Re: error R6031

From:

=?Utf-8?B?UGV0ZXI=?= <Peter@discussions.microsoft.com>

Newsgroups:

microsoft.public.vc.mfc

Date:

Sun, 29 Jun 2008 23:13:00 -0700

Message-ID:

<C803D6A5-19A4-4D2B-8A18-2C44C166372A@microsoft.com>

Thanks for your help,
I found that one my class constructor
(creating instance of global variable)
corrupts something in memory, so __native_startup_state
has bad value after called _initterm() in _CRT_INIT() function.

Peter

"Joseph M. Newcomer" wrote:

OK, that's definitely strange, and suggests memory damage.

I'd put a watch-for-change debug breakpoing on __native_startup_state and rerun the
program (it is going to be slooooooooowwwwwwww...., be prepared). This might tell who is
clobbering it.

That's the first thing I'd try under these conditions. Another hack is to constantly
monitor __native_startup_state in an OnIdle handler, but that presumes you can actually
get access to that symbol. A third approach would be to hard-code the address of
__native_startup_state into the OnIdle handler (this is not production-quality anything,
but is sort-of-legitimate in situations like this). Pop up a message box if it ever
deviates from 2. Then you know the last thing you did (menu item, control, etc.) is where
the problem is and you can start going after it. With luck, you might be able to home in
on it in a short period.

Here's some TRULY AWFUL code you could try if you can't get the symbol
__native_startup_state:

int CMyWinApp::OnIdle(long idlecount)
    {
     static LPDWORD loc = NULL;
     if(loc != NULL && *loc != 2)
        {
         CString s;
         s.Format(_T("__native_startup_state changed! Now %08x"), *loc);
         AfxMessageBox(s);
        }

     return CWinApp::OnIdle(idlecount);
   }

Then, with the debugger, you determine where __native_startup_state is found and you set
that LPDWORD to have that address (if you are still holding down your lunch at this
point...I said this code was gross and disgusting)

This has less execution impact than a monitor-for-change breakpoint but is far, far
cruftier. The good news is that as soon as you find this bug, you can dispose of this
code in your local toxic waste dump (some jurisdictions require permits for code this
toxic)
                joe
****
On Sun, 29 Jun 2008 13:09:01 -0700, Peter <Peter@discussions.microsoft.com> wrote:

Hi Joseph,

thanks for your tips.
I tried to debug _DllMainCRTStartup and __DllMainCRTStartup.
I met amazing thing:
When called _CRT_INIT on initialization, in crtdll.c at line: 318, there is
this source code:
__native_startup_state = __initialized;
when debugger is after this step, the variable "__native_startup_state" has
value: 0x0012f819 instead of 0x00000002 (value of __initialized) !!

I debugged this line also in disassembly window:
mov dword ptr [___native_startup_state (10076F48h)],edi

I am seeing in edi register value 0x0012f819 !!
So this strange value is really moved into variable ___native_startup_state .

This is reason why in exiting state there is R6031 error, because CRT code
assumes that in ___native_startup_state should be value 0x00000002
(__initialized),
the code does not find 0x0000002 but it finds 0x0012f819 and it triggers
message box in code of _CRT_INIT:
if(__native_startup_state!=__initialized)
{
/* somehow we are in a very bad state running shutdown when
we have not started */
_amsg_exit( _RT_CRT_INIT_CONFLICT);
}

What do you recommend ?

Peter

"Joseph M. Newcomer" wrote:

That's an intersting dump. It suggests that CRT_Init is being called during the shutdown
process. I'd suggest putting a breakpoint at the CommL!_CRT_Init function and doing some
single-stepping. There are several possible causes that come to mind here:

Memory damage that results in a flag being modified that gives erroneous information about
the initialization status
A bug in the release version code (not likely)
The fact that you have what appears to be a statically-linked CRT in a DLL (I'd suggest
trying the DLL version of the CRT to see if this fixes the problem)

I'd have to study the code more, and don't have time to do that today.
joe

On Sun, 29 Jun 2008 00:23:00 -0700, Peter <Peter@discussions.microsoft.com> wrote:

MFC Application and both dlls are created in VS2005.
This problem exists only in release versions, debug versions does not
trigger R6031 message box.
It is amazing that on application exit system calls DllMainCRTStartup.
I added debug info into release versions and here is "!analyze -v" from
WinDbg:

FAULTING_IP:
+0
00000000 ?? ???

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: 80000007 (Wake debugger)
ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD: 00000000

BUGCHECK_STR: 80000007

DEFAULT_BUCKET_ID: APPLICATION_HANG

PROCESS_NAME: BmfCons.exe

ERROR_CODE: (NTSTATUS) 0x80000007 - {Kernel Debugger Awakened} the system
debugger was awakened by an interrupt.

NTGLOBALFLAG: 400

APPLICATION_VERIFIER_FLAGS: 0

LOADERLOCK_OWNER_API: _ExitProcess:LdrShutdownProcess:LdrpCallInitRoutine:

DERIVED_WAIT_CHAIN:

Dl Eid Cid WaitType
-- --- ------- --------------------------
0 710.d2c Unknown

WAIT_CHAIN_COMMAND: ~0s;k;;

BLOCKING_THREAD: 00000d2c

PRIMARY_PROBLEM_CLASS: APPLICATION_HANG

LAST_CONTROL_TRANSFER: from 7739bf53 to 7c8285ec

STACK_TEXT:
0012f700 7739bf53 7739610a 00000000 00000000 ntdll!KiFastSystemCallRet
0012f738 7738969d 001506ec 00000000 00000001 USER32!NtUserWaitMessage+0xc
0012f760 7739f762 77380000 00166ae8 00000000 USER32!InternalDialogBox+0xd0
0012fa20 7739f047 0012fb7c 00000000 ffffffff USER32!SoftModalMessageBox+0x94b
0012fb70 7739eec9 0012fb7c 00000028 00000000 USER32!MessageBoxWorker+0x2ba
0012fbc8 773d7cf5 00000000 0016c298 00162718 USER32!MessageBoxTimeoutW+0x7a
0012fbfc 773c42c8 00000000 781c3808 78194898 USER32!MessageBoxTimeoutA+0x9c
0012fc1c 773c42a4 00000000 781c3808 78194898 USER32!MessageBoxExA+0x1b
0012fc38 7813986e 00000000 781c3808 78194898 USER32!MessageBoxA+0x45
0012fc7c 78131c2c 781c3808 78194898 00012010 MSVCR80!__crtMessageBoxA+0x1b4
0012fca0 781316d0 0000001f 10057194 0000001f MSVCR80!_NMSG_WRITE+0x162
0012fca8 10057194 0000001f 00000001 00000000 MSVCR80!_amsg_exit+0xe
0012fcc0 100572b0 10000000 00000000 00000001 CommL!_CRT_INIT+0x13a
[f:\rtm\vctools\crt_bld\self_x86\crt\src\crtdll.c @ 395]
0012fd04 1005732c 10000000 7c81a352 10000000 CommL!__DllMainCRTStartup+0xb7
[f:\rtm\vctools\crt_bld\self_x86\crt\src\crtdll.c @ 509]
0012fd0c 7c81a352 10000000 00000000 00000001 CommL!_DllMainCRTStartup+0x1d
[f:\rtm\vctools\crt_bld\self_x86\crt\src\crtdll.c @ 459]
0012fd2c 7c830e70 1005730f 10000000 00000000 ntdll!LdrpCallInitRoutine+0x14
0012fde4 77e668a3 00000000 003a3a9c 00000001 ntdll!LdrShutdownProcess+0x182
0012fed0 77e66905 00000000 77e8f3b0 ffffffff kernel32!_ExitProcess+0x43
0012fee4 78131720 00000000 78131a04 00000000 kernel32!ExitProcess+0x14
0012feec 78131a03 00000000 7474fc1a 0055cf20 MSVCR80!__crtExitProcess+0x14
0012ff28 78131a4b 00000000 00000000 00000000 MSVCR80!_cinit+0x101
0012ff38 004f177f 00000000 76ae9d37 00000000 MSVCR80!exit+0xd
0012ffc0 77e6f23b 00000000 00000000 7ffd8000 BmfCons!__tmainCRTStartup+0x164
[f:\rtm\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 549]
0012fff0 00000000 004f18db 00000000 78746341 kernel32!BaseProcessStart+0x23

FOLLOWUP_IP:
MSVCR80!__crtMessageBoxA+1b4
7813986e eb02 jmp MSVCR80!__crtMessageBoxA+0x1b8 (78139872)

SYMBOL_STACK_INDEX: 9

SYMBOL_NAME: MSVCR80!__crtMessageBoxA+1b4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: MSVCR80

IMAGE_NAME: MSVCR80.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 45712238

STACK_COMMAND: ~0s ; kb

BUCKET_ID: 80000007_MSVCR80!__crtMessageBoxA+1b4

FAILURE_BUCKET_ID: MSVCR80.dll!__crtMessageBoxA_80000007_APPLICATION_HANG

Followup: MachineOwner
---------

"Joseph M. Newcomer" wrote:

Which version of VS?

When you entered the debugger, what did the call stack say? Who was trying to do the
initialization?
joe

On Fri, 27 Jun 2008 23:23:00 -0700, Peter <Peter@discussions.microsoft.com> wrote:

My MFC app uses load-time dynamic linking with my dll and this dll uses
run-time dynamic linking to my another dll.
/clr compiler switch is not used in app neither in dlls.
Both dlls has DllMain() function wrapped in:

#ifdef _MANAGED
#pragma managed(push, off)
#endif
DllMain() {...}
#ifdef _MANAGED
#pragma managed(pop)
#endif

When MFC app is exited there appears error message:

RunTime Error !

...path to app.exe

R6031
- Attempt to initialize the CRT more than once.
This indicates bug in your application.

Any ideas ?
Peter

Joseph M. Newcomer [MVP]
email: newcomer@flounder.com
Web: http://www.flounder.com
MVP Tips: http://www.flounder.com/mvp_tips.htm