ARM64 supports storing pointer authentication codes in the upper bits of
a pointer. This mask can be used by LLDB to mimic ptrauth_strip and
strip the pointer authentication codes. To recover an address from
pointer with an authentication code, `AND` this mask with the pointer.
If the platform does not support pointer authentication, or the range of
valid addressees for a pointer was unaccessible, this field will be 0
and should be ignored.
Change-Id: Ie5cef90802dd1e892d456195ab8874223eac6a1b
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/2773358
Commit-Queue: Justin Cohen <justincohen@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
sed -i '' -E -e 's/Copyright (.+) The Crashpad Authors\. All rights reserved\.$/Copyright \1 The Crashpad Authors/' $(git grep -El 'Copyright (.+) The Crashpad Authors\. All rights reserved\.$')
Bug: chromium:1098010
Change-Id: I8d6138469ddbe3d281a5d83f64cf918ec2491611
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3878262
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Mark Mentovai <mark@chromium.org>
Fuchsia's Crashpad roller was broken due to uninitialized fields in
structs.
Bug: fxbug.dev/101498
Change-Id: I1283afea9c5ac4eddb432590f9a5ec5cb1856a7c
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3704517
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Alex Pankhurst <pankhurst@google.com>
This CL adds a new method ThreadSnapshot::ThreadName(), implements
it in each snapshot implementation, and adds tests for iOS, macOS,
Linux, Windows, and Fuchsia.
Bug: crashpad:327
Change-Id: I35031975223854c19d977e057dd026a40d33fd41
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3671776
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Ben Hamilton <benhamilton@google.com>
Reviewed-by: Ben Hamilton <benhamilton@google.com>
This change was partially scripted and partially done manually with vim
regex + manually placing the deleted constructors.
The script change looked for destructors in the public: section of a
class, if that existed the deleted constructors would go before the
destructor.
For manual placement I looked for any constructor in the public: section
of the corresponding class. If there wasn't one, then it would ideally
have gone as the first entry except below enums, classes and typedefs.
This may not have been perfect, but is hopefully good enough. Fingers
crossed.
#include "base/macros.h" is removed from files that don't use
ignore_result, which is the only other thing defined in base/macros.h.
Bug: chromium:1010217
Change-Id: I099526255a40b1ac1264904b4ece2f3f503c9418
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3171034
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Peter Boström <pbos@chromium.org>
Chromium moved base::size() to base/cxx17_backports.h, so do the same in
mini_chromium and update the users in Crashpad.
Roll mini_chromium to 2f06f83f to make the new base header available.
Bug: chromium:1210983
Change-Id: Ie3dc4c189dcdfcac030b95fe285f94abb29a27bf
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/2917779
Commit-Queue: Lei Zhang <thestig@chromium.org>
Commit-Queue: Mark Mentovai <mark@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
If the process' threads can't be read, then the cpu context object won't
be able to be initialized.
Previously, the process snapshot always assumed that the context would
be filled out, as there was no error returned, which could result in
later checks failing.
Return an error from the exception snapshot's initialization so that
process snapshot can correctly handle failure to initialize.
Bug: fuchsia:55837
Change-Id: Ia3fecef1230a19dfa23401b0339c6a94370c6baf
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/2296039
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
We occassionally see UB here that looks like context_.architecture isn't
initialized.
Note to reviewers: needs a test. Guidance on where/how to write one
would be most welcome.
Bug: fuchsia:55587
Change-Id: I886972e4d3a5c1e0c53eb17f3f65dada47a84115
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/2281881
Reviewed-by: Mark Mentovai <mark@chromium.org>
Reviewed-by: Scott Graham <scottmg@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
If the file just needs the CHECK/CHECK_OP/NOTREACHED
macros, use the appropriate header for that instead.
Or if logging.h is not needed at all, remove it.
This is both a nice cleanup (logging.h is a big header,
and including it unnecessarily has compile-time costs),
and part of the final step towards making logging.h no
longer include check.h and the others.
Bug: chromium:1031540
Change-Id: Ia46806bd95fe498bcf3cf6d2c13ffa4081678043
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/2255361
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Hans Wennborg <hans@chromium.org>
The new API replaces zx_system_get_version and is simpler.
Bug: fuchsia:45640
Change-Id: Ibc47703aba0e87e55265608b517e5953eada182f
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/2063908
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Scott Graham <scottmg@chromium.org>
In a stack overflow test from the Fuchsia tree, an intentional crash was
being induced that at the point it was reported to Crashpad resulted in
a stack pointer outside of the stack. This caused two problems:
- Crashpad attempted to capture that whole "thing" which could have been
anything, and in the failing test was a 1G guard region
- The whole wrong thing could be very large, resulting in OOM when
trying to write the minidump, which was the symptom of the bug.
Don't attempt to continue of SP isn't at least in a mapping, and don't
capture too-large regions for the stack as nothing useful can come of
that anyway.
New test added: ProcessSnapshotFuchsiaTest.InvalidStackPointer.
Bug: fuchsia:41212
Change-Id: Ifb48fd8b4b5b2f0cf10ab97e01dbd8b842368775
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1912942
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Francois Rousseau <frousseau@google.com>
This allows partial reading of the current process (e.g. modules or
CrashpadInfo), even though the memory map read (and so thread retrieval)
will fail if ProcessSnapshotFuchsia is used on the current process.
This is a follow up to
db6f51d3fc
which broke the CrashpadInfoClientOptions.* tests.
Bug: fuchsia:34598
Change-Id: Ifa17b4dbefcd198ff67ecea91f946cfa2439ca4c
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1776936
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
From looking at some syzkaller logs, the earliest error seems to be
[...ERROR memory_map_fuchsia.cc:47] zx_object_get_info ZX_INFO_PROCESS_MAPS: ZX_ERR_BAD_STATE (-20)
which might be caused by a failure to suspend. That error causes
ProcessReaderFuchsia's memory_map_ Initialize() to fail, but that was
mistakenly being ignored. Later calls then fail as well.
While we're here, also check a couple other Initialize()s that were
sometimes triggering later on.
Bug: https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=34598
Change-Id: I9f9d7315f504e6ec69308add20e2737ce5c5f644
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1763028
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
Stack mappings can be enormous for some processes dwarfing all other
data and making the .dmp useless. It isn't useful to capture beyond the
stack pointer, so grab only from the stack base to the stack pointer.
In the default config (safestack enabled), this isn't a major problem.
However, Chromium has safestack disabled, along with a large stack size,
so dumps with many threads become very large.
Bug: https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=6425
Bug: chromium:821951
Change-Id: Iebefc5fe43e3d1bc4d8b66c107d3ab8ae5b3f68b
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1758702
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Francois Rousseau <frousseau@google.com>
This is very similar to the windows implementation in
module_snapshot_win.cc.
Bug: crashpad:95
Change-Id: I3858e8bb0009c95395bfb7ca3855c3d937fd49d5
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1641588
Commit-Queue: Clark DuVall <cduvall@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
Also remove MemorySnapshotWin since the code is identical to
MemorySnapshotGeneric now.
Bug: crashpad:95
Change-Id: I9a631f8eb206dd72a69158021db87e8db41c5913
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1642148
Reviewed-by: Mark Mentovai <mark@chromium.org>
Reviewed-by: Vlad Tsyrklevich <vtsyrklevich@chromium.org>
Commit-Queue: Clark DuVall <cduvall@chromium.org>
On Fuchsia, executables and loadable modules don't have a name at build
time so we use "<_>" as module name to index their symbols on the crash
server. We need to use the same dummy value at run time.
Bug: fuchsia/DX-1193
Tested: `fx run-test crashpad_test`
Change-Id: Ie926a6d26cb52679ccfac767db098c9fbfd21dd8
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1548230
Commit-Queue: Francois Rousseau <frousseau@google.com>
Reviewed-by: Scott Graham <scottmg@chromium.org>
Fuchsia in the future will create VMOs as non-executable (i.e.,
without ZX_RIGHT_EXECUTE) by default, so this necessary preparation
for that.
Change-Id: I00ada804d1d16db4f50ff3882058e382b1845328
Reviewed-on: https://chromium-review.googlesource.com/c/1419778
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Matthew Dempsky <mdempsky@chromium.org>
Test: Existing
Change-Id: I36fde186de372d2b86807f4da4e6e589a1b19706
Reviewed-on: https://chromium-review.googlesource.com/c/1395479
Reviewed-by: Scott Graham <scottmg@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
This is a follow-up to c8a016b99d97, following the post-landing
discussion at
https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1393921/5#message-2058541d8c4505d20a990ab7734cd758e437a5f7
base::size, and std::size that will eventually replace it when C++17 is
assured, does not allow the size of non-static data members to be taken
in constant expression context. The remaining uses of ArraySize are in:
minidump/minidump_exception_writer.cc (×1)
minidump/minidump_system_info_writer.cc (×2, also uses base::size)
snapshot/cpu_context.cc (×4, also uses base::size)
util/misc/arraysize_test.cc (×10, of course)
The first of these occurs when initializing a constexpr variable. All
others are in expressions used with static_assert.
Includes:
Update mini_chromium to 737433ebade4d446643c6c07daae02a67e8deccao
f701716d9546 Add Windows ARM64 build target to mini_chromium
87a95a3d6ac2 Remove the arraysize macro
1f7255ead1f7 Placate MSVC in areas of base::size usage
737433ebade4 Add cast
Bug: chromium:837308
Change-Id: I6a5162654461b1bdd9b7b6864d0d71a734bcde19
Reviewed-on: https://chromium-review.googlesource.com/c/1396108
Commit-Queue: Mark Mentovai <mark@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
This plumbs some of the ZX_INFO_PROCESS_MAPS information out into
MINIDUMP_MEMORY_INFO. The mapping loses some information that Zircon
provides, and some of the data that Windows would provide isn't
available (for example, AllocationProtect). But this gives a general
idea of the memory layout of the process to check for bad pointers, etc.
when inspecting crashes.
Bug: fuchsia:DX-615
Change-Id: I2d7c02be0996672253cf0b1eb6a60b0a55e6033b
Reviewed-on: https://chromium-review.googlesource.com/c/1377089
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
we now run this code on arm64 devices in debug mode
Bug: crashpad:196
Bug: fuchsia:DX-712
Change-Id: Iea1975c5bd4cab3d503ca371ab731e25962fb255
Tested: /system/test/crashpad_tests on arm64 device in debug mode
Reviewed-on: https://chromium-review.googlesource.com/c/1352097
Commit-Queue: Francois Rousseau <frousseau@google.com>
Reviewed-by: Scott Graham <scottmg@chromium.org>
Add a method to the ProcessSnapshot to expose a ProcessMemory object to
allow reading memory directly from the underlying process.
CQ-DEPEND=CL:1278830
BUG=crashpad:262
Change-Id: Ied2a5510a9b051c7ac8c41cdd060e8daa531086e
Reviewed-on: https://chromium-review.googlesource.com/c/1315428
Commit-Queue: Vlad Tsyrklevich <vtsyrklevich@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
Flaking like:
[ RUN ] ProcessReaderFuchsia.ChildThreads
[22244:22258:20181109,001621.809627:ERROR scoped_task_suspend.cc:44] thread failed to suspend
[22244:22258:20181109,001621.810893:WARNING process_reader_fuchsia.cc:283] zx_thread_read_state(ZX_THREAD_STATE_GENERAL_REGS): ZX_ERR_BAD_STATE (-20)
[22244:22258:20181109,001621.810937:WARNING process_reader_fuchsia.cc:295] zx_thread_read_state(ZX_THREAD_STATE_VECTOR_REGS): ZX_ERR_BAD_STATE (-20)
../../third_party/crashpad/snapshot/fuchsia/process_reader_fuchsia_test.cc:161: Failure
Expected: (threads[i].stack_regions.size()) > (0u), actual: 0 vs 0
[ FAILED ] ProcessReaderFuchsia.ChildThreads (2487 ms)
ScopedTaskSuspend appears to try relatively hard to suspend, and without
retrying indefinitely it's not clear how to do a better job. Retrying
forever isn't suitable for production code though, where it would cause
the crash reporter to hang.
Bug: fuchsia:US-553
Change-Id: Ie233d2f5578cb8c35ce47207df4f1f8d2e1152f1
Reviewed-on: https://chromium-review.googlesource.com/c/1328022
Reviewed-by: Francois Rousseau <frousseau@google.com>
Commit-Queue: Scott Graham <scottmg@chromium.org>
In the future, Zircon's time types will change from unsigned to
signed. Use ZX_TIME_INFINITE instead of UINT64_MAX when
zx_nanosleep'ing.
See related Zircon bug ZX-2100.
Change-Id: I5eb139280c27ca817e1a489f04c860563c9b677c
Reviewed-on: https://chromium-review.googlesource.com/1123221
Commit-Queue: Nick Maniscalco <maniscalco@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Change-Id: Ifcfe6c2d18045ce3a2e443ee84d4dd84bb3db373
Reviewed-on: https://chromium-review.googlesource.com/1073567
Reviewed-by: Scott Graham <scottmg@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
Bug: crashpad:196
Change-Id: I82cf1c5384ebfc2fb7882e69145b211c4b24f7c5
Reviewed-on: https://chromium-review.googlesource.com/1054576
Reviewed-by: Scott Graham <scottmg@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
Annotations data structures may be dynamically allocated so could
appear outside a modules's address range. Let ImageAnnotationReader
use a ProcessMemoryRange for the process, rather than the module.
Also add a test for linux.
Bug: crashpad:30
Change-Id: Ibbf1d2fcb2e44b1b70c8a02e86c6f2fbd784535f
Reviewed-on: https://chromium-review.googlesource.com/1054705
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
Reviewed-by: Scott Graham <scottmg@chromium.org>
Packaged test running seems to be a ways off, but with a bit of path
fiddling in test_paths.cc we can actually use the paths where the tests
are copied, so do that instead to get all the tests re-enabled. The
setup in BUILD.gn should be mostly-useful once packaging is working as
all helper/data files will need to specified there anyway.
Also, attempted fix to flaky behaviour in
ProcessReaderFuchsia.ChildThreads exposed because the tests are now
being run. zx_object_wait_many() waits on *any* of the objects, not
*all* of them. Derp!
And finally, for the same test, work around some unintuitive behaviour
in zx_task_suspend(), in particular that the thread will not be
suspended for the purpose of reading registers right away, but instead
only "sometime later", which appears in pratice to be after the next
context switch. Have ScopedTaskSuspend block for a while to try to
ensure the registers become readble, and if they don't, at least fail
noisily at that point.
Bug: crashpad:196
Change-Id: I01fb3590ede96301c941c2a88eba47fdbfe74ea7
Reviewed-on: https://chromium-review.googlesource.com/1053797
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
The package deployment/running is in flux at the moment. In order to get
all the other tests on to the main Fuchsia waterfall, disable the ~25
tests that require external files (for launching child processes,
loading modules, or data files) because those operations all fail on
Fuchsia-without-packages right now. Upstream this is PKG-46. Once test
packaging and running has been resolved, this can be reverted.
These tests are still run when building Crashpad standalone on Fuchsia
as the standalone build simply copies all the relevant data files to the
device in /tmp.
Bug: crashpad:196
Change-Id: I1677c394a2b9d709c59363ebeea8aff193d4c21d
Reviewed-on: https://chromium-review.googlesource.com/1045547
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Implements InitializeException() in ProcessSnapshot, and pulls it all
together writing the dump in crash handler. Sample output at crash
00163eff624e653e on the staging server.
Also adds a child-retrieve helper to koid_utilities.
Bug: crashpad:196
Change-Id: I4bee7655e81e3243ac0ae896ff0caea7ce4acdad
Reviewed-on: https://chromium-review.googlesource.com/1044771
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
- Endian-swaps the 3 integer fields of the build id when returning it
for use as the module id (see bug 229).
- Removes the "app:" prefix on the main binary, as this prevents the
crash server from matching the binary name (and it isn't particularly
useful anyway)
- Map "<vDSO>" to "libzircon.so" as that's what it actually is, so that
symbols for it can be found.
Bug: crashpad:196, crashpad:229
Change-Id: Ie4abc732b7696345b96c34dbb1a7d2cc2cfcf77f
Reviewed-on: https://chromium-review.googlesource.com/1035461
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
This "child" test was actually reading itself (whoops!). Instead, pass
the address of the string to be read back from the child and read that.
Bug: crashpad:196
Change-Id: I27aa4cd06c69cd492cb3387a5a773a56e9cb02a3
Reviewed-on: https://chromium-review.googlesource.com/1033712
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
Conversion to CPUContext is currently only implemented for x64.
Bug: crashpad:196
Change-Id: I3fb8541f70a6f8d6f12c02e6b17c78e07e195056
Reviewed-on: https://chromium-review.googlesource.com/1007967
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
This implementation has some limitations as documented in the header,
however, threads must be suspended in order to use the register capture
debug API so this is somewhat useful for now in the context of
generate_dump.
Also, refactor some child-object retrieval helpers used in a few places.
Bug: crashpad:196
Change-Id: I1fdae5fc3d4b43841e535724eac10c1e58af04c5
Reviewed-on: https://chromium-review.googlesource.com/1007966
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
uname() seems to hang, sometimes, perhaps when then network is in a bad
state. Additionally, this way allows getting a minimal amount of version
information via zx_system_get_version().
Bug: crashpad:196
Change-Id: I2c040ee38ae017a6e8e060de10039bae6d159058
Reviewed-on: https://chromium-review.googlesource.com/1007979
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
With this `generate_dump <somepid>` generates a valid and somewhat
plausible (but still quite incomplete) minidump.
As an example, on a running Fuchsia system, `ps` reported the pid of
"netstack" as 6062, followed by `generate_dump 6062`, copy minidump.6062
to host, and run Breakpad's minidump_dump on the generated dump file,
resulting in:
https://gist.github.com/sgraham/24e4ba1af968219d7c154bb0fba43925
This looks roughly correct in that it has a bunch of threads (without
much data) and a reasonable looking module list.
Bug: crashpad:196
Change-Id: I3f68cc015f74374624a5ce497d46ac90df17a22c
Reviewed-on: https://chromium-review.googlesource.com/1005978
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
