Bug 21494 - segfault in find_partial_die_in_comp_unit
Summary: segfault in find_partial_die_in_comp_unit
Status: NEW
Alias: None
Product: gdb
Classification: Unclassified
Component: gdb (show other bugs)
Version: 8.0
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on: 20882
Blocks:
  Show dependency treegraph
 
Reported: 2017-05-16 09:49 UTC by Richard Biener
Modified: 2022-10-24 06:27 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Richard Biener 2017-05-16 09:49:12 UTC
I get a segfault in find_partial_die_in_comp_unit because cu->partial_dies is NULL.

#0  find_partial_die_in_comp_unit (sect_off=(unknown: 0), cu=0xfff0e0)
    at /space/rguenther/src/binutils-gdb/gdb/dwarf2read.c:16369
#1  0x00000000005f91d7 in find_partial_die (sect_off=(unknown: 0), 
    offset_in_dwz=0, cu=0xfd8b50)
    at /space/rguenther/src/binutils-gdb/gdb/dwarf2read.c:16419
#2  0x00000000005f955f in fixup_partial_die (part_die=0x1023220, cu=0xfd8b50)
    at /space/rguenther/src/binutils-gdb/gdb/dwarf2read.c:16522
#3  0x00000000005e16f1 in scan_partial_symbols (first_die=0x10231c0, 
    lowpc=0x7fffffffd330, highpc=0x7fffffffd328, set_addrmap=0, cu=0xfd8b50)
    at /space/rguenther/src/binutils-gdb/gdb/dwarf2read.c:6824
#4  0x00000000005dfe7a in process_psymtab_comp_unit_reader (
    reader=0x7fffffffd460, info_ptr=0x7ffff7fe4de4 "\002", 
    comp_unit_die=0xfef980, has_children=1, data=0x7fffffffd550)
    at /space/rguenther/src/binutils-gdb/gdb/dwarf2read.c:6183
#5  0x00000000005df125 in init_cutu_and_read_dies (this_cu=0xf1e600, 
    abbrev_table=0x0, use_existing_cu=0, keep=0, 
    die_reader_func=0x5dfb24 <process_psymtab_comp_unit_reader(die_reader_specs const*, gdb_byte const*, die_info*, int, void*)>, data=0x7fffffffd550)
    at /space/rguenther/src/binutils-gdb/gdb/dwarf2read.c:5798
#6  0x00000000005e0324 in process_psymtab_comp_unit (this_cu=0xf1e600, 
    want_partial_unit=0, pretend_language=language_minimal)
    at /space/rguenther/src/binutils-gdb/gdb/dwarf2read.c:6265
#7  0x00000000005e0f8c in dwarf2_build_psymtabs_hard (objfile=0xf1eff0)
    at /space/rguenther/src/binutils-gdb/gdb/dwarf2read.c:6658
#8  0x00000000005db951 in dwarf2_build_psymtabs (objfile=0xf1eff0)
    at /space/rguenther/src/binutils-gdb/gdb/dwarf2read.c:4407
#9  0x00000000004f0cab in read_psyms (objfile=0xf1eff0)
    at /space/rguenther/src/binutils-gdb/gdb/elfread.c:1290
#10 0x00000000006c7958 in require_partial_symbols (objfile=0xf1eff0, verbose=0)
    at /space/rguenther/src/binutils-gdb/gdb/psymtab.c:87
#11 0x0000000000704d23 in read_symbols (objfile=0xf1eff0, add_flags=...)
    at /space/rguenther/src/binutils-gdb/gdb/symfile.c:883
#12 0x000000000070535a in syms_from_objfile_1 (objfile=0xf1eff0, 
    addrs=0xf1dc20, add_flags=...)
    at /space/rguenther/src/binutils-gdb/gdb/symfile.c:1062
#13 0x00000000007053b2 in syms_from_objfile (objfile=0xf1eff0, addrs=0x0, 
    add_flags=...) at /space/rguenther/src/binutils-gdb/gdb/symfile.c:1078
#14 0x0000000000705753 in symbol_file_add_with_addrs (abfd=0xf1edb0, 
    name=0x7fffffffe2bf "./simple.exe", add_flags=..., addrs=0x0, flags=..., 
    parent=0x0) at /space/rguenther/src/binutils-gdb/gdb/symfile.c:1177
#15 0x0000000000705a48 in symbol_file_add_from_bfd (abfd=0xf1edb0, 
    name=0x7fffffffe2bf "./simple.exe", add_flags=..., addrs=0x0, flags=..., 
    parent=0x0) at /space/rguenther/src/binutils-gdb/gdb/symfile.c:1268
#16 0x0000000000705ac9 in symbol_file_add (name=0x7fffffffe2bf "./simple.exe", 
    add_flags=..., addrs=0x0, flags=...)

we come via

16415         if (per_cu->cu == NULL || per_cu->cu->partial_dies == NULL)
16416  ->       load_partial_comp_unit (per_cu);
16417
16418         per_cu->cu->last_used = 0;
16419         pd = find_partial_die_in_comp_unit (sect_off, per_cu->cu);

but after load_partial_comp_unit the partial_dies hash is not allocated.

The reason is likely invalid DWARF:

  Compilation Unit @ offset 0x15b:
   Length:        0x786c (32-bit)
   Version:       4
   Abbrev Offset: 0x64
   Pointer Size:  8
 <0><166>: Abbrev Number: 1 (DW_TAG_compile_unit)
    <167>   DW_AT_producer    : (indirect string, offset: 0x4c7): GNU GIMPLE 8.0.0 20170515 (experimental) [trunk revision 221942] -mtune=generic -march=x86-64 -mtune=generic -march=x86-64 -g -g -O2 -O0 -O2 -O0 -fexceptions -fmath-errno -fsigned-zeros -ftrapping-math -fno-trapv -fno-openmp -fno-openacc -fmessage-length=0 -fno-show-column -ffunction-sections -fdata-sections -fltrans
    <16b>   DW_AT_language    : 4       (C++)
    <16c>   DW_AT_name        : (indirect string, offset: 0x2c5): <artificial>
    <170>   DW_AT_comp_dir    : (indirect string, offset: 0x41e): /abuild/rguenther/obj-early-lto-debug-g/x86_64-pc-linux-gnu/libstdc++-v3/testsuite
    <174>   DW_AT_ranges      : 0x70
    <178>   DW_AT_low_pc      : 0x0
    <180>   DW_AT_stmt_list   : 0xe7
 <1><184>: Abbrev Number: 2 (DW_TAG_imported_unit)
    <185>   DW_AT_import      : <0x0>   [Abbrev Number: 113]

where this import references a non-existing unit.

sth better than just segfaulting should happen here.
Comment 1 Richard Biener 2017-05-16 10:06:53 UTC
Caused by bug 20536 :/
Comment 2 Richard Biener 2017-05-16 10:08:17 UTC
Err, 20882, stupid bugzilla defaults.
Comment 3 Tom Tromey 2022-10-21 16:59:05 UTC
Is it still possible to create an executable with this flaw?
Or is the linker bug fixed and now it's gone?

The DWARF scanner is rewritten so I don't know if the original
problem occurs or not.
Comment 4 Richard Biener 2022-10-24 06:27:21 UTC
(In reply to Tom Tromey from comment #3)
> Is it still possible to create an executable with this flaw?
> Or is the linker bug fixed and now it's gone?
> 
> The DWARF scanner is rewritten so I don't know if the original
> problem occurs or not.

The linker bug was meanwhile fixed.  Unfortunately I didn't save any of the
broken executables - the referenced bug says libstdc++ tests were broken,
but as far as I remember every executable compiled with -g -flto -Wl,--gc-sections was broken due to stripped relocations.  It might be possible to dig out an old BFD ld and create an affected executable that way (plus old gdb
to check if the segfault was reproducible).

Not sure if worth - feel free to close the bug instead.