Bug 11199

Summary: crash in quirk_gcc_member_function_pointer (dwarf2read.c)
Product: gdb Reporter: Keith Seitz <keiths>
Component: symtabAssignee: Tom Tromey <tromey>
Status: RESOLVED FIXED    
Severity: normal CC: gdb-prs, tromey
Priority: P2    
Version: unknown   
Target Milestone: 7.1   
Host: i386-unknown-linux Target: i386-unknown-linux
Build: i386-unknown-linux Last reconfirmed: 2010-01-21 21:51:16

Description Keith Seitz 2010-01-20 20:13:57 UTC 
This is probably a very obscure bug, but since it does cause gdb to crash, I'm
submitting this bug report.

The only reproducible case that I have is to install abiword and
gtkmathview-debuginfo. Attach to abiword with the --readnow option and BLAMO!
quirk_gcc_member_function_pointer will crash:

Program received signal SIGSEGV, Segmentation fault.
0x081c4919 in quirk_gcc_member_function_pointer (die=
During symbol reading, incomplete CFI data; unspecified registers (e.g., eax) at
0x81c477e.
0x1ec78cb4, cu=0x1e7d9bd8) at ../../src/gdb/dwarf2read.c:4952
4952	      || TYPE_CODE (TYPE_FIELD_TYPE (pfn_type, 0)) != TYPE_CODE_PTR)
(top-gdb) bt
During symbol reading, DW_AT_type missing from DW_TAG_subrange_type.
#0  0x081c4919 in quirk_gcc_member_function_pointer (die=0x1ec78cb4, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:4952
#1  0x081c4a0b in read_structure_type (die=0x1ec78cb4, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:4989
#2  0x081cbe8b in read_type_die (die=0x1ec78cb4, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8911
#3  0x081cbdf2 in tag_type_to_type (die=0x1ec78cb4, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8886
#4  0x081cbbf8 in die_type (die=0x1ec83688, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8784
#5  0x081c2c00 in dwarf2_add_field (fip=0xbfffdf3c, die=0x1ec83688, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:4414
#6  0x081c4c83 in read_structure_type (die=0x1ec835d8, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:5084
#7  0x081cbe8b in read_type_die (die=0x1ec835d8, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8911
#8  0x081cbdf2 in tag_type_to_type (die=0x1ec835d8, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8886
#9  0x081cbbf8 in die_type (die=0x1ec83ca0, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8784
#10 0x081c6070 in read_tag_reference_type (die=0x1ec83ca0, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:5795
#11 0x081cbf41 in read_type_die (die=0x1ec83ca0, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8934
#12 0x081cbdf2 in tag_type_to_type (die=0x1ec83ca0, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8886
#13 0x081cbbf8 in die_type (die=0x1ec83b54, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8784
#14 0x081c6632 in read_subroutine_type (die=0x1ec83aac, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:5948
#15 0x081cbebf in read_type_die (die=0x1ec83aac, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8919
#16 0x081c3e58 in dwarf2_add_member_fn (fip=0xbfffe1fc, die=0x1ec83aac, 
    type=0x1ef6a67c, cu=0x1e7d9bd8) at ../../src/gdb/dwarf2read.c:4732
#17 0x081c4cb1 in read_structure_type (die=0x1ec83a14, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:5089
#18 0x081cbe8b in read_type_die (die=0x1ec83a14, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8911
#19 0x081cbdf2 in tag_type_to_type (die=0x1ec83a14, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8886
#20 0x081cbbf8 in die_type (die=0x1ec87bc8, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8784
#21 0x081c2c00 in dwarf2_add_field (fip=0xbfffe35c, die=0x1ec87bc8, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:4414
#22 0x081c4c83 in read_structure_type (die=0x1ec879e4, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:5084
#23 0x081cbe8b in read_type_die (die=0x1ec879e4, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8911
#24 0x081cbdf2 in tag_type_to_type (die=0x1ec879e4, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8886
#25 0x081cbbf8 in die_type (die=0x1ec8a6f0, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8784
#26 0x081c2c00 in dwarf2_add_field (fip=0xbfffe4bc, die=0x1ec8a6f0, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:4414
#27 0x081c4c83 in read_structure_type (die=0x1ec8a69c, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:5084
#28 0x081cbe8b in read_type_die (die=0x1ec8a69c, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8911
#29 0x081cbdf2 in tag_type_to_type (die=0x1ec8a69c, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8886
#30 0x081cbbf8 in die_type (die=0x1ec7ce58, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8784
#31 0x081c2ee3 in dwarf2_add_field (fip=0xbfffe61c, die=0x1ec7ce58, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:4530
#32 0x081c4c83 in read_structure_type (die=0x1ec78ec0, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:5084
#33 0x081cbe8b in read_type_die (die=0x1ec78ec0, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8911
#34 0x081cbdf2 in tag_type_to_type (die=0x1ec78ec0, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8886
#35 0x081cbbf8 in die_type (die=0x1ec78e9c, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8784
#36 0x081c60f9 in read_tag_const_type (die=0x1ec78e9c, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:5813
#37 0x081cbf5b in read_type_die (die=0x1ec78e9c, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8937
#38 0x081cbdf2 in tag_type_to_type (die=0x1ec78e9c, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8886
#39 0x081cbbf8 in die_type (die=0x1ec78e6c, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8784
#40 0x081c5e4c in read_tag_pointer_type (die=0x1ec78e6c, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:5721
#41 0x081cbf0d in read_type_die (die=0x1ec78e6c, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8928
#42 0x081cbdf2 in tag_type_to_type (die=0x1ec78e6c, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8886
#43 0x081cbbf8 in die_type (die=0x1ec78e18, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8784
#44 0x081c6632 in read_subroutine_type (die=0x1ec78de8, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:5948
#45 0x081cbebf in read_type_die (die=0x1ec78de8, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8919
#46 0x081cbdf2 in tag_type_to_type (die=0x1ec78de8, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8886
#47 0x081cbbf8 in die_type (die=0x1ec82798, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8784
#48 0x081c5e4c in read_tag_pointer_type (die=0x1ec82798, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:5721
#49 0x081cbf0d in read_type_die (die=0x1ec82798, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8928
#50 0x081cbdf2 in tag_type_to_type (die=0x1ec82798, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8886
#51 0x081cbbf8 in die_type (die=0x1ec78d30, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:8784
#52 0x081c48bf in quirk_gcc_member_function_pointer (die=0x1ec78cb4, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:4943
#53 0x081c4a0b in read_structure_type (die=0x1ec78cb4, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:4989
#54 0x081c4fe0 in process_structure_scope (die=0x1ec78cb4, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:5184
#55 0x081c0c41 in process_die (die=0x1ec78cb4, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:3293
#56 0x081c1417 in read_file_scope (die=0x1ea5bbc8, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:3584
#57 0x081c0be5 in process_die (die=0x1ea5bbc8, cu=0x1e7d9bd8)
    at ../../src/gdb/dwarf2read.c:3275
#58 0x081c0aea in process_full_comp_unit (per_cu=0x1ea67184)
    at ../../src/gdb/dwarf2read.c:3242
#59 0x081c0594 in process_queue (objfile=0x1e80f1c8) at
../../src/gdb/dwarf2read.c:3058
#60 0x081c07d3 in psymtab_to_symtab_1 (pst=0x1ea79358)
    at ../../src/gdb/dwarf2read.c:3143
#61 0x081c072f in psymtab_to_symtab_1 (pst=0x1ec43454)
    at ../../src/gdb/dwarf2read.c:3121
#62 0x081c04d2 in dwarf2_psymtab_to_symtab (pst=0x1ec43454)
    at ../../src/gdb/dwarf2read.c:3017
#63 0x0815e9cb in psymtab_to_symtab (pst=0x1ec43454) at ../../src/gdb/symfile.c:281
#64 0x0815fbfc in symbol_file_add_with_addrs_or_offsets (abfd=0x1df56cb0,
add_flags=8, 
    addrs=0x1e667e88, offsets=0x0, num_offsets=0, flags=3)
    at ../../src/gdb/symfile.c:1015
#65 0x0815fd46 in symbol_file_add_separate (bfd=0x1df56cb0, symfile_flags=8, 
    objfile=0x1ea80740) at ../../src/gdb/symfile.c:1071
#66 0x081164cc in elf_symfile_read (objfile=0x1ea80740, symfile_flags=8)
    at ../../src/gdb/elfread.c:907
#67 0x0815f9ff in syms_from_objfile (objfile=0x1ea80740, addrs=0x131b1748, 
    offsets=0x0, num_offsets=0, add_flags=8) at ../../src/gdb/symfile.c:901
#68 0x0815fb97 in symbol_file_add_with_addrs_or_offsets (abfd=0x89b46f0,
add_flags=8, 
    addrs=0x131b1748, offsets=0x0, num_offsets=0, flags=2)
    at ../../src/gdb/symfile.c:994
#69 0x0815fda3 in symbol_file_add_from_bfd (abfd=0x89b46f0, add_flags=8, 
    addrs=0x131b1748, flags=2) at ../../src/gdb/symfile.c:1092
#70 0x080af857 in symbol_add_stub (so=0x85a6680, flags=8) at
../../src/gdb/solib.c:458
#71 0x080af959 in solib_read_symbols (so=0x85a6680, flags=8)
    at ../../src/gdb/solib.c:488
#72 0x080afd89 in solib_add (pattern=0x0, from_tty=0, target=0x8493320, readsyms=1)
    at ../../src/gdb/solib.c:750
#73 0x080b20a9 in enable_break (info=0x8541f40, from_tty=0)
    at ../../src/gdb/solib-svr4.c:1296
#74 0x080b28c0 in svr4_solib_create_inferior_hook (from_tty=0)
    at ../../src/gdb/solib-svr4.c:1742
#75 0x080b03e0 in solib_create_inferior_hook (from_tty=0) at
../../src/gdb/solib.c:1030
#76 0x0816c765 in post_create_inferior (target=0x8493320, from_tty=0)
    at ../../src/gdb/infcmd.c:407
#77 0x0816f852 in attach_command_post_wait (args=0xbffff5a5 "2113", from_tty=0, 
    async_exec=0) at ../../src/gdb/infcmd.c:2246
#78 0x0816fbde in attach_command (args=0xbffff5a5 "2113", from_tty=0)
    at ../../src/gdb/infcmd.c:2423
#79 0x0818208e in catch_command_errors (command=0x816f978 <attach_command>, 
    arg=0xbffff5a5 "2113", from_tty=0, mask=6) at ../../src/gdb/exceptions.c:525
#80 0x08087c52 in captured_main (data=0xbffff310) at ../../src/gdb/main.c:822
#81 0x08181fea in catch_errors (func=0x808704c <captured_main>,
func_args=0xbffff310, 
    errstring=0x8324bf7 "", mask=6) at ../../src/gdb/exceptions.c:510
#82 0x08087f62 in gdb_main (args=0xbffff310) at ../../src/gdb/main.c:911
#83 0x08086d88 in main (argc=7, argv=0xbffff3d4) at ../../src/gdb/gdb.c:33
Comment 1 Tom Tromey 2010-01-21 21:25:57 UTC 
On F11, a simpler reproducer:

gdb -readnow /usr/lib/debug/usr/lib/libmathview_frontend_libxml2.so.0.8.0.debug

The problem is that we somehow get a recursive call to
quirk_gcc_member_function_pointer.  The inner call crashes because it find the
type of __pfn, but the function type's first argument does not yet have a type.

I was unable to make a simpler test case :(

The only fix I can think of is pretty ugly: change read_structure_type
to smash the resulting type to a pointer-to-member type after the fact.
That is, don't call the quirk function until the structure type has been
made.
Comment 2 Tom Tromey 2010-01-21 21:30:13 UTC 
Interestingly, backing out this patch works around the bug:

2009-12-15  Gaius Mulley  <gaius@glam.ac.uk>

	* dwarf2read.c (read_subroutine_type): Add the subroutine
	type to the die immediately to allow a parameter type to be
	the same subroutine type.

This may explain why we never ran into this before.
Comment 3 Tom Tromey 2010-01-21 21:51:16 UTC 
FYI, I have a patch for this that I will submit soon.
Still no reproducer suitable for inclusion in the test suite :(
Comment 4 Sourceware Commits 2010-01-22 17:07:03 UTC 
Subject: Bug 11199

CVSROOT:	/cvs/src
Module name:	src
Changes by:	tromey@sourceware.org	2010-01-22 17:06:49

Modified files:
	gdb            : ChangeLog dwarf2read.c gdbtypes.c gdbtypes.h 
	gdb/testsuite  : ChangeLog 
Added files:
	gdb/testsuite/gdb.dwarf2: member-ptr-forwardref.S 
	                          member-ptr-forwardref.exp 

Log message:
	gdb
	PR symtab/11199:
	* dwarf2read.c (quirk_gcc_member_function_pointer): Change return
	type and arguments.  Use smash_to_methodptr_type.
	(read_structure_type): Call quirk_gcc_member_function_pointer
	later.
	* gdbtypes.h (smash_to_methodptr_type): Declare.
	* gdbtypes.c (smash_to_methodptr_type): New function.
	(lookup_methodptr_type): Use it.
	gdb/testsuite
	2010-01-22  Jan Kratochvil  <jan.kratochvil@redhat.com>
	
	PR symtab/11199:
	* gdb.dwarf2/member-ptr-forwardref.exp,
	gdb.dwarf2/member-ptr-forwardref.S: New.

Patches:
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/ChangeLog.diff?cvsroot=src&r1=1.11285&r2=1.11286
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/dwarf2read.c.diff?cvsroot=src&r1=1.350&r2=1.351
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/gdbtypes.c.diff?cvsroot=src&r1=1.184&r2=1.185
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/gdbtypes.h.diff?cvsroot=src&r1=1.120&r2=1.121
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/testsuite/ChangeLog.diff?cvsroot=src&r1=1.2098&r2=1.2099
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/testsuite/gdb.dwarf2/member-ptr-forwardref.S.diff?cvsroot=src&r1=NONE&r2=1.1
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/gdb/testsuite/gdb.dwarf2/member-ptr-forwardref.exp.diff?cvsroot=src&r1=NONE&r2=1.1
Comment 5 Tom Tromey 2010-01-22 17:07:53 UTC 
Fix checked in.