{"action":"created","issue":{"url":"https://api.github.com/repos/DynamoRIO/drmemory/issues/1745","labels_url":"https://api.github.com/repos/DynamoRIO/drmemory/issues/1745/labels{/name}","comments_url":"https://api.github.com/repos/DynamoRIO/drmemory/issues/1745/comments","events_url":"https://api.github.com/repos/DynamoRIO/drmemory/issues/1745/events","html_url":"https://github.com/DynamoRIO/drmemory/issues/1745","id":98304329,"number":1745,"title":"CRASH cleanup of drfuzz_test_empty","user":{"login":"derekbruening","id":6509618,"avatar_url":"https://avatars.githubusercontent.com/u/6509618?v=3","gravatar_id":"","url":"https://api.github.com/users/derekbruening","html_url":"https://github.com/derekbruening","followers_url":"https://api.github.com/users/derekbruening/followers","following_url":"https://api.github.com/users/derekbruening/following{/other_user}","gists_url":"https://api.github.com/users/derekbruening/gists{/gist_id}","starred_url":"https://api.github.com/users/derekbruening/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/derekbruening/subscriptions","organizations_url":"https://api.github.com/users/derekbruening/orgs","repos_url":"https://api.github.com/users/derekbruening/repos","events_url":"https://api.github.com/users/derekbruening/events{/privacy}","received_events_url":"https://api.github.com/users/derekbruening/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/DynamoRIO/drmemory/labels/Bug-ToolCrash","name":"Bug-ToolCrash","color":"FFAAAA"},{"url":"https://api.github.com/repos/DynamoRIO/drmemory/labels/Component-DrFuzz","name":"Component-DrFuzz","color":"ffffff"},{"url":"https://api.github.com/repos/DynamoRIO/drmemory/labels/OpSys-Linux","name":"OpSys-Linux","color":"FFFFFF"},{"url":"https://api.github.com/repos/DynamoRIO/drmemory/labels/Priority-High","name":"Priority-High","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"derekbruening","id":6509618,"avatar_url":"https://avatars.githubusercontent.com/u/6509618?v=3","gravatar_id":"","url":"https://api.github.com/users/derekbruening","html_url":"https://github.com/derekbruening","followers_url":"https://api.github.com/users/derekbruening/followers","following_url":"https://api.github.com/users/derekbruening/following{/other_user}","gists_url":"https://api.github.com/users/derekbruening/gists{/gist_id}","starred_url":"https://api.github.com/users/derekbruening/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/derekbruening/subscriptions","organizations_url":"https://api.github.com/users/derekbruening/orgs","repos_url":"https://api.github.com/users/derekbruening/repos","events_url":"https://api.github.com/users/derekbruening/events{/privacy}","received_events_url":"https://api.github.com/users/derekbruening/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2015-07-31T02:40:13Z","updated_at":"2015-07-31T17:20:20Z","closed_at":null,"body":"On my Fedora 20 machine drfuzz_test_empty fails every time in every build:\r\n\r\n```\r\ndrheapstat-dbg-32: 30 tests passed, **** 1 tests failed: ****\r\n        drfuzz_test_empty \r\ndrheapstat-rel-32: 30 tests passed, **** 1 tests failed: ****\r\n        drfuzz_test_empty \r\ndrmemory-dbg-32: 67 tests passed, **** 1 tests failed: ****\r\n        drfuzz_test_empty \r\ndrmemory-dbg-64: 14 tests passed, **** 1 tests failed: ****\r\n        drfuzz_test_empty \r\ndrmemory-rel-32: 67 tests passed, **** 1 tests failed: ****\r\n        drfuzz_test_empty \r\ndrmemory-rel-64: 14 tests passed, **** 1 tests failed: ****\r\n        drfuzz_test_empty \r\nfinal package: build successful; no tests for this build\r\n```\r\n\r\nThe suite log files show that it crashes:\r\n\r\n```\r\n<Stopping application /work/drmemory/build_suite/build_drmemory-dbg-32/tests/drfuzz_test_empty (4343)>\r\n<Application /work/drmemory/build_suite/build_drmemory-dbg-32/tests/drfuzz_test_empty (4343).  Tool internal crash at PC 0x790074e8.  Please report this at your tool's issue tracker.  Program aborted.\r\nReceived SIGSEGV at pc 0x790074e8 in thread 4343\r\nBase: 0xf7000000\r\nRegisters:eax=0x00000000 ebx=0x79016000 ecx=0x5296a95c edx=0x00000140\r\n        esi=0x000010f7 edi=0xf739e000 esp=0x5296a900 ebp=0x5296a910\r\n        eflags=0x00010202\r\nversion 5.0.16625, custom build\r\n-no_dynamic_options -client_lib '/work/drmemory/build_suite/build_drmemory-dbg-32/tests/libdrfuzz_test_empty.client.so;0;' -code_api -stack_size 56K -max_elide_jmp 0 -max_elide_call 0 -early_inject -emulate_brk -no_inline_ignored_syscalls -native_exec_default_list '' -no_native_exec_managed_code -no_indcall2direct \r\n0x5296a910 0x79007654\r\n0x5296a930 0x7900d4b0\r\n0x5296aaa4 0xf71e298c\r\n0x5296aae0 0xf7074ca5\r\n0x5296aaf0 0xf707323a\r\n0x5296ab10 0xf70733fc\r\n0x5296ab40 0xf7278913\r\n0x5296ab50 0x529113c0\r\n0xf729a501 0x5e5b0000>\r\n```\r\n\r\nAttaching gdb to a manual run:\r\n\r\n```\r\n(gdb) bt\r\n#0  0x790074e8 in drwrap_free_user_data (drcontext=0x4da593c0, pt=0x0, i=0)\r\n    at /work/drmemory/git/src/dynamorio/ext/drwrap/drwrap.c:965\r\n#1  0x79007654 in drwrap_thread_exit (drcontext=0x4da593c0)\r\n    at /work/drmemory/git/src/dynamorio/ext/drwrap/drwrap.c:988\r\n#2  0x7900d4b0 in drmgr_thread_exit_event (drcontext=0x4da593c0)\r\n    at /work/drmemory/git/src/dynamorio/ext/drmgr/drmgr.c:1671\r\n#3  0xf71e298c in instrument_thread_exit_event (dcontext=0x4da593c0)\r\n    at /work/drmemory/git/src/dynamorio/core/lib/instrument.c:1242\r\n#4  0xf7074ca5 in dynamo_thread_exit_pre_client (dcontext=0x4da593c0, id=22401)\r\n    at /work/drmemory/git/src/dynamorio/core/dynamo.c:2271\r\n#5  0xf707323a in dynamo_process_exit_cleanup () at /work/drmemory/git/src/dynamorio/core/dynamo.c:1220\r\n#6  0xf70733fc in dynamo_process_exit () at /work/drmemory/git/src/dynamorio/core/dynamo.c:1294\r\n```"},"comment":{"url":"https://api.github.com/repos/DynamoRIO/drmemory/issues/comments/126756983","html_url":"https://github.com/DynamoRIO/drmemory/issues/1745#issuecomment-126756983","issue_url":"https://api.github.com/repos/DynamoRIO/drmemory/issues/1745","id":126756983,"user":{"login":"derekbruening","id":6509618,"avatar_url":"https://avatars.githubusercontent.com/u/6509618?v=3","gravatar_id":"","url":"https://api.github.com/users/derekbruening","html_url":"https://github.com/derekbruening","followers_url":"https://api.github.com/users/derekbruening/followers","following_url":"https://api.github.com/users/derekbruening/following{/other_user}","gists_url":"https://api.github.com/users/derekbruening/gists{/gist_id}","starred_url":"https://api.github.com/users/derekbruening/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/derekbruening/subscriptions","organizations_url":"https://api.github.com/users/derekbruening/orgs","repos_url":"https://api.github.com/users/derekbruening/repos","events_url":"https://api.github.com/users/derekbruening/events{/privacy}","received_events_url":"https://api.github.com/users/derekbruening/received_events","type":"User","site_admin":false},"created_at":"2015-07-31T17:20:20Z","updated_at":"2015-07-31T17:20:20Z","body":"The bug is that there are 2 copies of drmgr and they clobber each other's DR TLS field:\r\n\r\n```\r\nBreakpoint 1, dr_set_tls_field (drcontext=0xef0213c0, value=0xef07ed14) at /work/drmemory/git/src/dynamorio/core/lib/instrument.c:4415\r\n4415        dcontext_t *dcontext = (dcontext_t *) drcontext;\r\n(gdb) bt\r\n#0  dr_set_tls_field (drcontext=0xef0213c0, value=0xef07ed14) at /work/drmemory/git/src/dynamorio/core/lib/instrument.c:4415\r\n#1  0x7900d3a7 in drmgr_thread_init_event (drcontext=0xef0213c0) at /work/drmemory/git/src/dynamorio/ext/drmgr/drmgr.c:1640\r\n#2  0xf71e266f in instrument_thread_init (dcontext=0xef0213c0, client_thread=false, valid_mc=false)\r\n    at /work/drmemory/git/src/dynamorio/core/lib/instrument.c:1198\r\n#3  0xf71e1311 in instrument_init () at /work/drmemory/git/src/dynamorio/core/lib/instrument.c:604\r\n#4  0xf70723ea in dynamorio_app_init () at /work/drmemory/git/src/dynamorio/core/dynamo.c:645\r\n#5  0xf72bbe1d in privload_early_inject (sp=0xffb11bb0, old_libdr_base=0x0, old_libdr_size=0)\r\n    at /work/drmemory/git/src/dynamorio/core/unix/loader.c:1807\r\n#6  0xf72789cf in _start () at /work/drmemory/git/src/dynamorio/core/arch/x86/x86.asm:1177\r\n(gdb) c\r\nContinuing.\r\n\r\nBreakpoint 1, dr_set_tls_field (drcontext=0xef0213c0, value=0xef07f768) at /work/drmemory/git/src/dynamorio/core/lib/instrument.c:4415\r\n4415        dcontext_t *dcontext = (dcontext_t *) drcontext;\r\n(gdb) bt\r\n#0  dr_set_tls_field (drcontext=0xef0213c0, value=0xef07f768) at /work/drmemory/git/src/dynamorio/core/lib/instrument.c:4415\r\n#1  0xf76f1fd7 in drmgr_thread_init_event (drcontext=0xef0213c0) at /work/drmemory/git/src/dynamorio/ext/drmgr/drmgr.c:1640\r\n#2  0xf71e266f in instrument_thread_init (dcontext=0xef0213c0, client_thread=false, valid_mc=false)\r\n    at /work/drmemory/git/src/dynamorio/core/lib/instrument.c:1198\r\n#3  0xf71e1311 in instrument_init () at /work/drmemory/git/src/dynamorio/core/lib/instrument.c:604\r\n#4  0xf70723ea in dynamorio_app_init () at /work/drmemory/git/src/dynamorio/core/dynamo.c:645\r\n#5  0xf72bbe1d in privload_early_inject (sp=0xffb11bb0, old_libdr_base=0x0, old_libdr_size=0)\r\n    at /work/drmemory/git/src/dynamorio/core/unix/loader.c:1807\r\n#6  0xf72789cf in _start () at /work/drmemory/git/src/dynamorio/core/arch/x86/x86.asm:1177\r\n```\r\n\r\nIt seems like it should crash for everyone.  It may depend on the value of uninitialized heap used in drmgr's TLS arrays."}}