title: Segmentation fault - Debugging assembly gdb
body: <p>I am debugging a segmentation fault. Here is the code snippet which faults at ff_printf call.</p>
  
  <pre><code>for (p = &amp;v[QUEUE], i = 0; i &lt; p-&gt;used; i++) {
          queue_t *q = p-&gt;data[i];
          ff_printf(F_DB, "  %02u %s\n",
              p-&gt;cp, q-&gt;tq-&gt;queue_name);
      }
  </code></pre>
  
  <p>The seg fault is at line ff_printf. When I debug through gdb, I can resolve p->cp and q->tq->queue_name. F_DB also gets resolved as it is an enum. Hence, it did not seg fault because of invalid deference.</p>
  
  <p>After disassembly of the code, I get the below assembly of the above code snippet for the line ff_printf.</p>
  
  <pre><code>   0x0000000000449b88 &lt;+360&gt;:   mov    -0x14(%r13),%rax
     0x0000000000449b8c &lt;+364&gt;:   movzwl %r10w,%edx
  
     0x0000000000449b90 &lt;+368&gt;:   movzwl (%rbx),%r9d
     0x0000000000449b94 &lt;+372&gt;:   mov    $0x56a4d9,%r8d
     0x0000000000449b9a &lt;+378&gt;:   mov    $0x5,%ecx
     0x0000000000449b9f &lt;+383&gt;:   mov    $0x5bb,%esi
     0x0000000000449ba4 &lt;+388&gt;:   mov    $0x56a27b,%edi
     0x0000000000449ba9 &lt;+393&gt;:   mov    (%rax,%rdx,8),%rax
     0x0000000000449bad &lt;+397&gt;:   mov    $0x56aec0,%edx
  =&gt; 0x0000000000449bb2 &lt;+402&gt;:   mov    0x88(%rax),%rax
     0x0000000000449bb9 &lt;+409&gt;:   mov    %r10d,-0x48(%rbp)
     0x0000000000449bbd &lt;+413&gt;:   mov    %rax,(%rsp)
     0x0000000000449bc1 &lt;+417&gt;:   xor    %eax,%eax
     0x0000000000449bc3 &lt;+419&gt;:   callq  0x4423c0 &lt;ff_printf&gt;
  </code></pre>
  
  <p>Now, I did debug the registers and verified with the code snippet. I was able to get F_DB, p->cp, q->tq->queue_name through the assembly debugging (viz through registers). I observe that the value of %rax is 0x0. I observe that the seg fault happens before the call the ff_printf library. </p>
  
  <p>I have two questions:</p>
  
  <p>1: How do I map this </p>
  
  <pre><code>"    =&gt; 0x0000000000449bb2 &lt;+402&gt;:  mov    0x88(%rax),%rax" 
  </code></pre>
  
  <p>to the code snippet? </p>
  
  <p>I observe that the %rax is populated through</p>
  
  <pre><code>0x0000000000449b88 &lt;+360&gt;:  mov    -0x14(%r13),%rax
  </code></pre>
  
  <p>which I think is mov ( address of $r13 - 0x14) to %rax.</p>
  
  <p>and </p>
  
  <pre><code>0x0000000000449ba9 &lt;+393&gt;:  mov    (%rax,%rdx,8),%rax
  </code></pre>
  
  <p>which I think it is mov ( address $rax+ address $rdx+ 8) to %rax. Am I right ? </p>
  
  <p>2: I am not sure if there was any stack corruption. This seg fault is very very rare, I cannot reproduce it. How to backtrace it further from here ?</p>