// Copyright (c) 2008-2009 Nokia Corporation and/or its subsidiary(-ies).
// All rights reserved.
// This component and the accompanying materials are made available
// under the terms of the License "Eclipse Public License v1.0"
// which accompanies this distribution, and is available
// at the URL "http://www.eclipse.org/legal/epl-v10.html".
//
// Initial Contributors:
// Nokia Corporation - initial contribution.
//
// Contributors:
//
// Description:
// e32test\debug\t_heapcorruption.cpp
// This is a test application that will cause heap corruption 
// to generate BTrace events (EHeapCorruption).
// 
//

//  Include Files  
#include "t_heapcorruption.h"
#include <e32base.h>
#include <e32base_private.h>
#include <e32cmn.h>
#include <e32cmn_private.h>


#define __NEXT_CELL(p)				((SCell*)(((TUint8*)p)+p->len))

TBool gEnableMemoryMonitor = EFalse;


/**
Test heap that will corrupt some cells to generate BTrace events.
*/
class RMyDummyHeap : public RHeap
{
public:
	//EBadFreeCellAddress
	void CorruptFreeMemory1()
		{
		SCell* f = (SCell*)&iFree;
		f->next = (SCell*)iTop;
		f->next += sizeof(TUint8);
		}
	
	//EBadFreeCellSize
	void CorruptFreeMemory2()
		{
		SCell* p = (SCell*)&iFree;
		SCell* n = p->next; 
		n->len = iMinCell-1;
		}
	
	//EBadAllocatedCellAddress
	void CorruptAllocatedMemory1()
		{
		SCell* c = (SCell*)iBase;
		SCell* f = (SCell*)&iFree;
		
		f = f->next;
		f = f->next;
		c->len = (TInt)f->next - (TInt)c;
		}
	
	//additional utilities
	void CorruptAllocatedMemorySize(void* aAddress)
		{
		SCell* addres = GetAddress(aAddress);
		SCell* c = (SCell*)iBase;
		for(;;)
			{
			if(c == addres)
				{
				c->len = iMinCell-1;
				break;
				}
			c = __NEXT_CELL(c);
			}
		}
		
	void CorruptAllocatedMemoryAddress(void* aAddress)
		{
		SCell* pF = &iFree;				// free cells
		pF = pF->next;				// next free cell
		if (!pF)
			pF = (SCell*)iTop;	
		SCell* addres = GetAddress(aAddress);
		SCell* c = (SCell*)iBase;
		for(;;)
			{
			if(c == addres)
				{
				c->len = (TInt)pF->next - (TInt)c;
				break;
				}
			c = __NEXT_CELL(c);
			}
		}
	
	void EnableHeavyMemoryMonitoring()
		{
		iFlags |= EMonitorMemory;
		}
};


/**
Heap corruption 2:
- Overrunning an array using memset 
(EHeapCorruption - EBadAllocatedCellSize)
*/
void Memory_Corruption2()
	{
	if(gEnableMemoryMonitor)
		{
		RMyDummyHeap* h = (RMyDummyHeap*)&User::Heap();
		h->EnableHeavyMemoryMonitoring();	
		}
	
	char* buf = new char[10];  //will be aligned to 12
	char* buf2 = new char[10]; //will be aligned to 12
	TInt a = User::Heap().AllocLen(buf);
	memset(buf, 255, a+1); //memory corruption
	
	if(!gEnableMemoryMonitor)
			User::Heap().Check(); //force 'heap walker' to check the heap
	
	delete buf2;
	delete buf; //when heavy monitoring is ON should send trace
	}


//causes EBadFreeCellAddress corruption type
void Memory_Corruption3()
	{
	TInt* p1 = new TInt();
	TInt* p2 = new TInt();
	TInt* p3 = new TInt();
	TInt* p4 = new TInt();
	TInt* p5 = new TInt();
	TInt* p6 = new TInt();
	delete p2;
	delete p4;
	delete p6;
	
	RMyDummyHeap* h = (RMyDummyHeap*)&User::Heap();
	h->CorruptFreeMemory1();
	User::Heap().Check();
	
	delete p5;
	delete p3;
	delete p1;
	}


//causes EBadFreeCellSize RHeap corruption type
void Memory_Corruption4()
	{
	TInt* p1 = new TInt();
	TInt* p2 = new TInt();
	TInt* p3 = new TInt();
	delete p2;
	
	RMyDummyHeap* h = (RMyDummyHeap*)&User::Heap();
	h->CorruptFreeMemory2();
	User::Heap().Check();
	
	delete p3;
	
	delete p1;
	}


//causes EBadAllocatedCellAddress corruption type
void Memory_Corruption5()
	{
	TInt* p1 = new TInt;
	TInt* p2 = new TInt;
	TInt* p3 = new TInt;
	TInt* p4 = new TInt;
	TInt* p5 = new TInt;
	TInt* p6 = new TInt;
	TInt* p7 = new TInt;
	delete p2;
	delete p4;
	delete p6;
	
	RMyDummyHeap* h = (RMyDummyHeap*)&User::Heap();
	//h->CorruptAllocatedMemory1();
	h->CorruptAllocatedMemoryAddress((void*)p7);
	User::Heap().Check();
	
	delete p7;
	delete p5;
	delete p3;
	delete p1;
	}


void Memory_Corruption_Special1()
	{
	char* buf = new char;
	RMyDummyHeap* h = (RMyDummyHeap*)&User::Heap();
	h->EnableHeavyMemoryMonitoring();
	h->CorruptAllocatedMemoryAddress((void*)buf);
	delete buf;// should output EHeapCorruption trace
	}



//  Local Functions
LOCAL_D TInt threadTraceHeapCorruptionTestThread(TAny* param)
	{
	TInt t = *((TInt*)param);
	switch(t)
		{
		case RHeap::EBadAllocatedCellSize:
			Memory_Corruption2();
			break;
		case RHeap::EBadFreeCellAddress:
			Memory_Corruption3();
			break;
		case RHeap::EBadFreeCellSize:
			Memory_Corruption4();
			break;
		case RHeap::EBadAllocatedCellAddress:
			Memory_Corruption5();
			break;
		case 1000:
			Memory_Corruption_Special1();
			break;
		default:
			User::Invariant();
			break;
		}
	return 0;
	}


//Function to execute corruption cases.
TInt ExecuteTest(TInt aTestType)
	{
	RThread thread;
	TInt type;
	TRequestStatus stat;
	TInt r = KErrNone;
	gEnableMemoryMonitor = EFalse;
	
	switch(aTestType)
		{
		case 0: ////RHeap::EBadAllocatedCellSize with heavy monitoring enabled
			type = RHeap::EBadAllocatedCellSize;
			gEnableMemoryMonitor = ETrue;
			r = thread.Create(_L("t_tbrace_heapcorruption"), threadTraceHeapCorruptionTestThread, 
					               KDefaultStackSize, 0x2000, 0x2000, &type);
			thread.Logon(stat);
			thread.Resume();
			User::WaitForRequest(stat);
			thread.Close();
			break;
			
		case 1: //RHeap::EBadFreeCellAddress:
			type = RHeap::EBadFreeCellAddress;
			r = thread.Create(_L("t_tbrace_heapcorruption"), threadTraceHeapCorruptionTestThread, 
					               KDefaultStackSize, 0x2000, 0x2000, &type);
			thread.Logon(stat);
			thread.Resume();
			User::WaitForRequest(stat);
			thread.Close();
		break;
		
		case 2: //RHeap::EBadFreeCellSize:
			type = RHeap::EBadFreeCellSize;
			r = thread.Create(_L("t_tbrace_heapcorruption"), threadTraceHeapCorruptionTestThread, 
			                KDefaultStackSize, 0x2000, 0x2000, &type);
			thread.Logon(stat);
			thread.Resume();
			User::WaitForRequest(stat);
			thread.Close();
		break;
		
		case 3: //RHeap::EBadAllocatedCellSize:
			type = RHeap::EBadAllocatedCellSize;
			r = thread.Create(_L("t_tbrace_heapcorruption"), threadTraceHeapCorruptionTestThread, 
						               KDefaultStackSize, 0x2000, 0x2000, &type);
			thread.Logon(stat);
			thread.Resume();
			User::WaitForRequest(stat);
			thread.Close();
		break;
		
		case 4: //RHeap::EBadAllocatedCellAddress:
			type = RHeap::EBadAllocatedCellAddress;
			r = thread.Create(_L("t_tbrace_heapcorruption"), threadTraceHeapCorruptionTestThread, 
						               KDefaultStackSize, 0x2000, 0x2000, &type);
			thread.Logon(stat);
			thread.Resume();
			User::WaitForRequest(stat);
			thread.Close();
		break;
		
		case 1000:
			type = 1000;
			gEnableMemoryMonitor = ETrue;
			r = thread.Create(_L("t_tbrace_heapcorruption"), threadTraceHeapCorruptionTestThread, 
			                 KDefaultStackSize, 0x2000, 0x2000, &type);
			thread.Logon(stat);
			thread.Resume();
			User::WaitForRequest(stat);
			thread.Close();
		break;
		
		default:
			User::Invariant();
			break;
		}
	
	return r;
	}


LOCAL_C void MainL ()
	{
	//reading command line
	TInt testType = 0; //unknown test
	TInt cmdLength = User::CommandLineLength();
	HBufC* cmdLine = HBufC::NewLC(cmdLength);
	TPtr clp(cmdLine->Des());
	User::CommandLine(clp);
	TLex argv(clp);
	for(TInt i=0; !argv.Eos(); i++)
		{
		TPtrC token(argv.NextToken());

		if(token.Compare(_L("0")) == 0)
			testType = 0;
		if(token.Compare(_L("1")) == 0)
			testType = 1;
		else if(token.Compare(_L("2")) == 0)
			testType = 2;
		else if(token.Compare(_L("3")) == 0)
			testType = 3;
		else if(token.Compare(_L("4")) == 0)
			testType = 4;
		else if(token.Compare(_L("1000")) == 0)
			testType = 1000;
		}
	CleanupStack::PopAndDestroy(); //cmdLine
	
	ExecuteTest(testType);
	}

LOCAL_C void DoStartL ()
	{
	// Create active scheduler (to run active objects)
	CActiveScheduler* scheduler = new (ELeave) CActiveScheduler();
	CleanupStack::PushL (scheduler);
	CActiveScheduler::Install (scheduler);

	MainL ();

	// Delete active scheduler
	CleanupStack::PopAndDestroy (scheduler);
	}

//  Global Functions

GLDEF_C TInt E32Main()
	{
	// Create cleanup stack
	CTrapCleanup* cleanup = CTrapCleanup::New();

	// Run application code inside TRAP harness, wait keypress when terminated
	TRAPD(mainError, DoStartL());
	if (mainError)
		return mainError;

	delete cleanup;
	return KErrNone;
	}