Bug 10819 - gdb 7.0 crashes on Solaris 8 when reading symbols from the program being debugged
Summary: gdb 7.0 crashes on Solaris 8 when reading symbols from the program being debu...
Status: RESOLVED FIXED
Alias: None
Product: gdb
Classification: Unclassified
Component: gdb (show other bugs)
Version: 7.0
: P2 normal
Target Milestone: 7.1
Assignee: Paul Pluzhnikov
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-10-21 08:39 UTC by Steve Evans
Modified: 2009-10-22 20:36 UTC (History)
1 user (show)

See Also:
Host: sparc-sun-solaris2.8
Target: sparc-sun-solaris2.8
Build: sparc-sun-solaris2.8
Last reconfirmed:


Attachments
proposed fix (241 bytes, patch)
2009-10-22 04:40 UTC, Paul Pluzhnikov
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Steve Evans 2009-10-21 08:39:25 UTC
gdb 7.0 crashes on Solaris 8 when reading symbols from the program being
debugged. This has been reproduced with several different programs, both big and
small. Here is an example:

GNU gdb (GDB) 7.0
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "sparc-sun-solaris2.8".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from
/ds/5/SOLARIS_build/red_redac/programs/rinf_to_pcb...Segmentation Fault (core
dumped)

I have built a debug version of gdb 7.0 and debugged it using gdb 6.7. Here is
the traceback:

#0  0x001f9f18 in bsearch_cie_cmp (key=0xffbed430, element=0x0) at
dwarf2-frame.c:1514
#1  0xfeeb60e0 in bsearch () from /usr/lib/libc.so.1
#2  0x001fa024 in find_cie (cie_table=0xffbed640, cie_pointer=0) at
dwarf2-frame.c:1528
#3  0x001fa838 in decode_frame_entry_1 (unit=0xba4760, start=0xfef52774 "",
eh_frame_p=0,
    cie_table=0xffbed640, fde_table=0xffbed638) at dwarf2-frame.c:1686
#4  0x001fb354 in decode_frame_entry (unit=0xba4760, start=0xfef52774 "",
eh_frame_p=0,
    cie_table=0xffbed640, fde_table=0xffbed638) at dwarf2-frame.c:1907
#5  0x001fbab4 in dwarf2_build_frame_info (objfile=0x519910) at dwarf2-frame.c:2081
#6  0x000d1428 in elf_symfile_read (objfile=0x519910, mainline=0) at elfread.c:739
#7  0x00141b6c in syms_from_objfile (objfile=0x519910, addrs=0x504860,
offsets=0x0, num_offsets=0,
    add_flags=6) at symfile.c:889
#8  0x00141e08 in symbol_file_add_with_addrs_or_offsets (abfd=0x501b48,
add_flags=6, addrs=0x0,
    offsets=0x0, num_offsets=0, flags=0) at symfile.c:990
#9  0x00142194 in symbol_file_add_from_bfd (abfd=0x501b48, add_flags=6,
addrs=0x0, flags=0)
    at symfile.c:1091
#10 0x001421e0 in symbol_file_add (name=0xffbee0c1 "rinf_to_pcb", add_flags=6,
addrs=0x0, flags=0)
    at symfile.c:1103
#11 0x00142274 in symbol_file_add_main_1 (args=0xffbee0c1 "rinf_to_pcb",
from_tty=1, flags=0)
    at symfile.c:1126
#12 0x00142210 in symbol_file_add_main (args=0xffbee0c1 "rinf_to_pcb",
from_tty=1) at symfile.c:1119
#13 0x00173270 in catch_command_errors (command=0x1421f0 <symbol_file_add_main>,
    arg=0xffbee0c1 "rinf_to_pcb", from_tty=1, mask=6) at exceptions.c:525
#14 0x00047e78 in captured_main (data=0xffbedd20) at main.c:804
#15 0x00173170 in catch_errors (func=0x46d38 <captured_main>, func_args=0xffbedd20,
    errstring=0x3ed3a0 "", mask=6) at exceptions.c:510
#16 0x00048598 in gdb_main (args=0xffbedd20) at main.c:911
#17 0x00046974 in main (argc=2, argv=0xffbedda4) at gdb.c:33

The line in question is:

struct dwarf2_cie *cie = *(struct dwarf2_cie **) element;

and element is NULL
Comment 1 Paul Pluzhnikov 2009-10-21 19:19:44 UTC
(In reply to comment #0)

> and element is NULL

This implies that Solaris bsearch is broken, which is hard to believe.
Could you please execute:

  frame 2
  print *cie_table

Also, does GDB-7.0 crash when run on itself, or only on your rinf_to_pcb
executable?
Comment 2 Paul Pluzhnikov 2009-10-22 04:40:56 UTC
Created attachment 4308 [details]
proposed fix

Hard as it is to believe, bsearch appears to in fact be broken:

(top-gdb) p *cie_table
$1 = {num_entries = 0, entries = 0x0}

Apparently calling bsearch on a table with zero elements is unsafe on Solaris
8.
Comment 3 Steve Evans 2009-10-22 07:06:16 UTC
Reply to commment #1

You appear to have got the answer to the first question that you asked. The
value  of  *cie_table is indeed

(gdb) print *cie_table
$1 = {num_entries = 0, entries = 0x0}

The problem happens with any executable, even a simple hello world program.

I will try your proposed fixed in comment #2

Thanks.
Comment 4 Steve Evans 2009-10-22 07:54:31 UTC
The patch fixed the problem, thanks.
Comment 5 Sourceware Commits 2009-10-22 20:20:41 UTC
Subject: Bug 10819

CVSROOT:	/cvs/src
Module name:	src
Changes by:	ppluzhnikov@sourceware.org	2009-10-22 20:20:27

Modified files:
	gdb            : ChangeLog dwarf2-frame.c objfiles.c 

Log message:
	2009-10-22  Paul Pluzhnikov  <ppluzhnikov@google.com>
	
	PR gdb/10819
	* dwarf2-frame.c (find_cie): Don't call bsearch on empty cie_table.
	* objfiles.c (find_pc_section): Likewise.
	(update_section_map): Don't allocate empty table.

Patches:
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/ChangeLog.diff?cvsroot=src&r1=1.10989&r2=1.10990
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/dwarf2-frame.c.diff?cvsroot=src&r1=1.100&r2=1.101
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/objfiles.c.diff?cvsroot=src&r1=1.99&r2=1.100

Comment 6 Sourceware Commits 2009-10-22 20:31:50 UTC
Subject: Bug 10819

CVSROOT:	/cvs/src
Module name:	src
Branch: 	gdb_7_0-branch
Changes by:	ppluzhnikov@sourceware.org	2009-10-22 20:31:36

Modified files:
	gdb            : ChangeLog dwarf2-frame.c objfiles.c 

Log message:
	2009-10-22  Paul Pluzhnikov  <ppluzhnikov@google.com>
	
	PR gdb/10819
	* dwarf2-frame.c (find_cie): Don't call bsearch on empty cie_table.
	* objfiles.c (find_pc_section): Likewise.
	(update_section_map): Don't allocate empty table.

Patches:
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/ChangeLog.diff?cvsroot=src&only_with_tag=gdb_7_0-branch&r1=1.10874.2.51&r2=1.10874.2.52
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/dwarf2-frame.c.diff?cvsroot=src&only_with_tag=gdb_7_0-branch&r1=1.99&r2=1.99.2.1
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/objfiles.c.diff?cvsroot=src&only_with_tag=gdb_7_0-branch&r1=1.96.2.1&r2=1.96.2.2

Comment 7 Paul Pluzhnikov 2009-10-22 20:36:28 UTC
Fixed on trunk and gdb_7_0-branch