MATLAB appcrash when I use mxFree in S-Function

hi, I'm studying a C mex s-function. I wrote following C++ code.

#define S_FUNCTION_NAME    sfun_exam
#define S_FUNCTION_LEVEL  2

#include "simstruc.h"
#include "matrix.h" // for mxMalloc
#include <stdlib.h>

#define FALSE      0
#define TRUE      1
#define NUM_INPUTS    0
#define NUM_OUTPUTS    0
#define NUM_PARAMS    0
#define NUM_CONT_STATE  0
#define NUM_DISC_STATE  0

static void mdlInitializeSizes(SimStruct *S)
{
  ssPrintf("mdlInitializeSizes entry\n");

  ssSetNumSFcnParams(S, NUM_PARAMS);
  //ssSetSFcnParamTunable(S, 0, 0);

  ssSetNumContStates(S, NUM_CONT_STATE);
  ssSetNumDiscStates(S, NUM_DISC_STATE);

  if (!ssSetNumInputPorts(S, NUM_INPUTS)) return;
  
  if (!ssSetNumOutputPorts(S, NUM_OUTPUTS)) return;

  ssSetNumSampleTimes(S, 1);

  ssSetNumRWork(S, 0);
  ssSetNumIWork(S, 0);
  ssSetNumPWork(S, 1);
  ssSetNumModes(S, 0);
  ssSetNumNonsampledZCs(S, 0);

  ssSetSimStateCompliance(S, USE_DEFAULT_SIM_STATE);

  ssSetOptions(S, 0);

  ssPrintf("mdlInitializeSizes exit\n");
}

static void mdlInitializeSampleTimes(SimStruct *S)
{
  ssPrintf("mdlInitializeSampleTimes entry\n");

  ssPrintf("mdlInitializeSampleTimes exit\n");
}

#define MDL_START
static void mdlStart(SimStruct *S)
{
  ssPrintf("mdlStart entry\n");

  double  *temp = (double *)mxMalloc(sizeof(double));
  ssPrintf("assigned address = %d\n", temp);

  ssGetPWork(S)[0] = (void *)temp;

  ssPrintf("mdlStart exit\n");
}

static void mdlOutputs(SimStruct *S, int_T tid)
{
  ssPrintf("mdlOutputs entry\n");

  UNUSED_ARG(tid);

  ssPrintf("mdlOutputs exit\n");
}

static void mdlTerminate(SimStruct *S)
{
  ssPrintf("mdlTerminate entry\n");

  void  *temp;
  temp = ssGetPWork(S)[0];
  ssPrintf("assigned address = %d\n", temp);
  mxFree(temp);

  ssPrintf("mdlTerminate exit\n");
}

/*=============================*
 * Required S-function trailer *
 *=============================*/

#ifdef  MATLAB_MEX_FILE    /* Is this file being compiled as a MEX-file? */
#include "simulink.c"      /* MEX-file interface mechanism */
#else
#include "cg_sfun.h"       /* Code generation registration function */
#endif

It is built without error. but during simulation, MATLAB appcrash occured.

Problem signature
Problem Event Name:  APPCRASH
Application Name:  MATLAB.exe
Application Version:  7.13.0.0
Application Timestamp:  4e4754eb
Fault Module Name:  StackHash_b9f6
Fault Module Version:  6.1.7601.17725
Fault Module Timestamp:  4ec49b60
Exception Code:  c0000374
Exception Offset:  000c380b
OS Version:  6.1.7601.2.1.0.256.48
Locale ID:  1042
Additional Information 1:  b9f6
Additional Information 2:  b9f67d14f6a48d7204fa389a0a5bf0d1
Additional Information 3:  c4cc
Additional Information 4:  c4ccbe39e350b9853267802fd89da65d

When I used malloc and free Instead of mxMalloc and mxFree, this appcrash didn't occur.

what did I do wrong??

thanks for reading..

Answer 1

[Friedrich]

Hi,

please do not use mxfree and other mx* memory functions:

http://www.mathworks.com/support/solutions/en/data/1-5RMJID/?solution=1-5RMJID

[Kyungjoon Kim]

thanks :)

Answer 2

[Kaustubha Govind]

ssGetPWork(S) returns memory owned and managed by Simulink - you should not be freeing this memory in your own code. Is there a reason you want to do this? Also, I don't know why mxFree crashes, but free doesn't. My guess is that mxFree does some extra checking or book-keeping that detects the segmentation violation, whereas free is failing to detect it.

[Kyungjoon Kim]

This comment is a mdlTerminate comment in example model "sfcndemo_counter_cpp"

/* Function: mdlTerminate =====================================================

* Abstract:

* In this function, you should perform any actions that are necessary

* at the termination of a simulation. For example, if memory was

* allocated in mdlStart, this is the place to free it.

*/

mdlTerminate is called by Simulink Engine. But I think I need to write code freeing memory allocated in mdlStart.

thanks for your answer..

[Kaustubha Govind]

Yes, you must only manually free memory that you allocated using mxMalloc/mxCalloc, everything else is allocated and freed by the Simulink Engine - you can only read/write.

[Kyungjoon Kim]

ok.. I used mxMalloc in mdlStart, so I should free memory in mdlTerminate..isn't it right??

[Kyungjoon Kim]

I think I found something..

I added one more S-Function block using the same C++ code.

The following strings are printed by ssPrintf.

1. when mxMalloc used.

mdlStart entry

assigned address = 813751488

mdlStart exit

mdlStart entry

assigned address = 813751488

mdlStart exit

2. when malloc used.

mdlStart

assigned address = 596974504

mdlStart exit

mdlStart entry

assigned address = 596974520

mdlStart exit

mxMalloc allocate memory managed by MATLAB memory manager.

It looks like MATLAB memory manager does not know that S-Function pointer work vector is referencing allocated memory.

so, when I used mxMalloc, the same addresss is returned because MATLAB memory manager deallocated the memory after first S-Function block's mdlStart exit.

I think I should not use mxMalloc with S-Function pointer work vector.

Am I right?

[Kaustubha Govind]

Oops, sorry, just realized you are using PWorks, and not DWorks. You do need to allocate and free memory for PWorks yourself. I think Friedrich's answer is correct.

Answer 3

[James Tursa]

I know nothing about S-functions, but to hazard a guess maybe you need to NULL out the array value after you manually free the memory so that something in the background doesn't see this value and try to free it again even though the pointer is no longer valid. E.g., maybe add the last line shown:

  temp = ssGetPWork(S)[0];
  ssPrintf("assigned address = %d\n", temp);
  mxFree(temp);
  ssGetPWork(S)[0] = NULL; /* add this line */

[Kyungjoon Kim]

I'm sorry but it does not work.

thanks for your answer :)