ASSERT (V8) vmareas.c:8559 f != FRAG_NEXT(entry), vmarea fraglist corrupted by trace jumping over sandbox2ro page

_From [rnk@google.com](https://code.google.com/u/rnk@google.com/) on January 24, 2013 16:33:47_

This is a follow-on to issue #942 .

I believe the problem can be reproduced by creating a sandboxed page in the middle of a vmarea, creating a trace that jumps across the sandboxed page, then thrashing between sandboxing and page protections.

As discussed for issue #942 , shared executable areas need to fully contain thread local executed areas. This issue occurs when there are two local executed areas inside a shared executable area created by merging regions after sandbox2ro. We end up adding two fragment entries to the same shared exec vmarea fraglist, which violates our invariants.

Some logs:

./bin64/drrun -debug -checklevel 1 -no_deadlock_avoidance -loglevel 5 -logmask 0x2000 -no_hashtable_study -reset_every_nth_pending 0 -- ~/v8/out/x64.release/d8 --test --stress-opt --always-opt --nobreak-on-abort --nodead-code-elimination --expose-debug-as debug ~/v8/test/mjsunit/mjsunit.js ~/v8/test/mjsunit/debug-function-scopes.js

Before removing vm area:
...
0x0000235ea2d06000-0x0000235ea2d4a000 W--- unexpected vm area
0x0000235ea2d4a000-0x0000235ea2d4b000 W-S- selfmod replacement
0x0000235ea2d4b000-0x0000235ea2dff000 W--- unexpected vm area
...
After removing vm area:
...
0x0000235ea2d06000-0x0000235ea2d4a000 W--- unexpected vm area
0x0000235ea2d4b000-0x0000235ea2dff000 W--- unexpected vm area
...
vm_area_add_fragment for F82797(0x0000235ea2d26862)
also 0x000000004240f3d8 pc=0x0000235ea2d4b880
....
0x000000004240f468 F82796 tag=0x0000235ea2d4aae0
0x000000004240f3d8 F=0x000000004240f4f0 pc=0x0000235ea2d4b880
SYSLOG_ERROR: Application /usr/local/google/home/rnk/v8/out/x64.release/d8 (5728). Internal Error Internal DynamoRIO Error: ../core/vmareas.c:8559 f != FRAG_NEXT(entry)

For F82797, we check thread local vmareas to create vmlist. We get two entries for two PCs:
0x0000235ea2d26862
0x0000235ea2d4b880
Note how they straddle the old sandboxed vmarea that we flushed away and merged.

Then we iterate vmlist and add those entries to thread shared vmareas, which don't have the same bounds as thread local vmareas. So, both entries end up inside the same vmarea.

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=1064_