Bug 11648 - gdb crashes with segmentation fault when printing larger objects
Summary: gdb crashes with segmentation fault when printing larger objects
Status: RESOLVED FIXED
Alias: None
Product: gdb
Classification: Unclassified
Component: c++ (show other bugs)
Version: 7.1
: P2 critical
Target Milestone: 7.2
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-05-31 10:26 UTC by Sven Anderson
Modified: 2012-02-23 19:44 UTC (History)
4 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments
Session log of how to produce segmantation fault (980 bytes, text/plain)
2010-05-31 11:44 UTC, Sven Anderson
Details
Sometimes this backtrace is displayed (1.53 KB, text/plain)
2010-05-31 11:45 UTC, Sven Anderson
Details
Backtrace of the segmentation fault when gdb is run gdb (1015 bytes, text/plain)
2010-09-21 13:56 UTC, Sven Anderson
Details
trace of gdb running in valgrind (16.68 KB, text/plain)
2010-09-21 14:02 UTC, Sven Anderson
Details
test case to crash gdb 7.1 (185 bytes, text/plain)
2010-09-28 12:03 UTC, Sven Anderson
Details
How to reproduce the crash with the test case (760 bytes, text/plain)
2010-09-28 12:13 UTC, Sven Anderson
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Sven Anderson 2010-05-31 10:26:11 UTC
System: Linux anderssv-lx-01 2.6.32-22-generic #33-Ubuntu SMP Wed Apr 28
13:27:30 UTC 2010 i686 GNU/Linux
Glibc: 2.11.1-0ubuntu7.1
g++: 4.4.3-4ubuntu5

The following happens only with gdb 7.1 and latest snapshot, 7.0.1 works fine.

Since my last system update to Ubuntu 10.4 I was unable to use the debugger for
our software project in eclipse. I noticed that gdb has been updated to 7.1 and
found out that I can reproduce a segmentation fault with a few steps by just
setting a breakpoint in main and from there printing a string object three times
(own implementation, not std::string) and quitting it with q each time. I will
attach a session log with glibc debugging informations and backtrace.

In eclipse it even crashes when I step through the code, but I don't know if
there are also prints involved while stepping in eclipse.

If you need any further information I will try to provide it.
Comment 1 Sven Anderson 2010-05-31 11:44:44 UTC
Created attachment 4822 [details]
Session log of how to produce segmantation fault
Comment 2 Sven Anderson 2010-05-31 11:45:37 UTC
Created attachment 4823 [details]
Sometimes this backtrace is displayed
Comment 3 Sven Anderson 2010-05-31 11:50:25 UTC
I noticed that sometimes, if glibc debugging informations are installed, a
backtrace is shown (see second attachment), but this is not so easy to reproduce.

Also sometimes I manage get the following error message instead of a
segmentation fault:
value.c:627: internal-error: value_free: Assertion `val->reference_count > 0'
failed.
A problem internal to GDB has been detected, [...]
Comment 4 Tom Tromey 2010-06-03 15:52:23 UTC
One thing that might be helpful is if you ran your gdb session under valgrind,
then reproduced the bug.  Be sure to have the gdb debuginfo available when
you do this.

Otherwise I think we will need a test case so we can reproduce the problem.
Comment 5 Sven Anderson 2010-09-21 13:56:09 UTC
Created attachment 4994 [details]
Backtrace of the segmentation fault when gdb is run gdb

This is a backtrace of the segmentation fault when I run the gdb inside of
another gdb session. As you can see the violation happens in obstack_free().
Comment 6 Sven Anderson 2010-09-21 14:02:42 UTC
Created attachment 4995 [details]
trace of gdb running in valgrind

This is a complete trace of a gdb session running in valgrind. Search for
"Invalid free()" at the end. Again you see it happens in obstack_free().
Comment 7 Tom Tromey 2010-09-27 17:49:19 UTC
Could you possibly try 7.2?
This area has been reworked a bit since 7.1.

Otherwise it is hard to see how to proceed without a test case.
Unfortunately the valgrind output didn't really help me diagnose the bug.
Comment 8 Sven Anderson 2010-09-28 09:09:34 UTC
Indeed, with 7.2 I cannot reproduce the crash. This is good news. But still I
will try to extract a test-case from our code.
Comment 9 Sven Anderson 2010-09-28 12:03:47 UTC
Created attachment 5017 [details]
test case to crash gdb 7.1
Comment 10 Sven Anderson 2010-09-28 12:13:17 UTC
Created attachment 5018 [details]
How to reproduce the crash with the test case
Comment 11 Sven Anderson 2010-09-28 12:29:39 UTC
Ok, in the end the test case is very simple. You just need a class with a couple
of static objects of its own. See gdb-crash.cpp.

How to reproduce:
$ g++ -g gdb-crash.cpp -o gdb-crash
$ ~/src/gdb-7.1.50.20100527/gdb/gdb gdb-crash
(gdb) b main
(gdb) r
(gdb) print global
q<return>
(gdb) print global
q<return>
(gdb) print global
-> segmentation fault
(see gdb-crash.txt for details)

My system is an up-to-date Ubuntu 10.04, 32bit, that is:

$ uname -a
Linux anderssv-lx-01 2.6.32-25-generic #44-Ubuntu SMP Fri Sep 17 20:26:08 UTC
2010 i686 GNU/Linux

and libc: 2.11.1-0ubuntu7.2 (i686 optimized version)
Comment 12 Sven Anderson 2010-09-28 12:35:44 UTC
Forgot the compiler:
$ g++ -v
Using built-in specs.
Target: i486-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu 4.4.3-4ubuntu5'
--with-bugurl=file:///usr/share/doc/gcc-4.4/README.Bugs
--enable-languages=c,c++,fortran,objc,obj-c++ --prefix=/usr --enable-shared
--enable-multiarch --enable-linker-build-id --with-system-zlib
--libexecdir=/usr/lib --without-included-gettext --enable-threads=posix
--with-gxx-include-dir=/usr/include/c++/4.4 --program-suffix=-4.4 --enable-nls
--enable-clocale=gnu --enable-libstdcxx-debug --enable-plugin --enable-objc-gc
--enable-targets=all --disable-werror --with-arch-32=i486 --with-tune=generic
--enable-checking=release --build=i486-linux-gnu --host=i486-linux-gnu
--target=i486-linux-gnu
Thread model: posix
gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5)
Comment 13 Tom Tromey 2012-02-23 19:44:34 UTC
Thanks.
Definitely works now, so I'm closing this.