Createdump will incorrectly try to classify memfd entries as files

[hoyosjs]

runtime/src/coreclr/debug/createdump/crashinfounix.cpp

Lines 271 to 275 in b0d4502

	if (moduleName != nullptr && *moduleName == '/')
	{
	m_moduleMappings.insert(memoryRegion);
	m_cbModuleMappings += memoryRegion.Size();
	}

The entries will always get collected as files incorrectly since they are called /memfd:doublemapper (deleted)

Tagging subscribers to this area: @tommcdon
See info in area-owners.md if you want to be subscribed.

Issue Details

---

runtime/src/coreclr/debug/createdump/crashinfounix.cpp

Lines 271 to 275 in b0d4502

	if (moduleName != nullptr && *moduleName == '/')
	{
	m_moduleMappings.insert(memoryRegion);
	m_cbModuleMappings += memoryRegion.Size();
	}

The entries will always get collected as files incorrectly since they are called /memfd:doublemapper (deleted)

Author:	hoyosjs
Assignees:	-
Labels:	area-Diagnostics-coreclr
Milestone:	-

[janvorli]

Maybe anything marked by (deleted) at the end should not be considered to be a file, as the (deleted) indicates the file doesn't exist in the filesystem.

[tommcdon]

@mikem8361

[hoyosjs]

Granted, system dumps seem to have these as well in NT_FILE

[mikem8361]

Maybe our dump readers need to ignore them.

[mikem8361]

But createdump still shouldn't add them to the module mappings and module lists, I think.

[mikem8361]

Another question is whether the modules marked as (deleted) should be added to the (non-full) dumps if they don't exists in the file system. Is the memory these regions map used by the runtime still?

[mikem8361]

The clrmd ELF reader removes the " (deleted) " from the module name but doesn't skip it. I added this and put the comment:

// This substitution is for unloaded modules for which Linux appends " (deleted)" to the module name.
string path = image.FileName.Replace(" (deleted)", "");

I don't remember why I just didn't skip them.

The deleted tag seems to be on all the /memfd:doublemapper (deleted) so I think those shouldn't be in the module list built by the ELF reader but I'm not sure.

[hoyosjs]

deleted will always show up, they are using memfd which has no disk-backed file.