PR gdb/16196:
* valprint.c (read_string): Set new variable fetchlen based on
fetchlimit and size. Use it in call to partial_memory_read.
Update comment.
PR gdb/16196:
* valprint.c (read_string): Set new variable fetchlen based on
fetchlimit and size. Use it in call to partial_memory_read.
Update comment.
Pedro asked me to add a comment to dw2-bad-cfi.S explaining the nature
of the badness.
I'm checking this in.
2013-11-22 Tom Tromey <tromey@redhat.com>
* gdb.dwarf2/dw2-bad-cfi.S: Update comment.
Debugging PR 16155 further, I found that the DWARF unwinder found the
function in question, but thought it had no registers saved
(fs->regs.num_regs == 0).
It seems to me that if a frame does not specify the return address
column, or if the return address column is explicitly marked as
DWARF2_FRAME_REG_UNSPECIFIED, then we should set the
"undefined_retaddr" flag and let the DWARF unwinder gracefully stop.
This patch implements that idea.
With this patch the backtrace works properly:
(gdb) bt
#0 0x0000007fb7ed485c in nanosleep () from /lib64/libc.so.6
#1 0x0000007fb7ed4508 in sleep () from /lib64/libc.so.6
#2 0x00000000004008bc in thread_function (arg=0x4) at threadapply.c:73
#3 0x0000007fb7fad950 in start_thread () from /lib64/libpthread.so.0
#4 0x0000007fb7f0956c in clone () from /lib64/libc.so.6
2013-11-22 Tom Tromey <tromey@redhat.com>
PR backtrace/16155:
* dwarf2-frame.c (dwarf2_frame_cache): Set undefined_retaddr if
the return address column is unspecified.
2013-11-22 Tom Tromey <tromey@redhat.com>
* gdb.dwarf2/dw2-bad-cfi.c: New file.
* gdb.dwarf2/dw2-bad-cfi.exp: New file.
* gdb.dwarf2/dw2-bad-cfi.S: New file.
If value_fetch_lazy loops infinitely while unwrapping lval_register
values, it means we either somehow ended up with two frames with the
same ID in the frame chain, or some code is trying to unwind behind
get_prev_frame's back (e.g., a frame unwind sniffer trying to unwind).
In any case, it should always be an internal error to end up in this
situation.
This patch adds a check and throws an internal error if the same frame
is returned.
2013-11-22 Tom Tromey <tromey@redhat.com>
Pedro Alves <palves@redhat.com>
PR backtrace/16155
* value.c (value_fetch_lazy): Internal error if
get_frame_register_value returns the same register.
output deterministic. time.h include is no longer needed.
* resres.c (res_append_resource): Likewise.
* pe-dll.c (fill_edata): Only use a real timestamp if
--insert-timestamp was used.
* emultempl/pe.em: Add the --insert-timestamp option.
* emultempl/pep.em: Likewise for 64bit.
* ld.texinfo: Document the --insert-timestamp option.
* libcoff-in.h: Add insert_timestamp flag to the pe_data struct.
* libcoff.h: Regenerate.
* peXXigen.c (_bfd_XXi_only_swap_filehdr_out): Only use a real
timestamp if --insert-timestamp was used.
Given we already have the frame id stash, which holds the ids of all
frames in the chain, detecting corrupted stacks with wide stack cycles
with non-consecutive dup frame ids is just as cheap as just detecting
cycles in consecutive frames:
#0 frame_id1
#1 frame_id2
#2 frame_id3
#3 frame_id1
#4 frame_id2
#5 frame_id3
#6 frame_id1
... forever ...
We just need to check whether the stash already knows about a given
frame id instead of comparing the ids of the previous/this frames.
Tested on x86_64 Fedora 17.
gdb/
2013-11-22 Pedro Alves <palves@redhat.com>
Tom Tromey <tromey@redhat.com>
* frame.c (frame_stash_add): Now returns whether a frame with the
same ID was already known.
(compute_frame_id): New function, factored out from get_frame_id.
(get_frame_id): No longer lazilly compute the frame id here.
(get_prev_frame_if_no_cycle): New function. Detects wider stack
cycles.
(get_prev_frame_1): Use it instead of get_prev_frame_raw directly,
and checking for stack cycles here.
The UNWIND_SAME_ID check is done between THIS_FRAME and the next frame
when we go try to unwind the previous frame. But at this point, it's
already too late -- we ended up with two frames with the same ID in
the frame chain. Each frame having its own ID is an invariant assumed
throughout GDB. This patch applies the UNWIND_SAME_ID detection
earlier, right after the previous frame is unwound, discarding the dup
frame if a cycle is detected.
The patch includes a new test that fails before the change. Before
the patch, the test causes an infinite loop in GDB, after the patch,
the UNWIND_SAME_ID logic kicks in and makes the backtrace stop with:
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
The test uses dwarf CFI to emulate a corrupted stack with a cycle. It
has a function with registers marked DW_CFA_same_value (most
importantly RSP/RIP), so that GDB computes the same ID for that frame
and its caller. IOW, something like this:
#0 - frame_id_1
#1 - frame_id_2
#2 - frame_id_3
#3 - frame_id_4
#4 - frame_id_4 <<<< outermost (UNWIND_SAME_ID).
(The test's code is just a copy of dw2-reg-undefined.S /
dw2-reg-undefined.c, adjusted to use DW_CFA_same_value instead of
DW_CFA_undefined, and to mark a different set of registers.)
The infinite loop is here, in value_fetch_lazy:
while (VALUE_LVAL (new_val) == lval_register && value_lazy (new_val))
{
frame = frame_find_by_id (VALUE_FRAME_ID (new_val));
...
new_val = get_frame_register_value (frame, regnum);
}
get_frame_register_value can return a lazy register value pointing to
the next frame. This means that the register wasn't clobbered by
FRAME; the debugger should therefore retrieve its value from the next
frame.
To be clear, get_frame_register_value unwinds the value in question
from the next frame:
struct value *
get_frame_register_value (struct frame_info *frame, int regnum)
{
return frame_unwind_register_value (frame->next, regnum);
^^^^^^^^^^^
}
In other words, if we get a lazy lval_register, it should have the
frame ID of the _next_ frame, never of FRAME.
At this point in value_fetch_lazy, the whole relevant chunk of the
stack up to frame #4 has already been unwound. The loop always
"unlazies" lval_registers in the "next/innermost" direction, not in
the "prev/unwind further/outermost" direction.
So say we're looking at frame #4. get_frame_register_value in frame
#4 can return a lazy register value of frame #3. So the next
iteration, frame_find_by_id tries to read the register from frame #3.
But, since frame #4 happens to have same id as frame #3,
frame_find_by_id returns frame #4 instead. Rinse, repeat, and we have
an infinite loop.
This is an old latent problem, exposed by the recent addition of the
frame stash. Before we had a stash, frame_find_by_id(frame_id_4)
would walk over all frames starting at the current frame, and would
always find #3 first. The stash happens to return #4 instead:
struct frame_info *
frame_find_by_id (struct frame_id id)
{
struct frame_info *frame, *prev_frame;
...
/* Try using the frame stash first. Finding it there removes the need
to perform the search by looping over all frames, which can be very
CPU-intensive if the number of frames is very high (the loop is O(n)
and get_prev_frame performs a series of checks that are relatively
expensive). This optimization is particularly useful when this function
is called from another function (such as value_fetch_lazy, case
VALUE_LVAL (val) == lval_register) which already loops over all frames,
making the overall behavior O(n^2). */
frame = frame_stash_find (id);
if (frame)
return frame;
for (frame = get_current_frame (); ; frame = prev_frame)
{
gdb/
2013-11-22 Pedro Alves <palves@redhat.com>
PR 16155
* frame.c (get_prev_frame_1): Do the UNWIND_SAME_ID check between
this frame and the new previous frame, not between this frame and
the next frame.
gdb/testsuite/
2013-11-22 Pedro Alves <palves@redhat.com>
PR 16155
* gdb.dwarf2/dw2-dup-frame.S: New file.
* gdb.dwarf2/dw2-dup-frame.c: New file.
* gdb.dwarf2/dw2-dup-frame.exp: New file.
Two rationales, same patch.
TL;DR 1:
dwarf2_frame_cache recursion is evil. dwarf2_frame_cache calls
dwarf2_tailcall_sniffer_first which then recurses into
dwarf2_frame_cache.
TL;DR 2:
An unwinder trying to unwind is evil. dwarf2_frame_sniffer calls
dwarf2_frame_cache which calls dwarf2_tailcall_sniffer_first which
then tries to unwind the PC of the previous frame.
Avoid all that by deferring dwarf2_tailcall_sniffer_first until it's
really necessary.
Rationale 1
===========
A frame sniffer should not try to unwind, because that bypasses all
the validation checks done by get_prev_frame. The UNWIND_SAME_ID
scenario is one such case where GDB is currently broken because (in
part) of this (the next patch adds a test that would fail without
this).
GDB goes into an infinite loop in value_fetch_lazy, here:
while (VALUE_LVAL (new_val) == lval_register && value_lazy (new_val))
{
frame = frame_find_by_id (VALUE_FRAME_ID (new_val));
...
new_val = get_frame_register_value (frame, regnum);
}
(top-gdb) bt
#0 value_fetch_lazy (val=0x11516d0) at ../../src/gdb/value.c:3510
#1 0x0000000000584bd8 in value_optimized_out (value=0x11516d0) at ../../src/gdb/value.c:1096
#2 0x00000000006fe7a1 in frame_register_unwind (frame=0x1492600, regnum=16, optimizedp=0x7fffffffcdec, unavailablep=0x7fffffffcde8, lvalp=0x7fffffffcdd8, addrp=
0x7fffffffcde0, realnump=0x7fffffffcddc, bufferp=0x7fffffffce10 "@\316\377\377\377\177") at ../../src/gdb/frame.c:940
#3 0x00000000006fea3a in frame_unwind_register (frame=0x1492600, regnum=16, buf=0x7fffffffce10 "@\316\377\377\377\177") at ../../src/gdb/frame.c:990
#4 0x0000000000473b9b in i386_unwind_pc (gdbarch=0xf54660, next_frame=0x1492600) at ../../src/gdb/i386-tdep.c:1771
#5 0x0000000000601dfa in gdbarch_unwind_pc (gdbarch=0xf54660, next_frame=0x1492600) at ../../src/gdb/gdbarch.c:2870
#6 0x0000000000693db5 in dwarf2_tailcall_sniffer_first (this_frame=0x1492600, tailcall_cachep=0x14926f0, entry_cfa_sp_offsetp=0x7fffffffcf00)
at ../../src/gdb/dwarf2-frame-tailcall.c:389
#7 0x0000000000690928 in dwarf2_frame_cache (this_frame=0x1492600, this_cache=0x1492618) at ../../src/gdb/dwarf2-frame.c:1245
#8 0x0000000000690f46 in dwarf2_frame_sniffer (self=0x8e4980, this_frame=0x1492600, this_cache=0x1492618) at ../../src/gdb/dwarf2-frame.c:1423
#9 0x000000000070203b in frame_unwind_find_by_frame (this_frame=0x1492600, this_cache=0x1492618) at ../../src/gdb/frame-unwind.c:112
#10 0x00000000006fd681 in get_frame_id (fi=0x1492600) at ../../src/gdb/frame.c:408
#11 0x00000000007006c2 in get_prev_frame_1 (this_frame=0xdc1860) at ../../src/gdb/frame.c:1826
#12 0x0000000000700b7a in get_prev_frame (this_frame=0xdc1860) at ../../src/gdb/frame.c:2056
#13 0x0000000000514588 in frame_info_to_frame_object (frame=0xdc1860) at ../../src/gdb/python/py-frame.c:322
#14 0x000000000051784c in bootstrap_python_frame_filters (frame=0xdc1860, frame_low=0, frame_high=-1) at ../../src/gdb/python/py-framefilter.c:1396
#15 0x0000000000517a6f in apply_frame_filter (frame=0xdc1860, flags=7, args_type=CLI_SCALAR_VALUES, out=0xed7a90, frame_low=0, frame_high=-1)
at ../../src/gdb/python/py-framefilter.c:1492
#16 0x00000000005e77b0 in backtrace_command_1 (count_exp=0x0, show_locals=0, no_filters=0, from_tty=1) at ../../src/gdb/stack.c:1777
#17 0x00000000005e7c0f in backtrace_command (arg=0x0, from_tty=1) at ../../src/gdb/stack.c:1891
#18 0x00000000004e37a7 in do_cfunc (c=0xda4fa0, args=0x0, from_tty=1) at ../../src/gdb/cli/cli-decode.c:107
#19 0x00000000004e683c in cmd_func (cmd=0xda4fa0, args=0x0, from_tty=1) at ../../src/gdb/cli/cli-decode.c:1882
#20 0x00000000006f35ed in execute_command (p=0xcc66c2 "", from_tty=1) at ../../src/gdb/top.c:468
#21 0x00000000005f8853 in command_handler (command=0xcc66c0 "bt") at ../../src/gdb/event-top.c:435
#22 0x00000000005f8e12 in command_line_handler (rl=0xfe05f0 "@") at ../../src/gdb/event-top.c:632
#23 0x000000000074d2c6 in rl_callback_read_char () at ../../src/readline/callback.c:220
#24 0x00000000005f8375 in rl_callback_read_char_wrapper (client_data=0x0) at ../../src/gdb/event-top.c:164
#25 0x00000000005f876a in stdin_event_handler (error=0, client_data=0x0) at ../../src/gdb/event-top.c:375
#26 0x00000000005f72fa in handle_file_event (data=...) at ../../src/gdb/event-loop.c:768
#27 0x00000000005f67a3 in process_event () at ../../src/gdb/event-loop.c:342
#28 0x00000000005f686a in gdb_do_one_event () at ../../src/gdb/event-loop.c:406
#29 0x00000000005f68bb in start_event_loop () at ../../src/gdb/event-loop.c:431
#30 0x00000000005f83a7 in cli_command_loop (data=0x0) at ../../src/gdb/event-top.c:179
#31 0x00000000005eeed3 in current_interp_command_loop () at ../../src/gdb/interps.c:327
#32 0x00000000005ef8ff in captured_command_loop (data=0x0) at ../../src/gdb/main.c:267
#33 0x00000000005ed2f6 in catch_errors (func=0x5ef8e4 <captured_command_loop>, func_args=0x0, errstring=0x8b6554 "", mask=RETURN_MASK_ALL)
at ../../src/gdb/exceptions.c:524
#34 0x00000000005f0d21 in captured_main (data=0x7fffffffd9e0) at ../../src/gdb/main.c:1067
#35 0x00000000005ed2f6 in catch_errors (func=0x5efb9b <captured_main>, func_args=0x7fffffffd9e0, errstring=0x8b6554 "", mask=RETURN_MASK_ALL)
at ../../src/gdb/exceptions.c:524
#36 0x00000000005f0d57 in gdb_main (args=0x7fffffffd9e0) at ../../src/gdb/main.c:1076
#37 0x000000000045bb6a in main (argc=4, argv=0x7fffffffdae8) at ../../src/gdb/gdb.c:34
(top-gdb)
GDB is trying to unwind the PC register of the previous frame (frame
#5 above), starting from the frame being sniffed (the THIS frame).
But the THIS frame's unwinder says the PC of the previous frame is
actually the same as the previous's frame's next frame (which is the
same frame we started with, the THIS frame), therefore it returns an
lval_register lazy value with frame set to THIS frame. And so the
value_fetch_lazy loop never ends.
Rationale 2
===========
As an experiment, I tried making dwarf2-frame.c:read_addr_from_reg use
address_from_register. That caused a bunch of regressions, but it
actually took me a long while to figure out what was going on. Turns
out dwarf2-frame.c:read_addr_from_reg is called while computing the
frame's CFA, from within dwarf2_frame_cache. address_from_register
wants to create a register with frame_id set to the frame being
constructed. To create the frame id, we again call dwarf2_frame_cache,
which given:
static struct dwarf2_frame_cache *
dwarf2_frame_cache (struct frame_info *this_frame, void **this_cache)
{
...
if (*this_cache)
return *this_cache;
returns an incomplete object to the caller:
static void
dwarf2_frame_this_id (struct frame_info *this_frame, void **this_cache,
struct frame_id *this_id)
{
struct dwarf2_frame_cache *cache =
dwarf2_frame_cache (this_frame, this_cache);
...
(*this_id) = frame_id_build (cache->cfa, get_frame_func (this_frame));
}
As cache->cfa is still 0 (we were trying to compute it!), and
get_frame_id recalls this id from here on, we end up with a broken
frame id in recorded for this frame. Later, when inspecting locals,
the dwarf machinery needs to know the selected frame's base, which
calls get_frame_base:
CORE_ADDR
get_frame_base (struct frame_info *fi)
{
return get_frame_id (fi).stack_addr;
}
which as seen above then returns 0 ...
So I gave up using address_from_register.
But, the pain of investigating this made me want to have GDB itself
assert that recursion never happens here. So I wrote a patch to do
that. But, it triggers on current mainline, because
dwarf2_tailcall_sniffer_first, called from dwarf2_frame_cache, unwinds
the this_frame.
A sniffer shouldn't be trying to unwind, exactly because of this sort
of tricky issue. The patch defers calling
dwarf2_tailcall_sniffer_first until it's really necessary, in
dwarf2_frame_prev_register (thus actually outside the sniffer path).
As this makes the call to dwarf2_frame_sniffer in dwarf2_frame_cache
unnecessary again, the patch removes that too.
Tested on x86_64 Fedora 17.
gdb/
2013-11-22 Pedro Alves <palves@redhat.com>
PR 16155
* dwarf2-frame.c (struct dwarf2_frame_cache)
<checked_tailcall_bottom, entry_cfa_sp_offset,
entry_cfa_sp_offset_p>: New fields.
(dwarf2_frame_cache): Adjust to use the new cache fields instead
of locals. Don't call dwarf2_tailcall_sniffer_first here.
(dwarf2_frame_prev_register): Call it here, but only once.
Two rationales, same patch.
TL;DR 1:
dwarf2_frame_cache recursion is evil. dwarf2_frame_cache calls
dwarf2_tailcall_sniffer_first which then recurses into
dwarf2_frame_cache.
TL;DR 2:
An unwinder trying to unwind is evil. dwarf2_frame_sniffer calls
dwarf2_frame_cache which calls dwarf2_tailcall_sniffer_first which
then tries to unwind the PC of the previous frame.
Avoid all that by deferring dwarf2_tailcall_sniffer_first until it's
really necessary.
Rationale 1
===========
A frame sniffer should not try to unwind, because that bypasses all
the validation checks done by get_prev_frame. The UNWIND_SAME_ID
scenario is one such case where GDB is currently broken because (in
part) of this (the next patch adds a test that would fail without
this).
GDB goes into an infinite loop in value_fetch_lazy, here:
while (VALUE_LVAL (new_val) == lval_register && value_lazy (new_val))
{
frame = frame_find_by_id (VALUE_FRAME_ID (new_val));
...
new_val = get_frame_register_value (frame, regnum);
}
(top-gdb) bt
#0 value_fetch_lazy (val=0x11516d0) at ../../src/gdb/value.c:3510
#1 0x0000000000584bd8 in value_optimized_out (value=0x11516d0) at ../../src/gdb/value.c:1096
#2 0x00000000006fe7a1 in frame_register_unwind (frame=0x1492600, regnum=16, optimizedp=0x7fffffffcdec, unavailablep=0x7fffffffcde8, lvalp=0x7fffffffcdd8, addrp=
0x7fffffffcde0, realnump=0x7fffffffcddc, bufferp=0x7fffffffce10 "@\316\377\377\377\177") at ../../src/gdb/frame.c:940
#3 0x00000000006fea3a in frame_unwind_register (frame=0x1492600, regnum=16, buf=0x7fffffffce10 "@\316\377\377\377\177") at ../../src/gdb/frame.c:990
#4 0x0000000000473b9b in i386_unwind_pc (gdbarch=0xf54660, next_frame=0x1492600) at ../../src/gdb/i386-tdep.c:1771
#5 0x0000000000601dfa in gdbarch_unwind_pc (gdbarch=0xf54660, next_frame=0x1492600) at ../../src/gdb/gdbarch.c:2870
#6 0x0000000000693db5 in dwarf2_tailcall_sniffer_first (this_frame=0x1492600, tailcall_cachep=0x14926f0, entry_cfa_sp_offsetp=0x7fffffffcf00)
at ../../src/gdb/dwarf2-frame-tailcall.c:389
#7 0x0000000000690928 in dwarf2_frame_cache (this_frame=0x1492600, this_cache=0x1492618) at ../../src/gdb/dwarf2-frame.c:1245
#8 0x0000000000690f46 in dwarf2_frame_sniffer (self=0x8e4980, this_frame=0x1492600, this_cache=0x1492618) at ../../src/gdb/dwarf2-frame.c:1423
#9 0x000000000070203b in frame_unwind_find_by_frame (this_frame=0x1492600, this_cache=0x1492618) at ../../src/gdb/frame-unwind.c:112
#10 0x00000000006fd681 in get_frame_id (fi=0x1492600) at ../../src/gdb/frame.c:408
#11 0x00000000007006c2 in get_prev_frame_1 (this_frame=0xdc1860) at ../../src/gdb/frame.c:1826
#12 0x0000000000700b7a in get_prev_frame (this_frame=0xdc1860) at ../../src/gdb/frame.c:2056
#13 0x0000000000514588 in frame_info_to_frame_object (frame=0xdc1860) at ../../src/gdb/python/py-frame.c:322
#14 0x000000000051784c in bootstrap_python_frame_filters (frame=0xdc1860, frame_low=0, frame_high=-1) at ../../src/gdb/python/py-framefilter.c:1396
#15 0x0000000000517a6f in apply_frame_filter (frame=0xdc1860, flags=7, args_type=CLI_SCALAR_VALUES, out=0xed7a90, frame_low=0, frame_high=-1)
at ../../src/gdb/python/py-framefilter.c:1492
#16 0x00000000005e77b0 in backtrace_command_1 (count_exp=0x0, show_locals=0, no_filters=0, from_tty=1) at ../../src/gdb/stack.c:1777
#17 0x00000000005e7c0f in backtrace_command (arg=0x0, from_tty=1) at ../../src/gdb/stack.c:1891
#18 0x00000000004e37a7 in do_cfunc (c=0xda4fa0, args=0x0, from_tty=1) at ../../src/gdb/cli/cli-decode.c:107
#19 0x00000000004e683c in cmd_func (cmd=0xda4fa0, args=0x0, from_tty=1) at ../../src/gdb/cli/cli-decode.c:1882
#20 0x00000000006f35ed in execute_command (p=0xcc66c2 "", from_tty=1) at ../../src/gdb/top.c:468
#21 0x00000000005f8853 in command_handler (command=0xcc66c0 "bt") at ../../src/gdb/event-top.c:435
#22 0x00000000005f8e12 in command_line_handler (rl=0xfe05f0 "@") at ../../src/gdb/event-top.c:632
#23 0x000000000074d2c6 in rl_callback_read_char () at ../../src/readline/callback.c:220
#24 0x00000000005f8375 in rl_callback_read_char_wrapper (client_data=0x0) at ../../src/gdb/event-top.c:164
#25 0x00000000005f876a in stdin_event_handler (error=0, client_data=0x0) at ../../src/gdb/event-top.c:375
#26 0x00000000005f72fa in handle_file_event (data=...) at ../../src/gdb/event-loop.c:768
#27 0x00000000005f67a3 in process_event () at ../../src/gdb/event-loop.c:342
#28 0x00000000005f686a in gdb_do_one_event () at ../../src/gdb/event-loop.c:406
#29 0x00000000005f68bb in start_event_loop () at ../../src/gdb/event-loop.c:431
#30 0x00000000005f83a7 in cli_command_loop (data=0x0) at ../../src/gdb/event-top.c:179
#31 0x00000000005eeed3 in current_interp_command_loop () at ../../src/gdb/interps.c:327
#32 0x00000000005ef8ff in captured_command_loop (data=0x0) at ../../src/gdb/main.c:267
#33 0x00000000005ed2f6 in catch_errors (func=0x5ef8e4 <captured_command_loop>, func_args=0x0, errstring=0x8b6554 "", mask=RETURN_MASK_ALL)
at ../../src/gdb/exceptions.c:524
#34 0x00000000005f0d21 in captured_main (data=0x7fffffffd9e0) at ../../src/gdb/main.c:1067
#35 0x00000000005ed2f6 in catch_errors (func=0x5efb9b <captured_main>, func_args=0x7fffffffd9e0, errstring=0x8b6554 "", mask=RETURN_MASK_ALL)
at ../../src/gdb/exceptions.c:524
#36 0x00000000005f0d57 in gdb_main (args=0x7fffffffd9e0) at ../../src/gdb/main.c:1076
#37 0x000000000045bb6a in main (argc=4, argv=0x7fffffffdae8) at ../../src/gdb/gdb.c:34
(top-gdb)
GDB is trying to unwind the PC register of the previous frame (frame
#5 above), starting from the frame being sniffed (the THIS frame).
But the THIS frame's unwinder says the PC of the previous frame is
actually the same as the previous's frame's next frame (which is the
same frame we started with, the THIS frame), therefore it returns an
lval_register lazy value with frame set to THIS frame. And so the
value_fetch_lazy loop never ends.
Rationale 2
===========
As an experiment, I tried making dwarf2-frame.c:read_addr_from_reg use
address_from_register. That caused a bunch of regressions, but it
actually took me a long while to figure out what was going on. Turns
out dwarf2-frame.c:read_addr_from_reg is called while computing the
frame's CFA, from within dwarf2_frame_cache. address_from_register
wants to create a register with frame_id set to the frame being
constructed. To create the frame id, we again call dwarf2_frame_cache,
which given:
static struct dwarf2_frame_cache *
dwarf2_frame_cache (struct frame_info *this_frame, void **this_cache)
{
...
if (*this_cache)
return *this_cache;
returns an incomplete object to the caller:
static void
dwarf2_frame_this_id (struct frame_info *this_frame, void **this_cache,
struct frame_id *this_id)
{
struct dwarf2_frame_cache *cache =
dwarf2_frame_cache (this_frame, this_cache);
...
(*this_id) = frame_id_build (cache->cfa, get_frame_func (this_frame));
}
As cache->cfa is still 0 (we were trying to compute it!), and
get_frame_id recalls this id from here on, we end up with a broken
frame id in recorded for this frame. Later, when inspecting locals,
the dwarf machinery needs to know the selected frame's base, which
calls get_frame_base:
CORE_ADDR
get_frame_base (struct frame_info *fi)
{
return get_frame_id (fi).stack_addr;
}
which as seen above then returns 0 ...
So I gave up using address_from_register.
But, the pain of investigating this made me want to have GDB itself
assert that recursion never happens here. So I wrote a patch to do
that. But, it triggers on current mainline, because
dwarf2_tailcall_sniffer_first, called from dwarf2_frame_cache, unwinds
the this_frame.
A sniffer shouldn't be trying to unwind, exactly because of this sort
of tricky issue. The patch defers calling
dwarf2_tailcall_sniffer_first until it's really necessary, in
dwarf2_frame_prev_register (thus actually outside the sniffer path).
As this makes the call to dwarf2_frame_sniffer in dwarf2_frame_cache
unnecessary again, the patch removes that too.
Tested on x86_64 Fedora 17.
gdb/
2013-11-22 Pedro Alves <palves@redhat.com>
PR 16155
* dwarf2-frame.c (struct dwarf2_frame_cache)
<checked_tailcall_bottom, entry_cfa_sp_offset,
entry_cfa_sp_offset_p>: New fields.
(dwarf2_frame_cache): Adjust to use the new cache fields instead
of locals. Don't call dwarf2_tailcall_sniffer_first here.
(dwarf2_frame_prev_register): Call it here, but only once.
Tested on x86_64 Fedora 17.
gdb/
2013-11-22 Pedro Alves <palves@redhat.com>
Tom Tromey <tromey@redhat.com>
* frame.c (frame_stash_add): Now returns whether a frame with the
same ID was already known.
(compute_frame_id): New function, factored out from get_frame_id.
(get_frame_id): No longer lazilly compute the frame id here.
(get_prev_frame_if_no_cycle): New function. Detects wider stack
cycles.
(get_prev_frame_1): Use it instead of get_prev_frame_raw directly,
and checking for stack cycles here.
The UNWIND_SAME_ID check is done between THIS_FRAME and the next frame
when we go try to unwind the previous frame. But at this point, it's
already too late -- we ended up with two frames with the same ID in
the frame chain. Each frame having its own ID is an invariant assumed
throughout GDB. This patch applies the UNWIND_SAME_ID detection
earlier, right after the previous frame is unwound, discarding the dup
frame if a cycle is detected.
The patch includes a new test that fails before the change. Before
the patch, the test causes an infinite loop in GDB, after the patch,
the UNWIND_SAME_ID logic kicks in and makes the backtrace stop with:
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
The test uses dwarf CFI to emulate a corrupted stack with a cycle. It
has a function with registers marked DW_CFA_same_value (most
importantly RSP/RIP), so that GDB computes the same ID for that frame
and its caller. IOW, something like this:
#0 - frame_id_1
#1 - frame_id_2
#2 - frame_id_3
#3 - frame_id_4
#4 - frame_id_4 <<<< outermost (UNWIND_SAME_ID).
(The test's code is just a copy of dw2-reg-undefined.S /
dw2-reg-undefined.c, adjusted to use DW_CFA_same_value instead of
DW_CFA_undefined, and to mark a different set of registers.)
The infinite loop is here, in value_fetch_lazy:
while (VALUE_LVAL (new_val) == lval_register && value_lazy (new_val))
{
frame = frame_find_by_id (VALUE_FRAME_ID (new_val));
...
new_val = get_frame_register_value (frame, regnum);
}
get_frame_register_value can return a lazy register value pointing to
the next frame. This means that the register wasn't clobbered by
FRAME; the debugger should therefore retrieve its value from the next
frame.
To be clear, get_frame_register_value unwinds the value in question
from the next frame:
struct value *
get_frame_register_value (struct frame_info *frame, int regnum)
{
return frame_unwind_register_value (frame->next, regnum);
^^^^^^^^^^^
}
In other words, if we get a lazy lval_register, it should have the
frame ID of the _next_ frame, never of FRAME.
At this point in value_fetch_lazy, the whole relevant chunk of the
stack up to frame #4 has already been unwound. The loop always
"unlazies" lval_registers in the "next/innermost" direction, not in
the "prev/unwind further/outermost" direction.
So say we're looking at frame #4. get_frame_register_value in frame
#4 can return a lazy register value of frame #3. So the next
iteration, frame_find_by_id tries to read the register from frame #3.
But, since frame #4 happens to have same id as frame #3,
frame_find_by_id returns frame #4 instead. Rinse, repeat, and we have
an infinite loop.
This is an old latent problem, exposed by the recent addition of the
frame stash. Before we had a stash, frame_find_by_id(frame_id_4)
would walk over all frames starting at the current frame, and would
always find #3 first. The stash happens to return #4 instead:
struct frame_info *
frame_find_by_id (struct frame_id id)
{
struct frame_info *frame, *prev_frame;
...
/* Try using the frame stash first. Finding it there removes the need
to perform the search by looping over all frames, which can be very
CPU-intensive if the number of frames is very high (the loop is O(n)
and get_prev_frame performs a series of checks that are relatively
expensive). This optimization is particularly useful when this function
is called from another function (such as value_fetch_lazy, case
VALUE_LVAL (val) == lval_register) which already loops over all frames,
making the overall behavior O(n^2). */
frame = frame_stash_find (id);
if (frame)
return frame;
for (frame = get_current_frame (); ; frame = prev_frame)
{
gdb/
2013-11-22 Pedro Alves <palves@redhat.com>
PR 16155
* frame.c (get_prev_frame_1): Do the UNWIND_SAME_ID check between
this frame and the new previous frame, not between this frame and
the next frame.
gdb/testsuite/
2013-11-22 Pedro Alves <palves@redhat.com>
PR 16155
* gdb.dwarf2/dw2-dup-frame.S: New file.
* gdb.dwarf2/dw2-dup-frame.c: New file.
* gdb.dwarf2/dw2-dup-frame.exp: New file.
Hi,
I find "has_more" is not checked when a dynamic varobj is created in
proc mi_create_dynamic_varobj. This patch adds the check to
"has_more".
gdb/testsuite:
2013-11-22 Yao Qi <yao@codesourcery.com>
* lib/mi-support.exp (mi_create_dynamic_varobj): Update
comment and add one more argument "has_more".
* gdb.python/py-mi.exp: Callers update.
In gdb.python/py-mi.exp, two varobjs container and nscont are created
when pretty-printing is still not enabled, so they are not dynamic
varobj, IIUC. In this patch, we use mi_create_floating_varobj instead
of mi_create_dynamic_varobj.
gdb/testsuite:
2013-11-22 Yao Qi <yao@codesourcery.com>
* gdb.python/py-mi.exp: Use mi_create_floating_varobj instead
of mi_create_dynamic_varobj.
Hi,
I find "dynamic=1" appear in the result of each child of the output of
-var-list-children,
-var-list-children ss1
^done,numchild="2",children=[child={name="ss1.a",exp="a",numchild="0",type="struct s",thread-id="1",dynamic="1"},child={name="ss1.b",exp="b",numchild="0",type="struct s",thread-id="1",dynamic="1"}],has_more="0"
but the doc doesn't mention this. This patch is to copy the description
of "dynamic=1" here.
gdb/doc:
2013-11-21 Yao Qi <yao@codesourcery.com>
* gdb.texinfo (GDB/MI Variable Objects): Add attribute 'dynamic'
for the output of command -var-list-children.
Looks "see" is unnecessary before @pxref.
gdb/doc:
2013-11-21 Yao Qi <yao@codesourcery.com>
* gdb.texinfo (Caching Target Data): Remove "see" before
@pxref.
2013-11-20 Pedro Alves <palves@redhat.com>
* gdb.base/maint.exp (maint print objfiles): Consume one line at a
time, and run it through all three milestone regexes.
is_intlike was mostly duplicating is_integral_type, with the exception
of the handling of TYPE_CODE_PTR when parameter PTR_OK is nonzero.
This patches deletes the is_intlike function, using is_integral_type
instead, and adjusting the two locations where this function gets
called.
The code should remain strictly equivalent.
gdb/ChangeLog:
* python/py-value.c (is_intlike): Delete.
(valpy_int): Replace use of CHECK_TYPEDEF and is_intlike
by use of is_integral_type.
(valpy_long): Replace use of CHECK_TYPEDEF and is_intlike
by use of is_integral_type and check for TYPE_CODE_PTR.
I was "lucky" enough that an unrelated patch changed how many symtabs
GDB expands in a plain run to main, and that triggered a latent issue
in this test:
PASS: gdb.base/maint.exp: maint print objfiles: header
PASS: gdb.base/maint.exp: maint print objfiles: psymtabs
FAIL: gdb.base/maint.exp: maint print objfiles: symtabs
The problem is in my case, expect is managing to alway put in the
buffer chunks like this:
Psymtabs:
../../../src/gdb/testsuite/gdb.base/break1.c at 0x1ed2280, ../../../src/gdb/testsuite/gdb.base/break.c at 0x1ed21d0,
Symtabs:
../../../src/gdb/testsuite/gdb.base/break.c at 0x1f044f0, /usr/include/stdio.h at 0x1ed25a0, /usr/include/libio.h at 0x1ed2510, /usr/include/bits/types.h at 0x1ed2480, /usr/lib/gcc/x86_64-redhat-linux/4.7.2/include/stddef.h at 0x1ed23f0,
Object file /usr/lib/debug/lib64/ld-2.15.so.debug: Objfile at 0x1f4bff0, bfd at 0x1f2d940, 0 minsyms
Psymtabs:
bsearch.c at 0x1f65340, ../sysdeps/x86_64/multiarch/init-arch.c at
0x1f65290, ...
Note: Psymtabs:/Symtabs:/Psymtabs:.
So, the loop matches the first Psymtabs in the buffer. Then we're
left with
../../../src/gdb/testsuite/gdb.base/break1.c at 0x1ed2280, ../../../src/gdb/testsuite/gdb.base/break.c at 0x1ed21d0,
Symtabs:
../../../src/gdb/testsuite/gdb.base/break.c at 0x1f044f0, /usr/include/stdio.h at 0x1ed25a0, /usr/include/libio.h at 0x1ed2510, /usr/include/bits/types.h at 0x1ed2480, /usr/lib/gcc/x86_64-redhat-linux/4.7.2/include/stddef.h at 0x1ed23f0,
Object file /usr/lib/debug/lib64/ld-2.15.so.debug: Objfile at 0x1f4bff0, bfd at 0x1f2d940, 0 minsyms
Psymtabs:
bsearch.c at 0x1f65340, ../sysdeps/x86_64/multiarch/init-arch.c at
0x1f65290, ...
In the next iteration, because the psymtabs regex comes first, we
match with the Psymtabs: line, then of course, end up with just
bsearch.c at 0x1f65340, ../sysdeps/x86_64/multiarch/init-arch.c at
0x1f65290, ...
in the buffer. The "Symtabs:" line is lost. expect then reads more
gdb output, and manages to again retrieve the same pattern. Rinse,
repeat, and the test never matches any "Symtab:" line.
We don't know the order the matches lines will appear, so the fix is
to consume one line at a time, and run it through all three milestone
regexes.
gdb/testsuite/
2013-11-20 Pedro Alves <palves@redhat.com>
* gdb.base/maint.exp (maint print objfiles): Consume one line at a
time, and run it through all three milestone regexes.
free location in the text memory region, not a computation based
upon the size of the text section. Orphaned sections or other
linker scripts might insert new sections between the .text section
and the .data section.
* scripttempl/elf32msp430_3.sc (.data): Likewise.
This fixes the mingw build breakage reported by Pierre.
I found that the gnulib strerror module somehow requires us to pull in
the gethostname module. However, pulling in the gethostname module
makes many things break.
I've sent a bug report to gnulib.
Meanwhile, removing the strerror module should not harm gdb and fixes
the build.
I'm checking this in.
2013-11-20 Tom Tromey <tromey@redhat.com>
* gnulib/update-gnulib.sh (IMPORTED_GNULIB_MODULES): Remove
strerror module.
* gnulib/aclocal.m4: Update.
* gnulib/config.in: Update.
* gnulib/configure: Update.
* gnulib/import/Makefile.am: Update.
* gnulib/import/Makefile.in: Update.
* gnulib/import/errno.in.h: Remove.
* gnulib/import/intprops.h: Remove.
* gnulib/import/m4/errno_h.m4: Remove.
* gnulib/import/m4/gnulib-cache.m4: Update.
* gnulib/import/m4/gnulib-comp.m4: Update.
* gnulib/import/m4/strerror.m4: Remove.
* gnulib/import/m4/sys_socket_h.m4: Remove.
* gnulib/import/strerror-override.c: Remove.
* gnulib/import/strerror-override.h: Remove.
* gnulib/import/strerror.c: Remove.
* gnulib/update-gnulib.sh: Update.
Ensure that certain commands (e.g. whatis/ptype) and sizeof intrinsic
have no side effects (variables cannot be altered).
2013-11-20 Sanimir Agovic <sanimir.agovic@intel.com>
testsuite/
* gdb.base/eval-avoid-side-effects.exp: New test.
Boundary length is simpler implemented by means of a pretty
printer. This simplifies users life when examining a bound register.
Changelog:
2013-11-20 Walfred Tedeschi <walfred.tedeschi@intel.com>
* python/lib/gdb/command/bound_register.py: New file.
* gdb/data-directory/Makefile.in: copy bond_register.py to the right path to
be initialized at gdb startup.
testsuite/
* gdb.python/py-pp-maint.exp: Consider new pretty-print added for registers.
Change-Id: Id4f39845e5ece56c370a1fd4343648909f08b731
Signed-off-by: Walfred Tedeschi <walfred.tedeschi@intel.com>
Conflicts:
gdb/ChangeLog
2013-06-24 Walfred Tedeschi <walfred.tedeschi@intel.com>
* amd64-linux-nat.c (amd64_linux_gregset32_reg_offset):
Add MPX registers.
(amd64_linux_read_description): Add initialization for MPX and
AVX independently.
* amd64-linux-tdep.c: Includes features/i386/amd64-mpx-linux.c.
(amd64_linux_gregset_reg_offset): Add MPX registers.
(amd64_linux_core_read_description): Add initialization for MPX
registers.
(_initialize_amd64_linux_tdep): Initialize MPX targets.
* amd64-linux-tdep.h (AMD64_LINUX_RAX_REGNUM): Set it to the last
register on the list.
(tdesc_amd64_mpx_linux) Add new target for MPX.
* amd64-tdep.c: Includes features/i386/amd64-mpx.c.
(amd64_mpx_names): MPX register names.
(amd64_init_abi): Add MPX register while initializing the ABI.
(_initialize_amd64_tdep): Initialize MPX targets.
* amd64-tdep.h (amd64_regnum): Add MPX registers.
(AMD64_NUM_REGS): Set number of registers taking MPX into account.
Change-Id: I4a785c181e2fb45e4086650b2f87426caeb2f800
Signed-off-by: Walfred Tedeschi <walfred.tedeschi@intel.com>
Conflicts:
gdb/ChangeLog
2013-11-20 Walfred Tedeschi <walfred.tedeschi@intel.com>
* i386-linux-nat.c (GETXSTATEREGS_SUPPLIES): Add MPX
registers on the range of registers to be read from
xsave buffer.
(i386_linux_read_description): Add case for MPX.
* i386-linux-tdep.c: Include features/i386/i386-mpx-linux.c.
(i386_linux_gregset_reg_offset): Add MPX registers.
(i386_linux_core_read_description): Initialize also MPX.
(_initialize_i386_linux_tdep): Add mpx initialization.
* i386-tdep.h (gdbarch_tdep): Add fields bnd0r_regnum, bnd0_regnum,
mpx_register_names.
(i386_regnum): Add MPX registers.
(I386_MPX_NUM_REGS): New macro.
(i386_bnd_regnum_p): New function.
* i386-linux-tdep.h (I386_LINUX_NUM_REGS): Set
number of registers to be the number of BNDSTATUS.
(tdesc_i386_mpx_linux): Add description for MPX Linux registers.
* i386-tdep.c: Include features/i386/i386-mpx.c.
(i386_mpx_names): Add MPX register names array.
(i386_bnd_names): Add bnd pseudo register names array.
(i386_bndr_regnum_p): Lookup register numbers for bnd raw
registers.
(i386_bndr_regnum_p): Lookup register numbers for bnd raw registers.
(386_mpx_ctrl_regnum_p): Lookup register numbers for MPX control
registers.
(i386_bnd_type): New function.
(i386_pseudo_register_type): Use i386_bnd_type for bnd pseudo
register types.
(i386_pseudo_register_read_into_value): Add bnd case.
(i386_pseudo_register_write): Add bnd pseudo registers.
(i386_register_reggroup_p): Add MPX register to the group all.
(i386_validate_tdesc_p): Add MPX to the target description
validation.
(i386_pseudo_register_name): Add bnd pseudo registers.
(i386_gdbarch_init): Add MPX for architecture initialization.
(_initia_initialize_i386_tdep): Add mpx initialization.
* i387-tdep.c (xsave_mpx_offset): New vector for MPX offsets on
XSAVE buffer.
(XSAVE_MPX_ADDR): New macro.
(i387_supply_xsave): Add MPX case.
(i387_collect_xsave): Add MPX case.
* i387-tdep.h (I387_BND0R_REGNUM): New macro.
(I387_BNDCFGU_REGNUM): New macro.
(I387_NUM_MPX_REGS): New macro.
(I387_NUM_BND_REGS): New macro.
(I387_NUM_MPX_CTRL_REGS): New macro.
(I387_MPXEND_REGNUM): New macro.
* common/i386-xstate.h (I386_XSTATE_BNDREGS): New macro.
(I386_XSTATE_BNDCFG): Likewise.
(I386_XSTATE_MPX_MASK): Likewise.
(I386_XSTATE_ALL_MASK): New macro represents flags for all states.
(I386_XSTATE_BNDREGS_SIZE): New macro.
(I386_XSTATE_BNDCFG_SIZE): Likewise.
(I386_XSTATE_SIZE): Adapt for MPX.
(I386_XSTATE_MAX_SIZE): Likewise.
Change-Id: I9ddb7d49434d86fa18eb6b99515203d7c567aefd
Signed-off-by: Walfred Tedeschi <walfred.tedeschi@intel.com>
Conflicts:
gdb/ChangeLog
Bitfields are represented by intervals [start, begin]. It means that for an
interval comprised by only one bit start and end will be equal.
The present condition does not always hold. On the other hand in target-description.c
(tdesc_gdb_type) bitfield is created when "f->type" is null. The routine
maint_print_maint_print_c_tdesc_cmd is modified to follow the same strategy.
2013-11-20 Walfred Tedeschi <walfred.tedeschi@intel.com>
* target-descriptions.c (maint_print_maint_print_c_tdesc_cmd):
Modified logic of creating a bitfield to be in sync with
tdesc_gdb_type.
testsuite/
* gdb.xml/maint_print_struct.xml (bitfield): Added bitfield having
start and end equal 0.
Change-Id: I8c62db049995f0c0c30606d9696b86afe237cbb9
Alan Modra
Sterling Augustine
Pedro Alves
Tom Tromey
Cory Fields
Senthil Kumar Selvaraj
Doug Evans
Yao Qi
Andrew Pinski
schwab
Nick Clifton
Conrad Hoffmann
H.J. Lu
Tristan Gingold
Doug Evans
Joel Brobecker
Sanimir Agovic
Walfred Tedeschi