CRASH in os_loader_thread_init_prologue

Created by: trylab
Describe the bug Crash happens in os_loader_thread_init_prologue
Screenshots or Pasted Text
2:012> bu dynamorio!os_loader_thread_init_prologue
2:012> g
Breakpoint 0 hit
dynamorio!os_loader_thread_init_prologue:
00000000`710cbd40 48895c2408      mov     qword ptr [rsp+8],rbx ss:00000001`33faf7e0=000001d7aea19080

2:012> p
dynamorio!os_loader_thread_init_prologue+0x5:
00000000`710cbd45 57              push    rdi

2:012> p
dynamorio!os_loader_thread_init_prologue+0x6:
00000000`710cbd46 4883ec20        sub     rsp,20h

2:012> p
dynamorio!os_loader_thread_init_prologue+0xa:
00000000`710cbd4a 488bd9          mov     rbx,rcx

2:012> p
dynamorio!os_loader_thread_init_prologue+0xd:
00000000`710cbd4d 33ff            xor     edi,edi

2:012> p
dynamorio!os_loader_thread_init_prologue+0xf:
00000000`710cbd4f 8b0deb1f0c00    mov     ecx,dword ptr [dynamorio!tls_next_idx (00000000`7118dd40)] ds:00000000`7118dd40=00000001

2:012> p
dynamorio!os_loader_thread_init_prologue+0x15:
00000000`710cbd55 85c9            test    ecx,ecx

2:012> p
dynamorio!os_loader_thread_init_prologue+0x17:
00000000`710cbd57 7e4f            jle     dynamorio!os_loader_thread_init_prologue+0x68 (00000000`710cbda8) [br=0]

2:012> p
dynamorio!os_loader_thread_init_prologue+0x19:
00000000`710cbd59 8b05e51f0c00    mov     eax,dword ptr [dynamorio!tls_array_count (00000000`7118dd44)] ds:00000000`7118dd44=00000000

2:012> p
dynamorio!os_loader_thread_init_prologue+0x1f:
00000000`710cbd5f 85c0            test    eax,eax

2:012> p
dynamorio!os_loader_thread_init_prologue+0x21:
00000000`710cbd61 0f44c1          cmove   eax,ecx

2:012> p
dynamorio!os_loader_thread_init_prologue+0x24:
00000000`710cbd64 488d4fff        lea     rcx,[rdi-1]

2:012> p
dynamorio!os_loader_thread_init_prologue+0x28:
00000000`710cbd68 4863d0          movsxd  rdx,eax

2:012> p
dynamorio!os_loader_thread_init_prologue+0x2b:
00000000`710cbd6b 48c1e203        shl     rdx,3

2:012> p
dynamorio!os_loader_thread_init_prologue+0x2f:
00000000`710cbd6f 8905cf1f0c00    mov     dword ptr [dynamorio!tls_array_count (00000000`7118dd44)],eax ds:00000000`7118dd44=00000000

2:012> !address 00000000`7118dd44
Mapping file section regions...
Mapping module regions...
Mapping PEB regions...
Mapping TEB and stack regions...
Mapping heap regions...
Mapping page heap regions...
Mapping other regions...
Mapping stack trace database regions...
Mapping activation context regions...

Usage:                  Image
Base Address:           00000000`7118d000
End Address:            00000000`71199000
Region Size:            00000000`0000c000 (  48.000 kB)
State:                  00001000          MEM_COMMIT
Protect:                00000004          PAGE_READWRITE
Type:                   01000000          MEM_IMAGE
Allocation Base:        00000000`71000000
Allocation Protect:     00000080          PAGE_EXECUTE_WRITECOPY


2:012> g
Breakpoint 0 hit
dynamorio!os_loader_thread_init_prologue:
00000000`710cbd40 48895c2408      mov     qword ptr [rsp+8],rbx ss:00000001`345fed78=000001d7ae9fd9c0

2:011> p
dynamorio!os_loader_thread_init_prologue+0x5:
00000000`710cbd45 57              push    rdi

2:011> p
dynamorio!os_loader_thread_init_prologue+0x6:
00000000`710cbd46 4883ec20        sub     rsp,20h

2:011> p
dynamorio!os_loader_thread_init_prologue+0xa:
00000000`710cbd4a 488bd9          mov     rbx,rcx

2:011> p
dynamorio!os_loader_thread_init_prologue+0xd:
00000000`710cbd4d 33ff            xor     edi,edi

2:011> p
dynamorio!os_loader_thread_init_prologue+0xf:
00000000`710cbd4f 8b0deb1f0c00    mov     ecx,dword ptr [dynamorio!tls_next_idx (00000000`7118dd40)] ds:00000000`7118dd40=00000001

2:011> p
dynamorio!os_loader_thread_init_prologue+0x15:
00000000`710cbd55 85c9            test    ecx,ecx

2:011> p
dynamorio!os_loader_thread_init_prologue+0x17:
00000000`710cbd57 7e4f            jle     dynamorio!os_loader_thread_init_prologue+0x68 (00000000`710cbda8) [br=0]

2:011> p
dynamorio!os_loader_thread_init_prologue+0x19:
00000000`710cbd59 8b05e51f0c00    mov     eax,dword ptr [dynamorio!tls_array_count (00000000`7118dd44)] ds:00000000`7118dd44=00000001

2:011> p
dynamorio!os_loader_thread_init_prologue+0x1f:
00000000`710cbd5f 85c0            test    eax,eax

2:011> p
dynamorio!os_loader_thread_init_prologue+0x21:
00000000`710cbd61 0f44c1          cmove   eax,ecx

2:011> p
dynamorio!os_loader_thread_init_prologue+0x24:
00000000`710cbd64 488d4fff        lea     rcx,[rdi-1]

2:011> p
dynamorio!os_loader_thread_init_prologue+0x28:
00000000`710cbd68 4863d0          movsxd  rdx,eax

2:011> p
dynamorio!os_loader_thread_init_prologue+0x2b:
00000000`710cbd6b 48c1e203        shl     rdx,3

2:011> p
dynamorio!os_loader_thread_init_prologue+0x2f:
00000000`710cbd6f 8905cf1f0c00    mov     dword ptr [dynamorio!tls_array_count (00000000`7118dd44)],eax ds:00000000`7118dd44=00000001

2:011> !address 00000000`7118dd44
Mapping file section regions...
Mapping module regions...
Mapping PEB regions...
Mapping TEB and stack regions...
Mapping heap regions...
Mapping page heap regions...
Mapping other regions...
Mapping stack trace database regions...
Mapping activation context regions...

Usage:                  Image
Base Address:           00000000`7118d000
End Address:            00000000`711a5000
Region Size:            00000000`00018000 (  96.000 kB)
State:                  00001000          MEM_COMMIT
Protect:                00000002          PAGE_READONLY
Type:                   01000000          MEM_IMAGE
Allocation Base:        00000000`71000000
Allocation Protect:     00000080          PAGE_EXECUTE_WRITECOPY


2:011> !heap -p -a 00000000`7118dd44

2:011> p
(11b0.1248): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
dynamorio!os_loader_thread_init_prologue+0x2f:
00000000`710cbd6f 8905cf1f0c00    mov     dword ptr [dynamorio!tls_array_count (00000000`7118dd44)],eax ds:00000000`7118dd44=00000001


2:011> k
 # Child-SP          RetAddr           Call Site
00 00000001`345fed48 00000000`7104472a dynamorio!os_loader_thread_init_prologue+0x2f [c:\projects\dynamorio\core\win32\loader.c @ 384] 
01 00000001`345fed78 00000000`71005615 dynamorio!loader_thread_init+0x2a [c:\projects\dynamorio\core\loader_shared.c @ 277] 
02 00000001`345feda8 00000000`710b4185 dynamorio!dynamo_thread_init+0x515 [c:\projects\dynamorio\core\dynamo.c @ 2394] 
03 00000001`345fee18 00000000`710b3fa5 dynamorio!intercept_new_thread+0xa5 [c:\projects\dynamorio\core\win32\callback.c @ 3139] 
04 00000001`345ff158 00000000`71184ce5 dynamorio!intercept_ldr_init+0x95 [c:\projects\dynamorio\core\win32\callback.c @ 3390] 
05 00000001`345ff188 00000000`00000000 dynamorio!interception_code_array+0xce5
Versions
What version of DynamoRIO are you using? DynamoRIO-Windows-7.91.18308.zip
Does the latest build from https://github.com/DynamoRIO/dynamorio/wiki/Latest-Build solve the problem? Not tested
What operating system version are you running on? ("Windows 10" is not sufficient: give the release number.) Windows 10 Pro 1909 18363.657
Is your application 32-bit or 64-bit? 64-bit
Additional context Please note dynamorio!tls_array_count becomes read only when crash happens.