search

moralismercatus / crete

Open source concolic testing tool for binaries
1 stars 1 forks source link

First TB inconsistent across iterations when using call stack monitoring #98

Open moralismercatus opened 9 years ago

moralismercatus commented 9 years ago

Testing echo with call-stack-bound=2 and filter-traces=true, eventually crete-dispatch will terminate with this assertion:

Assertion `trace[tv] == graph_[ev]' failed.

The assertion exists because, in my mind, the scenario should never happen. It doesn't make sense that the first TB should differ across executions.

Does it have something to do with interrupts? Always a likely culprit.

moralismercatus commented 9 years ago

So, the problem was introduced by the call stack monitoring mechanism; however, call stack monitoring wasn't the cause.

Before _cretestart() calls harness(), there is a TB after the call to _cretebegin(). Now, occasionally (seemingly arbitrarily), that TB is skipped, and the first TB is for harness().

This could be attributed to an interrupt, but why is that first TB (in _cretestart()) not captured/dumped? That is still a mystery.

The workaround for now is to place _cretestart() in the blacklist.