// Copyright (c) 2008-2009 Nokia Corporation and/or its subsidiary(-ies).

 // All rights reserved.

 // This component and the accompanying materials are made available

 // under the terms of the License "Eclipse Public License v1.0"

 // which accompanies this distribution, and is available

 // at the URL "http://www.eclipse.org/legal/epl-v10.html".

 //

 // Initial Contributors:

 // Nokia Corporation - initial contribution.

 //

 // Contributors:

 //

 // Description:

 // e32test\debug\t_heapcorruption.cpp

 // This is a test application that will cause heap corruption 

 // to generate BTrace events (EHeapCorruption).

 // 

 //

 //  Include Files  

 #include "t_heapcorruption.h"

 #include <e32base.h>

 #include <e32base_private.h>

 #include <e32cmn.h>

 #include <e32cmn_private.h>

 #define __NEXT_CELL(p)				((SCell*)(((TUint8*)p)+p->len))

 TBool gEnableMemoryMonitor = EFalse;

 /**

 Test heap that will corrupt some cells to generate BTrace events.

 */

 class RMyDummyHeap : public RHeap

 {

 public:

 	//EBadFreeCellAddress

 	void CorruptFreeMemory1()

 		{

 		SCell* f = (SCell*)&iFree;

 		f->next = (SCell*)iTop;

 		f->next += sizeof(TUint8);

 		}

 	//EBadFreeCellSize

 	void CorruptFreeMemory2()

 		{

 		SCell* p = (SCell*)&iFree;

 		SCell* n = p->next; 

 		n->len = iMinCell-1;

 		}

 	//EBadAllocatedCellAddress

 	void CorruptAllocatedMemory1()

 		{

 		SCell* c = (SCell*)iBase;

 		SCell* f = (SCell*)&iFree;

 		f = f->next;

 		f = f->next;

 		c->len = (TInt)f->next - (TInt)c;

 		}

 	//additional utilities

 	void CorruptAllocatedMemorySize(void* aAddress)

 		{

 		SCell* addres = GetAddress(aAddress);

 		SCell* c = (SCell*)iBase;

 		for(;;)

 			{

 			if(c == addres)

 				{

 				c->len = iMinCell-1;

 				break;

 				}

 			c = __NEXT_CELL(c);

 			}

 		}

 	void CorruptAllocatedMemoryAddress(void* aAddress)

 		{

 		SCell* pF = &iFree;				// free cells

 		pF = pF->next;				// next free cell

 		if (!pF)

 			pF = (SCell*)iTop;	

 		SCell* addres = GetAddress(aAddress);

 		SCell* c = (SCell*)iBase;

 		for(;;)

 			{

 			if(c == addres)

 				{

 				c->len = (TInt)pF->next - (TInt)c;

 				break;

 				}

 			c = __NEXT_CELL(c);

 			}

 		}

 	void EnableHeavyMemoryMonitoring()

 		{

 		iFlags |= EMonitorMemory;

 		}

 };

 /**

 Heap corruption 2:

 - Overrunning an array using memset 

 (EHeapCorruption - EBadAllocatedCellSize)

 */

 void Memory_Corruption2()

 	{

 	if(gEnableMemoryMonitor)

 		{

 		RMyDummyHeap* h = (RMyDummyHeap*)&User::Heap();

 		h->EnableHeavyMemoryMonitoring();	

 		}

 	char* buf = new char[10];  //will be aligned to 12

 	char* buf2 = new char[10]; //will be aligned to 12

 	TInt a = User::Heap().AllocLen(buf);

 	memset(buf, 255, a+1); //memory corruption

 	if(!gEnableMemoryMonitor)

 			User::Heap().Check(); //force 'heap walker' to check the heap

 	delete buf2;

 	delete buf; //when heavy monitoring is ON should send trace

 	}

 //causes EBadFreeCellAddress corruption type

 void Memory_Corruption3()

 	{

 	TInt* p1 = new TInt();

 	TInt* p2 = new TInt();

 	TInt* p3 = new TInt();

 	TInt* p4 = new TInt();

 	TInt* p5 = new TInt();

 	TInt* p6 = new TInt();

 	delete p2;

 	delete p4;

 	delete p6;

 	RMyDummyHeap* h = (RMyDummyHeap*)&User::Heap();

 	h->CorruptFreeMemory1();

 	User::Heap().Check();

 	delete p5;

 	delete p3;

 	delete p1;

 	}

 //causes EBadFreeCellSize RHeap corruption type

 void Memory_Corruption4()

 	{

 	TInt* p1 = new TInt();

 	TInt* p2 = new TInt();

 	TInt* p3 = new TInt();

 	delete p2;

 	RMyDummyHeap* h = (RMyDummyHeap*)&User::Heap();

 	h->CorruptFreeMemory2();

 	User::Heap().Check();

 	delete p3;

 	delete p1;

 	}

 //causes EBadAllocatedCellAddress corruption type

 void Memory_Corruption5()

 	{

 	TInt* p1 = new TInt;

 	TInt* p2 = new TInt;

 	TInt* p3 = new TInt;

 	TInt* p4 = new TInt;

 	TInt* p5 = new TInt;

 	TInt* p6 = new TInt;

 	TInt* p7 = new TInt;

 	delete p2;

 	delete p4;

 	delete p6;

 	RMyDummyHeap* h = (RMyDummyHeap*)&User::Heap();

 	//h->CorruptAllocatedMemory1();

 	h->CorruptAllocatedMemoryAddress((void*)p7);

 	User::Heap().Check();

 	delete p7;

 	delete p5;

 	delete p3;

 	delete p1;

 	}

 void Memory_Corruption_Special1()

 	{

 	char* buf = new char;

 	RMyDummyHeap* h = (RMyDummyHeap*)&User::Heap();

 	h->EnableHeavyMemoryMonitoring();

 	h->CorruptAllocatedMemoryAddress((void*)buf);

 	delete buf;// should output EHeapCorruption trace

 	}

 //  Local Functions

 LOCAL_D TInt threadTraceHeapCorruptionTestThread(TAny* param)

 	{

 	TInt t = *((TInt*)param);

 	switch(t)

 		{

 		case RHeap::EBadAllocatedCellSize:

 			Memory_Corruption2();

 			break;

 		case RHeap::EBadFreeCellAddress:

 			Memory_Corruption3();

 			break;

 		case RHeap::EBadFreeCellSize:

 			Memory_Corruption4();

 			break;

 		case RHeap::EBadAllocatedCellAddress:

 			Memory_Corruption5();

 			break;

 		case 1000:

 			Memory_Corruption_Special1();

 			break;

 		default:

 			User::Invariant();

 			break;

 		}

 	return 0;

 	}

 //Function to execute corruption cases.

 TInt ExecuteTest(TInt aTestType)

 	{

 	RThread thread;

 	TInt type;

 	TRequestStatus stat;

 	TInt r = KErrNone;

 	gEnableMemoryMonitor = EFalse;

 	switch(aTestType)

 		{

 		case 0: ////RHeap::EBadAllocatedCellSize with heavy monitoring enabled

 			type = RHeap::EBadAllocatedCellSize;

 			gEnableMemoryMonitor = ETrue;

 			r = thread.Create(_L("t_tbrace_heapcorruption"), threadTraceHeapCorruptionTestThread, 

 					               KDefaultStackSize, 0x2000, 0x2000, &type);

 			thread.Logon(stat);

 			thread.Resume();

 			User::WaitForRequest(stat);

 			thread.Close();

 			break;

 		case 1: //RHeap::EBadFreeCellAddress:

 			type = RHeap::EBadFreeCellAddress;

 			r = thread.Create(_L("t_tbrace_heapcorruption"), threadTraceHeapCorruptionTestThread, 

 					               KDefaultStackSize, 0x2000, 0x2000, &type);

 			thread.Logon(stat);

 			thread.Resume();

 			User::WaitForRequest(stat);

 			thread.Close();

 		break;

 		case 2: //RHeap::EBadFreeCellSize:

 			type = RHeap::EBadFreeCellSize;

 			r = thread.Create(_L("t_tbrace_heapcorruption"), threadTraceHeapCorruptionTestThread, 

 			                KDefaultStackSize, 0x2000, 0x2000, &type);

 			thread.Logon(stat);

 			thread.Resume();

 			User::WaitForRequest(stat);

 			thread.Close();

 		break;

 		case 3: //RHeap::EBadAllocatedCellSize:

 			type = RHeap::EBadAllocatedCellSize;

 			r = thread.Create(_L("t_tbrace_heapcorruption"), threadTraceHeapCorruptionTestThread, 

 						               KDefaultStackSize, 0x2000, 0x2000, &type);

 			thread.Logon(stat);

 			thread.Resume();

 			User::WaitForRequest(stat);

 			thread.Close();

 		break;

 		case 4: //RHeap::EBadAllocatedCellAddress:

 			type = RHeap::EBadAllocatedCellAddress;

 			r = thread.Create(_L("t_tbrace_heapcorruption"), threadTraceHeapCorruptionTestThread, 

 						               KDefaultStackSize, 0x2000, 0x2000, &type);

 			thread.Logon(stat);

 			thread.Resume();

 			User::WaitForRequest(stat);

 			thread.Close();

 		break;

 		case 1000:

 			type = 1000;

 			gEnableMemoryMonitor = ETrue;

 			r = thread.Create(_L("t_tbrace_heapcorruption"), threadTraceHeapCorruptionTestThread, 

 			                 KDefaultStackSize, 0x2000, 0x2000, &type);

 			thread.Logon(stat);

 			thread.Resume();

 			User::WaitForRequest(stat);

 			thread.Close();

 		break;

 		default:

 			User::Invariant();

 			break;

 		}

 	return r;

 	}

 LOCAL_C void MainL ()

 	{

 	//reading command line

 	TInt testType = 0; //unknown test

 	TInt cmdLength = User::CommandLineLength();

 	HBufC* cmdLine = HBufC::NewLC(cmdLength);

 	TPtr clp(cmdLine->Des());

 	User::CommandLine(clp);

 	TLex argv(clp);

 	for(TInt i=0; !argv.Eos(); i++)

 		{

 		TPtrC token(argv.NextToken());

 		if(token.Compare(_L("0")) == 0)

 			testType = 0;

 		if(token.Compare(_L("1")) == 0)

 			testType = 1;

 		else if(token.Compare(_L("2")) == 0)

 			testType = 2;

 		else if(token.Compare(_L("3")) == 0)

 			testType = 3;

 		else if(token.Compare(_L("4")) == 0)

 			testType = 4;

 		else if(token.Compare(_L("1000")) == 0)

 			testType = 1000;

 		}

 	CleanupStack::PopAndDestroy(); //cmdLine

 	ExecuteTest(testType);

 	}

 LOCAL_C void DoStartL ()

 	{

 	// Create active scheduler (to run active objects)

 	CActiveScheduler* scheduler = new (ELeave) CActiveScheduler();

 	CleanupStack::PushL (scheduler);

 	CActiveScheduler::Install (scheduler);

 	MainL ();

 	// Delete active scheduler

 	CleanupStack::PopAndDestroy (scheduler);

 	}

 //  Global Functions

 GLDEF_C TInt E32Main()

 	{

 	// Create cleanup stack

 	CTrapCleanup* cleanup = CTrapCleanup::New();

 	// Run application code inside TRAP harness, wait keypress when terminated

 	TRAPD(mainError, DoStartL());

 	if (mainError)

 		return mainError;

 	delete cleanup;

 	return KErrNone;

 	}