Add a second jump table slicing patch to dyninst to fix a failed

assert in the first patch.

Author: mwkrentel

symtabAPI/Makefile

@@ -29,7 +29,7 @@ else
 # table multi slices branch.
 
 FETCH_TARFILE = dyninst-lite-9.3.2.tar.bz2
-EXTRA_PATCH_FILES = jump-table-slices
+EXTRA_PATCH_FILES = jump-table-slices jump-table-slices-2
 
 endif
 

symtabAPI/patches/jump-table-slices-2

@@ -0,0 +1,148 @@
+This patch is the diff between Xiaozhu's jump table slicing branch on
+June 2 (ba1b3348ab) and June 21 (ed29383c09).  Apply this patch after
+the jump-table-slices patch (which brings 9.3.2 up to the June 2
+commit).
+
+This has a small improvement in the jump table analysis and reduces
+some gaps.  But more importantly, it fixes a failed assert over a
+shared pointer in JumpTableFormatPred.C.
+
+commit ed29383c09bae75ba9daa41c8bfac3f3038f82ff (jump_table_multi_slices)
+Author: Xiaozhu Meng <xmeng@cs.wisc.edu>
+Date:   Wed Jun 21 16:13:00 2017 -0500
+
+    It is not a good idea to stop scanning jump table when an entry
+    leads to an address in another function.  The reason is that the
+    another function can have an overapproximated jump table scan,
+    causing wrong function boundary.
+
+    New heurisitics:
+    if the indirect jump is in a function with a hint, and the
+    indirect jump jumps to an adderss outside the range speicified by
+    the hint, we stop.
+
+
+diff --git a/parseAPI/h/CodeSource.h b/parseAPI/h/CodeSource.h
+index e7e7651..ed2066d 100644
+--- a/parseAPI/h/CodeSource.h
++++ b/parseAPI/h/CodeSource.h
+@@ -92,11 +92,12 @@ template <typename OS>
+ 
+ /* A starting point for parsing */
+ struct Hint {
+-    Hint() : _addr(0), _reg(NULL), _name("") { }
+-    Hint(Address a, CodeRegion * r, std::string s) :
+-        _addr(a), _reg(r), _name(s) { }
++    Hint() : _addr(0), _size(0), _reg(NULL), _name("") { }
++    Hint(Address a, int size, CodeRegion * r, std::string s) :
++        _addr(a), _size(size), _reg(r), _name(s) { }
+ 
+     Address _addr;
++    int _size;
+     CodeRegion * _reg;
+     std::string _name;
+ 
+diff --git a/parseAPI/src/IndirectAnalyzer.C b/parseAPI/src/IndirectAnalyzer.C
+index 139d6f4..740bffc 100644
+--- a/parseAPI/src/IndirectAnalyzer.C
++++ b/parseAPI/src/IndirectAnalyzer.C
+@@ -60,7 +60,7 @@ bool IndirectControlFlowAnalyzer::NewJumpTableAnalysis(std::vector<std::pair< Ad
+     parsing_printf("Apply indirect control flow analysis at %lx\n", block->last());
+     parsing_printf("Looking for thunk\n");
+     
+-//    if (block->last() == 0xa8d7c9) dyn_debug_parsing=1; else dyn_debug_parsing=0;
++//    if (block->last() == 0x549cf9) dyn_debug_parsing=1; else dyn_debug_parsing=0;
+ 
+ //  Find all blocks that reach the block containing the indirect jump
+ //  This is a prerequisit for finding thunks
+@@ -241,7 +241,7 @@ void IndirectControlFlowAnalyzer::ReadTable(AST::Ptr jumpTargetExpr,
+         JumpTableReadVisitor jtrv(index, v, cs, false, memoryReadSize);
+ 	jumpTargetExpr->accept(&jtrv);
+ 	if (jtrv.valid && cs->isCode(jtrv.targetAddress)) {
+-	    bool overlap = false;
++	    bool stop = false;
+ 	    set<Block*> blocks;
+ 	    block->obj()->findCurrentBlocks(block->region(), jtrv.targetAddress, blocks);
+ 	    for (auto bit = blocks.begin(); bit != blocks.end(); ++bit) {
+@@ -249,21 +249,28 @@ void IndirectControlFlowAnalyzer::ReadTable(AST::Ptr jumpTargetExpr,
+ 		    Block::Insns insns;
+ 		    (*bit)->getInsns(insns);
+ 		    if (insns.find(jtrv.targetAddress) == insns.end()) {
+-		        overlap = true;
++		        stop = true;
+ 			parsing_printf("WARNING: resolving jump tables leads to address %lx, which causes overlapping instructions in basic blocks [%lx,%lx)\n", jtrv.targetAddress, (*bit)->start(), (*bit)->end());
+ 			break;
+ 		    }
+ 		}
+ 	    }
+-	    set<Function*> funcs;
+-	    block->obj()->findCurrentFuncs(block->region(), jtrv.targetAddress, funcs);
+-	    for (auto fit = funcs.begin(); fit != funcs.end(); ++fit) {
+-	        if (*fit != func) {
+-		    overlap = true;
+-		    parsing_printf("WARNING: resolving jump tables leads to address %lx in another function at %lx\n", jtrv.targetAddress, (*fit)->addr());
++	    // Assume that indirect jump should not jump beyond the function range.
++	    // This assumption is shaky in terms of non-contiguous functions.
++	    // But non-contiguous blocks tend not be reach by indirect jumps
++	    if (func->src() == HINT) {
++	        Hint h(func->addr(), 0 , NULL, "");
++		auto range = equal_range(cs->hints().begin(), cs->hints().end(), h);
++		if (range.first != range.second && range.first != cs->hints().end()) {
++		    Address startAddr = range.first->_addr;
++		    int size = range.first->_size;
++		    if (jtrv.targetAddress < startAddr || jtrv.targetAddress >= startAddr + size) {
++		        stop = true;
++			parsing_printf("WARNING: resolving jump tables leads to address %lx, which is not in the function range specified in the symbol table\n", jtrv.targetAddress);			
++		    }
+ 		}
+ 	    }
+-	    if (overlap) break;
++	    if (stop) break;
+ 	    jumpTargets.insert(jtrv.targetAddress);
+ 	} else {
+ 	    // We have a bad entry. We stop here, as we have wrong information
+diff --git a/parseAPI/src/JumpTableFormatPred.C b/parseAPI/src/JumpTableFormatPred.C
+index 608d91b..876af5e 100644
+--- a/parseAPI/src/JumpTableFormatPred.C
++++ b/parseAPI/src/JumpTableFormatPred.C
+@@ -323,6 +323,7 @@ static Assignment::Ptr SearchForWrite(SliceNode::Ptr n, AbsRegion &src, Slicer::
+ 		        if (!(*oit).writesMemory() && !(*oit).readsMemory()) {
+ 			    std::set<RegisterAST::Ptr> regsRead;
+ 			    oit->getReadSet(regsRead);
++			    if (regsRead.empty()) continue;
+ 			    src = AbsRegion(Absloc( (*regsRead.begin())->getID() ));
+ 			    parsing_printf("\t\tContinue to slice on %s\n", src.format().c_str());
+ 			    break;
+diff --git a/parseAPI/src/SymbolicExpression.C b/parseAPI/src/SymbolicExpression.C
+index b03d1ea..7e1a4ce 100644
+--- a/parseAPI/src/SymbolicExpression.C
++++ b/parseAPI/src/SymbolicExpression.C
+@@ -77,6 +77,7 @@ AST::Ptr SymbolicExpression::SimplifyRoot(AST::Ptr ast, Address addr) {
+ 		    }
+ 		} 
+ 		break;
++/*		
+ 	    case ROSEOperation::sMultOp:
+ 	    case ROSEOperation::uMultOp:
+ 	        if (roseAST->child(0)->getID() == AST::V_ConstantAST) {
+@@ -89,7 +90,7 @@ AST::Ptr SymbolicExpression::SimplifyRoot(AST::Ptr ast, Address addr) {
+ 		    if (child1->val().val == 1) return roseAST->child(0);
+ 		}
+ 	        break;
+-
++*/
+ 	    case ROSEOperation::xorOp:
+ 	        if (roseAST->child(0)->getID() == AST::V_VariableAST && roseAST->child(1)->getID() == AST::V_VariableAST) {
+ 		    VariableAST::Ptr child0 = boost::static_pointer_cast<VariableAST>(roseAST->child(0)); 
+diff --git a/parseAPI/src/SymtabCodeSource.C b/parseAPI/src/SymtabCodeSource.C
+index 1310f32..b8cb12a 100644
+--- a/parseAPI/src/SymtabCodeSource.C
++++ b/parseAPI/src/SymtabCodeSource.C
+@@ -505,6 +505,7 @@ SymtabCodeSource::init_hints(dyn_hash_map<void*, CodeRegion*> & rmap,
+                 sr->getMemOffset()+sr->getDiskSize());
+         } else {
+             _hints.push_back( Hint((*fsit)->getOffset(),
++	                       (*fsit)->getSize(),
+                                cr,
+                                (*fsit)->getFirstSymbol()->getPrettyName()) );
+             parsing_printf("\t<%lx,%s,[%lx,%lx)>\n",