DynamoRIO / DynamoRIO/drmemory
x64 -share_xl8 crashes: somebody is zeroing the shadow addr reg
- Dominant language
- C
- Stars
- 2.7k
- Forks
- 290
- PR merge metrics
- No merged PRs in 30d
Description
Splitting from #111
When -share_xl8 was on by default for x64, running:
```
$ bin64/drmemory -no_esp_fastpath -dr_ops "-loglevel 4" -verbose 4 -- tests/free
<...>
```
We have sharing in the 1st 2 memrefs, yet rbx is clobbered with 0 and I
don't know who did it:
```
ilist before analysis:
TAG 0x00007ffa817e0518
+0 L3 0f 1f 84 00 00 00 00 nop 0x00000000(%rax,%rax)[4byte]
00
+8 L3 48 8b 0e mov (%rsi)[8byte] -> %rcx
+11 L3 4c 8b 46 08 mov 0x08(%rsi)[8byte] -> %r8
+15 L3 48 89 0f mov %rcx -> (%rdi)[8byte]
+18 L3 4c 89 47 08 mov %r8 -> 0x08(%rdi)[8byte]
+22 L3 83 ea 10 sub $0x00000010 %edx -> %edx
+25 L3 48 8d 76 10 lea 0x10(%rsi) -> %rsi
+29 L3 48 8d 7f 10 lea 0x10(%rdi) -> %rdi
+33 L3 75 e5 jnz $0x00007ffa817e0520
END 0x00007ffa817e0518
shadow register values:
rax=0000 rcx=0000 rdx=0000 rbx=0000 rsp=0000 rbp=0000 rsi=0000 rdi=0000
r8 =0000 r9 =0000 r10=0000 r11=0000 r12=0000 r13=0000 r14=0000 r15=0000 efl=00
xmm0=00000000 xmm1=00000000 xmm2=00000000 xmm3=00000000
xmm4=00000000 xmm5=00000000 xmm6=00000000 xmm7=00000000
xmm8=00000000 xmm9=00000000 xmm10=00000000 xmm11=00000000
xmm12=00000000 xmm13=00000000 xmm14=00000000 xmm15=00000000
mm0=0000 mm1=0000 mm2=0000 mm3=0000 mm4=0000 mm5=0000 mm6=0000 mm7=0000
whole-bb scratch: r1=%rbxspill#0 x0, r2=%rcxspill#1 x2
scratch: mov (%rsi)[8byte] -> %rcx| r1=%rbxspill#0, r2=%rcx dead
checking definedness for: mov (%rsi)[8byte] -> %rcx
fastpath: mov (%rsi)[8byte] -> %rcx| prop=1 srcsz=8 dstsz=8 checkdef=1 markdef=0 checkunaddr=0
eflags are dead so not saving
eflags are dead so not saving
checking definedness of src1 => 0 to propagate
eflags are dead so not saving
src shadow = $0x0000 sz=2
dst shadow = %gs:0x000000a2 sz=2
src offs = $0x00 sz=1
dst offs = $0x00 sz=1
scratch: mov 0x08(%rsi)[8byte] -> %r8| r1=%rbxspill#0, r2=%rcxspill#1
checking definedness for: mov 0x08(%rsi)[8byte] -> %r8
fastpath: mov 0x08(%rsi)[8byte] -> %r8| prop=1 srcsz=8 dstsz=8 checkdef=1 markdef=0 checkunaddr=0
sharing shadow addr: disp = 8 - (0 + 0) => 8 /4 - 0
checking definedness of src1 => 0 to propagate
eflags are dead so not saving
src shadow = $0x0000 sz=2
dst shadow = %gs:0x000000b0 sz=2
src offs = $0x00 sz=1
dst offs = $0x00 sz=1
<...>
+0 L3 0f 1f 84 00 00 00 00 nop 0x00000000(%rax,%rax)[4byte]
00
+8 m4 @0x000000004ce19118 65 48 89 1c 25 d0 00 mov %rbx -> %gs:0x000000d0[8byte]
00 00
+17 m4 @0x000000004d037790
+17 m4 @0x000000004d03b338 48 8d 1e lea (%rsi) -> %rbx
+20 m4 @0x000000004ce17ed0 66 65 81 3c 25 ac 00 cmp %gs:0x000000ac[2byte] $0x0000
00 00 00 00
+31 m4 @0x000000004d037610 75 fe jnz @0x000000004d037970[8byte]
+33 m4 @0x000000004d03cf88 f6 c3 03 test %bl $0x03
+36 m4 @0x000000004d038450 0f 85 fa ff ff ff jnz @0x000000004d037970[8byte]
+42 m4 @0x000000004ce16a78 48 23 1d 81 4a 02 00 and 0x000000004ce528b8[8byte] %rbx -> %rbx
+49 m4 @0x000000004d03c0e8 48 03 1d 79 4a 02 00 add 0x000000004ce528b0[8byte] %rbx -> %rbx
+56 m4 @0x000000004d03e2b0 48 c1 eb 02 shr $0x0000000000000002 %rbx -> %rbx
+60 m4 @0x000000004d03a610 48 0f b6 0b movzx (%rbx)[1byte] -> %rcx
+64 m4 @0x000000004d03b0b0 66 85 c9 test %cx %cx
+67 m4 @0x000000004d03a910 75 fe jnz @0x000000004d037970[8byte]
+69 m4 @0x000000004ce1a360 66 65 c7 04 25 a2 00 mov $0x0000 -> %gs:0x000000a2[2byte]
00 00 00 00
+80 m4 @0x000000004d0441d8
+80 m4 @0x000000004d039590
+80 m4 @0x000000004d03f360 eb fe jmp @0x000000004d03a580[8byte]
+82 m4 @0x000000004ce1aaf8
+82 m4 @0x000000004d037970
+82 m4 @0x000000004ce197c0 48 bb 20 05 7e 81 fa mov $0x00007ffa817e0520 -> %rbx
7f 00 00
+92 m4 @0x000000004d0453a8 48 c7 c1 30 de e2 4c mov @0x000000004d044a18[4byte] -> %rcx
+99 m4 @0x000000004d03e790 e9 1f 05 1d 00 jmp $0x000000004cffe354
+104 m4 @0x000000004d044a18
===> BAD! who did this??
+104 m4 @0x000000004d03b5d8 48 bb 00 00 00 00 00 mov $0x0000000000000000 -> %rbx
00 00 00
+114 m4 @0x000000004d03a580
+114 L3 48 8b 0e mov (%rsi)[8byte] -> %rcx
+117 m4 @0x000000004d038150 65 48 89 0c 25 d8 00 mov %rcx -> %gs:0x000000d8[8byte]
00 00
+126 m4 @0x000000004ce1ab70
=> CRASH here:
+126 m4 @0x000000004ce1aa38 48 0f b6 4b 02 movzx 0x02(%rbx)[1byte] -> %rcx
```
For now I'm disabling -share_xl8 to make progress on more important parts
of x64.
Contributor guide
Assessment
This issue has not been assessed yet.