This is a long post.\u00a0 Here’s a summary.<\/p>\n
The rest of this post explains what the constraints are and approximately what is necessary to get started.<\/p>\n
The main difficulty is the need to build a custom ROM and kernel.\u00a0 There are three reasons for this:<\/p>\n
Instead, there is a master process called the Zygote.\u00a0 To start an application (eg Firefox), a message is sent via a socket to the Zygote.\u00a0 This creates a child with fork(), and the child then goes on to load the relevant bytecode and (presumably) native code and “becomes” Firefox.\u00a0 So there’s no exec()\u00a0 boundary for Valgrind to enter at.<\/p>\n
Fortunately the AOSP folks provided a solution a couple of months back.\u00a0 They modified Zygote so that it can start selected processes under the control of a user-specified wrapper, which is precisely the hook we need.\u00a0 The AOSP tree now has this fix.<\/p>\n
Here’s an overview of the process.\u00a0 It doesn’t contain enough details to simply copy and paste, but it does give some idea of the hoop jumping that is unfortunately still required.<\/p>\n
Download sources and build Android images, as per directions at http:\/\/source.android.com\/source\/building.html<\/a>.\u00a0 This in itself is a major exercise.\u00a0 The relevant “lunch” flavour is full_crespo-eng, I think.\u00a0 At the end of this stage, you’ll have (amongst things) libraries with symbols and a wrapper-enabled Zygote.\u00a0 But not a swap enabled kernel.<\/p>\n Build a swap enabled kernel as per Mike Hommey’s instructions<\/a>, and incorporate it into the images built in the previous stage.\u00a0 In fact, I skipped this step — Mike kindly did it for me.<\/p>\n Push the images onto the phone, reboot, check it’s still alive.<\/p>\n Check out a copy of the Valgrind trunk from svn:\/\/svn.valgrind.org\/valgrind\/trunk, and build as described in detail in README.android.\u00a0 If you complete that successfully, you’ll have a working installation of Valgrind on the phone at \/data\/local\/Inst\/bin\/valgrind.<\/p>\n Install busybox on the phone, to make life a little less austere in the shell.<\/p>\n On the Linux host, generate a 1GB swap file and transfer it to \/sdcard on the phone (that’s the only place it will fit).\u00a0 Then enable swapping:<\/p>\n Note you’ll have to manually re-enable swapping every time the phone is rebooted.<\/p>\n Copy from the host, the contents of out\/target\/product\/crespo\/symbols\/system to \/sdcard\/symbols\/system.\u00a0 These are the debuginfo objects for the system libraries.\u00a0 Valgrind expects them to be present, as per comments above, so it can read symbols for libc.so and \/system\/bin\/linker.\u00a0 This will copy far more than that, which is not essential but nice for debugging.<\/p>\n Build a Firefox you want to debug.\u00a0 That of course means with line number info and with the flags –disable-jemalloc –enable-valgrind.\u00a0 I strongly suggest you use “-O -g” for a good compromise between speed and debuggability.\u00a0 When the build finishes, ask the build system to make an .apk file with the debug info in place, and install it.\u00a0 The .apk will be huge, about 125MB:<\/p>\n We’re nearly there.\u00a0 We have a device which is all set up, and a debuggable Firefox on it.\u00a0 But we need to tell Zygote that we want to start Firefox with a wrapper, namely Valgrind.\u00a0 In the shell on the phone, do this:<\/p>\n This tells Zygote that any startup of “org.mozilla.fennec_sewardj” should be done via an exec() of \/data\/local\/start_valgrind_fennec applied to Zygote-specified arguments.\u00a0 So, now we can put any old thing in a shell script, and Zygote will run it.\u00a0 Here’s what I have for \/data\/local\/start_valgrind_fennec:<\/p>\n Obviously you can put any Valgrind params you want in VGPARAMS; you get the general idea.\u00a0 Note that this is ARM, so you don’t need the –smc-check= flag that’s necessary on x86 targets.<\/p>\n Only two more hoops to jump through now.\u00a0 One question is where the Valgrind output should go.\u00a0 Initially I tried using Valgrind’s little-known but very useful –log-socket= parameter (see here<\/a> for details), but it seemed to crash the phone on a regular basis.<\/p>\n So I abandoned that.\u00a0 By default, Valgrind’s output winds up in the phone’s system log, mixed up with lots of other stuff.\u00a0 In the end I wound up running the following on the host, which works pretty well:<\/p>\n And finally .. we need to start Firefox.\u00a0 Now, due to recent changes in how the libraries are packaged for Android, you can’t start it by pressing on the Fennec icon (well, you can, but Valgrind won’t read the debuginfo.)\u00a0 Instead, issue this command in a shell on the phone:<\/p>\n This requests a “debug intent” startup of Firefox, which sidesteps the fancy dynamic unpacking of libraries into ashmem, and instead does the old style thing of unpacking them into \/data\/data\/org.mozilla.fennec_sewardj.\u00a0 From there Valgrind can read debuginfo in the normal way.<\/p>\n One minor last hint: run “top -d 2 -s cpu -m 19”.\u00a0 Because Valgrind runs slowly on the phone, I’m\u00a0 often in the situation of wondering am-I-waiting-for-it or is-it-waiting-for-me?\u00a0 Running top pretty much answers that question.<\/p>\n And .. so .. it works!\u00a0 It’s slow, but it appears to be stable, and, crucially, the false error rate from\u00a0 Memcheck is low enough to be usable.<\/p>\n So, what’s next?\u00a0 Writing this reminded me what a hassle it is to get all the ducks lined up right.\u00a0 We need to streamline it.\u00a0 Suggestions welcome!.<\/p>\n One thing I’ve been thinking about is to to avoid the need to have debuginfo on the target, by allowing Valgrind to query the host somehow.\u00a0 Another thing I plan to do is make the Callgrind tool work, so we can get profile information too.<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" This is a long post.\u00a0 Here’s a summary. the good news: Valgrind’s Memcheck tool now works well enough on Nexus S that it can run Firefox and find real bugs, for example bug 688733.\u00a0 The false error rate from Memcheck … Continue reading<\/a><\/p>\n","protected":false},"author":240,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/jseward\/wp-json\/wp\/v2\/posts\/135"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/jseward\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/jseward\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/jseward\/wp-json\/wp\/v2\/users\/240"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/jseward\/wp-json\/wp\/v2\/comments?post=135"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/jseward\/wp-json\/wp\/v2\/posts\/135\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/jseward\/wp-json\/wp\/v2\/media?parent=135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/jseward\/wp-json\/wp\/v2\/categories?post=135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/jseward\/wp-json\/wp\/v2\/tags?post=135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} cat \/proc\/swaps\r\n \/data\/local\/Bin\/busybox swapon \/sdcard\/swapfile1G\r\n cat \/proc\/swaps<\/pre>\n
(cd $objdir && make package PKG_SKIP_STRIP=1)\r\n adb install -r $objdir\/dist\/fennec-9.0a1.en-US.eabi-arm.apk<\/pre>\n
setprop wrap.org.mozilla.fennec_sewardj \"logwrapper \/data\/local\/start_valgrind_fennec\"<\/pre>\n
#!\/system\/bin\/sh\r\n VGPARAMS='--error-limit=no'\r\n export TMPDIR=\/data\/data\/org.mozilla.fennec_sewardj\r\n exec \/data\/local\/Inst\/bin\/valgrind $VGPARAMS $*<\/pre>\n
adb logcat -c ; adb logcat | grep --line-buffered start_valgrind \\\r\n | sed -u sQ\/data\/local\/start_valgrind_QQg | tee logfile.txt<\/pre>\n
am start -a org.mozilla.gecko.DEBUG -n org.mozilla.fennec_sewardj\/.App<\/pre>\n