Re: [DynInst_API:] setting dyninst probes in firefox

[Stan Cox <scox@xxxxxxxxxx>]

On 3/30/20 10:28, Xiaozhu Meng wrote:

> The assertion shown in your dump is no longer in the dyninst master. I encountered that assertion a few month ago and have determined that it is not necessary to assert.
If I use upstream then the original assertion etc problem is avoided; 
but I see a different issue.
dyninst 10.1.0

% DYNINSTAPI_RT_LIB=/usr/lib64/dyninst/libdyninstAPI_RT.so mutator-pp.x 
-e /usr/lib64/firefox/firefox -f main -p 27726
Instruction jnle 0x9d(%rip)
type should be either COND_TAKEN or COND_NOT_TAKEN, but it is 5
From 4076d03 to 4076d03
mutator-pp.x: 
/builddir/build/BUILD/dyninst-10.1.0/dyninst-10.1.0/parseAPI/src/BoundFactCalculator.C:379: 
BoundFact* BoundFactsCalculator::Meet(Dyninst::Node::Ptr): Assertion `0' 
failed.
Aborted (core dumped)

dyninst upstream
(addr, which is set from decode, has a value that looks suspicious)

% LD_LIBRARY_PATH=/work/dyninst/install/lib 
DYNINSTAPI_RT_LIB=/work/dyninst/install/lib/libdyninstAPI_RT.so 
/usr/bin/gdb --args mutator-pp.x -e /usr/lib64/firefox/firefox -f main 
-p 27726
...
Thread 1 "mutator-pp.x" received signal SIGSEGV, Segmentation fault.
NS_x86::ia32_decode_prefixes (addr=addr@entry=0x0, instruct=..., 
mode_64=mode_64@entry=true)
    at /work/scox/dyninst/src/common/src/arch-x86.C:11333
11333	      switch(addr[0])
(gdb) #0  NS_x86::ia32_decode_prefixes (addr=addr@entry=0x0, 
instruct=..., mode_64=mode_64@entry=true)
    at /work/scox/dyninst/src/common/src/arch-x86.C:11333
#1  0x00007ffff6cd72f2 in NS_x86::ia32_decode (capa=capa@entry=1, 
addr=0x0, instruct=..., mode_64=true)
    at /work/scox/dyninst/src/common/src/arch-x86.C:9482
#2  0x00007ffff6e1ab8a in 
Dyninst::InstructionAPI::InstructionDecoder_x86::doIA32Decode 
(this=0x17def500, b=...)
    at 
/work/scox/dyninst/src/instructionAPI/src/InstructionDecoder-x86.C:1761
#3  0x00007ffff6e1af31 in 
Dyninst::InstructionAPI::InstructionDecoder_x86::decodeOpcode 
(this=0x17def500, b=...)
    at 
/work/scox/dyninst/src/instructionAPI/src/InstructionDecoder-x86.C:1819
#4  0x00007ffff6ecd3f9 in 
Dyninst::InstructionAPI::InstructionDecoderImpl::decode 
(this=0x17def500, b=...)
    at 
/work/scox/dyninst/src/instructionAPI/src/InstructionDecoderImpl.C:56
#5  0x00007ffff6e12aba in 
Dyninst::InstructionAPI::InstructionDecoder_x86::decode (this=<optimized 
out>, b=...)
    at 
/work/scox/dyninst/src/instructionAPI/src/InstructionDecoder-x86.C:1901
#6  0x00007ffff6e12900 in 
Dyninst::InstructionAPI::InstructionDecoder::decode 
(this=this@entry=0x17ded6c0)
    at /usr/include/boost/smart_ptr/shared_ptr.hpp:732
#7  0x00007ffff727b267 in Dyninst::InsnAdapter::IA_IAPI::reset 
(this=this@entry=0x17ded680, dec_=..., start=start@entry=34584,
    o=<optimized out>, r=r@entry=0x7fff3a710880, 
isrc=isrc@entry=0x17d78580, curBlk_=0x17df26b8)
    at /work/scox/dyninst/src/parseAPI/src/IA_IAPI.C:212
#8  0x00007ffff72489f7 in 
Dyninst::ParseAPI::Parser::parse_frame_one_iteration (this=0x17d6b9a0, 
frame=..., recursive=true)
    at /work/scox/dyninst/src/parseAPI/h/CFG.h:511
#9  0x00007ffff724a6cd in Dyninst::ParseAPI::Parser::parse_frame 
(this=0x17d6b9a0, frame=..., recursive=<optimized out>)
    at /work/scox/dyninst/src/parseAPI/src/Parser.C:1332
#10 0x00007ffff724aaa6 in Dyninst::ParseAPI::Parser::ProcessOneFrame 
(this=0x17d6b9a0, pf=0x17da8690, recursive=<optimized out>)
    at /work/scox/dyninst/src/parseAPI/src/Parser.C:452
#11 0x00007ffff724ab56 in Dyninst::ParseAPI::Parser::SpawnProcessFrame 
(this=0x17d6b9a0, pf=<optimized out>, recursive=true)
    at /work/scox/dyninst/src/parseAPI/src/Parser.C:645
#12 0x00007ffff724ab84 in 
Dyninst::ParseAPI::Parser::_ZN7Dyninst8ParseAPI6Parser10LaunchWorkEP17LockFreeQueueItemIPNS0_10ParseFrameEEb._omp_fn.0(void) 
() at /work/scox/dyninst/src/parseAPI/src/Parser.C:633
#13 0x00007ffff6be391c in ?? () from /lib64/libgomp.so.1
#14 0x00007ffff6bec5b4 in ?? () from /lib64/libgomp.so.1
#15 0x00007ffff6beaf0d in ?? () from /lib64/libgomp.so.1
#16 0x00007ffff72437c6 in Dyninst::ParseAPI::Parser::ProcessFrames 
(recursive=true, work_queue=<optimized out>,
    this=<optimized out>) at 
/work/scox/dyninst/src/parseAPI/src/Parser.C:669
#17 Dyninst::ParseAPI::Parser::parse_frames (this=0x17d6b9a0, work=..., 
recursive=true)
    at /work/scox/dyninst/src/parseAPI/src/Parser.C:681
#18 0x00007ffff72444bd in Dyninst::ParseAPI::Parser::parse_vanilla 
(this=<optimized out>)
    at /work/scox/dyninst/src/parseAPI/src/Parser.C:328
#19 0x00007ffff72446b0 in Dyninst::ParseAPI::Parser::parse 
(this=0x17d6b9a0) at /work/scox/dyninst/src/parseAPI/src/Parser.C:177
#20 0x00007ffff72630db in Dyninst::ParseAPI::CodeObject::parse 
(this=0x17d6b550)
    at /work/scox/dyninst/src/parseAPI/src/CodeObject.C:172
#21 0x00007ffff7e81347 in image::image (this=0x175da4d0, desc=..., 
err=<optimized out>, mode=BPatch_normalMode,
    parseGaps=<optimized out>) at 
/work/scox/dyninst/src/dyninstAPI/src/image.C:1581
#22 0x00007ffff7e81fa3 in image::parseImage (desc=..., 
mode=mode@entry=BPatch_normalMode, parseGaps=parseGaps@entry=true)
    at /work/scox/dyninst/src/dyninstAPI/src/image.C:1225
#23 0x00007ffff7e8f4d4 in mapped_object::createMappedObject (desc=..., 
p=0xddb6e0, analysisMode=BPatch_normalMode, parseGaps=true)
--Type <RET> for more, q to quit, c to continue without paging--
    at /work/scox/dyninst/src/dyninstAPI/src/mapped_object.C:155
#24 0x00007ffff7e8f9d6 in mapped_object::createMappedObject (lib=..., 
p=p@entry=0xddb6e0,
    analysisMode=analysisMode@entry=BPatch_normalMode, 
parseGaps=parseGaps@entry=true)
    at /work/scox/dyninst/src/dyninstAPI/src/mapped_object.C:137
#25 0x00007ffff7ebe615 in PCProcess::createInitialMappedObjects 
(this=0xddb6e0)
    at /work/scox/dyninst/src/dyninstAPI/src/dynProcess.C:614
#26 0x00007ffff7ebf05e in PCProcess::bootstrapProcess (this=0xddb6e0) at 
/work/scox/dyninst/src/dyninstAPI/src/dynProcess.C:359
#27 0x00007ffff7ec0d78 in PCProcess::attachProcess (progpath="", 
pid=pid@entry=27726,
    analysisMode=analysisMode@entry=BPatch_normalMode) at 
/work/scox/dyninst/src/dyninstAPI/src/dynProcess.C:159
#28 0x00007ffff7e0ccc9 in BPatch_process::BPatch_process (this=0x4be9b0, 
path=0x0, pid=27726, mode=BPatch_normalMode)
    at /work/scox/dyninst/src/dyninstAPI/src/BPatch_process.C:328
#29 0x00007ffff7dec638 in BPatch::processAttach (this=<optimized out>, 
path=0x0, pid=27726, mode=BPatch_normalMode)
    at /work/scox/dyninst/src/dyninstAPI/src/BPatch.C:1260
#30 0x00000000004056a0 in main (argc=7, argv=0x7fffffffdaf8) at 
mutator-pp.cpp:181
(gdb) fra
#1  0x00007ffff6cd72f2 in NS_x86::ia32_decode (capa=capa@entry=1, 
addr=0x0, instruct=..., mode_64=true)
    at /work/scox/dyninst/src/common/src/arch-x86.C:9482
9482	    if (!ia32_decode_prefixes(addr, instruct, mode_64))
(gdb) print addr
$1 = (const unsigned char *) 0x0

(gdb) fra 4
#4  0x00007ffff6ecd3f9 in 
Dyninst::InstructionAPI::InstructionDecoderImpl::decode 
(this=0x17def500, b=...)
    at 
/work/scox/dyninst/src/instructionAPI/src/InstructionDecoderImpl.C:56
56	            decodeOpcode(b);
(gdb) print b
$7 = (Dyninst::InstructionAPI::InstructionDecoder::buffer &) @0x17ded6c0: {
  start = 0x0,
  end = 0xd <error: Cannot access memory at address 0xd>
}