1 '''
2 Tests
3
4 @author: Christian Holler (:decoder)
5
6 @license:
7
8 This Source Code Form is subject to the terms of the Mozilla Public
9 License, v. 2.0. If a copy of the MPL was not distributed with this
10 file, You can obtain one at http://mozilla.org/MPL/2.0/.
11
12 @contact: choller@mozilla.com
13 '''
14 import unittest
15 from FTB.Signatures.CrashInfo import ASanCrashInfo, GDBCrashInfo, CrashInfo,\
16 NoCrashInfo, MinidumpCrashInfo, AppleCrashInfo
17 from FTB.Signatures.CrashSignature import CrashSignature
18 from FTB.Signatures import RegisterHelper
19
20 from numpy import int64, uint64, int32, uint32
21 from FTB.ProgramConfiguration import ProgramConfiguration
22
23 asanTraceCrash = """
24 ASAN:SIGSEGV
25 =================================================================
26 ==5854==ERROR: AddressSanitizer: SEGV on unknown address 0x00000014 (pc 0x0810845f sp 0xffc57860 bp 0xffc57f18 T0)
27 #0 0x810845e in js::AbstractFramePtr::asRematerializedFrame() const /srv/repos/mozilla-central/js/src/shell/../jit/RematerializedFrame.h:114
28 #1 0x810845e in js::AbstractFramePtr::script() const /srv/repos/mozilla-central/js/src/shell/../vm/Stack-inl.h:572
29 #2 0x810845e in EvalInFrame(JSContext*, unsigned int, JS::Value*) /srv/repos/mozilla-central/js/src/shell/js.cpp:2655
30 #3 0x93f5b92 in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) /srv/repos/mozilla-central/js/src/jscntxtinlines.h:231
31 #4 0x93f5b92 in js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) /srv/repos/mozilla-central/js/src/vm/Interpreter.cpp:484
32 #5 0x9346ba7 in js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) /srv/repos/mozilla-central/js/src/vm/Interpreter.cpp:540
33 #6 0x8702baa in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /srv/repos/mozilla-central/js/src/jit/BaselineIC.cpp:8638
34
35 AddressSanitizer can not provide additional info.
36 SUMMARY: AddressSanitizer: SEGV /srv/repos/mozilla-central/js/src/shell/../jit/RematerializedFrame.h:114 js::AbstractFramePtr::asRematerializedFrame() const
37 ==5854==ABORTING
38 """
39
40 asanTraceHeapCrash = """
41 ASAN:SIGSEGV
42 =================================================================
43 ==11923==ERROR: AddressSanitizer: SEGV on unknown address 0x00000019 (pc 0xf718072e sp 0xff87d130 bp 0x000006a1 T0)
44
45 AddressSanitizer can not provide additional info.
46 SUMMARY: AddressSanitizer: SEGV ??:0 ??
47 ==11923==ABORTING
48 """
49
50 asanTraceUAF = """
51 ==19462==ERROR: AddressSanitizer: heap-use-after-free on address 0x7fd766c42800 at pc 0xe1f587 bp 0x7fffcb1b6ed0 sp 0x7fffcb1b6ec8
52 READ of size 6143520 at 0x7fd766c42800 thread T0
53 #0 0xe1f586 in void mozilla::PodCopy<char16_t>(char16_t*, char16_t const*, unsigned long) /srv/repos/mozilla-central/js/src/opt64asan/js/src/../../dist/include/mozilla/PodOperations.h:110
54 #1 0x5904e2 in js::frontend::CompileScript(js::ExclusiveContext*, js::LifoAlloc*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::ReadOnlyCompileOptions const&, char16_t const*, unsigned long, JSString*, unsigned int, js::SourceCompressionTask*) /srv/repos/mozilla-central/js/src/frontend/BytecodeCompiler.cpp:215
55 #2 0xc7eb8d in JS::Compile(JSContext*, JS::Handle<JSObject*>, JS::ReadOnlyCompileOptions const&, char16_t const*, unsigned long) /srv/repos/mozilla-central/js/src/jsapi.cpp:4478
56 #3 0x4f63a6 in Run(JSContext*, unsigned int, JS::Value*) /srv/repos/mozilla-central/js/src/shell/js.cpp:1193
57 #4 0xf8eb1b in JSFunction::native() const /srv/repos/mozilla-central/js/src/jscntxtinlines.h:220
58 #5 0xf377c8 in js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /srv/repos/mozilla-central/js/src/vm/Interpreter.cpp:521
59 #6 0x82e98a in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /srv/repos/mozilla-central/js/src/jit/BaselineIC.cpp:8103
60 #7 0x7fd76b2b1323 in
61 0x7fd766c42800 is located 0 bytes inside of 6143522-byte region [0x7fd766c42800,0x7fd76721e622)
62 freed by thread T0 here:
63 #0 0x4c6855 in __interceptor_free _asan_rtl_
64 #1 0xf0f898 in js_free(void*) /srv/repos/mozilla-central/js/src/opt64asan/js/src/../../dist/include/js/Utility.h:167
65 #2 0xd18c5d in _ZL19FinalizeTypedArenasI8JSStringEbPN2js6FreeOpEPPNS1_2gc11ArenaHeaderERNS4_9ArenaListENS4_9AllocKindERNS1_11SliceBudgetE /srv/repos/mozilla-central/js/src/jsgc.cpp:540
66 #3 0xec61f6 in js::gc::ArenaLists::backgroundFinalize(js::FreeOp*, js::gc::ArenaHeader*, bool) /srv/repos/mozilla-central/js/src/jsgc.cpp:1539
67 #4 0xebbaf7 in GCCycle(JSRuntime*, bool, long, js::JSGCInvocationKind, JS::gcreason::Reason) /srv/repos/mozilla-central/js/src/jsgc.cpp:4786
68 previously allocated by thread T0 here:
69 #0 0x4c6995 in __interceptor_malloc _asan_rtl_
70 #1 0xeeed65 in js_malloc(unsigned long) /srv/repos/mozilla-central/js/src/opt64asan/js/src/../../dist/include/js/Utility.h:144
71 #2 0x4ff625 in FileAsString(JSContext*, char const*) /srv/repos/mozilla-central/js/src/shell/js.cpp:1104
72 #3 0x4f61a0 in Run(JSContext*, unsigned int, JS::Value*) /srv/repos/mozilla-central/js/src/shell/js.cpp:1176
73 #4 0xf8eb1b in JSFunction::native() const /srv/repos/mozilla-central/js/src/jscntxtinlines.h:220
74 #5 0xf377c8 in js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /srv/repos/mozilla-central/js/src/vm/Interpreter.cpp:521
75 #6 0x82e98a in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /srv/repos/mozilla-central/js/src/jit/BaselineIC.cpp:8103
76 #7 0x7fd76b2b1323 in
77 #8 0x61100032da17 in
78 #9 0x7fd76b2aa503 in
79 Shadow bytes around the buggy address:
80 0x0ffb6cd804b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
81 0x0ffb6cd804c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
82 0x0ffb6cd804d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
83 0x0ffb6cd804e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
84 0x0ffb6cd804f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
85 =>0x0ffb6cd80500:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
86 0x0ffb6cd80510: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
87 0x0ffb6cd80520: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
88 0x0ffb6cd80530: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
89 0x0ffb6cd80540: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
90 0x0ffb6cd80550: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
91 Shadow byte legend (one shadow byte represents 8 application bytes):
92 Addressable: 00
93 Partially addressable: 01 02 03 04 05 06 07
94 Heap left redzone: fa
95 Heap right redzone: fb
96 Freed heap region: fd
97 Stack left redzone: f1
98 Stack mid redzone: f2
99 Stack right redzone: f3
100 Stack partial redzone: f4
101 Stack after return: f5
102 Stack use after scope: f8
103 Global redzone: f9
104 Global init order: f6
105 Poisoned by user: f7
106 ASan internal: fe
107 ==19462==ABORTING
108 """
109
110 gdbCrashAddress1 = """
111 (gdb) bt 16
112 #0 js::types::TypeObject::addProperty (this=0xf7469400, cx=0x9366458, id=$jsid(0x0), pprop=0xf7469418) at /srv/repos/mozilla-central/js/src/jsinfer.cpp:3691
113 (More stack frames follow...)
114 (gdb) info reg
115 eax 0x1 1
116 ecx 0x1 1
117 (gdb) x /i $pc
118 => 0x812bf19 <js::types::TypeObject::addProperty(JSContext*, jsid, js::types::Property**)+121>: mov (%ecx),%ecx
119 """
120
121 gdbCrashAddress2 = """
122 Program terminated with signal 11, Segmentation fault.
123 #0 repoint (this=0x160fc30, cx=0x15a4940, masm=..., attacher=..., ion=0x160fa80, attachKind=0x2b08c0 \"generic\") at /srv/repos/mozilla-central/js/src/ion/IonCaches.cpp:44
124 #1 CodeLocationJump (this=0x160fc30, cx=0x15a4940, masm=..., attacher=..., ion=0x160fa80, attachKind=0x2b08c0 \"generic\") at ../ion/shared/Assembler-shared.h:452
125 r0 0x34 52
126 r4 0x15a4940 22694208
127 r10 0x0 0
128 sp 0xbe9fec08 3198151688
129 pc 0x1a03ae <js::ion::IonCache::linkAndAttachStub(JSContext*, js::ion::MacroAssembler&, js::ion::IonCache::StubAttacher&, js::ion::IonScript*, char const*)+122>
130 cpsr 0xd0030 852016
131 => 0x1a03ae <js::ion::IonCache::linkAndAttachStub(JSContext*, js::ion::MacroAssembler&, js::ion::IonCache::StubAttacher&, js::ion::IonScript*, char const*)+122>: ldr.w r4, [r10]
132 0x1a03b2 <js::ion::IonCache::linkAndAttachStub(JSContext*, js::ion::MacroAssembler&, js::ion::IonCache::StubAttacher&, js::ion::IonScript*, char const*)+126>: mov r3, r0
133 """
134
135 gdbCrashAddress3 = """
136 (gdb) bt 16
137 #0 js::types::TypeObject::addProperty (this=0xf7469400, cx=0x9366458, id=$jsid(0x0), pprop=0xf7469418) at /srv/repos/mozilla-central/js/src/jsinfer.cpp:3691
138 (More stack frames follow...)
139 (gdb) info reg
140 rax 0x1 1
141 rdx 0x1 1
142 rbx 0x1 1
143 (gdb) x /i $pc
144 => 0x812bf19 <js::types::TypeObject::addProperty(JSContext*, jsid, js::types::Property**)+121>: shrb -0x69(%rdx,%rbx,8)
145 """
146
147 gdbSampleTrace1 = """
148 [New Thread 14711]
149 [Thread debugging using libthread_db enabled]
150 Core was generated by `/srv/repos/ionmonkey/js/src/opt32/js --ion -n -m --ion-eager -f /home/ownhero/h'.
151 Program terminated with signal 11, Segmentation fault.
152 #0 0x083fa060 in internalAppend<js::ion::MDefinition*> (this=0x847e4e8, ins=0x9e2ced0) at ./dist/include/js/Vector.h:790
153 790 new(endNoCheck()) T(t);
154 #0 0x083fa060 in internalAppend<js::ion::MDefinition*> (this=0x847e4e8, ins=0x9e2ced0) at ./dist/include/js/Vector.h:790
155 #1 append<js::ion::MDefinition*> (this=0x847e4e8, ins=0x9e2ced0) at ./dist/include/js/Vector.h:779
156 #2 js::ion::MPhi::addInput (this=0x847e4e8, ins=0x9e2ced0) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/MIR.cpp:456
157 #3 0x0838ad1c in js::ion::MBasicBlock::setBackedge (this=0x9d4a630, pred=0x9e2d0a8) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/MIRGraph.cpp:661
158 #4 0x0833ea08 in js::ion::IonBuilder::finishLoop (this=0xffdef8e0, state=..., successor=0x9e2d280) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonBuilder.cpp:1303
159 #5 0x0833eb47 in js::ion::IonBuilder::processForUpdateEnd (this=0xffdef8e0, state=...) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonBuilder.cpp:1476
160 #6 0x08350ac0 in processCfgStack (this=0xffdef8e0) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonBuilder.cpp:1104
161 #7 js::ion::IonBuilder::traverseBytecode (this=0xffdef8e0) at /home/ownhero/homes/mozilla/repos/ionmonkey/js/src/ion/IonBuilder.cpp:627
162 eax 0x0 0
163 ebx 0x8962ff4 144060404
164 ecx 0xf76038ac -144688980
165 edx 0x0 0
166 esi 0xf7602d9c -144691812
167 edi 0x0 0
168 ebp 0xff916fb8 4287721400
169 esp 0xff916ed0 4287721168
170 eip 0x818bc33 <js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct)+419>
171 => 0x818bc33 <js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct)+419>: movl $0x7b,0x0
172 0x818bc3d <js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct)+429>: call 0x804af50 <abort@plt>
173 """
174
175 gdbSampleTrace2 = """
176 Program terminated with signal 11, Segmentation fault.
177 #0 operator+ (this=0xf6c7e760, cx=0xa3024b8, iv=..., useLocale=false, buffer=..., sb=...) at ../gc/Barrier.h:462
178 462 HeapSlotArray operator +(uint32_t offset) const { return HeapSlotArray(array + offset); }
179 #0 operator+ (this=0xf6c7e760, cx=0xa3024b8, iv=..., useLocale=false, buffer=..., sb=...) at ../gc/Barrier.h:462
180 #1 js::ParallelArrayObject::toStringBufferImpl (this=0xf6c7e760, cx=0xa3024b8, iv=..., useLocale=false, buffer=..., sb=...) at /srv/repos/mozilla-central/js/src/builtin/ParallelArray.cpp:1521
181 #2 0x081d0379 in js::ParallelArrayObject::toStringBuffer (this=0xf6c7e760, cx=0xa3024b8, useLocale=false, sb=...) at /srv/repos/mozilla-central/js/src/builtin/ParallelArray.cpp:1566
182 #3 0x081d05b3 in js::ParallelArrayObject::toString (cx=0xa3024b8, args=...) at /srv/repos/mozilla-central/js/src/builtin/ParallelArray.cpp:1573
183 #4 0x081d06be in CallNonGenericMethod (cx=0xa3024b8, argc=0, vp=0xf6ee2150) at ../jsapi.h:1570
184 #5 NonGenericMethod<js::ParallelArrayObject::toString> (cx=0xa3024b8, argc=0, vp=0xf6ee2150) at /srv/repos/mozilla-central/js/src/builtin/ParallelArray.cpp:163
185 #6 0x080d8dd8 in CallJSNative (cx=0xa3024b8, args=..., construct=js::NO_CONSTRUCT) at ../jscntxtinlines.h:389
186 #7 PropertyAccess<(PropertyAccessKind)1> (cx=0xa3024b8, args=..., construct=js::NO_CONSTRUCT) at /srv/repos/mozilla-central/js/src/jsinterp.cpp:351
187 rbx 0x1 1
188 r14 0x1 1
189 => 0x7f01fffecf41: mov 0x8(%r14),%rbx
190 0x7f01fffecf45: cmp %rbx,0x18(%rdi)
191 """
192
193 gdbSampleTrace3 = """
194 Program terminated with signal 11, Segmentation fault.
195 #0 0x083ba5a9 in AssertCanGC () at /srv/repos/ionmonkey/js/src/gc/Root.h:1029
196 1029 JS_ASSERT_IF(isGCEnabled(), !InNoGCScope());
197 #0 0x083ba5a9 in AssertCanGC () at /srv/repos/ionmonkey/js/src/gc/Root.h:1029
198 #1 js::gc::NewGCThing<JSString, (js::AllowGC)1> (cx=0x9224850, kind=js::gc::FINALIZE_STRING, thingSize=16, heap=js::gc::TenuredHeap) at ../jsgcinlines.h:491
199 #2 0x083b205d in js_NewGCString<(js::AllowGC)1> (cx=0x9224850) at ../jsgcinlines.h:578
200 #3 0x08508069 in new_<(js::AllowGC)1> (length=33, right=\"result: \", left=\"\\njstest: undefined bug: \", cx=0x9224850) at /srv/repos/ionmonkey/js/src/vm/String-inl.h:194
201 #4 js::ConcatStrings<(js::AllowGC)1> (cx=0x9224850,: left=\"\\njstest: undefined bug: \", right=\"result: \") at /srv/repos/ionmonkey/js/src/vm/String.cpp:339
202 #5 0x08780467 in js::ion::DoConcatStrings (cx=0x9224850, lhs=$jsval(-nan(0xfff85f6bb4ff0)), rhs=$jsval(-nan(0xfff85f6c194e0)), res=$jsval(-nan(0xfff8200000000))) at /srv/repos/ionmonkey/js/src/ion/BaselineIC.cpp:2037
203 #6 0xf772685f in ?? ()
204 #7 0xf772bb76 in ?? ()
205 """
206
207 gdbRegressionTrace1 = """
208 Program received signal SIGSEGV, Segmentation fault.
209 js::ScriptedIndirectProxyHandler::defineProperty (this=0x930fad4, cx=0x9339130, proxy=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), desc={obj = (JSObject *) 0xf6247040 [object Proxy], attrs = 61524, getter = 0xf6700120, setter = 0, value = $jsval(-nan(0xfff88f62460d0))}) at /srv/repos/mozilla-central/js/src/proxy/ScriptedIndirectProxyHandler.cpp:201
210 201 RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
211 #0 js::ScriptedIndirectProxyHandler::defineProperty (this=0x930fad4, cx=0x9339130, proxy=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), desc={obj = (JSObject *) 0xf6247040 [object Proxy], attrs = 61524, getter = 0xf6700120, setter = 0, value = $jsval(-nan(0xfff88f62460d0))}) at /srv/repos/mozilla-central/js/src/proxy/ScriptedIndirectProxyHandler.cpp:201
212 #1 0x084ac820 in js::SetPropertyIgnoringNamedGetter (cx=0x9339130, handler=0x930fad4, proxy=(JSObject * const) 0xf6247040 [object Proxy], receiver=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), desc={obj = (JSObject *) 0xf6247040 [object Proxy], attrs = 61524, getter = 0xf6700120, setter = 0, value = $jsval(-nan(0xfff88f62460d0))}, descIsOwn=true, strict=false, vp=$jsval(-nan(0xfff88f62460d0))) at /srv/repos/mozilla-central/js/src/proxy/BaseProxyHandler.cpp:186
213 #2 0x084b0677 in js::ScriptedIndirectProxyHandler::derivedSet (this=0x930fad4, cx=0x9339130, proxy=(JSObject * const) 0xf6247040 [object Proxy], receiver=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), strict=false, vp=$jsval(-nan(0xfff88f62460d0))) at /srv/repos/mozilla-central/js/src/proxy/ScriptedIndirectProxyHandler.cpp:311
214 #3 0x084b08a8 in js::ScriptedIndirectProxyHandler::set (this=0x930fad4, cx=0x9339130, proxy=(JSObject * const) 0xf6247040 [object Proxy], receiver=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), strict=false, vp=$jsval(-nan(0xfff88f62460d0))) at /srv/repos/mozilla-central/js/src/proxy/ScriptedIndirectProxyHandler.cpp:290
215 #4 0x084aeb59 in js::Proxy::set (cx=0x9339130, proxy=(JSObject * const) 0xf6247040 [object Proxy], receiver=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), strict=false, vp=$jsval(-nan(0xfff88f62460d0))) at /srv/repos/mozilla-central/js/src/proxy/Proxy.cpp:336
216 #5 0x08535ec0 in setGeneric (strict=<optimized out>, vp=..., id=..., receiver=..., obj=(JSObject * const) 0xf6247040 [object Proxy], cx=0x9339130) at /srv/repos/mozilla-central/js/src/vm/NativeObject.h:1428
217 #6 js::baseops::SetPropertyHelper<(js::ExecutionMode)0> (cxArg=0x9339130, obj=(js::NativeObject * const) 0xf6700050 [object Array], receiver=(JSObject * const) 0xf6700050 [object Array], id=$jsid(0), qualified=js::baseops::Qualified, vp=$jsval(-nan(0xfff88f62460d0)), strict=false) at /srv/repos/mozilla-central/js/src/vm/NativeObject.cpp:2353
218 #7 0x08519490 in setGeneric (strict=false, vp=..., id=..., receiver=..., obj=(JSObject * const) 0xf6700050 [object Array], cx=0x9339130) at /srv/repos/mozilla-central/js/src/vm/NativeObject.h:1430
219 """
220
221 gdbRegressionTrace2 = """
222 Program received signal SIGSEGV, Segmentation fault.
223 0xf7673132 in ?? ()
224 #0 0xf7673132 in ?? ()
225 eax 0xf6043040 -167497664
226 ecx 0xf651f4b0 -162401104
227 edx 0xf651f4d0 -162401072
228 ebx 0xf651f4f0 -162401040
229 esp 0xfffd573c 0xfffd573c
230 ebp 0xfffd57e4 0xfffd57e4
231 esi 0x0 0
232 edi 0x934d3d0 154457040
233 eip 0xf7673132 0xf7673132
234 => 0xf7673132: vmovaps %xmm1,0x60(%esp)
235 """
236
237 gdbRegressionTrace3 = """
238 Program received signal SIGTRAP, Trace/breakpoint trap.
239 0x00007ffff5573368 in ?? ()
240 #0 0x00007ffff5573368 in ?? ()
241 #1 0x00007ffff558a9c9 in ?? ()
242 #2 0x0000000000000183 in ?? ()
243 #3 0x00007ffff5671ac0 in ?? ()
244 #4 0x0000000000000000 in ?? ()
245 rax 0x1ac4d40 28069184
246 rbx 0x7ffff5658730 140737310459696
247 rcx 0xfff9000000000000 -1970324836974592
248 rdx 0xfffc7ffff5700060 -985162595696544
249 rsi 0x7ffff55efa4d 140737310030413
250 rdi 0x1acfa60 28113504
251 rbp 0x7fffffffbf20 140737488338720
252 rsp 0x7fffffffbf28 140737488338728
253 r8 0x7ffff565b060 140737310470240
254 r9 0x0 0
255 r10 0x0 0
256 r11 0x7ffff6c3fc90 140737333427344
257 r12 0x0 0
258 r13 0x7fffffffca00 140737488341504
259 r14 0x183 387
260 r15 0x7ffff558a970 140737309616496
261 rip 0x7ffff5573368 140737309520744
262 => 0x7ffff5573368: movabs $0x7fffffffffff,%rbx
263 0x7ffff5573372: and 0xa08(%rax),%rbx
264 """
265
266 gdbRegressionTrace4 = """
267 Program received signal SIGSEGV, Segmentation fault.
268 0x0000000000000000 in ?? ()
269 #0 0x0000000000000000 in ?? ()
270 #1 0xfffc7ffff7e8a6c0 in ?? ()
271 #2 0x000000000043026c in js::jit::IonCompile (cx=0xfffc7ffff7e766c0, script=<optimized out>, baselineFrame=<optimized out>, osrPc=<optimized out>, constructing=<optimized out>, recompile=<optimized out>, optimizationLevel=js::jit::Optimization_DontCompile) at /home/ownhero/homes/mozilla/repos/mozilla-central/js/src/jit/Ion.cpp:2253
272 #3 0x00007ffff7e61160 in ?? ()
273 #4 0x0000000000000000 in ?? ()
274 rax 0x0 0
275 rbx 0xfffc7ffff7e766c0 -985162554317120
276 rcx 0x7fffffffd6c0 140737488344768
277 rdx 0x7ffff6907050 140737330049104
278 rsi 0x0 0
279 rdi 0x7ffff6a00048 140737331069000
280 rbp 0x7fffffffd270 140737488343664
281 rsp 0x7fffffffd240 140737488343616
282 r8 0x0 0
283 r9 0xffffc000 4294950912
284 r10 0x46000 286720
285 r11 0x7ffff6a00121 140737331069217
286 r12 0x8 8
287 r13 0x7fffffffd6f0 140737488344816
288 r14 0x1 1
289 r15 0x7ffff6914800 140737330104320
290 rip 0x0 0
291 => 0x0:
292 """
293
294 ubsanSampleTrace1 = """
295 codec/decoder/core/inc/dec_golomb.h:182:37: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
296 #0 0x51353a in WelsDec::BsGetUe(WelsCommon::TagBitStringAux*, unsigned int*) /home/user/code/openh264/./codec/decoder/core/inc/dec_golomb.h:182:37
297 #1 0x51a11b in WelsDec::ParseSliceHeaderSyntaxs(WelsDec::TagWelsDecoderContext*, WelsCommon::TagBitStringAux*, bool) /home/user/code/openh264/codec/decoder/core/src/decoder_core.cpp:692:3
298 #2 0x59f649 in WelsDec::ParseNalHeader(WelsDec::TagWelsDecoderContext*, WelsCommon::TagNalUnitHeader*, unsigned char*, int, unsigned char*, int, int*) /home/user/code/openh264/codec/decoder/core/src/au_parser.cpp:392:12
299 #3 0x50d2fe in WelsDecodeBs /home/user/code/openh264/codec/decoder/core/src/decoder.cpp:749:19
300 #4 0x4f3553 in WelsDec::CWelsDecoder::DecodeFrame2(unsigned char const*, int, unsigned char**, TagBufferInfo*) /home/user/code/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:502:3
301 #5 0x4f249f in WelsDec::CWelsDecoder::DecodeFrameNoDelay(unsigned char const*, int, unsigned char**, TagBufferInfo*) /home/user/code/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:438:16
302 #6 0x4e719f in H264DecodeInstance(ISVCDecoder*, char const*, char const*, int&, int&, char const*, char const*) /home/user/code/openh264/codec/console/dec/src/h264dec.cpp:218:5
303 #7 0x4e8630 in main /home/user/code/openh264/codec/console/dec/src/h264dec.cpp:358:5
304 #8 0x7fe1d5eb7ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
305 #9 0x41beb5 in _start (/home/user/Desktop/openh264/h264dec_64_ub_asan+0x41beb5)
306 #10 0x0 in mozilla::image::nsBMPDecoder::WriteInternal(char const*, unsigned int)::$_0::operator()(mozilla::image::nsBMPDecoder::State, char const*, unsigned long) const /test.cpp:1:1
307 #11 0x0 in Lex<<lambda at /builds/slave/m-in-l64-asan-0000000000000000/build/src/image/decoders/nsBMPDecoder.cpp:346:33> > /test.cpp:1:1
308
309 SUMMARY: AddressSanitizer: undefined-behavior codec/decoder/core/inc/dec_golomb.h:182:37 in
310 """
311
314 config = ProgramConfiguration("test", "x86", "linux")
315
316 crashInfo = ASanCrashInfo([], asanTraceCrash.splitlines(), config)
317 self.assertEqual(len(crashInfo.backtrace), 7)
318 self.assertEqual(crashInfo.backtrace[0], "js::AbstractFramePtr::asRematerializedFrame")
319 self.assertEqual(crashInfo.backtrace[2], "EvalInFrame")
320 self.assertEqual(crashInfo.backtrace[3], "js::CallJSNative")
321 self.assertEqual(crashInfo.backtrace[6], "js::jit::DoCallFallback")
322
323 self.assertEqual(crashInfo.crashAddress, 0x00000014L)
324 self.assertEqual(crashInfo.registers["pc"], 0x0810845fL)
325 self.assertEqual(crashInfo.registers["sp"], 0xffc57860L)
326 self.assertEqual(crashInfo.registers["bp"], 0xffc57f18L)
327
330 config = ProgramConfiguration("test", "x86", "linux")
331
332 crashInfo = ASanCrashInfo([], asanTraceHeapCrash.splitlines(), config)
333 self.assertEqual(len(crashInfo.backtrace), 1)
334
335 self.assertEqual(crashInfo.crashAddress, 0x00000019L)
336 self.assertEqual(crashInfo.registers["pc"], 0xf718072eL)
337 self.assertEqual(crashInfo.registers["sp"], 0xff87d130L)
338 self.assertEqual(crashInfo.registers["bp"], 0x000006a1L)
339
340 self.assertEqual(crashInfo.createShortSignature(), "[@ ??]")
341
344 config = ProgramConfiguration("test", "x86-64", "linux")
345
346 crashInfo = ASanCrashInfo([], asanTraceUAF.splitlines(), config)
347 self.assertEqual(len(crashInfo.backtrace), 23)
348 self.assertEqual(crashInfo.backtrace[0], "void mozilla::PodCopy<char16_t>")
349 self.assertEqual(crashInfo.backtrace[4], "JSFunction::native")
350
351 self.assertEqual(crashInfo.crashAddress, 0x7fd766c42800L)
352
362
365 config = ProgramConfiguration("test", "x86", "linux")
366
367 crashInfo = GDBCrashInfo([], gdbSampleTrace1.splitlines(), config)
368 self.assertEqual(len(crashInfo.backtrace), 8)
369 self.assertEqual(crashInfo.backtrace[0], "internalAppend<js::ion::MDefinition*>")
370 self.assertEqual(crashInfo.backtrace[2], "js::ion::MPhi::addInput")
371 self.assertEqual(crashInfo.backtrace[6], "processCfgStack")
372
373 self.assertEqual(crashInfo.registers["eax"], 0x0L)
374 self.assertEqual(crashInfo.registers["ebx"], 0x8962ff4L)
375 self.assertEqual(crashInfo.registers["eip"], 0x818bc33L)
376
379 config = ProgramConfiguration("test", "x86-64", "linux")
380
381 crashInfo1 = GDBCrashInfo([], gdbCrashAddress1.splitlines(), config)
382 crashInfo2 = GDBCrashInfo([], gdbCrashAddress2.splitlines(), config)
383 crashInfo3 = GDBCrashInfo([], gdbCrashAddress3.splitlines(), config)
384
385 self.assertEqual(crashInfo1.crashAddress, 0x1L)
386 self.assertEqual(crashInfo2.crashAddress, None)
387 self.assertEqual(crashInfo3.crashAddress, 0xffffffffffffffa0L)
388
391 registerMap64 = {}
392 registerMap64["rax"] = 0x0L
393 registerMap64["rbx"] = -1L
394 registerMap64["rsi"] = 0xde6e5L
395 registerMap64["rdi"] = 0x7ffff6543238L
396
397 registerMap32 = {}
398 registerMap32["eax"] = 0x0L
399 registerMap32["ebx"] = -1L
400 registerMap32["ecx"] = 0xf75fffb8L
401
402
403 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov %rbx,0x10(%rax)", registerMap64), 0x10L)
404 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov %ebx,0x10(%eax)", registerMap32), 0x10L)
405
406
407
408 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov %rax,0x10(%rbx)", registerMap64), 0xFL)
409 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov %eax,0x10(%ebx)", registerMap32), 0xFL)
410
411 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov %rbx,-0x10(%rax)", registerMap64), int64(uint64(0xfffffffffffffff0L)))
412 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov %ebx,-0x10(%eax)", registerMap32), int32(uint32(0xfffffff0L)))
413
414
415 self.assertEqual(GDBCrashInfo.calculateCrashAddress("movl $0x7b,0x0", registerMap32), 0x0L)
416
417
418
419
420 self.assertEqual(GDBCrashInfo.calculateCrashAddress("movdqu 0x40(%ecx),%xmm4", registerMap32), int32(uint32(0xf75ffff8L)))
421
422
423 self.assertEqual(GDBCrashInfo.calculateCrashAddress("mov -0x4(%rdi,%rsi,2),%eax", registerMap64), int64(uint64(0x7ffff66ffffeL)))
424
427 config = ProgramConfiguration("test", "x86", "linux")
428
429 crashInfo1 = GDBCrashInfo([], gdbRegressionTrace1.splitlines(), config)
430
431 self.assertEqual(crashInfo1.backtrace[0], "js::ScriptedIndirectProxyHandler::defineProperty")
432 self.assertEqual(crashInfo1.backtrace[1], "js::SetPropertyIgnoringNamedGetter")
433
441
449
457
460 config = ProgramConfiguration("test", "x86-64", "linux")
461
462 crashSignature1 = '{ "symptoms" : [ { "type" : "output", "value" : "test" } ] }'
463 crashSignature1Neg = '{ "symptoms" : [ { "type" : "output", "src" : "stderr", "value" : "test" } ] }'
464 crashSignature2 = '{ "symptoms" : [ { "type" : "output", "src" : "stderr", "value" : { "value" : "^fest$", "matchType" : "pcre" } } ] }'
465
466 outputSignature1 = CrashSignature(crashSignature1)
467 outputSignature1Neg = CrashSignature(crashSignature1Neg)
468 outputSignature2 = CrashSignature(crashSignature2)
469
470 gdbOutput = []
471 stdout = []
472 stderr = []
473
474 stdout.append("Foo")
475 stdout.append("Bartester")
476 stdout.append("Baz")
477 stderr.append("hackfest")
478
479 crashInfo = CrashInfo.fromRawCrashData(stdout, stderr, config, auxCrashData=gdbOutput)
480
481 self.assertIsInstance(crashInfo, NoCrashInfo)
482
483
484 self.assert_(outputSignature1.matches(crashInfo))
485
486
487 self.assertFalse(outputSignature1Neg.matches(crashInfo))
488
489
490 self.assertFalse(outputSignature2.matches(crashInfo))
491
492
493 stderr.append("fest")
494 crashInfo = CrashInfo.fromRawCrashData(stdout, stderr, config, auxCrashData=gdbOutput)
495 self.assert_(outputSignature2.matches(crashInfo))
496
499 config = ProgramConfiguration("test", "x86-64", "linux")
500
501 crashSignature1 = '{ "symptoms" : [ { "type" : "crashAddress", "address" : "< 0x1000" } ] }'
502 crashSignature1Neg = '{ "symptoms" : [ { "type" : "crashAddress", "address" : "0x1000" } ] }'
503 addressSig1 = CrashSignature(crashSignature1)
504 addressSig1Neg = CrashSignature(crashSignature1Neg)
505
506 crashInfo1 = CrashInfo.fromRawCrashData([], [], config, auxCrashData=gdbSampleTrace1.splitlines())
507 crashInfo3 = CrashInfo.fromRawCrashData([], [], config, auxCrashData=gdbSampleTrace3.splitlines())
508
509 self.assertIsInstance(crashInfo1, GDBCrashInfo)
510
511 self.assert_(addressSig1.matches(crashInfo1))
512 self.assertFalse(addressSig1Neg.matches(crashInfo1))
513
514
515 self.assertFalse(addressSig1.matches(crashInfo3))
516 self.assertFalse(addressSig1Neg.matches(crashInfo3))
517
520 config = ProgramConfiguration("test", "x86-64", "linux")
521
522 crashSignature1 = '{ "symptoms" : [ { "type" : "instruction", "registerNames" : ["r14"] } ] }'
523 crashSignature1Neg = '{ "symptoms" : [ { "type" : "instruction", "registerNames" : ["r14", "rax"] } ] }'
524 crashSignature2 = '{ "symptoms" : [ { "type" : "instruction", "instructionName" : "mov" } ] }'
525 crashSignature2Neg = '{ "symptoms" : [ { "type" : "instruction", "instructionName" : "cmp" } ] }'
526 crashSignature3 = '{ "symptoms" : [ { "type" : "instruction", "instructionName" : "mov", "registerNames" : ["r14", "rbx"] } ] }'
527 crashSignature3Neg = '{ "symptoms" : [ { "type" : "instruction", "instructionName" : "mov", "registerNames" : ["r14", "rax"] } ] }'
528
529 instructionSig1 = CrashSignature(crashSignature1)
530 instructionSig1Neg = CrashSignature(crashSignature1Neg)
531
532 instructionSig2 = CrashSignature(crashSignature2)
533 instructionSig2Neg = CrashSignature(crashSignature2Neg)
534
535 instructionSig3 = CrashSignature(crashSignature3)
536 instructionSig3Neg = CrashSignature(crashSignature3Neg)
537
538 crashInfo2 = CrashInfo.fromRawCrashData([], [], config, auxCrashData=gdbSampleTrace2.splitlines())
539 crashInfo3 = CrashInfo.fromRawCrashData([], [], config, auxCrashData=gdbSampleTrace3.splitlines())
540
541 self.assertIsInstance(crashInfo2, GDBCrashInfo)
542 self.assertIsInstance(crashInfo3, GDBCrashInfo)
543
544 self.assert_(instructionSig1.matches(crashInfo2))
545 self.assertFalse(instructionSig1Neg.matches(crashInfo2))
546
547 self.assert_(instructionSig2.matches(crashInfo2))
548 self.assertFalse(instructionSig2Neg.matches(crashInfo2))
549
550 self.assert_(instructionSig3.matches(crashInfo2))
551 self.assertFalse(instructionSig3Neg.matches(crashInfo2))
552
553
554 self.assertFalse(instructionSig1.matches(crashInfo3))
555 self.assertFalse(instructionSig2.matches(crashInfo3))
556 self.assertFalse(instructionSig3.matches(crashInfo3))
557
560 config = ProgramConfiguration("test", "x86-64", "linux")
561
562 crashSignature1 = '{ "symptoms" : [ { "type" : "stackFrame", "functionName" : "internalAppend" } ] }'
563 crashSignature1Neg = '{ "symptoms" : [ { "type" : "stackFrame", "functionName" : "foobar" } ] }'
564
565 crashSignature2 = '{ "symptoms" : [ { "type" : "stackFrame", "functionName" : "js::ion::MBasicBlock::setBackedge", "frameNumber" : "<= 4" } ] }'
566 crashSignature2Neg = '{ "symptoms" : [ { "type" : "stackFrame", "functionName" : "js::ion::MBasicBlock::setBackedge", "frameNumber" : "> 4" } ] }'
567
568 stackFrameSig1 = CrashSignature(crashSignature1)
569 stackFrameSig1Neg = CrashSignature(crashSignature1Neg)
570
571 stackFrameSig2 = CrashSignature(crashSignature2)
572 stackFrameSig2Neg = CrashSignature(crashSignature2Neg)
573
574 crashInfo1 = CrashInfo.fromRawCrashData([], [], config, auxCrashData=gdbSampleTrace1.splitlines())
575
576 self.assertIsInstance(crashInfo1, GDBCrashInfo)
577
578 self.assert_(stackFrameSig1.matches(crashInfo1))
579 self.assertFalse(stackFrameSig1Neg.matches(crashInfo1))
580
581 self.assert_(stackFrameSig2.matches(crashInfo1))
582 self.assertFalse(stackFrameSig2Neg.matches(crashInfo1))
583
586 config = ProgramConfiguration("test", "x86-64", "linux")
587
588 crashSignature1 = '{ "symptoms" : [ { "type" : "stackSize", "size" : 8 } ] }'
589 crashSignature1Neg = '{ "symptoms" : [ { "type" : "stackSize", "size" : 9 } ] }'
590
591 crashSignature2 = '{ "symptoms" : [ { "type" : "stackSize", "size" : "< 10" } ] }'
592 crashSignature2Neg = '{ "symptoms" : [ { "type" : "stackSize", "size" : "> 10" } ] }'
593
594 stackSizeSig1 = CrashSignature(crashSignature1)
595 stackSizeSig1Neg = CrashSignature(crashSignature1Neg)
596
597 stackSizeSig2 = CrashSignature(crashSignature2)
598 stackSizeSig2Neg = CrashSignature(crashSignature2Neg)
599
600 crashInfo1 = CrashInfo.fromRawCrashData([], [], config, auxCrashData=gdbSampleTrace1.splitlines())
601
602 self.assertIsInstance(crashInfo1, GDBCrashInfo)
603
604 self.assert_(stackSizeSig1.matches(crashInfo1))
605 self.assertFalse(stackSizeSig1Neg.matches(crashInfo1))
606
607 self.assert_(stackSizeSig2.matches(crashInfo1))
608 self.assertFalse(stackSizeSig2Neg.matches(crashInfo1))
609
612 registerMap = { "rax" : 0xfffffffffffffe00L, "rbx" : 0x7ffff79a7640L }
613
614 self.assertEqual(RegisterHelper.getRegisterValue("rax", registerMap), 0xfffffffffffffe00L)
615 self.assertEqual(RegisterHelper.getRegisterValue("eax", registerMap), 0xfffffe00L)
616 self.assertEqual(RegisterHelper.getRegisterValue("ax", registerMap), 0xfe00L)
617 self.assertEqual(RegisterHelper.getRegisterValue("ah", registerMap), 0xfeL)
618 self.assertEqual(RegisterHelper.getRegisterValue("al", registerMap), 0x0L)
619
620 self.assertEqual(RegisterHelper.getRegisterValue("rbx", registerMap), 0x7ffff79a7640L)
621 self.assertEqual(RegisterHelper.getRegisterValue("ebx", registerMap), 0xf79a7640L)
622 self.assertEqual(RegisterHelper.getRegisterValue("bx", registerMap), 0x7640L)
623 self.assertEqual(RegisterHelper.getRegisterValue("bh", registerMap), 0x76L)
624 self.assertEqual(RegisterHelper.getRegisterValue("bl", registerMap), 0x40L)
625
628 config = ProgramConfiguration("test", "x86", "linux")
629
630 with open('minidump-example.txt', 'r') as f:
631 crashInfo = MinidumpCrashInfo([], f.read().splitlines(), config)
632
633 self.assertEqual(len(crashInfo.backtrace), 44)
634 self.assertEqual(crashInfo.backtrace[0], "??")
635 self.assertEqual(crashInfo.backtrace[5], "??")
636 self.assertEqual(crashInfo.backtrace[6], "nsAppShell::ProcessNextNativeEvent")
637 self.assertEqual(crashInfo.backtrace[7], "nsBaseAppShell::DoProcessNextNativeEvent")
638
639 self.assertEqual(crashInfo.crashAddress, long(0x3e800006acb))
640
643 config = ProgramConfiguration("test", "x86", "linux")
644
645 with open('minidump-example.txt', 'r') as f:
646 crashData = f.read().splitlines()
647
648 crashInfo = CrashInfo.fromRawCrashData([], [], config, crashData)
649 self.assertEqual(crashInfo.crashAddress, long(0x3e800006acb))
650
653 config = ProgramConfiguration("test", "x86-64", "macosx")
654
655 with open('apple-crash-report-example.txt', 'r') as f:
656 crashInfo = AppleCrashInfo([], [], config, f.read().splitlines())
657
658 self.assertEqual(len(crashInfo.backtrace), 9)
659 self.assertEqual(crashInfo.backtrace[0], "js::jit::MacroAssembler::Pop")
660 self.assertEqual(crashInfo.backtrace[1], "js::jit::ICGetPropCallNativeCompiler::generateStubCode")
661 self.assertEqual(crashInfo.backtrace[2], "js::jit::ICStubCompiler::getStubCode")
662 self.assertEqual(crashInfo.backtrace[3], "js::jit::ICGetPropCallNativeCompiler::getStub")
663 self.assertEqual(crashInfo.backtrace[4], "js::jit::DoGetPropFallback")
664 self.assertEqual(crashInfo.backtrace[5], "??")
665 self.assertEqual(crashInfo.backtrace[6], "__cxa_finalize_ranges")
666 self.assertEqual(crashInfo.backtrace[7], "??")
667 self.assertEqual(crashInfo.backtrace[8], "-[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:]")
668
669 self.assertEqual(crashInfo.crashAddress, long(0x00007fff5f3fff98))
670
673 config = ProgramConfiguration("test", "x86-64", "macosx")
674
675 with open('apple-crash-report-example.txt', 'r') as f:
676 crashData = f.read().splitlines()
677
678 crashInfo = CrashInfo.fromRawCrashData([], [], config, crashData)
679 self.assertEqual(crashInfo.crashAddress, long(0x00007fff5f3fff98))
680
683 config = ProgramConfiguration("test", "x86", "linux")
684
685 crashInfo = CrashInfo.fromRawCrashData([], [], config, ubsanSampleTrace1.splitlines())
686 self.assertEqual(crashInfo.backtrace[0], "WelsDec::BsGetUe")
687 self.assertEqual(crashInfo.backtrace[9], "_start")
688
689 self.assertEqual(crashInfo.backtrace[11], "Lex< >")
690
691
692 if __name__ == "__main__":
693 unittest.main()
694