Bug 10457 - gdb Segfaults due stack overflow (excessive usage of alloca)
Summary: gdb Segfaults due stack overflow (excessive usage of alloca)
Status: RESOLVED FIXED
Alias: None
Product: gdb
Classification: Unclassified
Component: symtab (show other bugs)
Version: unknown
: P2 normal
Target Milestone: 6.8
Assignee: Paul Pluzhnikov
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-07-29 05:38 UTC by Holger Freyther
Modified: 2009-10-08 16:41 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments
Hack to change alloca to malloc (1.87 KB, patch)
2009-07-29 05:41 UTC, Holger Freyther
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Holger Freyther 2009-07-29 05:38:27 UTC
Debugging a process that loaded a debug enabled libWebKitQt will lead to a segfault in gdb. This 
is due a stack overflow. valgrind reports the event the following way and a backtrace from a core 
file is also in this description.

valgrind:
==11373== Process terminating with default action of signal 11 (SIGSEGV)
==11373==  Access not within mapped region at address 0xBE26EFDC
==11373==    at 0x827D2C2: cplus_demangle_type (in /usr/bin/gdb)
==11373==  If you believe this happened as a result of a stack overflow in your
==11373==  program's main thread (unlikely but possible), you can try to increase
==11373==  the size of the main thread stack using the --main-stacksize= flag.
==11373==  The main thread stack size used in this run was 8388608.
==11373== Stack overflow in thread 1: can't grow stack to 0xbe26efd8


gdb on the core:
Core was generated by `gdb --args ./bin/QtLauncher http://index.hu'.
Program terminated with signal 11, Segmentation fault.
#0  0x0827e538 in ?? ()
(gdb) bt
#0  0x0827e538 in ?? ()
#1  0x0827d2c7 in cplus_demangle_type ()
#2  0x0827d39e in cplus_demangle_type ()
#3  0x0827df55 in ?? ()
#4  0x0827e6b5 in ?? ()
#5  0x0827e76c in ?? ()
#6  0x08280b2b in ?? ()
#7  0x08280c95 in ?? ()
#8  0x08280d04 in cplus_demangle_v3 ()
#9  0x08279e03 in cplus_demangle ()
#10 0x08139fc4 in symbol_set_names ()
#11 0x0808dc80 in prim_record_minimal_symbol_and_info ()
#12 0x080fce83 in ?? ()
#13 0x080fd0ce in ?? ()
#14 0x080fda39 in ?? ()
#15 0x0813dcf0 in syms_from_objfile ()
#16 0x0813f383 in ?? ()
#17 0x080a879e in solib_read_symbols ()
#18 0x080a8dcc in solib_add ()
#19 0x08152341 in handle_inferior_event ()
#20 0x08154760 in wait_for_inferior ()
#21 0x08154b2c in proceed ()
#22 0x0814c157 in ?? ()
#23 0x08090ea2 in execute_command ()
#24 0x08161a9b in ?? ()
#25 0x081627ea in ?? ()
#26 0xb7ec1277 in rl_callback_read_char () from /lib/libreadline.so.5
#27 0x08161bdb in ?? ()
#28 0x081610b9 in ?? ()
#29 0x081608db in ?? ()
#30 0x08161796 in gdb_do_one_event ()
#31 0x0815baa3 in catch_errors ()
#32 0x080ee2d4 in ?? ()
#33 0x0815c173 in current_interp_command_loop ()
#34 0x0808890b in ?? ()
#35 0x0815baa3 in catch_errors ()
#36 0x080894a4 in ?? ()
#37 0x0815baa3 in catch_errors ()
#38 0x08088832 in gdb_main ()
#39 0x080887f3 in main ()
(gdb)
Comment 1 Holger Freyther 2009-07-29 05:41:34 UTC
Created attachment 4095 [details]
Hack to change alloca to malloc

The following workaround is working for me. The idea is to exchange alloca with
malloc.
Comment 2 Paul Pluzhnikov 2009-07-29 23:01:24 UTC
A related patch for the same problem (but in different area of GDB):
http://sourceware.org/ml/gdb-patches/2009-07/msg00598.html

Holger, could you send me (or otherwise make available) the bin/QtLauncher
binary which makes GDB crash?
Comment 3 Holger Freyther 2009-08-11 14:44:25 UTC
(In reply to comment #2)
> A related patch for the same problem (but in different area of GDB):
> http://sourceware.org/ml/gdb-patches/2009-07/msg00598.html
> 
> Holger, could you send me (or otherwise make available) the bin/QtLauncher
> binary which makes GDB crash?

The binary + WebKit library is +100mb of size. Where should I send it or upload it?

Comment 4 Holger Freyther 2009-10-01 06:31:28 UTC
Sorry for delaying it, I will try to compile and provide the necessary libraries
by next week.
Comment 5 Paul Pluzhnikov 2009-10-08 05:30:19 UTC
Following Holger's directions and additional directions here:
http://trac.webkit.org/wiki/BuildingQtOnLinux#DependenciesforspecificLinuxdistributions

I built debug version of Webkit with:
  WebKitTools/Scripts/build-webkit --qt --debug
on Fedora 11/i686 and tested it with GDB from CVS Head, which did not crash with
(default) 'ulimit -s' of 10240

The resulting libQtWebKit.so.4.5.2 is 472223763 bytes.

It does crash with 6M stack though.
The problem is alloca in elf_symtab_read in a loop.

Patch sent:
http://sourceware.org/ml/gdb-patches/2009-10/msg00163.html

With the patch, GDB runs in 16K stack (ulimit -s 16) on this test case without
any problems.

Comment 6 Sourceware Commits 2009-10-08 16:38:57 UTC
Subject: Bug 10457

CVSROOT:	/cvs/src
Module name:	src
Changes by:	ppluzhnikov@sourceware.org	2009-10-08 16:38:42

Modified files:
	gdb            : ChangeLog elfread.c 

Log message:
	2009-10-08  Paul Pluzhnikov  <ppluzhnikov@google.com>
	
	PR gdb/10457
	* elfread.c (elf_symtab_read): Don't use alloca in a loop.

Patches:
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/ChangeLog.diff?cvsroot=src&r1=1.10941&r2=1.10942
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/elfread.c.diff?cvsroot=src&r1=1.77&r2=1.78

Comment 7 Paul Pluzhnikov 2009-10-08 16:41:15 UTC
Fixed on trunk.
Comment 8 Sourceware Commits 2009-10-08 17:42:24 UTC
Subject: Bug 10457

CVSROOT:	/cvs/src
Module name:	src
Branch: 	gdb_7_0-branch
Changes by:	ppluzhnikov@sourceware.org	2009-10-08 17:42:10

Modified files:
	gdb            : ChangeLog elfread.c 

Log message:
	2009-10-08  Paul Pluzhnikov  <ppluzhnikov@google.com>
	
	PR gdb/10457
	* elfread.c (elf_symtab_read): Don't use alloca in a loop.

Patches:
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/ChangeLog.diff?cvsroot=src&only_with_tag=gdb_7_0-branch&r1=1.10874.2.48&r2=1.10874.2.49
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/elfread.c.diff?cvsroot=src&only_with_tag=gdb_7_0-branch&r1=1.77&r2=1.77.4.1