Getting A_invalidFree: Invalid free error

Hi Julian,

Does this problem happen in the original image processing demo code?

Xiaohui

Julian, as a quick test could you increase heap size?, also if you can summarize the changes you have done to the project it would be helpful.

thank you,

Paula 

Hi Julian,

Did you check your allocs and frees (names and sizes), so you're not trying to free an invalid pointer? When I get this error, the problem is generally there.

BR

Xiaohui,

this does not happen with original image processing  project.This happen in the modified version I have. I added  a daemon for receive udp data and sent data out through a task that use tcp socket.

 I have been checking map file and the only strange is that mscram_ipc is full there is not free space. This in original image processing project and my modified version. I don´t know if this could cause problems.

This is MEMORY CONFIGURATION:

         name                            origin         length      used         unused      attr  fill
----------------------                 --------        ---------     --------       --------      ----  --------
  L2SRAM                            00800000   00040000  0000c176  00033e8a  RW X
  MSMCSRAM_MASTER       0c000000   00100000  000e7182  00018e7e  RW X
  MSMCSRAM_SLAVE          0c100000   00100000  00000000  00100000  RW X
  MSMCSRAM_IPC               0c200000   00200000  00200000  00000000  RW X
  DDR3                                 80000000   10000000  09f9859f  06067a61  RW X

I attached the  map file.

Paula,

I  have made some changes mainly I have added a daemon task for udp reception of data  and  a task with  tcp socket for transmit to a server.  I also add  inter-proccesor messageQ  queue  for communicate master core , 0,  with slaves cores(1-7).  The size of message for cores 1-7 are 3300bytes*7cores=23.1kBytes so I don´t think is to much for  msmcsram for cores.

I  tried increasing  size of stacks but not changed. I mean size of heapmaster and stack of tasks .

Johanes,

I moved recvncfree  function , because it was out of a if statement  that checked if pBuf size was greater than or equal to 0, I think I moved out of that statement. After that change  the program seems to work well.

Now after 7 hours  working I get a new error:

A0=0x89f6d224 A1=0x1
A2=0x0 A3=0x0
A4=0x89f6d224 A5=0xfffffffb
A6=0x89f53d28 A7=0x0
A8=0x8003e8ac A9=0x1
A10=0x8003e834 A11=0x2
A12=0x8 A13=0x8003e8ac
A14=0x805820 A15=0x0
A16=0xc202d80 A17=0x180
A18=0x80000ed4 A19=0x0
A20=0x0 A21=0x0
A22=0x0 A23=0x0
A24=0x0 A25=0x0
A26=0x0 A27=0x2005000
A28=0x0 A29=0x200
A30=0x8 A31=0x1
B0=0x0 B1=0x0
B2=0x0 B3=0xc02b1cc
B4=0xc0dec7c B5=0xc0e127c
B6=0x89f53d90 B7=0xc0e0f2c
B8=0x0 B9=0xc0e0fb4
B10=0x89f53d28 B11=0x90
B12=0x89f53d90 B13=0x805820
B14=0x80be00 B15=0x8003e830
B16=0x0 B17=0xc0e08f8
B18=0x40 B19=0x78
B20=0x69 B21=0x2e2
B22=0xf B23=0x0
B24=0x0 B25=0x3000
B26=0x3000 B27=0x0
B28=0x0 B29=0xa
B30=0xbc B31=0x0
NTSR=0x1020f
ITSR=0xf
IRP=0xc056c04
SSR=0x0
AMR=0x0
RILC=0x0
ILC=0x0
Exception at 0x0
EFR=0x2 NRP=0x0
Internal exception: IERR=0x1
Instruction fetch exception
ti.sysbios.family.c64p.Exception: line 248: E_exceptionMin: pc = 0x00000000, sp = 0x8003e830.
To see more exception detail, use ROV or set 'ti.sysbios.family.c64p.Exception.enablePrint = true;'
xdc.runtime.Error.raise: terminating execution

Could  someone of you guys help  me  to find out where the problem comes?

I really appreciate your help.

Julian

Hi Julian,

One question, the 7 hours that you refer to are7 hours of you working or your project was running for 7 hours then you got this error?

The times when I got this error it was because some part of memory was getting corrupted, suppose you have code and data in the same memory, MSMCSRAM for example, and for some reason your data overwrites the part of memory where the code was stored, this would lead to an error of this type that you're seeing (I think that once a variable was being allocated in the task stack memory). But there are different causes for this type of error. The NRP stores the address where the wrong instruction was fetched, but yours has 0x0, so this won't help. What I generally do is try to find exactly where the error comes from and see what's going on there, like a function call, a variable initialization and so on.

BR

J.

Moved this thread over TI-RTOS(BIOS) forum to get faster response.

Thanks.

Hi Julian,

have you tried enabling Exception print to see if you can get more detailed information on the Exception? If you remove the daemon from your application, are you still getting these exceptions?

Johannes,

I mean that after 7 hours the application was working I was getting that error. It is a little difficult to catch that exeception. Until now I have got it 3 times in total, some of them in short periods of time.

This is an screenshot of diff of two errors with vim. Basically, again the pc=0x00000000 and sp=0x8003e008:

I read that B3 adddress is the return address. When I access that section, 0xc02b12c,in disassembly It seems to be something related to NameServer:

 I understand that there must be something overwriting some regions not allowed. I attach the map file if you guys can take a look at it.2728.image_processing_evmc6678l_master.zip

Tom,

thanks for your answer.

I am going to enable exception print to see if I can get more information about the error as you said.

I supposed it is enabled as follows:

var Excep = xdc.useModule("ti.sysbios.family.c64p.Exception")
Excep.enablePrint = true;

As soon as I get something new I will post it.

Regards.

Julian

Hi,

I am sorry for delay.

Tom ,

I was trying your recommendation but now the error has changed again to

== Start TCP Echo Client Test ==
Setting IpcMP_module->replyMQ 0x1, 0x10000
Setting IpcMP_module->replyMQ 0x2, 0x20000
Setting IpcMP_module->replyMQ 0x3, 0x30000
Setting IpcMP_module->replyMQ 0x4, 0x40000
Setting IpcMP_module->replyMQ 0x5, 0x50000
Setting IpcMP_module->replyMQ 0x7, 0x70000
TCP CONNECTED\n
Connected to STOMP:
CONNECTED
heart-beat:0,0
session:ID:localhost.localdomain-34557-1390858791970-2:126
server:ActiveMQ/5.8.0.redhat-60024
version:1.0


ti.sysbios.heaps.HeapMem: line 309: assertion failure: A_invalidFree: Invalid free
xdc.runtime.Error.raise: terminating execution

I have been searching for some error as Johannes advise me but all the malloc functions have their own  free function.

I enabled print exception but no extra information is given.

I have also disabled the UDP Daemon and  nothing happen. This is expected due the error usually

appears after data is sent to DSP  using  UDP.

Regards.

Julian

Julian,

I'm not familiar with the example you are using? From what product did this "original image processing  project" come from? It seems like something else is still going on between the working example and your application.

As BR mentioned, something trying to call Memory_free() on an invalid address. You can perhaps try to insert breakpoints in the Memory_free() call and see if the addresses are valid.

If you had a newer version of SYS/BIOS, there you may want to look into trying the HeapTrack heap memory manager until you find out what is calling "free()" incorrectly.

Tom,

this is a demo included with MCSDK it comes inside mcsdk_2_01_02_05/demos folder.

One thing I remember when this problem appears is that  I was working with 8 processor messages and

I decided to set core 0 as the one with the only task of receive strings and  distribute them to others cores and get the response of the cores. From here I have started to see the message of A_invalidFree from time to time . I have searched some misplaced declaration for core 0 but all are defined for cores 1 to 7 as it must be. I don´t know if IPC allows  to work with messages for cores 1 to 7 only.

Meanwhile I am trying to insert breakpoints and I will try  the new version of sysbios as you advise me  .

Regards

Julian

Hi,

I was looking at mcsdk_2_01_02_06\demos\image_processing\ipc\evmc6678l\slave\image_processing_evmc6678l_slave.cfg, there the heapSize is defined as 0x8000. Maybe after your change it became small? It's just a guess. Is it possible for you to share the project with us?

And I also have a question about this .cfg file. It has the following lines:

/* Create a Heap. */
var heapMemParams = new HeapMem.Params;
heapMemParams.size = 0x8000;
var heap0 = HeapMem.create(heapMemParams);
Memory.defaultHeapInstance = heap0;

...

Memory.defaultHeapSize = 0x10000;
Program.heap = 0x10000;

I don't understand how the last two lines define a size of 0x10000 if the heap instance created previously is 0x8000.

Regards

J

Julian,

Is there any way you can attach your project with failure so we can reproduce the problem and then debug it? I think it will be much efficient that way assuming your modification isn't much of code change and you are willing to let us take a look at it.

best regards,

David Zhou

Hi,

I am preparing  files I will send you, I need to do some modifications to a couple of python scripts(I hope this is not a problem) so it will not be so difficult to you repeat the tests.

Regards.

Julian

Hi,

Could you provide an e-mail address, i prefer send files by email, to send you the project and scripts ?

Regards

Julian

Julian,

Sure, please send it to dzhou@ti.com.

Thanks!

best regards,

David Zhou

Julian,

I am working on the issue with your package sent by e-mail. In the readme.txt, ====>2) Start image_processing in debug mode and run de project.

I loaded the .out file under ccs_project_and_py_files\image_processing\ipc\evmc6678l\master\Debug to 6678 core 0, the .out in ccs_project_and_py_files\image_processing\ipc\evmc6678l\slave\Debug to cores 1-7, and ran all the cores. Core 0 stuck before go main(), other cores can go main. Is this the way you ran the DSP side code? What is the boot mode of the DSP card? No-boot? And what is the user SW1 setting? static or DHCP? I saw you used: int port = 5001;//11//5001 IPAddr = inet_addr("10.88.2.25");//"10.88.1.183");//("10.88.1.183");//("10.88.2.29"); EWOULDBLOCK for the server.

Regards, Eric

Eric,

That´s the way I load the .out files, \master\Debug to core 0 and \Slave\Debug to core 1-7. Usually I group 8 cores and run the group. I have also  disable Auto- Run on Tools>Debugger Options> Auto Run an d Launch Options
I have disblabled "On a program load or restart" and saved for every core.

The sw´s configuration is No-boot, all pins in SW3-SW6 ON except pin 1 of SW3.  SW9 both pins are ON, so DHCP is enabled.

Push button SW1, in schematic files this is used for cold reset, it is not used  during tests.

Yes, I used

int port=5001;

IPAddr = inet_addr("10.88.2.25");

for set server port and IP address.

I hope switches configuration solve core 0 stuck.

Regards.

Julian,

Seems the stuck was caused by the card. I have another setup without this issue. I re-built the test program with my IP address and tested, am not sure if I ran this correctly, I am attaching a log please comments, is there a requirement which ports (11 or 5001) to use?

Regards, Eric

4375.Julian.docx

Eric,

About the card, you mean this a problem of dsp card? I have a revision 3A card, I could test with a 3B  if you suspect that the problem is the dsp card.

It is not necessary that port be 11 or 5001 at any of two parts of setup, you can use other port numbers.

As you run the setup it is ok. Run first server.py in one console and once you get the CONNECTED message in CCS console run send2dsp.py in other console, as soon as it starts to send messages you are going to watch the strings arriving from dsp in server.py console.

About the file you attached  you are right that is the way I am configuring IP and port. About strings at the end of file I think they are from sent.txt file and the received.txt  file must contain the processed strings that dsp returns and they must look as:

SEND
destination:/queue/a

,,,,,,,,,13,3.58,,,,,,,,,,,,,,,1,,,,,12,0,9,,,,,,,,,,,,,,,,,,,,,1,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,0,0,,,0,,,,,,8952020609593984923f,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,0.0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,020109,,,,,,,,,,,,,,,,,,,,,,,,,,,20130627074515,,,,,,,,,42,,,,,,,,,,,,867844000451073,,,,,,,,,,,,,,,,,,,,,,,,,,,

for every string arriving to DSP.

I don´t know if there is something wrong with server.py file I sent you and is causing you the problem. I attach  the server.py  that I am currently using , this generates and fill received.txt file. 2248.server.zip

Regards.