Crash Dump Analysis Patterns (Part 6a, Mac OS X)
Thursday, May 3rd, 2012This is a Mac OS X / GDB counterpart to NULL Pointer (code) pattern previously described for Windows platforms:
(gdb) bt
#0 0×0000000000000000 in ?? ()
#1 0×000000010e8cce73 in bar (ps=0×7fff6e4cbac0)
#2 0×000000010e8cce95 in foo (ps=0×7fff6e4cbac0)
#3 0×000000010e8cced5 in main (argc=1, argv=0×7fff6e4cbb08)
(gdb) disass 0×000000010e8cce73-3 0×000000010e8cce73
Dump of assembler code from 0×10e8cce70 to 0×10e8cce73:
0×000000010e8cce70
End of assembler dump.
(gdb) info r rdi
rdi 0x7fff6e4cbac0 140735043910336
(gdb) x/2 0x7fff6e4cbac0
0x7fff6e4cbac0: 0x0000000a 0×00000000
(gdb) p/x *($rdi+8)
$7 = 0×0
(gdb) bt
#0 0x0000000000000000 in ?? ()
#1 0x000000010e8cce73 in bar (ps=0×7fff6e4cbac0)
#2 0×000000010e8cce95 in foo (ps=0×7fff6e4cbac0)
#3 0×000000010e8cced5 in main (argc=1, argv=0×7fff6e4cbb08)
(gdb) ptype MYSTRUCT
type = struct _MyStruct_tag {
int data;
PFUNC pfunc;
}
(gdb) print {MYSTRUCT}0×7fff6e4cbac0
$2 = {data = 10, pfunc = 0}
Here’s the source code of the modeling application:
typedef void (*PFUNC)(void);
typedef struct _MyStruct_tag
{
int data;
PFUNC pfunc;
} MYSTRUCT;
void bar(MYSTRUCT *ps)
{
ps->pfunc();
}
void foo(MYSTRUCT *ps)
{
bar(ps);
}
int main(int argc, const char * argv[])
{
MYSTRUCT pstruct = {10, NULL};
foo(&pstruct);
return 0;
}
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
Forthcoming Training: Accelerated Mac OS X Core Dump Analysis
