Loader crashes on segment access while resolving dynamorio_app_takeover on Chrome unit_tests

_From [rnk@google.com](https://code.google.com/u/rnk@google.com/) on May 29, 2012 17:06:04_

I was trying to add a bot to run Chrome's test suite under DR on Linux, and I hit this. It only reproduces when running a release build on the unit_tests binary when launched via buildbot.

Here's the stack trace:

Program received signal SIGSEGV, Segmentation fault.
_dl_fixup (l=0x2b2e76cfddc0, reloc_arg=) at ../elf/dl-runtime.c:115
115 ../elf/dl-runtime.c: No such file or directory.
in ../elf/dl-runtime.c
(gdb) bt
#0 _dl_fixup (l=0x2b2e76cfddc0, reloc_arg=) at ../elf/dl-runtime.c:115
#1 0x00002b2e76cf1365 in _dl_runtime_resolve () at ../sysdeps/x86_64/dl-trampoline.S:41
#2 0x00002b2e76efe71c in _init () at /mnt/data/b/build/slave/linux_lucid_x64_chromium_checkout/dynamorio/core/linux/preload.c:188
#3 0x00002b2e76cead65 in call_init (main_map=0x2b2e76efd128, argc=1, argv=0x7fffcc4b2fa8, env=0x7fffcc4b2fb8) at dl-init.c:70
#4 _dl_init (main_map=0x2b2e76efd128, argc=1, argv=0x7fffcc4b2fa8, env=0x7fffcc4b2fb8) at dl-init.c:134
#5 0x00002b2e76cdcb2a in _dl_start_user () from /lib64/ld-linux-x86-64.so.2
#6 0x0000000000000001 in ?? ()
#7 0x00007fffcc4b4bdd in ?? ()
#8 0x0000000000000000 in ?? ()
(gdb) up
#1 0x00002b2e76cf1365 in _dl_runtime_resolve () at ../sysdeps/x86_64/dl-trampoline.S:41
41 ../sysdeps/x86_64/dl-trampoline.S: No such file or directory.
in ../sysdeps/x86_64/dl-trampoline.S
(gdb) up
#2 0x00002b2e76efe71c in _init () at /mnt/data/b/build/slave/linux_lucid_x64_chromium_checkout/dynamorio/core/linux/preload.c:188
188 dynamorio_app_take_over();
(gdb) x/i $pc
=> 0x2b2e76efe71c <_init+28>: xor %eax,%eax
(gdb) x/i $pc - 5
0x2b2e76efe717 <_init+23>: callq 0x2b2e76efe660
(gdb) down
...
(gdb) frame 0
#0 _dl_fixup (l=0x2b2e76cfddc0, reloc_arg=) at ../elf/dl-runtime.c:115
115 ../elf/dl-runtime.c: No such file or directory.
in ../elf/dl-runtime.c
(gdb) x/i $pc
=> 0x2b2e76cea78e <_dl_fixup+174>: mov %fs:0x4c,%r13d
(gdb) info reg
rax 0x2b2e76efe3f8 47478563922936
rbx 0x1 1
rcx 0x4 4
rdx 0x0 0
rsi 0x2b2e76efe2d8 47478563922648
rdi 0x2b2e76cfddc0 47478561824192
rbp 0x2b2e76efe000 0x2b2e76efe000
rsp 0x7fffcc4b2e80 0x7fffcc4b2e80 r8 0x0 0 r9 0x71356000 1899323392 r10 0x6b 107 r11 0xff0 4080 r12 0x204010 2113552 r13 0x2b2e76cfddc0 47478561824192 r14 0x7fffcc4b2fb8 140736620867512 r15 0x2 2
rip 0x2b2e76cea78e 0x2b2e76cea78e <_dl_fixup+174>
eflags 0x10246 [ PF ZF IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x63 99
gs 0x6b 107

I need to do more debugging. I don't understand why that access is crashing, or why I can only reproduce it on this machine, on this binary, and only via buildbot (has different pty settings!?).

The steps that cause the problem kind of make sense:
- libdrpreload calls dynamorio_app_init
- we set private fs and gs segs (for mangle_app_seg and private_loader)
- libdrpreload calls dynamorio_app_takeover
- loader attempts to resolve the import and access fs segment, crashes

The output from the failed run:

The PC that it prints is truncated. That's a separate issue that needs fixing in the events.mc format string.

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=787_