Virtual Address Space Fragmentation

Question

I am investigating a virtual address space fragmentation. The problem I have is that the calls to VirtualAlloc can have many sources (LOH, Memory mappings, ...)

Can I identify the caller of the function from a dump file ? of figure out somehow the source of my problem ?

Answer 1

You must enable gflags user stack trace for you app, you can do this from the command line or within WinDbg, if from WinDbg:

!gflag +ust

then you need to do a !heap -s and !heap -stat -h XX for a given heapblock will dump more specific stats , I suggest performing a memory dump here .dump /ma c:\\first.dmp then do the thing that is causing the fragmentation, break back into WinDbg by pressing ctrl+break and enter !heap -s again and perform another memory dump .dump /ma c:\\second.dmp .

The reason for the memory dumps and the heap summaries is that you can analyse which heaps are increasing or go back, open the dumps and perform analysis on those snapshots, dump the results into a text file and do a diff on the results.

So if you identified a particular heap block that is increasing then you can dump every allocation for that block !heap -p -a xxxx where xxxx is your heap block, I suggest you setup WinDbg to write the output to a file as this will be very large .logfile c:\\first.txt repeat on the second memory dump and do a diff to see what additional allocations are occurring.

Also you can dump the stats for the heap which will give you a breakdown of allocation sizes and this may also give you a clue. Anyway so long as you have the pdbs with the private symbols then you can identify who made the allocation with full call stacks.

Edit

There is an article which may help you: http://bugslasher.net/2011/01/15/memory-exhaustion-even-if-a-large-enough-free-memory-segment-is-available/

If you can get the virtual addresses then you can dump additional information using !pte address and pfn frameNum you can get the page frame number for the virtual address can be obtained from the result from !pte .

!vm 1 will display some stats on your virtual memory usage but not much more, the other thing is you could put a breakpoint on calls to virtualAlloc and dump the call stack and local variables if you use kf then this will display the distance in bytes between the stack frames which may indicate large allocations, I would write this information out to a log file and compare it later between the 2 dumps.

Answer 2

First, you must set pdb symbols for OS components and your programm : In symbols path window set string like this

srv*f:\\symbols\\websymbols*http://msdl.microsoft.com/download/symbols

and add path to your program private symbols. After this action you can see prety stack trace on command kb. First occurence of your programm in stack is caller function.