Use rr Record-and-Replay for Time-Travel Debugging

Topic Overview

rr: Record and Replay Debugging

rr is a Mozilla-developed tool that records program execution and allows deterministic replay. Unlike traditional debuggers where heisenbugs disappear on re-run, rr captures the exact execution trace including syscall results and thread scheduling decisions.

How rr Works

1. Record: rr record ./program captures all non-deterministic inputs
2. Replay: rr replay replays execution identically every time
3. Debug: Use GDB with reverse execution commands

Reverse execution commands in GDB+rr:

• reverse-continue (rc): Run backwards until a breakpoint
• reverse-step (rs): Step backwards one source line
• reverse-finish: Run backwards until the current function returns

For example, you can set a breakpoint at a crash site, then reverse-step to find the exact instruction that corrupted memory.

For This Exercise

You will document how rr record-and-replay debugging works with a program containing an intentional off-by-one bug. Deterministic replay lets you go backwards from the symptom to the root cause, which is invaluable for race conditions and intermittent crashes.

Recording in Practice

Start with rr record ./program to capture a failing run, then rr replay to debug deterministically. Set a breakpoint at the crash, run rc (reverse-continue) to the last write before corruption, then rs (reverse-step) through the suspect code. Mozilla developed rr specifically because intermittent test failures in Firefox were impossible to debug with conventional forward-only GDB sessions.

Write a C program that simulates rr reverse-continue queries over a recorded value trace.

Requirements:

• Parse a blank-separated integer line of n recorded values, then nb (may be 0) hex breakpoint addresses, then ne (may be 0) trace lines "addr val", then Q queries, one "K" per line
• A watchpoint stop happens at event j when value[j] != value[j-1], or j == 0 (initial write)
• For each query K: scan back from K to the most recent watchpoint stop at or before K; print "stop event: j", "watch value: V", and "replayed events: K - j"
• Summaries: "total stops: W" (number of watchpoint stops in the whole log), "first value: V0", "max value: M"
• Input has no line-structure guarantees, so tokenize with scanf and detect the record section by its leading %lx token; a %lx token fails only at EOF or when the token is not hex, so treat a failed/invalid scan as end of the record section