DynamoRIO / DynamoRIO/dynamorio

CRASH (1.5.0 64-bit firefox) copy_and_re_relativize_raw_instr

Open
#247 1 comment 0 reactions 0 assignees View on GitHub
Migrated OpSys-Linux Priority-High
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

_From [derek.br...@gmail.com](https://code.google.com/u/117968039472581148324/) on January 07, 2010 12:55:07_

just starting up firefox we hit a crash:

> rio /usr/bin/firefox

(gdb) x/8i sc->rip
0x3cd2882651 : mov %cl,(%rdi)
0x3cd2882653 : inc %rsi
0x3cd2882656 : inc %rdi
0x3cd2882659 : test $0x2,%dl
0x3cd288265c : je 0x3cd2882670
(gdb) p/x *sc

$2 = { r8 = 0x0, r9 = 0x1, r10 = 0x0, r11 = 0x1, r12 = 0x416360c0, r13 =
0x0, r14 = 0x1, r15 = 0x451463b0, rdi = 0x0, rsi = 0x422a2908, rbp = 0x0, rbx =
0x416c6610, rdx = 0x3,
rax = 0x0, rcx = 0xf, rsp = 0x416a1b48, rip = 0x3cd2882651, eflags =
0x10202,
cs = 0x33, gs = 0x0, fs = 0x0, __pad0 = 0x0, err = 0x6, trapno = 0xe,
oldmask = 0x0,
cr2 = 0x0, fpstate = 0x416aa200, reserved1 = {0x0, 0x0, 0x0, 0x0, 0x0,
0x0, 0x0, 0x0}}
(gdb) set $rsp=0x416a1b48
(gdb) bt
#0 0x00000000710cafd0 in syscall_ready ()
from /work/opensource/builds/build64rel/lib/libdynamorio.so
#1 0x000000007109b2f8 in copy_and_re_relativize_raw_instr
(dcontext=0x710eadae,
instr=0x3, dst_pc=0x71314000 "\1")
at /work/opensource/dynamorio/core/x86/encode.c:1861
#2 0x000000007109ecbe in instr_encode_common (dcontext=0x416360c0,
instr=0x416c6610,
pc=0x0, check_reachable=1) at
/work/opensource/dynamorio/core/x86/encode.c:1896
#3 0x00000000710619c5 in set_linkstub_fields (num_indirect_stubs=,
num_direct_stubs=, ilist=,
f=, dcontext=, emit=)
at /work/opensource/dynamorio/core/emit.c:390
#4 emit_fragment_common (num_indirect_stubs=,
num_direct_stubs=, ilist=,
f=, dcontext=, emit=)
at /work/opensource/dynamorio/core/emit.c:678
#5 0x0000000071062709 in emit_fragment_ex (dcontext=0x0, tag=0x416a9d8f
"", ilist=0x1,
flags=4294967295, vmlist=0x1, link=0, visible=1)
at /work/opensource/dynamorio/core/emit.c:1009
#6 0x00000000710b92ba in build_basic_block_fragment (dcontext=0x416360c0,
start=0x3cdf6323a7 "A\215I\377\17o%f\"!", initial_flags=0,
link=, visible=1, for_trace=,
unmangled_ilist=0x0) at /work/opensource/dynamorio/core/x86/interp.c:4067
#7 0x000000007105fe4f in dispatch (dcontext=0x416360c0)
at /work/opensource/dynamorio/core/dispatch.c:185
#8 0x000000004164a2d9 in ?? ()
#9 0x0000000000000000 in ?? ()
(gdb) info symbol 0x71314000
dynamo_options in section .data of
/work/opensource/builds/build64rel/lib/libdynamorio.so

Looks like our "Received SIGSEGV" message, which is coming from events.mc,
is truncating the address to 32-bit -- should fix that as well.

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=247_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.