Package FuzzManager :: Package FTB :: Package Signatures :: Module tests
[hide private]
[frames] | no frames]

Source Code for Module FuzzManager.FTB.Signatures.tests

  1  ''' 
  2  Tests 
  3   
  4  @author:     Christian Holler (:decoder) 
  5   
  6  @license: 
  7   
  8  This Source Code Form is subject to the terms of the Mozilla Public 
  9  License, v. 2.0. If a copy of the MPL was not distributed with this 
 10  file, You can obtain one at http://mozilla.org/MPL/2.0/. 
 11   
 12  @contact:    choller@mozilla.com 
 13  ''' 
 14  import unittest 
 15  from FTB.Signatures.CrashInfo import ASanCrashInfo, GDBCrashInfo, CrashInfo,\ 
 16      NoCrashInfo, MinidumpCrashInfo, AppleCrashInfo 
 17  from FTB.Signatures.CrashSignature import CrashSignature 
 18  from FTB.Signatures import RegisterHelper 
 19   
 20  from numpy import int64, uint64, int32, uint32 
 21  from FTB.ProgramConfiguration import ProgramConfiguration 
 22   
 23  asanTraceCrash = """ 
 24  ASAN:SIGSEGV 
 25  ================================================================= 
 26  ==5854==ERROR: AddressSanitizer: SEGV on unknown address 0x00000014 (pc 0x0810845f sp 0xffc57860 bp 0xffc57f18 T0) 
 27      #0 0x810845e in js::AbstractFramePtr::asRematerializedFrame() const /srv/repos/mozilla-central/js/src/shell/../jit/RematerializedFrame.h:114 
 28      #1 0x810845e in js::AbstractFramePtr::script() const /srv/repos/mozilla-central/js/src/shell/../vm/Stack-inl.h:572 
 29      #2 0x810845e in EvalInFrame(JSContext*, unsigned int, JS::Value*) /srv/repos/mozilla-central/js/src/shell/js.cpp:2655 
 30      #3 0x93f5b92 in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) /srv/repos/mozilla-central/js/src/jscntxtinlines.h:231 
 31      #4 0x93f5b92 in js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) /srv/repos/mozilla-central/js/src/vm/Interpreter.cpp:484 
 32      #5 0x9346ba7 in js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) /srv/repos/mozilla-central/js/src/vm/Interpreter.cpp:540 
 33      #6 0x8702baa in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /srv/repos/mozilla-central/js/src/jit/BaselineIC.cpp:8638 
 34   
 35  AddressSanitizer can not provide additional info. 
 36  SUMMARY: AddressSanitizer: SEGV /srv/repos/mozilla-central/js/src/shell/../jit/RematerializedFrame.h:114 js::AbstractFramePtr::asRematerializedFrame() const 
 37  ==5854==ABORTING 
 38  """ 
 39   
 40  asanTraceHeapCrash = """ 
 41  ASAN:SIGSEGV 
 42  ================================================================= 
 43  ==11923==ERROR: AddressSanitizer: SEGV on unknown address 0x00000019 (pc 0xf718072e sp 0xff87d130 bp 0x000006a1 T0) 
 44   
 45  AddressSanitizer can not provide additional info. 
 46  SUMMARY: AddressSanitizer: SEGV ??:0 ?? 
 47  ==11923==ABORTING 
 48  """ 
 49   
 50  asanTraceUAF = """ 
 51  ==19462==ERROR: AddressSanitizer: heap-use-after-free on address 0x7fd766c42800 at pc 0xe1f587 bp 0x7fffcb1b6ed0 sp 0x7fffcb1b6ec8 
 52  READ of size 6143520 at 0x7fd766c42800 thread T0 
 53      #0 0xe1f586 in void mozilla::PodCopy<char16_t>(char16_t*, char16_t const*, unsigned long) /srv/repos/mozilla-central/js/src/opt64asan/js/src/../../dist/include/mozilla/PodOperations.h:110 
 54      #1 0x5904e2 in js::frontend::CompileScript(js::ExclusiveContext*, js::LifoAlloc*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::ReadOnlyCompileOptions const&, char16_t const*, unsigned long, JSString*, unsigned int, js::SourceCompressionTask*) /srv/repos/mozilla-central/js/src/frontend/BytecodeCompiler.cpp:215 
 55      #2 0xc7eb8d in JS::Compile(JSContext*, JS::Handle<JSObject*>, JS::ReadOnlyCompileOptions const&, char16_t const*, unsigned long) /srv/repos/mozilla-central/js/src/jsapi.cpp:4478 
 56      #3 0x4f63a6 in Run(JSContext*, unsigned int, JS::Value*) /srv/repos/mozilla-central/js/src/shell/js.cpp:1193 
 57      #4 0xf8eb1b in JSFunction::native() const /srv/repos/mozilla-central/js/src/jscntxtinlines.h:220 
 58      #5 0xf377c8 in js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /srv/repos/mozilla-central/js/src/vm/Interpreter.cpp:521 
 59      #6 0x82e98a in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /srv/repos/mozilla-central/js/src/jit/BaselineIC.cpp:8103 
 60      #7 0x7fd76b2b1323 in 
 61  0x7fd766c42800 is located 0 bytes inside of 6143522-byte region [0x7fd766c42800,0x7fd76721e622) 
 62  freed by thread T0 here: 
 63      #0 0x4c6855 in __interceptor_free _asan_rtl_ 
 64      #1 0xf0f898 in js_free(void*) /srv/repos/mozilla-central/js/src/opt64asan/js/src/../../dist/include/js/Utility.h:167 
 65      #2 0xd18c5d in _ZL19FinalizeTypedArenasI8JSStringEbPN2js6FreeOpEPPNS1_2gc11ArenaHeaderERNS4_9ArenaListENS4_9AllocKindERNS1_11SliceBudgetE /srv/repos/mozilla-central/js/src/jsgc.cpp:540 
 66      #3 0xec61f6 in js::gc::ArenaLists::backgroundFinalize(js::FreeOp*, js::gc::ArenaHeader*, bool) /srv/repos/mozilla-central/js/src/jsgc.cpp:1539 
 67      #4 0xebbaf7 in GCCycle(JSRuntime*, bool, long, js::JSGCInvocationKind, JS::gcreason::Reason) /srv/repos/mozilla-central/js/src/jsgc.cpp:4786 
 68  previously allocated by thread T0 here: 
 69      #0 0x4c6995 in __interceptor_malloc _asan_rtl_ 
 70      #1 0xeeed65 in js_malloc(unsigned long) /srv/repos/mozilla-central/js/src/opt64asan/js/src/../../dist/include/js/Utility.h:144 
 71      #2 0x4ff625 in FileAsString(JSContext*, char const*) /srv/repos/mozilla-central/js/src/shell/js.cpp:1104 
 72      #3 0x4f61a0 in Run(JSContext*, unsigned int, JS::Value*) /srv/repos/mozilla-central/js/src/shell/js.cpp:1176 
 73      #4 0xf8eb1b in JSFunction::native() const /srv/repos/mozilla-central/js/src/jscntxtinlines.h:220 
 74      #5 0xf377c8 in js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /srv/repos/mozilla-central/js/src/vm/Interpreter.cpp:521 
 75      #6 0x82e98a in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /srv/repos/mozilla-central/js/src/jit/BaselineIC.cpp:8103 
 76      #7 0x7fd76b2b1323 in 
 77      #8 0x61100032da17 in 
 78      #9 0x7fd76b2aa503 in 
 79  Shadow bytes around the buggy address: 
 80    0x0ffb6cd804b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 
 81    0x0ffb6cd804c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 
 82    0x0ffb6cd804d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 
 83    0x0ffb6cd804e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 
 84    0x0ffb6cd804f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 
 85  =>0x0ffb6cd80500:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 
 86    0x0ffb6cd80510: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 
 87    0x0ffb6cd80520: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 
 88    0x0ffb6cd80530: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 
 89    0x0ffb6cd80540: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 
 90    0x0ffb6cd80550: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 
 91  Shadow byte legend (one shadow byte represents 8 application bytes): 
 92    Addressable:           00 
 93    Partially addressable: 01 02 03 04 05 06 07 
 94    Heap left redzone:     fa 
 95    Heap right redzone:    fb 
 96    Freed heap region:     fd 
 97    Stack left redzone:    f1 
 98    Stack mid redzone:     f2 
 99    Stack right redzone:   f3 
100    Stack partial redzone: f4 
101    Stack after return:    f5 
102    Stack use after scope: f8 
103    Global redzone:        f9 
104    Global init order:     f6 
105    Poisoned by user:      f7 
106    ASan internal:         fe 
107  ==19462==ABORTING 
108  """ 
109   
110  gdbCrashAddress1 = """ 
111  (gdb) bt 16  
112  #0  js::types::TypeObject::addProperty (this=0xf7469400, cx=0x9366458, id=$jsid(0x0), pprop=0xf7469418) at /srv/repos/mozilla-central/js/src/jsinfer.cpp:3691  
113  (More stack frames follow...)  
114  (gdb) info reg  
115  eax            0x1      1 
116  ecx            0x1      1 
117  (gdb) x /i $pc  
118  => 0x812bf19 <js::types::TypeObject::addProperty(JSContext*, jsid, js::types::Property**)+121>: mov    (%ecx),%ecx 
119  """ 
120      
121  gdbCrashAddress2 = """ 
122  Program terminated with signal 11, Segmentation fault.  
123  #0  repoint (this=0x160fc30, cx=0x15a4940, masm=..., attacher=..., ion=0x160fa80, attachKind=0x2b08c0 \"generic\") at /srv/repos/mozilla-central/js/src/ion/IonCaches.cpp:44  
124  #1  CodeLocationJump (this=0x160fc30, cx=0x15a4940, masm=..., attacher=..., ion=0x160fa80, attachKind=0x2b08c0 \"generic\") at ../ion/shared/Assembler-shared.h:452  
125  r0      0x34    52  
126  r4      0x15a4940       22694208  
127  r10     0x0     0  
128  sp      0xbe9fec08      3198151688  
129  pc      0x1a03ae <js::ion::IonCache::linkAndAttachStub(JSContext*, js::ion::MacroAssembler&, js::ion::IonCache::StubAttacher&, js::ion::IonScript*, char const*)+122>  
130  cpsr    0xd0030 852016  
131  => 0x1a03ae <js::ion::IonCache::linkAndAttachStub(JSContext*, js::ion::MacroAssembler&, js::ion::IonCache::StubAttacher&, js::ion::IonScript*, char const*)+122>:       ldr.w   r4, [r10]  
132     0x1a03b2 <js::ion::IonCache::linkAndAttachStub(JSContext*, js::ion::MacroAssembler&, js::ion::IonCache::StubAttacher&, js::ion::IonScript*, char const*)+126>:       mov     r3, r0 
133  """ 
134      
135  gdbCrashAddress3 = """        
136  (gdb) bt 16  
137  #0  js::types::TypeObject::addProperty (this=0xf7469400, cx=0x9366458, id=$jsid(0x0), pprop=0xf7469418) at /srv/repos/mozilla-central/js/src/jsinfer.cpp:3691  
138  (More stack frames follow...)  
139  (gdb) info reg  
140  rax            0x1      1 
141  rdx            0x1      1 
142  rbx            0x1      1 
143  (gdb) x /i $pc  
144  => 0x812bf19 <js::types::TypeObject::addProperty(JSContext*, jsid, js::types::Property**)+121>: shrb   -0x69(%rdx,%rbx,8) 
145  """ 
146   
147  gdbSampleTrace1 = """ 
148  [New Thread 14711] 
149  [Thread debugging using libthread_db enabled] 
150  Core was generated by `/srv/repos/ionmonkey/js/src/opt32/js --ion -n -m --ion-eager -f /home/ownhero/h'. 
151  Program terminated with signal 11, Segmentation fault. 
152  #0  0x083fa060 in internalAppend<js::ion::MDefinition*> (this=0x847e4e8, ins=0x9e2ced0) at ./dist/include/js/Vector.h:790 
153  790         new(endNoCheck()) T(t); 
154  #0  0x083fa060 in internalAppend<js::ion::MDefinition*> (this=0x847e4e8, ins=0x9e2ced0) at ./dist/include/js/Vector.h:790 
155  #1  append<js::ion::MDefinition*> (this=0x847e4e8, ins=0x9e2ced0) at ./dist/include/js/Vector.h:779 
156  #2  js::ion::MPhi::addInput (this=0x847e4e8, ins=0x9e2ced0) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/MIR.cpp:456 
157  #3  0x0838ad1c in js::ion::MBasicBlock::setBackedge (this=0x9d4a630, pred=0x9e2d0a8) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/MIRGraph.cpp:661 
158  #4  0x0833ea08 in js::ion::IonBuilder::finishLoop (this=0xffdef8e0, state=..., successor=0x9e2d280) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonBuilder.cpp:1303 
159  #5  0x0833eb47 in js::ion::IonBuilder::processForUpdateEnd (this=0xffdef8e0, state=...) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonBuilder.cpp:1476 
160  #6  0x08350ac0 in processCfgStack (this=0xffdef8e0) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonBuilder.cpp:1104 
161  #7  js::ion::IonBuilder::traverseBytecode (this=0xffdef8e0) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonBuilder.cpp:627 
162  eax    0x0    0 
163  ebx    0x8962ff4    144060404 
164  ecx    0xf76038ac    -144688980 
165  edx    0x0    0 
166  esi    0xf7602d9c    -144691812 
167  edi    0x0    0 
168  ebp    0xff916fb8    4287721400 
169  esp    0xff916ed0    4287721168 
170  eip    0x818bc33 <js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct)+419> 
171  => 0x818bc33 <js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct)+419>:    movl   $0x7b,0x0 
172     0x818bc3d <js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct)+429>:    call   0x804af50 <abort@plt> 
173  """ 
174           
175  gdbSampleTrace2 = """ 
176  Program terminated with signal 11, Segmentation fault. 
177  #0  operator+ (this=0xf6c7e760, cx=0xa3024b8, iv=..., useLocale=false, buffer=..., sb=...) at ../gc/Barrier.h:462 
178  462         HeapSlotArray operator +(uint32_t offset) const { return HeapSlotArray(array + offset); } 
179  #0  operator+ (this=0xf6c7e760, cx=0xa3024b8, iv=..., useLocale=false, buffer=..., sb=...) at ../gc/Barrier.h:462 
180  #1  js::ParallelArrayObject::toStringBufferImpl (this=0xf6c7e760, cx=0xa3024b8, iv=..., useLocale=false, buffer=..., sb=...) at /srv/repos/mozilla-central/js/src/builtin/ParallelArray.cpp:1521 
181  #2  0x081d0379 in js::ParallelArrayObject::toStringBuffer (this=0xf6c7e760, cx=0xa3024b8, useLocale=false, sb=...) at /srv/repos/mozilla-central/js/src/builtin/ParallelArray.cpp:1566 
182  #3  0x081d05b3 in js::ParallelArrayObject::toString (cx=0xa3024b8, args=...) at /srv/repos/mozilla-central/js/src/builtin/ParallelArray.cpp:1573 
183  #4  0x081d06be in CallNonGenericMethod (cx=0xa3024b8, argc=0, vp=0xf6ee2150) at ../jsapi.h:1570 
184  #5  NonGenericMethod<js::ParallelArrayObject::toString> (cx=0xa3024b8, argc=0, vp=0xf6ee2150) at /srv/repos/mozilla-central/js/src/builtin/ParallelArray.cpp:163 
185  #6  0x080d8dd8 in CallJSNative (cx=0xa3024b8, args=..., construct=js::NO_CONSTRUCT) at ../jscntxtinlines.h:389 
186  #7  PropertyAccess<(PropertyAccessKind)1> (cx=0xa3024b8, args=..., construct=js::NO_CONSTRUCT) at /srv/repos/mozilla-central/js/src/jsinterp.cpp:351 
187  rbx            0x1      1 
188  r14            0x1      1 
189  => 0x7f01fffecf41:    mov    0x8(%r14),%rbx 
190     0x7f01fffecf45:    cmp    %rbx,0x18(%rdi) 
191  """ 
192   
193  gdbSampleTrace3 = """ 
194  Program terminated with signal 11, Segmentation fault. 
195  #0  0x083ba5a9 in AssertCanGC () at /srv/repos/ionmonkey/js/src/gc/Root.h:1029 
196  1029        JS_ASSERT_IF(isGCEnabled(), !InNoGCScope()); 
197  #0  0x083ba5a9 in AssertCanGC () at /srv/repos/ionmonkey/js/src/gc/Root.h:1029 
198  #1  js::gc::NewGCThing<JSString, (js::AllowGC)1> (cx=0x9224850, kind=js::gc::FINALIZE_STRING, thingSize=16, heap=js::gc::TenuredHeap) at ../jsgcinlines.h:491 
199  #2  0x083b205d in js_NewGCString<(js::AllowGC)1> (cx=0x9224850) at ../jsgcinlines.h:578 
200  #3  0x08508069 in new_<(js::AllowGC)1> (length=33, right=\"result: \", left=\"\\njstest: undefined bug:  \", cx=0x9224850) at /srv/repos/ionmonkey/js/src/vm/String-inl.h:194 
201  #4  js::ConcatStrings<(js::AllowGC)1> (cx=0x9224850,: left=\"\\njstest: undefined bug:  \", right=\"result: \") at /srv/repos/ionmonkey/js/src/vm/String.cpp:339 
202  #5  0x08780467 in js::ion::DoConcatStrings (cx=0x9224850, lhs=$jsval(-nan(0xfff85f6bb4ff0)), rhs=$jsval(-nan(0xfff85f6c194e0)), res=$jsval(-nan(0xfff8200000000))) at /srv/repos/ionmonkey/js/src/ion/BaselineIC.cpp:2037 
203  #6  0xf772685f in ?? () 
204  #7  0xf772bb76 in ?? () 
205  """ 
206   
207  gdbRegressionTrace1 = """ 
208  Program received signal SIGSEGV, Segmentation fault. 
209  js::ScriptedIndirectProxyHandler::defineProperty (this=0x930fad4, cx=0x9339130, proxy=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), desc={obj = (JSObject *) 0xf6247040 [object Proxy], attrs = 61524, getter = 0xf6700120, setter = 0, value = $jsval(-nan(0xfff88f62460d0))}) at /srv/repos/mozilla-central/js/src/proxy/ScriptedIndirectProxyHandler.cpp:201 
210  201         RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy)); 
211  #0  js::ScriptedIndirectProxyHandler::defineProperty (this=0x930fad4, cx=0x9339130, proxy=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), desc={obj = (JSObject *) 0xf6247040 [object Proxy], attrs = 61524, getter = 0xf6700120, setter = 0, value = $jsval(-nan(0xfff88f62460d0))}) at /srv/repos/mozilla-central/js/src/proxy/ScriptedIndirectProxyHandler.cpp:201 
212  #1  0x084ac820 in js::SetPropertyIgnoringNamedGetter (cx=0x9339130, handler=0x930fad4, proxy=(JSObject * const) 0xf6247040 [object Proxy], receiver=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), desc={obj = (JSObject *) 0xf6247040 [object Proxy], attrs = 61524, getter = 0xf6700120, setter = 0, value = $jsval(-nan(0xfff88f62460d0))}, descIsOwn=true, strict=false, vp=$jsval(-nan(0xfff88f62460d0))) at /srv/repos/mozilla-central/js/src/proxy/BaseProxyHandler.cpp:186 
213  #2  0x084b0677 in js::ScriptedIndirectProxyHandler::derivedSet (this=0x930fad4, cx=0x9339130, proxy=(JSObject * const) 0xf6247040 [object Proxy], receiver=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), strict=false, vp=$jsval(-nan(0xfff88f62460d0))) at /srv/repos/mozilla-central/js/src/proxy/ScriptedIndirectProxyHandler.cpp:311 
214  #3  0x084b08a8 in js::ScriptedIndirectProxyHandler::set (this=0x930fad4, cx=0x9339130, proxy=(JSObject * const) 0xf6247040 [object Proxy], receiver=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), strict=false, vp=$jsval(-nan(0xfff88f62460d0))) at /srv/repos/mozilla-central/js/src/proxy/ScriptedIndirectProxyHandler.cpp:290 
215  #4  0x084aeb59 in js::Proxy::set (cx=0x9339130, proxy=(JSObject * const) 0xf6247040 [object Proxy], receiver=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), strict=false, vp=$jsval(-nan(0xfff88f62460d0))) at /srv/repos/mozilla-central/js/src/proxy/Proxy.cpp:336 
216  #5  0x08535ec0 in setGeneric (strict=<optimized out>, vp=..., id=..., receiver=..., obj=(JSObject * const) 0xf6247040 [object Proxy], cx=0x9339130) at /srv/repos/mozilla-central/js/src/vm/NativeObject.h:1428 
217  #6  js::baseops::SetPropertyHelper<(js::ExecutionMode)0> (cxArg=0x9339130, obj=(js::NativeObject * const) 0xf6700050 [object Array], receiver=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), qualified=js::baseops::Qualified, vp=$jsval(-nan(0xfff88f62460d0)), strict=false) at /srv/repos/mozilla-central/js/src/vm/NativeObject.cpp:2353 
218  #7  0x08519490 in setGeneric (strict=false, vp=..., id=..., receiver=..., obj=(JSObject * const) 0xf6700050 [object Array], cx=0x9339130) at /srv/repos/mozilla-central/js/src/vm/NativeObject.h:1430 
219  """ 
220   
221  gdbRegressionTrace2 = """ 
222  Program received signal SIGSEGV, Segmentation fault. 
223  0xf7673132 in ?? () 
224  #0  0xf7673132 in ?? () 
225  eax            0xf6043040    -167497664 
226  ecx            0xf651f4b0    -162401104 
227  edx            0xf651f4d0    -162401072 
228  ebx            0xf651f4f0    -162401040 
229  esp            0xfffd573c    0xfffd573c 
230  ebp            0xfffd57e4    0xfffd57e4 
231  esi            0x0    0 
232  edi            0x934d3d0    154457040 
233  eip            0xf7673132    0xf7673132 
234  => 0xf7673132:    vmovaps %xmm1,0x60(%esp) 
235  """ 
236   
237  gdbRegressionTrace3 = """ 
238  Program received signal SIGTRAP, Trace/breakpoint trap. 
239  0x00007ffff5573368 in ?? () 
240  #0  0x00007ffff5573368 in ?? () 
241  #1  0x00007ffff558a9c9 in ?? () 
242  #2  0x0000000000000183 in ?? () 
243  #3  0x00007ffff5671ac0 in ?? () 
244  #4  0x0000000000000000 in ?? () 
245  rax    0x1ac4d40    28069184 
246  rbx    0x7ffff5658730    140737310459696 
247  rcx    0xfff9000000000000    -1970324836974592 
248  rdx    0xfffc7ffff5700060    -985162595696544 
249  rsi    0x7ffff55efa4d    140737310030413 
250  rdi    0x1acfa60    28113504 
251  rbp    0x7fffffffbf20    140737488338720 
252  rsp    0x7fffffffbf28    140737488338728 
253  r8    0x7ffff565b060    140737310470240 
254  r9    0x0    0 
255  r10    0x0    0 
256  r11    0x7ffff6c3fc90    140737333427344 
257  r12    0x0    0 
258  r13    0x7fffffffca00    140737488341504 
259  r14    0x183    387 
260  r15    0x7ffff558a970    140737309616496 
261  rip    0x7ffff5573368    140737309520744 
262  => 0x7ffff5573368:    movabs $0x7fffffffffff,%rbx 
263     0x7ffff5573372:    and    0xa08(%rax),%rbx 
264  """ 
265   
266  gdbRegressionTrace4 = """ 
267  Program received signal SIGSEGV, Segmentation fault. 
268  0x0000000000000000 in ?? () 
269  #0  0x0000000000000000 in ?? () 
270  #1 0xfffc7ffff7e8a6c0 in ?? () 
271  #2 0x000000000043026c in js::jit::IonCompile (cx=0xfffc7ffff7e766c0, script=<optimized out>, baselineFrame=<optimized out>, osrPc=<optimized out>, constructing=<optimized out>, recompile=<optimized out>, optimizationLevel=js::jit::Optimization_DontCompile) at /home/ownhero/homes/mozilla/repos/mozilla-central/js/src/jit/Ion.cpp:2253 
272  #3 0x00007ffff7e61160 in ?? () 
273  #4 0x0000000000000000 in ?? () 
274  rax    0x0    0 
275  rbx    0xfffc7ffff7e766c0    -985162554317120 
276  rcx    0x7fffffffd6c0    140737488344768 
277  rdx    0x7ffff6907050    140737330049104 
278  rsi    0x0    0 
279  rdi    0x7ffff6a00048    140737331069000 
280  rbp    0x7fffffffd270    140737488343664 
281  rsp    0x7fffffffd240    140737488343616 
282  r8    0x0    0 
283  r9    0xffffc000    4294950912 
284  r10    0x46000    286720 
285  r11    0x7ffff6a00121    140737331069217 
286  r12    0x8    8 
287  r13    0x7fffffffd6f0    140737488344816 
288  r14    0x1    1 
289  r15    0x7ffff6914800    140737330104320 
290  rip    0x0    0 
291  => 0x0:     
292  """ 
293   
294  ubsanSampleTrace1 = """ 
295  codec/decoder/core/inc/dec_golomb.h:182:37: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' 
296      #0 0x51353a in WelsDec::BsGetUe(WelsCommon::TagBitStringAux*, unsigned int*) /home/user/code/openh264/./codec/decoder/core/inc/dec_golomb.h:182:37 
297      #1 0x51a11b in WelsDec::ParseSliceHeaderSyntaxs(WelsDec::TagWelsDecoderContext*, WelsCommon::TagBitStringAux*, bool) /home/user/code/openh264/codec/decoder/core/src/decoder_core.cpp:692:3 
298      #2 0x59f649 in WelsDec::ParseNalHeader(WelsDec::TagWelsDecoderContext*, WelsCommon::TagNalUnitHeader*, unsigned char*, int, unsigned char*, int, int*) /home/user/code/openh264/codec/decoder/core/src/au_parser.cpp:392:12 
299      #3 0x50d2fe in WelsDecodeBs /home/user/code/openh264/codec/decoder/core/src/decoder.cpp:749:19 
300      #4 0x4f3553 in WelsDec::CWelsDecoder::DecodeFrame2(unsigned char const*, int, unsigned char**, TagBufferInfo*) /home/user/code/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:502:3 
301      #5 0x4f249f in WelsDec::CWelsDecoder::DecodeFrameNoDelay(unsigned char const*, int, unsigned char**, TagBufferInfo*) /home/user/code/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:438:16 
302      #6 0x4e719f in H264DecodeInstance(ISVCDecoder*, char const*, char const*, int&, int&, char const*, char const*) /home/user/code/openh264/codec/console/dec/src/h264dec.cpp:218:5 
303      #7 0x4e8630 in main /home/user/code/openh264/codec/console/dec/src/h264dec.cpp:358:5 
304      #8 0x7fe1d5eb7ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287 
305      #9 0x41beb5 in _start (/home/user/Desktop/openh264/h264dec_64_ub_asan+0x41beb5) 
306      #10 0x0 in mozilla::image::nsBMPDecoder::WriteInternal(char const*, unsigned int)::$_0::operator()(mozilla::image::nsBMPDecoder::State, char const*, unsigned long) const /test.cpp:1:1  
307      #11 0x0 in Lex<<lambda at /builds/slave/m-in-l64-asan-0000000000000000/build/src/image/decoders/nsBMPDecoder.cpp:346:33> > /test.cpp:1:1 
308   
309  SUMMARY: AddressSanitizer: undefined-behavior codec/decoder/core/inc/dec_golomb.h:182:37 in  
310  """ 
311   
312 -class ASanParserTestCrash(unittest.TestCase):
313 - def runTest(self):
314 config = ProgramConfiguration("test", "x86", "linux") 315 316 crashInfo = ASanCrashInfo([], asanTraceCrash.splitlines(), config) 317 self.assertEqual(len(crashInfo.backtrace), 7) 318 self.assertEqual(crashInfo.backtrace[0], "js::AbstractFramePtr::asRematerializedFrame") 319 self.assertEqual(crashInfo.backtrace[2], "EvalInFrame") 320 self.assertEqual(crashInfo.backtrace[3], "js::CallJSNative") 321 self.assertEqual(crashInfo.backtrace[6], "js::jit::DoCallFallback") 322 323 self.assertEqual(crashInfo.crashAddress, 0x00000014L) 324 self.assertEqual(crashInfo.registers["pc"], 0x0810845fL) 325 self.assertEqual(crashInfo.registers["sp"], 0xffc57860L) 326 self.assertEqual(crashInfo.registers["bp"], 0xffc57f18L)
327
328 -class ASanParserTestHeapCrash(unittest.TestCase):
329 - def runTest(self):
330 config = ProgramConfiguration("test", "x86", "linux") 331 332 crashInfo = ASanCrashInfo([], asanTraceHeapCrash.splitlines(), config) 333 self.assertEqual(len(crashInfo.backtrace), 1) 334 335 self.assertEqual(crashInfo.crashAddress, 0x00000019L) 336 self.assertEqual(crashInfo.registers["pc"], 0xf718072eL) 337 self.assertEqual(crashInfo.registers["sp"], 0xff87d130L) 338 self.assertEqual(crashInfo.registers["bp"], 0x000006a1L) 339 340 self.assertEqual(crashInfo.createShortSignature(), "[@ ??]")
341
342 -class ASanParserTestUAF(unittest.TestCase):
343 - def runTest(self):
344 config = ProgramConfiguration("test", "x86-64", "linux") 345 346 crashInfo = ASanCrashInfo([], asanTraceUAF.splitlines(), config) 347 self.assertEqual(len(crashInfo.backtrace), 23) 348 self.assertEqual(crashInfo.backtrace[0], "void mozilla::PodCopy<char16_t>") 349 self.assertEqual(crashInfo.backtrace[4], "JSFunction::native") 350 351 self.assertEqual(crashInfo.crashAddress, 0x7fd766c42800L)
352
353 -class ASanDetectionTest(unittest.TestCase):
354 - def runTest(self):
355 config = ProgramConfiguration("test", "x86", "linux") 356 357 crashInfo1 = CrashInfo.fromRawCrashData([], [], config, auxCrashData=asanTraceCrash.splitlines()) 358 crashInfo2 = CrashInfo.fromRawCrashData([], asanTraceUAF.splitlines(), config) 359 360 self.assertIsInstance(crashInfo1, ASanCrashInfo) 361 self.assertIsInstance(crashInfo2, ASanCrashInfo)
362
363 -class GDBParserTestCrash(unittest.TestCase):
364 - def runTest(self):
365 config = ProgramConfiguration("test", "x86", "linux") 366 367 crashInfo = GDBCrashInfo([], gdbSampleTrace1.splitlines(), config) 368 self.assertEqual(len(crashInfo.backtrace), 8) 369 self.assertEqual(crashInfo.backtrace[0], "internalAppend<js::ion::MDefinition*>") 370 self.assertEqual(crashInfo.backtrace[2], "js::ion::MPhi::addInput") 371 self.assertEqual(crashInfo.backtrace[6], "processCfgStack") 372 373 self.assertEqual(crashInfo.registers["eax"], 0x0L) 374 self.assertEqual(crashInfo.registers["ebx"], 0x8962ff4L) 375 self.assertEqual(crashInfo.registers["eip"], 0x818bc33L)
376
377 -class GDBParserTestCrashAddress(unittest.TestCase):
378 - def runTest(self):
379 config = ProgramConfiguration("test", "x86-64", "linux") 380 381 crashInfo1 = GDBCrashInfo([], gdbCrashAddress1.splitlines(), config) 382 crashInfo2 = GDBCrashInfo([], gdbCrashAddress2.splitlines(), config) 383 crashInfo3 = GDBCrashInfo([], gdbCrashAddress3.splitlines(), config) 384 385 self.assertEqual(crashInfo1.crashAddress, 0x1L) 386 self.assertEqual(crashInfo2.crashAddress, None) 387 self.assertEqual(crashInfo3.crashAddress, 0xffffffffffffffa0L)
388
389 -class GDBParserTestCrashAddressSimple(unittest.TestCase):
390 - def runTest(self):
391 registerMap64 = {} 392 registerMap64["rax"] = 0x0L 393 registerMap64["rbx"] = -1L 394 registerMap64["rsi"] = 0xde6e5L 395 registerMap64["rdi"] = 0x7ffff6543238L 396 397 registerMap32 = {} 398 registerMap32["eax"] = 0x0L 399 registerMap32["ebx"] = -1L 400 registerMap32["ecx"] = 0xf75fffb8L 401 402 # Simple tests 403 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov %rbx,0x10(%rax)", registerMap64), 0x10L) 404 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov %ebx,0x10(%eax)", registerMap32), 0x10L) 405 406 407 # Overflow tests 408 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov %rax,0x10(%rbx)", registerMap64), 0xFL) 409 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov %eax,0x10(%ebx)", registerMap32), 0xFL) 410 411 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov %rbx,-0x10(%rax)", registerMap64), int64(uint64(0xfffffffffffffff0L))) 412 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov %ebx,-0x10(%eax)", registerMap32), int32(uint32(0xfffffff0L))) 413 414 # Scalar test 415 self.assertEqual(GDBCrashInfo.calculateCrashAddress("movl $0x7b,0x0", registerMap32), 0x0L) 416 417 # Real world examples 418 # Note: The crash address here can also be 0xf7600000 because the double quadword 419 # move can fail on the second 8 bytes if the source address is not 16-byte aligned 420 self.assertEqual(GDBCrashInfo.calculateCrashAddress("movdqu 0x40(%ecx),%xmm4", registerMap32), int32(uint32(0xf75ffff8L))) 421 422 # Again, this is an unaligned access and the crash can be at 0x7ffff6700000 or 0x7ffff6700000 - 4 423 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov -0x4(%rdi,%rsi,2),%eax", registerMap64), int64(uint64(0x7ffff66ffffeL)))
424
425 -class GDBParserTestRegression1(unittest.TestCase):
426 - def runTest(self):
427 config = ProgramConfiguration("test", "x86", "linux") 428 429 crashInfo1 = GDBCrashInfo([], gdbRegressionTrace1.splitlines(), config) 430 431 self.assertEqual(crashInfo1.backtrace[0], "js::ScriptedIndirectProxyHandler::defineProperty") 432 self.assertEqual(crashInfo1.backtrace[1], "js::SetPropertyIgnoringNamedGetter")
433
434 -class GDBParserTestCrashAddressRegression2(unittest.TestCase):
435 - def runTest(self):
436 config = ProgramConfiguration("test", "x86", "linux") 437 438 crashInfo2 = GDBCrashInfo([], gdbRegressionTrace2.splitlines(), config) 439 440 self.assertEqual(crashInfo2.crashAddress, 0xfffd579cL)
441
442 -class GDBParserTestCrashAddressRegression3(unittest.TestCase):
443 - def runTest(self):
444 config = ProgramConfiguration("test", "x86-64", "linux") 445 446 crashInfo3 = GDBCrashInfo([], gdbRegressionTrace3.splitlines(), config) 447 448 self.assertEqual(crashInfo3.crashAddress, 0x7fffffffffffL)
449
450 -class GDBParserTestCrashAddressRegression4(unittest.TestCase):
451 - def runTest(self):
452 config = ProgramConfiguration("test", "x86-64", "linux") 453 454 crashInfo4 = GDBCrashInfo([], gdbRegressionTrace4.splitlines(), config) 455 456 self.assertEqual(crashInfo4.crashAddress, 0x0L)
457
458 -class CrashSignatureOutputTest(unittest.TestCase):
459 - def runTest(self):
460 config = ProgramConfiguration("test", "x86-64", "linux") 461 462 crashSignature1 = '{ "symptoms" : [ { "type" : "output", "value" : "test" } ] }' 463 crashSignature1Neg = '{ "symptoms" : [ { "type" : "output", "src" : "stderr", "value" : "test" } ] }' 464 crashSignature2 = '{ "symptoms" : [ { "type" : "output", "src" : "stderr", "value" : { "value" : "^fest$", "matchType" : "pcre" } } ] }' 465 466 outputSignature1 = CrashSignature(crashSignature1) 467 outputSignature1Neg = CrashSignature(crashSignature1Neg) 468 outputSignature2 = CrashSignature(crashSignature2) 469 470 gdbOutput = [] 471 stdout = [] 472 stderr = [] 473 474 stdout.append("Foo") 475 stdout.append("Bartester") 476 stdout.append("Baz") 477 stderr.append("hackfest") 478 479 crashInfo = CrashInfo.fromRawCrashData(stdout, stderr, config, auxCrashData=gdbOutput) 480 481 self.assertIsInstance(crashInfo, NoCrashInfo) 482 483 # Ensure we match on stdout/err if nothing is specified 484 self.assert_(outputSignature1.matches(crashInfo)) 485 486 # Don't match stdout if stderr is specified 487 self.assertFalse(outputSignature1Neg.matches(crashInfo)) 488 489 # Check that we're really using PCRE 490 self.assertFalse(outputSignature2.matches(crashInfo)) 491 492 # Add something the PCRE should match, then retry 493 stderr.append("fest") 494 crashInfo = CrashInfo.fromRawCrashData(stdout, stderr, config, auxCrashData=gdbOutput) 495 self.assert_(outputSignature2.matches(crashInfo))
496
497 -class CrashSignatureAddressTest(unittest.TestCase):
498 - def runTest(self):
499 config = ProgramConfiguration("test", "x86-64", "linux") 500 501 crashSignature1 = '{ "symptoms" : [ { "type" : "crashAddress", "address" : "< 0x1000" } ] }' 502 crashSignature1Neg = '{ "symptoms" : [ { "type" : "crashAddress", "address" : "0x1000" } ] }' 503 addressSig1 = CrashSignature(crashSignature1) 504 addressSig1Neg = CrashSignature(crashSignature1Neg) 505 506 crashInfo1 = CrashInfo.fromRawCrashData([], [], config, auxCrashData=gdbSampleTrace1.splitlines()) 507 crashInfo3 = CrashInfo.fromRawCrashData([], [], config, auxCrashData=gdbSampleTrace3.splitlines()) 508 509 self.assertIsInstance(crashInfo1, GDBCrashInfo) 510 511 self.assert_(addressSig1.matches(crashInfo1)) 512 self.assertFalse(addressSig1Neg.matches(crashInfo1)) 513 514 # For crashInfo3, we don't have a crash address. Ensure we don't match 515 self.assertFalse(addressSig1.matches(crashInfo3)) 516 self.assertFalse(addressSig1Neg.matches(crashInfo3))
517
518 -class CrashSignatureRegisterTest(unittest.TestCase):
519 - def runTest(self):
520 config = ProgramConfiguration("test", "x86-64", "linux") 521 522 crashSignature1 = '{ "symptoms" : [ { "type" : "instruction", "registerNames" : ["r14"] } ] }' 523 crashSignature1Neg = '{ "symptoms" : [ { "type" : "instruction", "registerNames" : ["r14", "rax"] } ] }' 524 crashSignature2 = '{ "symptoms" : [ { "type" : "instruction", "instructionName" : "mov" } ] }' 525 crashSignature2Neg = '{ "symptoms" : [ { "type" : "instruction", "instructionName" : "cmp" } ] }' 526 crashSignature3 = '{ "symptoms" : [ { "type" : "instruction", "instructionName" : "mov", "registerNames" : ["r14", "rbx"] } ] }' 527 crashSignature3Neg = '{ "symptoms" : [ { "type" : "instruction", "instructionName" : "mov", "registerNames" : ["r14", "rax"] } ] }' 528 529 instructionSig1 = CrashSignature(crashSignature1) 530 instructionSig1Neg = CrashSignature(crashSignature1Neg) 531 532 instructionSig2 = CrashSignature(crashSignature2) 533 instructionSig2Neg = CrashSignature(crashSignature2Neg) 534 535 instructionSig3 = CrashSignature(crashSignature3) 536 instructionSig3Neg = CrashSignature(crashSignature3Neg) 537 538 crashInfo2 = CrashInfo.fromRawCrashData([], [], config, auxCrashData=gdbSampleTrace2.splitlines()) 539 crashInfo3 = CrashInfo.fromRawCrashData([], [], config, auxCrashData=gdbSampleTrace3.splitlines()) 540 541 self.assertIsInstance(crashInfo2, GDBCrashInfo) 542 self.assertIsInstance(crashInfo3, GDBCrashInfo) 543 544 self.assert_(instructionSig1.matches(crashInfo2)) 545 self.assertFalse(instructionSig1Neg.matches(crashInfo2)) 546 547 self.assert_(instructionSig2.matches(crashInfo2)) 548 self.assertFalse(instructionSig2Neg.matches(crashInfo2)) 549 550 self.assert_(instructionSig3.matches(crashInfo2)) 551 self.assertFalse(instructionSig3Neg.matches(crashInfo2)) 552 553 # Crash info3 doesn't have register information, ensure we don't match any 554 self.assertFalse(instructionSig1.matches(crashInfo3)) 555 self.assertFalse(instructionSig2.matches(crashInfo3)) 556 self.assertFalse(instructionSig3.matches(crashInfo3))
557
558 -class CrashSignatureStackFrameTest(unittest.TestCase):
559 - def runTest(self):
560 config = ProgramConfiguration("test", "x86-64", "linux") 561 562 crashSignature1 = '{ "symptoms" : [ { "type" : "stackFrame", "functionName" : "internalAppend" } ] }' 563 crashSignature1Neg = '{ "symptoms" : [ { "type" : "stackFrame", "functionName" : "foobar" } ] }' 564 565 crashSignature2 = '{ "symptoms" : [ { "type" : "stackFrame", "functionName" : "js::ion::MBasicBlock::setBackedge", "frameNumber" : "<= 4" } ] }' 566 crashSignature2Neg = '{ "symptoms" : [ { "type" : "stackFrame", "functionName" : "js::ion::MBasicBlock::setBackedge", "frameNumber" : "> 4" } ] }' 567 568 stackFrameSig1 = CrashSignature(crashSignature1) 569 stackFrameSig1Neg = CrashSignature(crashSignature1Neg) 570 571 stackFrameSig2 = CrashSignature(crashSignature2) 572 stackFrameSig2Neg = CrashSignature(crashSignature2Neg) 573 574 crashInfo1 = CrashInfo.fromRawCrashData([], [], config, auxCrashData=gdbSampleTrace1.splitlines()) 575 576 self.assertIsInstance(crashInfo1, GDBCrashInfo) 577 578 self.assert_(stackFrameSig1.matches(crashInfo1)) 579 self.assertFalse(stackFrameSig1Neg.matches(crashInfo1)) 580 581 self.assert_(stackFrameSig2.matches(crashInfo1)) 582 self.assertFalse(stackFrameSig2Neg.matches(crashInfo1))
583
584 -class CrashSignatureStackSizeTest(unittest.TestCase):
585 - def runTest(self):
586 config = ProgramConfiguration("test", "x86-64", "linux") 587 588 crashSignature1 = '{ "symptoms" : [ { "type" : "stackSize", "size" : 8 } ] }' 589 crashSignature1Neg = '{ "symptoms" : [ { "type" : "stackSize", "size" : 9 } ] }' 590 591 crashSignature2 = '{ "symptoms" : [ { "type" : "stackSize", "size" : "< 10" } ] }' 592 crashSignature2Neg = '{ "symptoms" : [ { "type" : "stackSize", "size" : "> 10" } ] }' 593 594 stackSizeSig1 = CrashSignature(crashSignature1) 595 stackSizeSig1Neg = CrashSignature(crashSignature1Neg) 596 597 stackSizeSig2 = CrashSignature(crashSignature2) 598 stackSizeSig2Neg = CrashSignature(crashSignature2Neg) 599 600 crashInfo1 = CrashInfo.fromRawCrashData([], [], config, auxCrashData=gdbSampleTrace1.splitlines()) 601 602 self.assertIsInstance(crashInfo1, GDBCrashInfo) 603 604 self.assert_(stackSizeSig1.matches(crashInfo1)) 605 self.assertFalse(stackSizeSig1Neg.matches(crashInfo1)) 606 607 self.assert_(stackSizeSig2.matches(crashInfo1)) 608 self.assertFalse(stackSizeSig2Neg.matches(crashInfo1))
609
610 -class RegisterHelperValueTest(unittest.TestCase):
611 - def runTest(self):
612 registerMap = { "rax" : 0xfffffffffffffe00L, "rbx" : 0x7ffff79a7640L } 613 614 self.assertEqual(RegisterHelper.getRegisterValue("rax", registerMap), 0xfffffffffffffe00L) 615 self.assertEqual(RegisterHelper.getRegisterValue("eax", registerMap), 0xfffffe00L) 616 self.assertEqual(RegisterHelper.getRegisterValue("ax", registerMap), 0xfe00L) 617 self.assertEqual(RegisterHelper.getRegisterValue("ah", registerMap), 0xfeL) 618 self.assertEqual(RegisterHelper.getRegisterValue("al", registerMap), 0x0L) 619 620 self.assertEqual(RegisterHelper.getRegisterValue("rbx", registerMap), 0x7ffff79a7640L) 621 self.assertEqual(RegisterHelper.getRegisterValue("ebx", registerMap), 0xf79a7640L) 622 self.assertEqual(RegisterHelper.getRegisterValue("bx", registerMap), 0x7640L) 623 self.assertEqual(RegisterHelper.getRegisterValue("bh", registerMap), 0x76L) 624 self.assertEqual(RegisterHelper.getRegisterValue("bl", registerMap), 0x40L)
625
626 -class MinidumpParserTestCrash(unittest.TestCase):
627 - def runTest(self):
628 config = ProgramConfiguration("test", "x86", "linux") 629 630 with open('minidump-example.txt', 'r') as f: 631 crashInfo = MinidumpCrashInfo([], f.read().splitlines(), config) 632 633 self.assertEqual(len(crashInfo.backtrace), 44) 634 self.assertEqual(crashInfo.backtrace[0], "??") 635 self.assertEqual(crashInfo.backtrace[5], "??") 636 self.assertEqual(crashInfo.backtrace[6], "nsAppShell::ProcessNextNativeEvent") 637 self.assertEqual(crashInfo.backtrace[7], "nsBaseAppShell::DoProcessNextNativeEvent") 638 639 self.assertEqual(crashInfo.crashAddress, long(0x3e800006acb))
640
641 -class MinidumpSelectorTest(unittest.TestCase):
642 - def runTest(self):
643 config = ProgramConfiguration("test", "x86", "linux") 644 645 with open('minidump-example.txt', 'r') as f: 646 crashData = f.read().splitlines() 647 648 crashInfo = CrashInfo.fromRawCrashData([], [], config, crashData) 649 self.assertEqual(crashInfo.crashAddress, long(0x3e800006acb))
650
651 -class AppleParserTestCrash(unittest.TestCase):
652 - def runTest(self):
653 config = ProgramConfiguration("test", "x86-64", "macosx") 654 655 with open('apple-crash-report-example.txt', 'r') as f: 656 crashInfo = AppleCrashInfo([], [], config, f.read().splitlines()) 657 658 self.assertEqual(len(crashInfo.backtrace), 9) 659 self.assertEqual(crashInfo.backtrace[0], "js::jit::MacroAssembler::Pop") 660 self.assertEqual(crashInfo.backtrace[1], "js::jit::ICGetPropCallNativeCompiler::generateStubCode") 661 self.assertEqual(crashInfo.backtrace[2], "js::jit::ICStubCompiler::getStubCode") 662 self.assertEqual(crashInfo.backtrace[3], "js::jit::ICGetPropCallNativeCompiler::getStub") 663 self.assertEqual(crashInfo.backtrace[4], "js::jit::DoGetPropFallback") 664 self.assertEqual(crashInfo.backtrace[5], "??") 665 self.assertEqual(crashInfo.backtrace[6], "__cxa_finalize_ranges") 666 self.assertEqual(crashInfo.backtrace[7], "??") 667 self.assertEqual(crashInfo.backtrace[8], "-[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:]") 668 669 self.assertEqual(crashInfo.crashAddress, long(0x00007fff5f3fff98))
670
671 -class AppleSelectorTest(unittest.TestCase):
672 - def runTest(self):
673 config = ProgramConfiguration("test", "x86-64", "macosx") 674 675 with open('apple-crash-report-example.txt', 'r') as f: 676 crashData = f.read().splitlines() 677 678 crashInfo = CrashInfo.fromRawCrashData([], [], config, crashData) 679 self.assertEqual(crashInfo.crashAddress, long(0x00007fff5f3fff98))
680
681 -class UBSanParserTestCrash(unittest.TestCase):
682 - def runTest(self):
683 config = ProgramConfiguration("test", "x86", "linux") 684 685 crashInfo = CrashInfo.fromRawCrashData([], [], config, ubsanSampleTrace1.splitlines()) 686 self.assertEqual(crashInfo.backtrace[0], "WelsDec::BsGetUe") 687 self.assertEqual(crashInfo.backtrace[9], "_start") 688 689 self.assertEqual(crashInfo.backtrace[11], "Lex< >")
690 691 692 if __name__ == "__main__": 693 unittest.main() 694