CRASH (browser_tests while persisting) entrance_stub_target_tag()

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on July 07, 2013 22:20:59_

Unrecoverable Error at PC 0x682bd739. Program aborted.
0xc0000005 0x00000000 0x682bd739 0x682bd739 0x00000000 0xe7ce3006
Base: 0x68250000
Registers: eax=0x198a3428 ebx=0xe7ce3000 ecx=0xe7ce3000 edx=0x1a884df4
esi=0x1c6fe7c4 edi=0x1c096440 esp=0x1c6fe71c ebp=0x1c701838

0:011> U 0x682bd739
dynamorio!entrance_stub_target_tag+0x9 [d:\derek\dr\git\src\core\x86\emit_utils.c @ 1891]:
682bd739 8b7106 mov esi,dword ptr [ecx+6]

0:011> kn =1c701838 1c6fe71c 682bd739
# ChildEBP RetAddr
00 1c6fe71c 682ab91f dynamorio!entrance_stub_target_tag+0x9 [d:\derek\dr\git\src\core\x86\emit_utils.c @ 1891]
01 1c6fe74c 682abccd dynamorio!coarse_merge_process_stub+0x1f [d:\derek\dr\git\src\core\perscache.c @ 1328]
02 1c6fe778 682ad4d4 dynamorio!coarse_merge_update_jmps+0x20d [d:\derek\dr\git\src\core\perscache.c @ 1490]
03 1c6fe7e0 682adfc9 dynamorio!coarse_unit_merge+0x1e4 [d:\derek\dr\git\src\core\perscache.c @ 1996]
04 1c6fe808 682ae33a dynamorio!coarse_unit_merge_with_disk+0x99 [d:\derek\dr\git\src\core\perscache.c @ 2626]
05 1c6fef14 682a4510 dynamorio!coarse_unit_persist+0x28a [d:\derek\dr\git\src\core\perscache.c @ 3382]
06 1c6fef34 682a4600 dynamorio!vm_area_coarse_region_freeze+0xf0 [d:\derek\dr\git\src\core\vmareas.c @ 10091]
07 1c6fef58 682aafb7 dynamorio!vm_area_coarse_units_freeze+0x70 [d:\derek\dr\git\src\core\vmareas.c @ 10148]
08 1c6fef80 682ad100 dynamorio!coarse_units_freeze_all+0x227 [d:\derek\dr\git\src\core\perscache.c @ 548]
09 1c6fef88 6827e7fd dynamorio!perscache_fast_exit+0x10 [d:\derek\dr\git\src\core\perscache.c @ 437]

0:011> dds esp
1c6fe71c 1c6fe7c4
1c6fe720 682ab91f dynamorio!coarse_merge_process_stub+0x1f [d:\derek\dr\git\src\core\perscache.c @ 1328]
1c6fe724 e7ce3000
1c6fe728 198a3428

```
next_pc = 0x07f87df8 ">???"
```

07f87dc5 85d2 test edx,edx
07f87dc7 0f8663820000 jbe 07f90030
07f87dcd 8d7e34 lea edi,[esi+34h]
07f87dd0 57 push edi
07f87dd1 8d45ec lea eax,[ebp-14h]
07f87dd4 50 push eax
07f87dd5 682b7ef176 push offset ntdll!SbpUpdateCache+0xe3 (76f17e2b)
07f87dda 8bff mov edi,edi
07f87ddc 55 push ebp
07f87ddd 8bec mov ebp,esp
07f87ddf 56 push esi
07f87de0 8b750c mov esi,dword ptr [ebp+0Ch]
07f87de3 57 push edi
07f87de4 8b7d08 mov edi,dword ptr [ebp+8]
07f87de7 6a04 push 4
07f87de9 83c620 add esi,20h
07f87dec 59 pop ecx
07f87ded 33c0 xor eax,eax
07f87def e302 jecxz 07f87df3
07f87df1 eb05 jmp 07f87df8
07f87df3 e908b2d5df jmp e7ce3000 <--- bogus target
==>
07f87df8 3e813efdf1fdf1 cmp dword ptr ds:[esi],0F1FDF1FDh
07f87dff 7502 jne 07f87e03
07f87e01 0f0b ud2
07f87e03 26813ffdf1fdf1 cmp dword ptr es:[edi],0F1FDF1FDh
07f87e0a 7502 jne 07f87e0e
07f87e0c 0f0b ud2
07f87e0e a7 cmps dword ptr [esi],dword ptr es:[edi]
07f87e0f e1e7 loope 07f87df8
07f87e11 5f pop edi
07f87e12 0f94c0 sete al

0:011> dds 1c6fe7e0
1c6fe7e0 00000000
1c6fe7e4 682adfc9 dynamorio!coarse_unit_merge_with_disk+0x99 [d:\derek\dr\git\src\core\perscache.c @ 2626]
1c6fe7e8 1c096440
1c6fe7ec 198a3528
1c6fe7f0 198a3428
1c6fe7f4 00000000
0:011> dt dynamorio!coarse_info_t 198a3428
+0x000 frozen : 0y1
+0x000 persisted : 0y1
+0x000 in_use : 0y0
+0x000 has_persist_info : 0y1
+0x000 primary_for_module : 0y0
+0x000 stubs_readonly : 0y1
+0x004 cache : 0x194592b4 Void
+0x008 htable : 0x194087c4 Void
+0x00c th_htable : 0x194089f4 Void
+0x010 pclookup_last_htable : (null)
+0x014 stubs : 0x1a39102c Void
+0x018 fcache_return_prefix : 0x07f90000 "d???"
+0x01c trace_head_return_prefix : 0x07f90011 "???"
+0x020 ibl_ret_prefix : 0x07f90016 "???"
+0x024 ibl_call_prefix : 0x07f9001b "???"
+0x028 ibl_jmp_prefix : 0x07f90020 "???"
+0x02c incoming : (null)
+0x030 cache_start_pc : 0x07f64000 "???"
+0x034 cache_end_pc : 0x07f8f537 ""
+0x038 stubs_start_pc : 0x07f90030 "gd???"
+0x03c stubs_end_pc : 0x07f96eb0 "???"
+0x040 mmap_size : 0x77000
+0x044 pclookup_htable : (null)
+0x048 flags : 0x109
+0x04c mmap_pc : 0x07f20000 "RIO$."
+0x050 mmap_ro_size : 0x70000
+0x054 fd : 0x00000204 Void
+0x058 persisted_source_mmap_size : 0
+0x05c stubs_write_count : 0
+0x060 non_frozen : (null)
+0x064 lock : _mutex_t
+0x06c incoming_lock : _mutex_t
+0x074 base_pc : 0x76ee0000 "???"
+0x078 end_pc : 0x76fb6000 "--- memory read error at address 0x76fb6000 ---"
+0x07c module_md5 : module_digest_t
+0x09c persist_base : 0x76ed0000 "MZ???"
+0x0a0 mod_shift : 0n0
0:011> dt dynamorio!coarse_info_t 198a3528
+0x000 frozen : 0y1
+0x000 persisted : 0y0
+0x000 in_use : 0y0
+0x000 has_persist_info : 0y1
+0x000 primary_for_module : 0y1
+0x000 stubs_readonly : 0y0
+0x004 cache : 0x1940940c Void
+0x008 htable : 0x199b0034 Void
+0x00c th_htable : 0x19408840 Void
+0x010 pclookup_last_htable : (null)
+0x014 stubs : 0x1c647260 Void
+0x018 fcache_return_prefix : 0x1a48a000 "d???"
+0x01c trace_head_return_prefix : 0x1a48a011 "???"
+0x020 ibl_ret_prefix : 0x1a48a016 "???"
+0x024 ibl_call_prefix : 0x1a48a01b "???"
+0x028 ibl_jmp_prefix : 0x1a48a020 "???"
+0x02c incoming : (null)
+0x030 cache_start_pc : 0x1a461000 "???"
+0x034 cache_end_pc : 0x1a4852f9 ""
+0x038 stubs_start_pc : 0x1a48a030 "gd???"
+0x03c stubs_end_pc : 0x1a490190 ""
+0x040 mmap_size : 0x2f190
+0x044 pclookup_htable : 0x19425abc Void
+0x048 flags : 8
+0x04c mmap_pc : (null)
+0x050 mmap_ro_size : 0
+0x054 fd : (null)
+0x058 persisted_source_mmap_size : 0
+0x05c stubs_write_count : 0
+0x060 non_frozen : (null)
+0x064 lock : _mutex_t
+0x06c incoming_lock : _mutex_t
+0x074 base_pc : 0x76ee0000 "???"
+0x078 end_pc : 0x76fb6000 "--- memory read error at address 0x76fb6000 ---"
+0x07c module_md5 : module_digest_t
+0x09c persist_base : (null)
+0x0a0 mod_shift : 0n0

it's ntdll:
76ed0000 77050000 ntdll (pdb symbols) d:\derek\symbols\wntdll.pdb\D74F79EB1F8D4A45ABCD2F476CCABACC2\wntdll.pdb

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=1204_