of it.
 word    evt_head;  // event head -index (keep it word!)
 t_event    *pevt_tail;  // event tail -pointer
 word    evt_cnt;  // counts events in the queue
 word    max_evt_cnt; // max used event queue size
 word    lost_events; // events lost -counter
 struct evt_queue_ty *next;   // next evtQueue in chain
} evtQueue;

pevtQueue evtCreateEventQueue(unsigned int size)
{
 evtQueue *This;
 evtQueue *Chain;

This = (evtQueue*)malloc(sizeof(evtQueue) + size*sizeof(t_event));
 if (This != NULL)
 {
  This->evt_buffer = (t_event*)(This+1);
  /* preset instance: */
  This->evt_head = 0;
  This->pevt_tail = This->evt_buffer;
  This->evt_cnt = 0;
  This->max_evt_cnt = 0;
  This->lost_events = 0;
  This->next = NULL;
  This->evtqsize = size;

  if (evtFirstQ == NULL)   /* the first time ? (..is the best? HUH!) */
  {
   kernServiceReg(&evtPump);
   /* preset static variables: */
   curEvent = NULL;   /* no events under progress */
   evtFirstQ = This;   /* and This is the first queue in chain */
  }
  else
  for (Chain=evtFirstQ; ; Chain=Chain->next)
  {
   /* chain the queue: */
   if (Chain->next == NULL) /* if the end-of-chain found */
   {
    if (evtFirstQ == NULL) /* if there's no chain yet, */
     evtFirstQ = This; /* then start it by This. */
    else     /* Otherwise */
     Chain->next = This; /* set This to the end of the chain. */
    break;     /* a faster way out, than next loop... */
   }
  }
 }
       
 K2_ASSERT(This != NULL);
 return This;     /* ok, give the pointer to the created queue */
}