app state recreate failure

[derekbruening]

From [email protected] on May 27, 2010 16:47:38

When running program with Umbra and EMS64 enabled, the client code may
cause SIGSEGV, and DR tries to re-create the app state.

However, if the SIGSEGV happens when a trace is being created, DR will
first abort the trace being built by calling trace_abort, which will delete
the code fragment (md->last_copy) that cause the SIGSEGV.
The call stack as below:
#0 0x00007fff5989b4bb in memset () from /lib/libc.so.6
#1 0x000000007107fca8 in fcache_remove_fragment (dcontext=0x4003a080,
f=0x404c18e0) at
/home/Workspace/DynamoRIO/dynamorio-read-only/core/fcache.c:3640
#2 0x000000007105d42d in fragment_delete (dcontext=0x4003a080,
f=0x404c18e0, actions=36) at
/home/Workspace/DynamoRIO/dynamorio-read-only/core/fragment.c:3166
#3 0x000000007110282d in delete_private_copy (dcontext=0x4003a080) at
/home/DynamoRIO/dynamorio-read-only/core/monitor.c:134
#4 0x0000000071102b88 in trace_abort (dcontext=0x4003a080) at
/home/DynamoRIO/dynamorio-read-only/core/monitor.c:2443
#5 0x0000000071197360 in master_signal_handler_C (sig=11, siginfo=, ucxt=0x4005a170, xsp=) at
/home/DynamoRIO/dynamorio-read-only/core/linux/signal.c:3615
#6 0x0000000071179110 in syscall_ready () from
/home/DynamoRIO/dynamorio-read-only/exports/lib64/debug/libdynamorio.so

Later when DR tries to re-create the app state, the fragment cannot be
found, and recreation failed.
The app state recreate call stack:

#0 recreate_app_state_internal (tdcontext=0x4003a080, mcontext=0x40059c20,
just_pc=0, owning_f=0x0, restore_memory=1) at
/home/DynamoRIO/dynamorio-read-only/core/x86/arch.c:3002
#1 0x00000000711338f7 in recreate_app_state (tdcontext=0x4003a080,
mcontext=0x40059c20, restore_memory=1) at
/home/DynamoRIO/dynamorio-read-only/core/x86/arch.c:3215
#2 0x000000007112a454 in translate_mcontext (trec=0x40006218,
mcontext=0x40059c20, restore_memory=1) at
/home/DynamoRIO/dynamorio-read-only/core/synch.c:373
#3 0x00000000711905e4 in translate_sigcontext (dcontext=0x4003a080,
sc=0x4005a198) at /home/DynamoRIO/dynamorio-read-only/core/linux/signal.c:2205
#4 0x00000000711930e8 in record_pending_signal (dcontext=0x4003a080,
sig=11, ucxt=0x4005a170, frame=0x4005a168, forged=0,
access_address=0xffff9b030060c6c0 <Address 0xffff9b030060c6c0 out of
bounds>) at /home/DynamoRIO/dynamorio-read-only/core/linux/signal.c:3011
#5 0x0000000071197382 in master_signal_handler_C (sig=11, siginfo=, ucxt=0x4005a170, xsp=) at
/home/DynamoRIO/dynamorio-read-only/core/linux/signal.c:3617
#6 0x0000000071179110 in syscall_ready () from
/home/DynamoRIO/dynamorio-read-only/exports/lib64/debug/libdynamorio.so

Error message as below:

<Application BARNES (4445). Internal Error Internal DynamoRIO Error:
/home/DynamoRIO/dynamorio-read-only/core/synch.c:379
version 1.6.0, build 18
-client_lib '/home/Umbra/umbra-master/build/bin/libumbra.so;0;' -code_api
-max_elide_jmp 0 -max_elide_call 0 -no_shared_bbs -no_shared_traces
-thread_priv
0x0000000040059a80 0x00000000710a52fc
0x0000000040059bd0 0x000000007112a4cc
0x0000000040059c10 0x00000000711905e4
0x0000000040059dd0 0x00000000711930e8
0x0000000040059ff0 0x0000000071197382
0x000000004005a160 0x0000000071179110
0x000000000060b620 0x0000000000000000>

Original issue: http://code.google.com/p/dynamorio/issues/detail?id=307

[derekbruening]

From [email protected] on July 08, 2010 12:17:03

this looks like a regression caused by r298 's re-ordering of thread exit routines