FuzzManager icon indicating copy to clipboard operation
FuzzManager copied to clipboard

When symbols are missing, use library filename instead of "??"

Open jruderman opened this issue 9 years ago • 2 comments

To create a FuzzManager signature for https://bugzilla.mozilla.org/show_bug.cgi?id=1288589 (as seen by minidump_stackwalk), I'd like to specify that the crash has to have AppleIntelHD3000GraphicsGLDriver on the stack so I can still find bugs on computers with other graphics cards. But currently, MinidumpCrashInfo just creates "??" entries when it doesn't have symbols for system libraries.

I guess library+offset would make signatures change too often, and some debuggers unhelpfully give library+address. So I'm suggesting using just the library name, as an improvement over using "??".

Started: https://gist.github.com/jruderman/16f50b51b822eeb0591516c160ab18ca

jruderman avatar Jul 22 '16 03:07 jruderman

These are the signatures I'm using for now:

  • https://fuzzmanager.fuzzing.mozilla.org/crashmanager/signatures/2362/
  • https://fuzzmanager.fuzzing.mozilla.org/crashmanager/signatures/2363/

jruderman avatar Jul 22 '16 03:07 jruderman

There are several problems to watch out for here:

  1. What if there is no filename available? (e.g. what happens with a JIT crash?) The code should fallback to use ?? in any case if the other info is unavailable.
  2. The current algorithm for signature generation measures how many ?? we have on the stack to determine if we have "enough" stack to use the stack for matching at all. Assuming the worst case, most or all frames are missing and we only have filenames. It is questionable if the stack is "safe" enough to propose then. Not saying it isn't but we should give this some thought. Fixing this in the current design is quite hard though.

It would be good to keep these things in mind when writing the patch. I agree on the library+offset thing, as the offset is highly build specific.

choller avatar Jul 22 '16 14:07 choller