!address -summary and !heap -s disagree on mem leak?

Question

I have a 32 Gigabyte dump file. !address -summary shows heap usage at 32.033 Gb but !heap -s shows all the heaps as small (2MB or less). Any ideas about the disparity between the two commands shown below?

ps. Windbg version 6.3.9600.16384 AMD64

0:018> !address -summary

Mapping file section regions...
Mapping module regions...
Mapping PEB regions...
Mapping TEB and stack regions...
Mapping heap regions...
Mapping page heap regions...
Mapping other regions...
Mapping stack trace database regions...
Mapping activation context regions...

--- Usage Summary ---------------- RgnCount ----------- Total Size -------- %ofBusy %ofTotal
Free                                    167      7f7`f74c0000 (   7.969 Tb)               99.61%
Heap                                     95        8`02223000 (  32.033 Gb)  99.68%    0.39%
<unknown>                                33        0`032f6000 (  50.961 Mb)   0.15%    0.00%
Image                                   518        0`02f78000 (  47.469 Mb)   0.14%    0.00%
Stack                                    57        0`004c0000 (   4.750 Mb)   0.01%    0.00%
Other                                    15        0`001b8000 (   1.719 Mb)   0.01%    0.00%
TEB                                      19        0`00026000 ( 152.000 kb)   0.00%    0.00%
PEB                                       1        0`00001000 (   4.000 kb)   0.00%    0.00%

--- Type Summary (for busy) ------ RgnCount ----------- Total Size -------- %ofBusy %ofTotal
MEM_PRIVATE                             187        8`03b5e000 (  32.058 Gb)  99.76%    0.39%
MEM_IMAGE                               519        0`02f79000 (  47.473 Mb)   0.14%    0.00%
MEM_MAPPED                               32        0`02059000 (  32.348 Mb)   0.10%    0.00%

--- State Summary ---------------- RgnCount ----------- Total Size -------- %ofBusy %ofTotal
MEM_FREE                                167      7f7`f74c0000 (   7.969 Tb)           99.61%
MEM_COMMIT                              672        8`04f16000 (  32.077 Gb)  99.82%    0.39%
MEM_RESERVE                              66        0`03c1a000 (  60.102 Mb)   0.18%    0.00%

--- Protect Summary (for commit) - RgnCount ----------- Total Size -------- %ofBusy %ofTotal
PAGE_READWRITE                          216        8`01672000 (  32.022 Gb)  99.65%    0.39%
PAGE_READONLY                           297        0`01dd2000 (  29.820 Mb)   0.09%    0.00%
PAGE_EXECUTE_READ                        98        0`0195b000 (  25.355 Mb)   0.08%    0.00%
PAGE_WRITECOPY                           41        0`00140000 (   1.250 Mb)   0.00%    0.00%
PAGE_READWRITE|PAGE_GUARD                19        0`00036000 ( 216.000 kb)   0.00%    0.00%
PAGE_EXECUTE_READWRITE                    1        0`00001000 (   4.000 kb)   0.00%    0.00%

--- Largest Region by Usage ----------- Base Address -------- Region Size ----------
Free                                      9`80030000      7f5`6e4d0000 (   7.959 Tb)
Heap                                      1`80030000        8`00000000 (  32.000 Gb)
<unknown>                                 0`00939000        0`013f7000 (  19.965 Mb)
Image                                   7fe`fe95a000        0`0089e000 (   8.617 Mb)
Stack                                     0`03590000        0`00035000 ( 212.000 kb)
Other                                     0`007a0000        0`00181000 (   1.504 Mb)
TEB                                     7ff`fff94000        0`00002000 (   8.000 kb)
PEB                                     7ff`fffd6000        0`00001000 (   4.000 kb)

0:018> !heap -s
LFH Key                   : 0x000000b22491393a
Termination on corruption : ENABLED
          Heap     Flags   Reserv  Commit  Virt   Free  List   UCR  Virt  Lock  Fast 
                             (k)     (k)    (k)     (k) length      blocks cont. heap 
-------------------------------------------------------------------------------------
Virtual block: 00000000002f0000 - 00000000002f0000 (size 0000000000000000)
Virtual block: 0000000180030000 - 0000000180030000 (size 0000000000000000)
00000000001f0000 00000002    2048   1640   2048     18    29     2    2      0   LFH
0000000000010000 00008000      64      4     64      1     1     1    0      0      
Virtual block: 00000000004e0000 - 00000000004e0000 (size 0000000000000000)
00000000004d0000 00001002    1088    212   1088     16    11     2    1      0   LFH
Virtual block: 0000000002100000 - 0000000002100000 (size 0000000000000000)
00000000022c0000 00001002      64     28     64      2     2     1    1      0   LFH
Virtual block: 00000000022d0000 - 00000000022d0000 (size 0000000000000000)
00000000004c0000 00001002      64     64     64     11     3     1    1      0   LFH
Virtual block: 0000000002400000 - 0000000002400000 (size 0000000000000000)
0000000000490000 00001002      64     36     64      6     2     1    1      0   LFH
Virtual block: 0000000002530000 - 0000000002530000 (size 0000000000000000)
00000000026f0000 00001002      64     64     64      6     3     1    1      0   LFH
Virtual block: 0000000002700000 - 0000000002700000 (size 0000000000000000)
0000000002840000 00001002      64     36     64      6     2     1    1      0   LFH
Virtual block: 0000000002850000 - 0000000002850000 (size 0000000000000000)
00000000029d0000 00001002      64     28     64      2     2     1    1      0   LFH
Virtual block: 00000000029e0000 - 00000000029e0000 (size 0000000000000000)
0000000002b60000 00001002      64     32     64      3     2     1    1      0   LFH
Virtual block: 0000000002c00000 - 0000000002c00000 (size 0000000000000000)
0000000002bf0000 00001002      64     36     64      5     2     1    1      0   LFH
0000000002db0000 00001002     512     24    512      3     2     1    0      0      
0000000002ea0000 00011002     512      8    512      2     1     1    0      0      
Virtual block: 0000000002fc0000 - 0000000002fc0000 (size 0000000000000000)
Virtual block: 00000000037d0000 - 00000000037d0000 (size 0000000000000000)
0000000002f40000 00001002     512    204    512     66     7     1    2      0   LFH
0000000003270000 00001002      64      8     64      3     1     1    0      0      
0000000003120000 00001002     512      8    512      2     2     1    0      0      
0000000003750000 00001002     512      8    512      3     2     1    0      0      
0000000003900000 00001002     512      8    512      3     1     1    0      0      
0000000003740000 00001002      64      8     64      3     1     1    0      0      
Virtual block: 0000000003980000 - 0000000003980000 (size 0000000000000000)
0000000003b60000 00001002      64     40     64      1     2     1    1      0   LFH
0000000003e40000 00001003     512    100    512     42    14     1    0    N/A   
0000000003d20000 00001003     512      8    512      5     1     1    0    N/A   
0000000004090000 00001003     512      8    512      5     1     1    0    N/A   
00000000036b0000 00001003     512      8    512      5     1     1    0    N/A   
0000000003f50000 00001003     512      8    512      5     1     1    0    N/A   
0000000004160000 00001003     512      8    512      5     1     1    0    N/A   
0000000004360000 00001003     512      8    512      5     1     1    0    N/A   
00000000045a0000 00001003     512      8    512      5     1     1    0    N/A   
00000000042d0000 00001003     512      8    512      5     1     1    0    N/A   
0000000003ad0000 00001003     512      8    512      5     1     1    0    N/A   
0000000004790000 00001003     512      8    512      5     1     1    0    N/A   
0000000004010000 00001003     512      8    512      5     1     1    0    N/A   
0000000004460000 00001003     512      8    512      5     1     1    0    N/A   
00000000046c0000 00001003     512      8    512      5     1     1    0    N/A   
0000000004990000 00001003     512      8    512      5     1     1    0    N/A   
0000000004ba0000 00001003     512      8    512      5     1     1    0    N/A   
0000000004b80000 00001003    1088    136   1088     69     2     2    0    N/A   
Virtual block: 0000000005120000 - 0000000005120000 (size 0000000000000000)
00000000031d0000 00001002    1088    376   1088     12     3     2    1      0   LFH
Virtual block: 0000000005250000 - 0000000005250000 (size 0000000000000000)
0000000003d10000 00001002      64     36     64      7     2     1    1      0   LFH
-------------------------------------------------------------------------------------

Kowalski

Answer 1

It seems that the 32 GB are hidden behind the lines starting with Virtual block. I created a sample program which alloces a 100 MB block of memory using the HeapAlloc() function.

In WinDbg 6.12.0002.633, 6.2.9200.16384 and 6.3.9600.16384, every time I allocate such a block, it shows up as an additional line Virtual block: <address> - <address> (size 00000000).

Unfortunately I have no idea of how to get the correct size.

Spermatic

But !address -summary is indeed stating that heap usage is 32GB. Shouldn't therefore !heap -s show heaps totaling 32GB? – Kowalski

Of course you're right. VirtualAlloc() calls increase the amount of <unknown> memory. Does !heap -s -v find anything suspicious? – Spermatic

Nope, the output looks identical to !heap -s. – Kowalski

Hi Marc, I played around with different types of memory allocations and found that HeapAlloc() reproduces your situation. I've updated my answer. – Spermatic

Hi Thomas, I'll upvote your answer rather than accept it since it reproduces but doesn't actually answer the discrepancy. – Kowalski

So which types of memory allocations did not reproduce this situation? – Kowalski