windbg memory leak investigation - missing heap me

Question

I am investigating a slow memory leak in a windows application using windbg

!heap -s gives the following output

          Heap     Flags   Reserv  Commit  Virt   Free  List   UCR  Virt  Lock  Fast 
                            (k)     (k)    (k)     (k) length      blocks cont. heap 
-------------------------------------------------------------------------------------
00000023d62c0000 08000002 1182680 1169996 1181900  15759  2769    78    3   2b63   LFH
00000023d4830000 08008000      64      4     64      2     1     1    0      0      
00000023d6290000 08001002    1860    404   1080     43     7     2    0      0   LFH
00000023d6dd0000 08001002   32828  32768  32828  32765    33     1    0      0      
    External fragmentation  99 % (33 free blocks)
00000023d8fb0000 08001000   16384   2420  16384   2412     5     5    0   3355      
    External fragmentation  99 % (5 free blocks)
00000023da780000 08001002      60      8     60      5     2     1    0      0      
-------------------------------------------------------------------------------------

This shows that the heap with address 00000023d62c0000 has over a gigabyte of reserved memory.

Next I ran the command !heap -stat -h 00000023d62c0000

 heap @ 00000023d62c0000
group-by: TOTSIZE max-display: 20
    size     #blocks     total     ( %) (percent of total busy bytes)
    30 19b1 - 4d130  (13.81)
    20 1d72 - 3ae40  (10.55)
    ccf 40 - 333c0  (9.18)
    478 8c - 271a0  (7.01)
    27158 1 - 27158  (7.00)
    40 80f - 203c0  (5.78)
    410 79 - 1eb90  (5.50)
    68 43a - 1b790  (4.92)
    16000 1 - 16000  (3.94)
    50 39e - 12160  (3.24)
    11000 1 - 11000  (3.05)
    308 54 - fea0  (2.85)
    60 28e - f540  (2.75)
    8018 1 - 8018  (1.43)
    80 f2 - 7900  (1.36)
    1000 5 - 5000  (0.90)
    70 ac - 4b40  (0.84)
    4048 1 - 4048  (0.72)
    100 3e - 3e00  (0.69)
    48 c9 - 3888  (0.63)

If I add up the total size of the heap blocks from the above command (4d130 + 3ae40 + ...) I get a few megabytes of allocated memory.

Am I missing something here? How can I find which blocks are consuming the gigabyte of allocated heap memory?

Answer 1

I believe that the !heap –stat is broken for 64 bits dumps, at least big one. I have instead used debugdiag 1.2 for hunting memory leaks on 64 bits.