Fallback to the first executable map if the given executable is invalid

When a core file is created from a Python script that's executed
directly via shebang, the reported executable will be the shell script.
This is a problem because when we proceed to analyse the core file
pystack fails as this is not the correct binary that was used to
generate the core.

To avoid this problem, detect when this happens and fall back to the
executable reported in the first map that has a path in the core, which
is generally the real executable that we need.

src/pystack/__main__.py

@@ -352,9 +352,20 @@ def process_core(parser: argparse.ArgumentParser, args: argparse.Namespace) -> N
         print(format_failureinfo_information(corefile_analyzer.extract_failure_info()))
 
     if not is_elf(executable):
-        raise errors.InvalidExecutable(
-            f"The provided executable ({executable}) doesn't have an executable format"
+        first_map = next(
+            (map for map in corefile_analyzer.extract_maps() if map.path is not None),
+            None,
         )
+        if first_map is not None and is_elf(first_map.path):
+            executable = first_map.path
+            LOGGER.info(
+                "Setting executable automatically to the first map in the core: %s",
+                executable,
+            )
+        else:
+            raise errors.InvalidExecutable(
+                f"The provided executable ({executable}) doesn't have an executable format"
+            )
 
     if args.native_mode != NativeReportingMode.OFF:
         for module in corefile_analyzer.missing_modules():

tests/unit/test_main.py

@@ -26,6 +26,7 @@
 from pystack.errors import InvalidPythonProcess
 from pystack.errors import MissingExecutableMaps
 from pystack.errors import NotEnoughInformation
+from pystack.maps import VirtualMap
 
 
 def test_error_message_wih_permission_error_text():
@@ -1213,3 +1214,69 @@ def test_core_file_missing_build_ids_are_logged(caplog, native):
         else []
     )
     assert record_messages == expected
+
+
+def test_executable_is_not_elf_uses_the_first_map():
+    # GIVEN
+
+    argv = ["pystack", "core", "corefile", "executable"]
+
+    # WHEN
+    real_executable = Path("/foo/bar/executable")
+
+    with patch(
+        "pystack.__main__.get_process_threads_for_core"
+    ) as get_process_threads_mock, patch("pystack.__main__.print_thread"), patch(
+        "pystack.__main__.is_elf", lambda x: x == real_executable
+    ), patch(
+        "sys.argv", argv
+    ), patch(
+        "pathlib.Path.exists", return_value=True
+    ), patch(
+        "pystack.__main__.CoreFileAnalyzer"
+    ) as core_analyzer_test:
+        core_analyzer_test().extract_executable.return_value = "extracted_executable"
+        core_analyzer_test().extract_maps.return_value = [
+            VirtualMap(
+                start=0x1000,
+                end=0x2000,
+                flags="r-xp",
+                offset=0,
+                device="00:00",
+                inode=0,
+                filesize=0,
+                path=None,
+            ),
+            VirtualMap(
+                start=0x2000,
+                end=0x3000,
+                flags="rw-p",
+                offset=0,
+                device="00:00",
+                inode=0,
+                filesize=0,
+                path=Path("/foo/bar/executable"),
+            ),
+            VirtualMap(
+                start=0x3000,
+                end=0x4000,
+                flags="r--p",
+                offset=0,
+                device="00:00",
+                inode=0,
+                filesize=0,
+                path=None,
+            ),
+        ]
+        main()
+
+    # THEN
+
+    get_process_threads_mock.assert_called_with(
+        Path("corefile"),
+        real_executable,
+        library_search_path="",
+        native_mode=NativeReportingMode.OFF,
+        locals=False,
+        method=StackMethod.AUTO,
+    )