/*

* Copyright (c) 2009 Nokia Corporation and/or its subsidiary(-ies). 

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:

*

*/

#include <memspy/engine/memspyenginehelperfbserv.h>

// System includes

#include <s32mem.h>

#include <f32file.h>

#include <e32rom.h>

// Driver includes

#include <memspy/driver/memspydriverclient.h>

// User includes

#include <memspy/engine/memspyengine.h>

#include <memspy/engine/memspyengineutils.h>

#include <memspy/engine/memspyengineoutputsink.h>

#include <memspy/engine/memspyengineobjectprocess.h>

#include <memspy/engine/memspyengineobjectthread.h>

#include <memspy/engine/memspyengineobjectcontainer.h>

// Literal constants

_LIT( KMemSpyEngineFBServComma, ", " );

_LIT( KMemSpyEngineFBServExportFileName, "Image_%08x_%02d_bpp_(%d x %d).bmp");

_LIT( KMemSpyEngineFBSLargeChunkName, "FbsLargeChunk" );

_LIT( KMemSpyEngineFBSSharedChunkName, "FbsSharedChunk" );

CMemSpyEngineHelperFbServ::CMemSpyEngineHelperFbServ( CMemSpyEngine& aEngine )

:   iEngine( aEngine )

    {

    }

CMemSpyEngineHelperFbServ::~CMemSpyEngineHelperFbServ()

    {

    iEngine.Driver().WalkHeapClose();

    }

void CMemSpyEngineHelperFbServ::ConstructL()

    {

    }

CMemSpyEngineHelperFbServ* CMemSpyEngineHelperFbServ::NewL( CMemSpyEngine& aEngine )

    {

    CMemSpyEngineHelperFbServ* self = new(ELeave) CMemSpyEngineHelperFbServ( aEngine );

    CleanupStack::PushL( self );

    self->ConstructL();

    CleanupStack::Pop( self );

    return self;

    }

TBool CMemSpyEngineHelperFbServ::IsLargeBitmapChunk( const TMemSpyDriverChunkInfo& aChunkInfo )

    {

    TBool ret = EFalse;

    //

    if  ( aChunkInfo.iType == EMemSpyDriverChunkTypeGlobal )

        {

        ret = ( aChunkInfo.iName.FindF( KMemSpyEngineFBSLargeChunkName ) >= 0 );

        }

    //

    return ret;

    }

TBool CMemSpyEngineHelperFbServ::IsSharedBitmapChunk( const TMemSpyDriverChunkInfo& aChunkInfo )

    {

    TBool ret = EFalse;

    //

    if  ( aChunkInfo.iType == EMemSpyDriverChunkTypeGlobal )

        {

        ret = ( aChunkInfo.iName.FindF( KMemSpyEngineFBSSharedChunkName ) >= 0 );

        }

    //

    return ret;

    }

EXPORT_C void CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL( RArray<TInt>& aHandles )

    {

    TInt fontConCount = 0;

    TInt bitmapConCount =0;

    //RArray<TInt> dirtyHandles;

    //CleanupClosePushL( dirtyHandles );

    GetArrayOfBitmapHandlesL( aHandles, bitmapConCount, fontConCount );

    //CleanupStack::PopAndDestroy( &dirtyHandles );

    }

void CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL( RArray<TInt>& aHandles, TInt& aBitmapConCount, TInt& aFontConCount )

    {

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - START") );

    CMemSpyThread& fbServThread = IdentifyFbServThreadL();

    // Suspend the process

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - got FBServ thread, suspending it..."));

    iEngine.ProcessSuspendLC( fbServThread.Process().Id() );

    // Get the heap cell data for the correct object (CFbTop)

    TAny* cellAddress = NULL;

    HBufC8* cellData = LocateCFbTopHeapCellDataLC( fbServThread, cellAddress );

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - got CFbTop cell data: %d bytes", cellData->Length()));

    // Work out the offset to the bitmap address handles array

    const TUint offsetBitmapCon = OffsetToCObjectConBitmapCon();

    const TUint offsetFontCon = OffsetToCObjectConFontCon();

    const TUint offsetHandleArray = OffsetToBitmapHandleArray();

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - offsetBitmapCon:   %d", offsetBitmapCon ));

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - offsetFontCon:     %d", offsetFontCon ));

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - offsetHandleArray: %d", offsetHandleArray ));

    // Create stream for reading heap data (makes life a bit easier).

    RDesReadStream stream( *cellData );

    CleanupClosePushL( stream );

    // We need to skip over the preamble to the start of the actual data.

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - skipping %d bytes [to start of bitmap con]...", offsetBitmapCon ));

    (void) stream.ReadL( offsetBitmapCon ); // skip this much

    // Read CFbTop::iBitmapCon cell address

    TAny* cellAddresBitmapCon = reinterpret_cast<TAny*>( stream.ReadUint32L() );

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - cellAddresBitmapCon: 0x%08x", cellAddresBitmapCon ));

    TInt bitmapConAllocated = 0;

    RArray<TAny*> bitmapConAddresses;

    CleanupClosePushL( bitmapConAddresses );

    ReadCObjectConInfoL( cellAddresBitmapCon, bitmapConAddresses, aBitmapConCount, bitmapConAllocated );

    CleanupStack::PopAndDestroy( &bitmapConAddresses );

    // Read CFbTop::iFontCon cell address

    TAny* cellAddresFontCon = reinterpret_cast<TAny*>( stream.ReadUint32L() );

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - cellAddresFontCon: 0x%08x", cellAddresFontCon ));

    TInt fontConAllocated = 0;

    RArray<TAny*> fontConAddresses;

    CleanupClosePushL( fontConAddresses );

    ReadCObjectConInfoL( cellAddresFontCon, fontConAddresses, aFontConCount, fontConAllocated );

    CleanupStack::PopAndDestroy( &fontConAddresses );

    // Skip forwards to the bitmap handle array info

    const TUint skipRemaining = ( offsetHandleArray - offsetFontCon );

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - skipRemaining: %d", skipRemaining ));

    (void) stream.ReadL( skipRemaining ); // skip this much

    // The layout of RPointerArrayBase is as follows:

    //

    //  TInt iCount;

	//  TAny** iEntries;

	//  TInt iAllocated;

	//  TInt iGranularity;

	//  TInt iSpare1;

	//  TInt iSpare2;

    // Now read the next 4 bytes. This is the number of allocated array entries.

    const TInt arrayEntryCount = stream.ReadInt32L();

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - arrayEntryCount: %d", arrayEntryCount ));

    // The next four bytes are the address of the cell we are interested in.

    cellAddress = reinterpret_cast<TAny*>( stream.ReadUint32L() );

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - cellAddress: 0x%08x", cellAddress ));

    // The next four bytes are the allocated count

    const TInt arrayAlloctedCount = stream.ReadInt32L();

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - arrayAlloctedCount: %d", arrayAlloctedCount ));

    // Validate

    if  ( arrayEntryCount > arrayAlloctedCount || arrayEntryCount < 0 || arrayAlloctedCount < 0 )

        {

        TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - invalid array details => Leave with KErrCorrupt"));

        User::Leave( KErrCorrupt );

        }

    // Clean up - don't need this data anymore. Real data is in another cell

    CleanupStack::PopAndDestroy( 2, cellData );  // stream & cellData

    // Now obtain the heap cell data for the actual array itself.

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - trying to find bitmap array data..."));

    cellData = LocateBitmapArrayHeapCellDataLC( cellAddress, arrayAlloctedCount );

    // Parse the cell data in order to obtain the bitmap handles.

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - trying to extract bitmap handles..."));

    ParseCellDataAndExtractHandlesL( *cellData, aHandles, arrayEntryCount );

    // Tidy up

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - resuming process..."));

    CleanupStack::PopAndDestroy( cellData );

    // Close heap walker & resume process

    iEngine.Driver().WalkHeapClose();

    CleanupStack::PopAndDestroy();

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::GetArrayOfBitmapHandlesL() - END"));

    }

void CMemSpyEngineHelperFbServ::GetBitmapInfoL( TInt aHandle, TMemSpyEngineFBServBitmapInfo& aInfo )

    {

    CFbsBitmap* bitmap = GetBitmapInfoLC( aHandle, aInfo );

    CleanupStack::PopAndDestroy( bitmap );

    }

CFbsBitmap* CMemSpyEngineHelperFbServ::GetBitmapInfoLC( TInt aHandle, TMemSpyEngineFBServBitmapInfo& aInfo )

    {

    CFbsBitmap* bitmap = new(ELeave) CFbsBitmap();

    CleanupStack::PushL( bitmap );

    const TInt error = bitmap->Duplicate( aHandle );

    User::LeaveIfError( error );

    // Basic info from bitmap itself

    aInfo.iHandle = aHandle;

    aInfo.iDisplayMode = bitmap->DisplayMode();

    // Extended info comes from header

    const SEpocBitmapHeader header( bitmap->Header() );

    aInfo.iSizeInPixels = header.iSizeInPixels;

    aInfo.iCompressionType = header.iCompression;

    aInfo.iColor = header.iColor;

    aInfo.iBitsPerPixel = header.iBitsPerPixel;

    aInfo.iSizeInBytes = header.iBitmapSize;

    // Flags

    aInfo.iFlags = TMemSpyEngineFBServBitmapInfo::EFlagsNone;

    if  ( bitmap->IsRomBitmap() )

        {

        aInfo.iFlags |= TMemSpyEngineFBServBitmapInfo::EFlagsIsRomBitmap;

        }

     if  ( bitmap->IsLargeBitmap() )

        {

        aInfo.iFlags |= TMemSpyEngineFBServBitmapInfo::EFlagsIsLarge;

        }

    if  ( bitmap->IsCompressedInRAM() )

        {

        aInfo.iFlags |= TMemSpyEngineFBServBitmapInfo::EFlagsIsCompressedInRam;

        }

    else

        {

        // Can only do this if not compressed

        if  ( bitmap->IsMonochrome() )

             {

             aInfo.iFlags |= TMemSpyEngineFBServBitmapInfo::EFlagsIsMonochrome;

             }

        }

    return bitmap;

    }

CMemSpyThread& CMemSpyEngineHelperFbServ::IdentifyFbServThreadL()

    {

    _LIT(KFbServThreadName, "FbServ::!Fontbitmapserver");

    //

    CMemSpyThread* thread = NULL;

    CMemSpyProcess* process = NULL;

    // Get the fbserv thread object

    CMemSpyEngineObjectContainer& container = iEngine.Container();

    User::LeaveIfError( container.ProcessAndThreadByFullName( KFbServThreadName, process, thread ) );

    //

    return *thread;

    }

HBufC8* CMemSpyEngineHelperFbServ::LocateCFbTopHeapCellDataLC( CMemSpyThread& aFbServThread, TAny*& aCellAddress )

    {

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::LocateCFbTopHeapCellDataLC() - START"));

    // We'll start looking for the CFbTop object at cell index 0, then we'll

    // continue to a maximum of cell index 10. These are not actual allocation

    // numbers, they are just cell indicies within FBServ's heap.

    // Realistically, the cell should be the 7th.

    const TInt KFbServWillingToStartAtCellIndex = 0;

    const TInt KFbServWillingToSearchUntilCellIndex = 10;

    // We know the size of the cell is pretty big, since it contains a large 

    // hash-map object (4096 elements by default, 4 bytes big => 16k). We'll

    // not try to retrieve more than 18k of data.

    const TInt KFbServExpectedMinimumCellSize = 14*1024;

    const TInt KFbServExpectedMaximumCellSize = 18*1024;

    // This is what we'll return, if we find it...

    aCellAddress = NULL;

    HBufC8* heapCellData = NULL;

    // Get the heap info - we need this for verification purposes

    TMemSpyHeapInfo info;

    TInt err = iEngine.Driver().GetHeapInfoUser( info, aFbServThread.Id() );

    if ( err == KErrNone && info.Type() == TMemSpyHeapInfo::ETypeUnknown )

        {

        err = KErrNotSupported;

        }

    User::LeaveIfError( err );

    // Now walk the heap!

    err = iEngine.Driver().WalkHeapInit( aFbServThread.Id() );

    if  ( err == KErrNone )

        {

        TMemSpyDriverCellType cellType;

        TAny* cellAddress;

        TInt cellLength;

        TInt cellNestingLevel;

        TInt cellAllocationNumber;

        TInt cellHeaderSize;

        TAny* cellPayloadAddress;

        //

        for( TInt cellIndex = KFbServWillingToStartAtCellIndex; err == KErrNone && cellIndex < KFbServWillingToSearchUntilCellIndex; cellIndex++ )

            {

            err = iEngine.Driver().WalkHeapNextCell( aFbServThread.Id(), cellType, cellAddress, cellLength, cellNestingLevel, cellAllocationNumber, cellHeaderSize, cellPayloadAddress );

            TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::LocateCFbTopHeapCellDataLC() - cellIndex[%d] err: %d, cellLength: %d, cellAllocationNumber: %d, cellType: %d", cellIndex, err, cellLength, cellAllocationNumber, cellType));

            if  ( err == KErrNone && (cellType & EMemSpyDriverAllocatedCellMask))

                {

                // We know we are looking for a relatively large *allocated* cell.

                if  ( cellLength >= KFbServExpectedMinimumCellSize && cellLength <= KFbServExpectedMaximumCellSize )

                    {

                    const TInt payloadLength = cellLength;

                    // This is *probably* the right cell. Let's get the data and check.

                    HBufC8* data = HBufC8::NewLC( payloadLength );

                    TPtr8 pData( data->Des() );

                    //

                    err = iEngine.Driver().WalkHeapReadCellData( cellAddress, pData, payloadLength );

                    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::LocateCFbTopHeapCellDataLC() - data fetch returned error: %d", err));

                    if  ( err == KErrNone )

                        {

                        //_LIT(KHeapDumpDataFormat, "%S");

                        //iEngine.Sink().OutputBinaryDataL( KHeapDumpDataFormat, pData.Ptr(), (const TUint8*) cellAddress, pData.Length() );

                        // Check the data

                        const TUint heapMaxSize = info.AsRHeap().MetaData().iMaxHeapSize;

                        const TUint heapBaseAddress = (TUint) info.AsRHeap().MetaData().ChunkBaseAddress();

                        const TBool correctHeapCellLocated = VerifyCorrectHeapCellL( *data, cellAddress, cellPayloadAddress, heapBaseAddress, heapMaxSize );

                        TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::LocateCFbTopHeapCellDataLC() - verified: %d", correctHeapCellLocated));

                        if  ( correctHeapCellLocated )

                            {

                            aCellAddress = cellAddress;

                            heapCellData = data;

                            CleanupStack::Pop( data );

                            break;

                            }

                        else

                            {

                            // Not the right cell. Keep going...

                            CleanupStack::PopAndDestroy( data );

                            }

                        }

                    }

                }

            }

        // NB: don't do this here - 

        // iEngine.Driver().WalkHeapClose();

        // It gets done after all reading is complete

        }

    if  ( heapCellData == NULL )

        {

        TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::LocateCFbTopHeapCellDataLC() - END - didn't find the right cell => KErrNotFound"));

        User::Leave( KErrNotFound );

        }

    //

    CleanupStack::PushL( heapCellData );

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::LocateCFbTopHeapCellDataLC() - END - everything okay, cell is: 0x%08x", aCellAddress));

    return heapCellData;

    }

void CMemSpyEngineHelperFbServ::ReadCObjectConInfoL( TAny* aCellAddress, RArray<TAny*>& aContainerObjects, TInt& aCount, TInt& aAllocated )

    {

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - START - trying cell: 0x%08x", aCellAddress ));

    // What we will return

    HBufC8* cellData = NULL;

    // Try to get info about real cell

    TMemSpyDriverCellType cellType;

    TInt cellLength;

    TInt cellNestingLevel;

    TInt cellAllocationNumber;

    TInt cellHeaderSize;

    TAny* cellPayloadAddress;

    // NOTE: this call may change the value of 'cellAddress'

    TInt err = iEngine.Driver().WalkHeapGetCellInfo( aCellAddress, cellType, cellLength, cellNestingLevel, cellAllocationNumber, cellHeaderSize, cellPayloadAddress );

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - err: %d, cellAddress: 0x%08x, cellLength: %d, cellAllocationNumber: %d, cellType: %d", err, aCellAddress, cellLength, cellAllocationNumber, cellType));

	if (err == KErrNone && (cellType & EMemSpyDriverAllocatedCellMask))

        {

        // Check that the cell size meets our expectations - it should be a CObjectCon cell.

        const TInt expectedCellSize = sizeof(CObjectCon*) + cellHeaderSize;

        TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - expectedCellSize: %d, actual: %d, address: 0x%08x", expectedCellSize, cellLength, aCellAddress));

        if  ( expectedCellSize <= cellLength )

            {

            TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - cell lengths are good, trying to get cell data..."));

            // Try to get real cell data        

            cellData = HBufC8::NewLC( cellLength );

            TPtr8 pData( cellData->Des() );

            //

            err = iEngine.Driver().WalkHeapReadCellData( aCellAddress, pData, cellLength );

            TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - reading cell data returned error: %d", err));

            }

        else

            {

            TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - not enough data -> KErrCorrupt"));

            err = KErrCorrupt;

            }

        }

    else

        {

        TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - END - didn't find cell data => KErrNotFound"));

        User::Leave( KErrNotFound );

        }

    CObjectCon* con = CObjectCon::NewL();

    const TUint32 KExpectedObjectConVTable = *((TUint32*) con);

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - KExpectedObjectConVTable: 0x%08x", KExpectedObjectConVTable ));

    delete con;

    // We should have the valid CObjectCon data now.

    RDesReadStream stream( *cellData );

    CleanupClosePushL( stream );

    // Read vtable

    const TUint32 vTable = stream.ReadUint32L();

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - actual vTable: 0x%08x", vTable ));

    if  ( vTable != KExpectedObjectConVTable )

        {

        User::Leave( KErrNotFound );

        }

    const TInt uniqueId = stream.ReadInt32L();

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - uniqueId: %d", uniqueId ));

    aCount = stream.ReadInt32L();

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - aCount: %d", aCount ));

    aAllocated = stream.ReadInt32L();

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - aAllocated: %d", aAllocated ));

    // This is actually CObject's iObject, i.e. CObject** iObjects.

    TAny* pObjects = reinterpret_cast< TAny*>( stream.ReadUint32L() );

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - pObjects: 0x%08x", pObjects ));

    CleanupStack::PopAndDestroy( 2, cellData ); // cellData & stream

    // Now fetch the cell containing the CObject pointers...

    err = iEngine.Driver().WalkHeapGetCellInfo( pObjects, cellType, cellLength, cellNestingLevel, cellAllocationNumber, cellHeaderSize, cellPayloadAddress );

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - array of CObject* cell fetch err: %d, cellAddress: 0x%08x, cellLength: %d, cellAllocationNumber: %d, cellType: %d", err, aCellAddress, cellLength, cellAllocationNumber, cellType));

    User::LeaveIfError( err );

    const TInt expectedSize = ( aAllocated * sizeof(CObject*) ) + cellHeaderSize;

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - expectedSize: %d, actual size: %d", expectedSize, cellLength ));

    if  ( cellLength < expectedSize )

        {

        User::Leave( KErrUnderflow );

        }

    // Get the data

    cellData = HBufC8::NewLC( cellLength );

    TPtr8 pData( cellData->Des() );

    err = iEngine.Driver().WalkHeapReadCellData( pObjects, pData, cellLength );

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - reading cell data returned error: %d", err));

    User::LeaveIfError( err );

    // Open stream

    stream.Open( *cellData );

    CleanupClosePushL( stream );

    // Extract array of pointers

    for( TInt i=0; i<aCount; i++ )

        {

        TAny* objectAddress = reinterpret_cast< TAny*>( stream.ReadUint32L() );

        TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - object[%04d]: 0x%08x", i, objectAddress ));

        aContainerObjects.AppendL( objectAddress );

        }

    CleanupStack::PopAndDestroy( 2, cellData ); // cellData & stream

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::ReadCObjectConInfoL() - END" ));

    }

HBufC8* CMemSpyEngineHelperFbServ::LocateBitmapArrayHeapCellDataLC( TAny*& aArrayCellAddress, TInt aArrayAllocCount )

    {

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::LocateBitmapArrayHeapCellDataLC() - START - trying cell: 0x%08x, aArrayAllocCount: %d", aArrayCellAddress, aArrayAllocCount));

    // What we will return

    HBufC8* cellData = NULL;

    // Try to get info about real cell

    TMemSpyDriverCellType cellType;

    TInt cellLength;

    TInt cellNestingLevel;

    TInt cellAllocationNumber;

    TInt cellHeaderSize;

    TAny* cellPayloadAddress;

    // NOTE: this call may change the value of 'cellAddress'

    TInt err = iEngine.Driver().WalkHeapGetCellInfo( aArrayCellAddress, cellType, cellLength, cellNestingLevel, cellAllocationNumber, cellHeaderSize, cellPayloadAddress );

    TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::LocateCFbTopHeapCellDataLC() - err: %d, cellAddress: 0x%08x, cellLength: %d, cellAllocationNumber: %d, cellType: %d", err, aArrayCellAddress, cellLength, cellAllocationNumber, cellType));

    if (err == KErrNone && (cellType & EMemSpyDriverAllocatedCellMask))

        {

        // Check that the cell size meets our expectations. 

        // The cell should be a very specific length

        const TInt expectedCellSize = (sizeof(CBase*) * aArrayAllocCount) + cellHeaderSize;

        TRACE( RDebug::Printf("CMemSpyEngineHelperFbServ::LocateBitmapArrayHeapCellDataLC() - expectedCellSize: %d, actual: %d, address: 0x%08x", expectedCellSize, cellLength, aArrayCellAddress));

        if  ( expectedCellSize <= cellLength )