search

DynamoRIO / dynamorio

Dynamic Instrumentation Tool Platform
Other
2.68k stars 565 forks source link

CRASH (ui_tests fixup_last_cti targeter==NULL) #582

Open derekbruening opened 10 years ago

derekbruening commented 10 years ago

From bruen...@google.com on October 12, 2011 15:21:53

I believe this is while running this test but it's during full ui_tests suite under plain DR and sometimes the suite keeps going, will try to repro later:

[ RUN ] BookmarksUITest.CommandAgainGoesBackToBookmarksTab

this is under --single-process with issue #577 fixed

0:000> .exr 1af13ba8
ExceptionAddress: 01990e78 (dynamorio!fixup_last_cti+0x00000288)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 0000003c
Attempt to read from address 0000003c

0:000> .cxr 1af13bf8
eax=1af21c98 ebx=00000000 ecx=00000008 edx=373e38e0 esi=1af21c98 edi=00000000
eip=01990e78 esp=1af13ee0 ebp=00000000 iopl=0         nv up ei pl zr na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
dynamorio!fixup_last_cti+0x288:
01990e78 8b773c           mov     esi,[edi+0x3c]    ds:002b:0000003c=????????
0:000> kn
  **\* Stack trace for last set context - .thread/.cxr resets it
 # ChildEBP RetAddr  
00 1af13f18 01993e90 dynamorio!fixup_last_cti+0x288 [e:\src\dr\git\src\core\x86\interp.c @ 5298]
01 1af13f54 01965c30 dynamorio!extend_trace+0x60 [e:\src\dr\git\src\core\x86\interp.c @ 5655]
02 1af13f74 019660b5 dynamorio!internal_extend_trace+0xf0 [e:\src\dr\git\src\core\monitor.c @ 1746]
03 1af13fb4 0195a462 dynamorio!monitor_cache_enter+0x345 [e:\src\dr\git\src\core\monitor.c @ 2164]
04 1ae94800 0106e2d5 dynamorio!dispatch+0x182 [e:\src\dr\git\src\core\dispatch.c @ 169]

    instr_t *next = targeter->next;

so failed to find targeter

Original issue: http://code.google.com/p/dynamorio/issues/detail?id=582

derekbruening commented 10 years ago

From bruen...@google.com on October 20, 2011 08:48:34

ok, so we have a trace starting with the block at 0x149876ad. we're adding a 2nd block at 373e38e0. we haven't added it to the trace buffer yet, though! that's the problem: we've executed block 2 but never added it, and now our next_tag is for the 3rd block, yet we try to find a targeter in the 1st block.