Skip to content

dwarf2reader: support NaCl Saigo CFA pseudo-register -2#19

Open
illwieckz wants to merge 1 commit into
masterfrom
illwieckz/saigo-nacl
Open

dwarf2reader: support NaCl Saigo CFA pseudo-register -2#19
illwieckz wants to merge 1 commit into
masterfrom
illwieckz/saigo-nacl

Conversation

@illwieckz

@illwieckz illwieckz commented Jul 13, 2026

Copy link
Copy Markdown
Member

Saigo LLVM emits DWARF CFI using register number -2 as a pseudo-register when describing the canonical frame address.

Breakpad currently interprets this value as register 4294967294, which can produce invalid CFI rules and cause failures while processing symbols.

Normalize the NaCl CFA pseudo-register to Breakpad's existing kCFARegister representation when parsing CFI operands.


Disclaimer: Like for the PHDR NaCl thing (DaemonEngine/native_client#6), I experimented using ChatGPT as a debugger assistant, providing the bot some diagnostic information in a discussion: gdb backtrace, output from readelf, llvm-dwarfdump, etc. The bot suggested me some diagnostics in order to figure out where the unexpected value was emitted. And after extensive testing of the build pipeline it turns out the problem got pretty well cornered!

After such investigation has been done, I decided to patch breakpad because modifying LLVM would probably be a nightmare, and this seems to be the least intrusive workaround.

Saigo LLVM emits DWARF CFI using register number -2 as a
pseudo-register when describing the canonical frame address.

Breakpad currently interprets this value as register 4294967294,
which can produce invalid CFI rules and cause failures while
processing symbols.

Normalize the NaCl CFA pseudo-register to Breakpad's existing
kCFARegister representation when parsing CFI operands.
@illwieckz illwieckz requested a review from slipher July 13, 2026 23:20
@illwieckz illwieckz added the bug label Jul 13, 2026
@illwieckz

Copy link
Copy Markdown
Member Author
$ src/tools/linux/dump_syms/dump_syms cgame-amd64.nexe >crash_generation_app.sym
$ FILE=`head -1 crash_generation_app.sym | cut -f5 -d' '`
$ BUILDID=`head -1 crash_generation_app.sym | cut -f4 -d' '`
$ SYMBOLPATH=symbols/${FILE}/${BUILDID}/
$ mkdir -p ${SYMBOLPATH}
$ mv crash_generation_app.sym ${SYMBOLPATH}
$ ln -s cgame-amd64.nexe symbols/main.nexe
$ ln -s crash_generation_app.sym symbols/main.nexe/BE0794FE0E665A02D9B1FD6F095A58090/main.nexe.sym
$ src/processor/minidump_stackwalk crash-nacl-CGame-1783971162313.dmp symbols/
2026-07-14 00:59:10: minidump.cc:5137: INFO: Minidump opened minidump crash-nacl-CGame-1783971162313.dmp
2026-07-14 00:59:10: minidump.cc:5267: INFO: Minidump not byte-swapping minidump
2026-07-14 00:59:10: minidump.cc:4120: INFO: MinidumpMiscInfo size larger than expected 1368, skipping over the unknown part
2026-07-14 00:59:10: minidump.cc:5919: INFO: GetStream: type 1197932545 not present
2026-07-14 00:59:10: minidump_processor.cc:1731: INFO: Unknown exception reason 0x0000000b / 0x00000000
2026-07-14 00:59:10: minidump.cc:5919: INFO: GetStream: type 1197932546 not present
2026-07-14 00:59:10: minidump.cc:2303: INFO: MinidumpModule could not determine version for main.nexe
2026-07-14 00:59:10: minidump.cc:2303: INFO: MinidumpModule could not determine version for main.nexe
2026-07-14 00:59:10: minidump.cc:5919: INFO: GetStream: type 14 not present
2026-07-14 00:59:10: minidump_processor.cc:174: INFO: Found 0 memory regions.
2026-07-14 00:59:10: minidump_processor.cc:184: INFO: Minidump crash-nacl-CGame-1783971162313.dmp has CPU info, OS info, no Breakpad info, exception, module list, thread list, no dump thread, requesting thread, and no process create time
2026-07-14 00:59:10: minidump_processor.cc:223: INFO: Looking at thread crash-nacl-CGame-1783971162313.dmp:0/1 id 0x0
2026-07-14 00:59:10: minidump.cc:474: INFO: MinidumpContext: looks like AMD64 context
2026-07-14 00:59:10: minidump.cc:474: INFO: MinidumpContext: looks like AMD64 context
2026-07-14 00:59:10: source_line_resolver_base.cc:236: INFO: Loading symbols for module main.nexe from memory buffer
2026-07-14 00:59:10: minidump.cc:1379: INFO: MinidumpMemoryRegion request out of range: 0xfffeff78+8/0xfffebd80+0x41d4
2026-07-14 00:59:10: postfix_evaluator-inl.h:160: ERROR: Could not dereference memory at address 0xfffeff78: .cfa -8 + ^
2026-07-14 00:59:10: minidump.cc:1379: INFO: MinidumpMemoryRegion request out of range: 0xfffeff88+8/0xfffebd80+0x41d4
2026-07-14 00:59:10: minidump.cc:1379: INFO: MinidumpMemoryRegion request out of range: 0xfffeff50+8/0xfffebd80+0x41d4
2026-07-14 00:59:10: minidump_processor.cc:348: INFO: Processed crash-nacl-CGame-1783971162313.dmp
Operating system: NaCl
                  0.0.0 nacl
CPU: amd64
     family 0 model 0 stepping 0
     0 CPUs

GPU: UNKNOWN

Crash reason:  0x0000000b / 0x00000000
Crash address: 0x0
Process uptime: not available

Thread 0 (crashed)
 0  main.nexe!InjectFaultCmd::DoFault(Cmd::Args const&) [Command.cpp : 572 + 0x3]
    rax = 0x0000000000000001   rdx = 0x0000000000000001
    rcx = 0x000000006c756166   rbx = 0x00000000fffebef8
    rsi = 0x00000000fffebe19   rdi = 0x746c756166676573
    rbp = 0x00000000fffebe30   rsp = 0x00000000fffebe00
     r8 = 0x00000000fd2212c8    r9 = 0x00000000fd2212c8
    r10 = 0x0000000000000074   r11 = 0x0000000000000001
    r12 = 0x0000000000000000   r13 = 0x0000000000000000
    r14 = 0x00000000fffebef8   r15 = 0x00002cb400000000
    rip = 0x00000000001dc2c6
    Found by: given as instruction pointer in context
 1  main.nexe!InjectFaultCmd::Run(Cmd::Args const&) const [Command.cpp : 544 + 0x1e]
    rbx = 0x0000000014268678   rbp = 0x00000000fffebe80
    rsp = 0x00000000fffebe40   r12 = 0x0000000000000000
    r13 = 0x0000000000000000   r14 = 0x00000000fffebef8
    r15 = 0x00002cb400000000   rip = 0x00000000001dbec0
    Found by: call frame info
 2  main.nexe!Cmd::ExecuteSyscall(Util::Reader&, IPC::Channel&) [CommonProxies.cpp : 116 + 0x34]
    rbx = 0x0000000000000000   rbp = 0x00000000fffebf50
    rsp = 0x00000000fffebe90   r12 = 0x0000000000000000
    r13 = 0x0000000000000000   r14 = 0x0000000000000021
    r15 = 0x00002cb400000000   rip = 0x00000000001bbe60
    Found by: call frame info
 3  main.nexe!VM::HandleCommonSyscall(int, int, Util::Reader, IPC::Channel&) [CommonProxies.cpp : 138 + 0x2b]
    rbx = 0x00000000fffeff00   rbp = 0x00000000fffec010
    rsp = 0x00000000fffebf60   r12 = 0x0000000014268554
    r13 = 0x0000000000000000   r14 = 0x00000000fffefdf0
    r15 = 0x00002cb400000000   rip = 0x00000000001c0c20
    Found by: call frame info
 4  main.nexe!VM::VMHandleSyscall(unsigned int, Util::Reader) [cg_api.cpp : 148 + 0x2a]
    rbx = 0x00000000fffeff00   rbp = 0x00000000fffefea0
    rsp = 0x00000000fffec020   r12 = 0x0000000000000000
    r13 = 0x0000000000000000   r14 = 0x00000000fffefdf0
    r15 = 0x00002cb400000000   rip = 0x0000000000029040
    Found by: call frame info
 5  main.nexe!main [VMMain.cpp : 82 + 0x28]
    rbx = 0x00000000fffeff00   rbp = 0x00000000fffeff40
    rsp = 0x00000000fffefeb0   r12 = 0x0000000000000000
    r13 = 0x0000000000000000   r14 = 0x00000000fffefec0
    r15 = 0x00002cb400000000   rip = 0x00000000001d6d20
    Found by: call frame info
 6  main.nexe!_start [start.c : 66 + 0x31]
    rbx = 0x0000000000000002   rbp = 0x00000000fffeff80
    rsp = 0x00000000fffeff50   r12 = 0x00000000fffeffc8
    r13 = 0x0000000000000000   r14 = 0x00000000fffeffbc
    r15 = 0x00002cb400000000   rip = 0x0000000000690ee0
    Found by: call frame info

Loaded modules:
0x00020000 - 0x006d76bf  main.nexe  ???  (main)
2026-07-14 00:59:10: minidump.cc:5109: INFO: Minidump closing minidump

@illwieckz illwieckz force-pushed the illwieckz/saigo-nacl branch 2 times, most recently from 9c0148c to 25cea09 Compare July 13, 2026 23:31
@illwieckz illwieckz changed the title dwarf2reader: support NaCl Saigo CFA pseudo-register (-2) dwarf2reader: support NaCl Saigo CFA pseudo-register -2 Jul 13, 2026
@illwieckz illwieckz force-pushed the illwieckz/saigo-nacl branch from 25cea09 to 2ca55d1 Compare July 13, 2026 23:34
@slipher

slipher commented Jul 14, 2026

Copy link
Copy Markdown
Member

Gamelogic crash tests from Daemon's tools/crash_test.py pass 100%. Awesome, great work!!

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants