Bug 31671 - [gdb/exp] Segmentation fault in value_type
Summary: [gdb/exp] Segmentation fault in value_type
Status: NEW
Alias: None
Product: gdb
Classification: Unclassified
Component: exp (show other bugs)
Version: 13.1
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-23 12:35 UTC by Tom de Vries
Modified: 2024-05-03 19:49 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tom de Vries 2024-04-23 12:35:38 UTC
With a 13.2 based package, on SLE-11 using gcc 4.3.4, I run into:
...
(gdb) FAIL: gdb.objc/basicclass.exp: breakpoint in category method
continue
Continuing.

Breakpoint 5, -[BasicClass(Private) hiddenMethod] (self=0x605170, _cmd=0x601400 <_OBJC_SELECTOR_TABLE+32>) at /usr/src/packages/BUILD/gdb-13.2/gdb/testsuite/gdb.objc/basicclass.m:62
62	  return self;
(gdb) FAIL: gdb.objc/basicclass.exp: continue until category method
print [self printHi]


Fatal signal: Segmentation fault
----- Backtrace -----
0x4fffc2 gdb_internal_backtrace_1
	../../gdb/bt-utils.c:122
0x4fffc2 _Z22gdb_internal_backtracev
	../../gdb/bt-utils.c:168
0x6146d7 handle_fatal_signal
	../../gdb/event-top.c:971
0x61475f handle_sigsegv
	../../gdb/event-top.c:1044
0x151a6dc0f84f ???
0x8f2860 _Z10value_typePK5value
	../../gdb/value.c:1111
0x683270 value_arg_coerce
	../../gdb/infcall.c:184
0x683270 _Z27call_function_by_hand_dummyP5valueP4typeN3gdb10array_viewIS0_EEPFvPviES6_
	../../gdb/infcall.c:1112
0x685c5e _Z21call_function_by_handP5valueP4typeN3gdb10array_viewIS0_EE
	../../gdb/infcall.c:786
0x60e290 eval_op_objc_msgcall
	../../gdb/eval.c:2176
0x60e290 _ZN4expr22objc_msgcall_operation8evaluateEP4typeP10expression6noside
	../../gdb/eval.c:2253
0x61288e _ZN10expression8evaluateEP4type6noside
	../../gdb/eval.c:101
0x77c8fc process_print_command_args
	../../gdb/printcmd.c:1310
0x77d2cd print_command_1
	../../gdb/printcmd.c:1323
0x533125 _Z8cmd_funcP16cmd_list_elementPKci
	../../gdb/cli/cli-decode.c:2543
0x8a24a6 _Z15execute_commandPKci
	../../gdb/top.c:690
0x615403 _Z15command_handlerPKc
	../../gdb/event-top.c:628
0x6163cd _Z20command_line_handlerOSt10unique_ptrIcN3gdb13xfree_deleterIcEEE
	../../gdb/event-top.c:864
0x61498b gdb_rl_callback_handler
	../../gdb/event-top.c:256
0x92085f rl_callback_read_char
	../../../readline/readline/callback.c:290
0x614b9d gdb_rl_callback_read_char_wrapper_noexcept
	../../gdb/event-top.c:192
0x614d6f gdb_rl_callback_read_char_wrapper
	../../gdb/event-top.c:231
0x6147ff stdin_event_handler
	../../gdb/event-top.c:553
0xac559c gdb_wait_for_event
	../../gdbsupport/event-loop.cc:694
0xac5d31 _Z16gdb_do_one_eventi
	../../gdbsupport/event-loop.cc:264
0x6f26f9 start_event_loop
	../../gdb/main.c:411
0x6f26f9 captured_command_loop
	../../gdb/main.c:471
0x6f3f04 captured_main
	../../gdb/main.c:1330
0x6f3f04 _Z8gdb_mainP18captured_main_args
	../../gdb/main.c:1345
0x414c84 main
	../../gdb/gdb.c:32
---------------------
A fatal error internal to GDB has been detected, further
debugging is not possible.  GDB will now terminate.

This is a bug, please report it.  For instructions, see:
<http://bugs.opensuse.org/>.
...
Comment 1 Tom de Vries 2024-04-23 12:41:06 UTC
In more detail:
...
Breakpoint 5, -[BasicClass(Private) hiddenMethod] (self=0x605170, _cmd=0x601400 <_OBJC_SELECTOR_TABLE+32>) at /usr/src/packages/BUILD/gdb-13.2/build-x86_64-suse-linux/gdb/testsuite/../../../gdb/testsuite/gdb.objc/basicclass.m:62
62	  return self;

Thread 1 "gdb" received signal SIGSEGV, Segmentation fault.
value_type (value=value@entry=0x0) at ../../gdb/value.c:1111
1111	  return value->type;
(gdb) bt
#0  value_type (value=value@entry=0x0) at ../../gdb/value.c:1111
#1  0x0000000000683271 in value_arg_coerce (is_prototyped=0, param_type=<optimized out>, arg=0x0, 
    gdbarch=0x7ffff017c0d0) at ../../gdb/infcall.c:184
#2  call_function_by_hand_dummy (function=function@entry=0x7ffff026bf50, 
    default_return_type=default_return_type@entry=0x0, args=..., dummy_dtor=dummy_dtor@entry=0x0, 
    dummy_dtor_data=dummy_dtor_data@entry=0x0) at ../../gdb/infcall.c:1112
#3  0x0000000000685c5f in call_function_by_hand (function=function@entry=0x7ffff026bf50, 
    default_return_type=default_return_type@entry=0x0, args=...) at ../../gdb/infcall.c:786
#4  0x000000000060e291 in eval_op_objc_msgcall (exp=<optimized out>, args=..., target=0x7ffff02563c0, 
    selector=6304368, noside=EVAL_NORMAL, expect_type=0x0) at ../../gdb/eval.c:2176
#5  expr::objc_msgcall_operation::evaluate (this=<optimized out>, expect_type=0x0, exp=<optimized out>, 
    noside=EVAL_NORMAL) at ../../gdb/eval.c:2253
#6  0x000000000061288f in expression::evaluate (this=0x7ffff01aca60, expect_type=expect_type@entry=0x0, 
    noside=noside@entry=EVAL_NORMAL) at ../../gdb/eval.c:101
#7  0x0000000000612a67 in evaluate_expression (exp=<optimized out>, expect_type=expect_type@entry=0x0)
    at ../../gdb/eval.c:115
#8  0x000000000077c8fd in process_print_command_args (args=0x7ffff01d93ce "[self printHi]", 
    print_opts=print_opts@entry=0x7fffffffdeb0, voidprint=voidprint@entry=true) at ../../gdb/printcmd.c:1310
#9  0x000000000077d2ce in print_command_1 (args=<optimized out>, voidprint=<optimized out>)
    at ../../gdb/printcmd.c:1323
#10 0x0000000000533126 in cmd_func (cmd=<optimized out>, args=<optimized out>, from_tty=<optimized out>)
    at ../../gdb/cli/cli-decode.c:2543
#11 0x00000000008a24a7 in execute_command (p=<optimized out>, p@entry=0x7ffff01d93c8 "print [self printHi]", 
    from_tty=0) at ../../gdb/top.c:690
#12 0x0000000000615404 in command_handler (command=0x7ffff01d93c8 "print [self printHi]")
    at ../../gdb/event-top.c:628
#13 0x000000000089fcec in read_command_file (stream=stream@entry=0x7ffff0127320) at ../../gdb/top.c:457
#14 0x000000000054228e in script_from_file (stream=stream@entry=0x7ffff0127320, 
    file=file@entry=0x7fffffffe8d5 "outputs/gdb.objc/basicclass/gdb.in.1") at ../../gdb/cli/cli-script.c:1641
#15 0x0000000000530294 in source_script_from_stream (
    file_to_open=0x7ffff0080c48 "outputs/gdb.objc/basicclass/gdb.in.1", 
    file=0x7fffffffe8d5 "outputs/gdb.objc/basicclass/gdb.in.1", stream=0x7ffff0127320)
    at ../../gdb/cli/cli-cmds.c:729
#16 source_script_with_search (file=0x7fffffffe8d5 "outputs/gdb.objc/basicclass/gdb.in.1", 
    file@entry=<error reading variable: value has been optimized out>, 
    from_tty=<error reading variable: value has been optimized out>, 
    search_path=<error reading variable: value has been optimized out>) at ../../gdb/cli/cli-cmds.c:774
#17 0x00000000006f1d24 in catch_command_errors (command=<optimized out>, arg=<optimized out>, 
    from_tty=<optimized out>, do_bp_actions=do_bp_actions@entry=false) at ../../gdb/main.c:513
#18 0x00000000006f1df6 in execute_cmdargs (cmdarg_vec=cmdarg_vec@entry=0x7fffffffe2d0, 
    file_type=file_type@entry=CMDARG_FILE, cmd_type=cmd_type@entry=CMDARG_COMMAND, ret=ret@entry=0x7fffffffe26c)
    at ../../gdb/main.c:606
#19 0x00000000006f2ffa in captured_main_1 (context=context@entry=0x7fffffffe420) at ../../gdb/main.c:1299
#20 0x00000000006f3efb in captured_main (data=data@entry=0x7fffffffe420) at ../../gdb/main.c:1320
#21 gdb_main (args=args@entry=0x7fffffffe440) at ../../gdb/main.c:1345
#22 0x0000000000414c85 in main (argc=<optimized out>, argv=<optimized out>) at ../../gdb/gdb.c:32
...
Comment 2 Hannes Domani 2024-05-03 15:38:18 UTC
Commit [1] changed the arrayview argument of the last 2 call_function_by_hand calls to include the NULL pointer at the end, I suspect this is the reason for the crash.

It also added the following comment to the split out function:

> /* Note that ARGS needs 2 empty slots up front and must end with a
>    null pointer.  */

Why is this null pointer even needed?


[1] https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=5e80600ed0e929faaeac205dbf0d4e7f9b2842cb
Comment 3 Tom Tromey 2024-05-03 19:45:19 UTC
(In reply to Hannes Domani from comment #2)

> Why is this null pointer even needed?

It probably isn't; but before it took an array_view,
maybe call_function_by_hand required a NULL-terminated array.
Comment 4 Tom Tromey 2024-05-03 19:49:04 UTC
I can't seem to run this test:

UNSUPPORTED: gdb.objc/basicclass.exp: couldn't compile basicclass.m: unrecognized error

My recollection is that some change to the objective-c
runtime made all the gdb.objc tests stop compiling, and
nobody has ever gone back and tried to fix them.