aboutsummaryrefslogtreecommitdiff
path: root/src/processor
diff options
context:
space:
mode:
Diffstat (limited to 'src/processor')
-rw-r--r--src/processor/stackwalker_x86.cc117
1 files changed, 115 insertions, 2 deletions
diff --git a/src/processor/stackwalker_x86.cc b/src/processor/stackwalker_x86.cc
index 14824ddf..cb8be3ed 100644
--- a/src/processor/stackwalker_x86.cc
+++ b/src/processor/stackwalker_x86.cc
@@ -38,6 +38,7 @@
#include "processor/stackwalker_x86.h"
#include "google_breakpad/processor/call_stack.h"
+#include "google_breakpad/processor/code_modules.h"
#include "google_breakpad/processor/memory_region.h"
#include "google_breakpad/processor/stack_frame_cpu.h"
#include "processor/linked_ptr.h"
@@ -163,15 +164,23 @@ StackFrame* StackwalkerX86::GetCallerFrame(
// postfix notation and will be passed to PostfixEvaluator::Evaluate.
// Given the dictionary and the program string, it is possible to compute
// the return address and the values of other registers in the calling
- // function.
+ // function. When encountering a nontraditional frame (one which takes
+ // advantage of FPO), the stack may need to be scanned for these values.
+ // For traditional frames, simple deterministic dereferencing suffices
+ // without any need for scanning. The results of program string evaluation
+ // will be used to determine whether to scan for better values.
string program_string;
+ bool traditional_frame = true;
+ bool recover_ebp = true;
if (last_frame_info && last_frame_info->valid == StackFrameInfo::VALID_ALL) {
// FPO data available.
+ traditional_frame = false;
if (!last_frame_info->program_string.empty()) {
// The FPO data has its own program string, which will tell us how to
// get to the caller frame, and may even fill in the values of
// nonvolatile registers and provide pointers to local variables and
- // parameters.
+ // parameters. In some cases, particularly with program strings that use
+ // .raSearchStart, the stack may need to be scanned afterward.
program_string = last_frame_info->program_string;
} else if (last_frame_info->allocates_base_pointer) {
// The function corresponding to the last frame doesn't use the frame
@@ -197,6 +206,15 @@ StackFrame* StackwalkerX86::GetCallerFrame(
// the caller is at a known location in the saved-register area of
// the stack frame.
//
+ // For this type of frame, MSVC 14 (from Visual Studio 8/2005) in
+ // link-time code generation mode (/LTCG and /GL) can generate erroneous
+ // debugging data. The reported size of saved registers can be 0,
+ // which is clearly an error because these frames must, at the very
+ // least, save %ebp. For this reason, in addition to those given above
+ // about the use of .raSearchStart, the stack may need to be scanned
+ // for a better return address and a better frame pointer after the
+ // program string is evaluated.
+ //
// %eip_new = *(%esp_old + callee_params + saved_regs + locals)
// %ebp_new = *(%esp_old + callee_params + saved_regs - 8)
// %esp_new = %esp_old + callee_params + saved_regs + locals + 4
@@ -217,12 +235,18 @@ StackFrame* StackwalkerX86::GetCallerFrame(
// is the value that it had in the caller, so it can be carried
// straight through without bringing its validity into question.
//
+ // Because of the use of .raSearchStart, the stack will possibly be
+ // examined to locate a better return address after program string
+ // evaluation. The stack will not be examined to locate a saved
+ // %ebp value, because these frames do not save (or use) %ebp.
+ //
// %eip_new = *(%esp_old + callee_params + saved_regs + locals)
// %esp_new = %esp_old + callee_params + saved_regs + locals + 4
// %ebp_new = %ebp_old
program_string = "$eip .raSearchStart ^ = "
"$esp .raSearchStart 4 + = "
"$ebp $ebp =";
+ recover_ebp = false;
}
} else {
// No FPO information is available for the last frame. Assume that the
@@ -244,6 +268,10 @@ StackFrame* StackwalkerX86::GetCallerFrame(
// CALL itself, and 4 bytes for the callee's PUSH of the caller's frame
// pointer.
//
+ // Instruction and frame pointer recovery for these traditional frames is
+ // entirely deterministic, and the stack will not be scanned after
+ // recovering these values.
+ //
// %eip_new = *(%ebp_old + 4)
// %esp_new = %ebp_old + 8
// %ebp_new = *(%ebp_old)
@@ -264,6 +292,91 @@ StackFrame* StackwalkerX86::GetCallerFrame(
return NULL;
}
+ // If this stack frame did not use %ebp in a traditional way, locating the
+ // return address isn't entirely deterministic. In that case, the stack
+ // can be scanned to locate the return address.
+ //
+ // Even in nontraditional frames, if program string evaluation resulted in
+ // both %eip and %ebp values of 0, trust that the end of the stack has been
+ // reached and don't scan for anything else.
+ if (!traditional_frame &&
+ (dictionary["$eip"] != 0 || dictionary["$ebp"] != 0)) {
+ int offset = 0;
+
+ // This scan can only be done if a CodeModules object is available, to
+ // check that candidate return addresses are in fact inside a module.
+ //
+ // TODO(mmentovai): This ignores dynamically-generated code. One possible
+ // solution is to check the minidump's memory map to see if the candidate
+ // %eip value comes from a mapped executable page, although this would
+ // require dumps that contain MINIDUMP_MEMORY_INFO, which the Breakpad
+ // client doesn't currently write (it would need to call MiniDumpWriteDump
+ // with the MiniDumpWithFullMemoryInfo type bit set). Even given this
+ // ability, older OSes (pre-XP SP2) and CPUs (pre-P4) don't enforce
+ // an independent execute privilege on memory pages.
+
+ u_int32_t eip = dictionary["$eip"];
+ if (modules_ && !modules_->GetModuleForAddress(eip)) {
+ const int kRASearchWords = 15;
+
+ // The instruction pointer at .raSearchStart was invalid, so start
+ // looking one 32-bit word above that location.
+ u_int32_t location_start = dictionary[".raSearchStart"] + 4;
+
+ for (u_int32_t location = location_start;
+ location <= location_start + kRASearchWords * 4;
+ location += 4) {
+ if (!memory_->GetMemoryAtAddress(location, &eip))
+ break;
+
+ if (modules_->GetModuleForAddress(eip)) {
+ // This is a better return address that what program string
+ // evaluation found. Use it, and set %esp to the location above the
+ // one where the return address was found.
+ //
+ // TODO(mmentovai): The return-address check can be made even
+ // stronger in modules for which debugging data is available. In
+ // that case, it's possible to check that the candidate return
+ // address is inside a known function.
+
+ dictionary["$eip"] = eip;
+ dictionary["$esp"] = location + 4;
+ offset = location - location_start;
+ break;
+ }
+ }
+ }
+
+ // When trying to recover the previous value of the frame pointer (%ebp),
+ // start looking at the lowest possible address in the saved-register
+ // area, and look at the entire saved register area, increased by the
+ // size of |offset| to account for additional data that may be on the
+ // stack. The scan is performed from the highest possible address to
+ // the lowest, because we expect that the function's prolog would have
+ // saved %ebp early.
+ u_int32_t ebp = dictionary["$ebp"];
+ u_int32_t value; // throwaway variable to check pointer validity
+ if (recover_ebp && !memory_->GetMemoryAtAddress(ebp, &value)) {
+ int fp_search_bytes = last_frame_info->saved_register_size + offset;
+ u_int32_t location_end = last_frame->context.esp +
+ last_frame_callee_parameter_size;
+
+ for (u_int32_t location = location_end + fp_search_bytes;
+ location >= location_end;
+ location -= 4) {
+ if (!memory_->GetMemoryAtAddress(location, &ebp))
+ break;
+
+ if (memory_->GetMemoryAtAddress(ebp, &value)) {
+ // The candidate value is a pointer to the same memory region
+ // (the stack). Prefer it as a recovered %ebp result.
+ dictionary["$ebp"] = ebp;
+ break;
+ }
+ }
+ }
+ }
+
// Treat an instruction address of 0 as end-of-stack. Treat incorrect stack
// direction as end-of-stack to enforce progress and avoid infinite loops.
if (dictionary["$eip"] == 0 ||