[Bug libstdc++/59392] New: crash on throw from "unexpected exception" handler with ARM EABI unwinder

[Bug libstdc++/59392] New: crash on throw from "unexpected exception" handler with ARM EABI unwinder

[roland at gnu dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59392

            Bug ID: 59392
           Summary: crash on throw from "unexpected exception" handler
                    with ARM EABI unwinder
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: roland at gnu dot org
            Target: arm-linux-gnueabihf

Created attachment 31382
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=31382&action=edit
test case

I've observed this on trunk and on 4.6.3, but I think the bug has been there
since the introduction of ARM EABI unwinding in 4.2.

The attached test case crashes with a null pointer dereference (producing no
output) on ARM/EABI targets.  On other targets (I only tested
x86_64-linux-gnu), it correctly crashes via abort after emitting a message
(i.e. std::terminate runs).  The original case was more complex and used
std::set_terminate to set a handler that used longjmp, avoiding the abort.  For
the test suite, it's probably most convenient to do that (or just exit with an
expected code in the terminate handler) rather than to detect that the default
std::terminate crash happened correctly vs a different crash.

The bug comes about in an obvious and straightforward way.  But I don't know
the libsupc++ internals well enough to suggest an appropriate fix off hand. 
What happens is that libstdc++-v3/libsupc++/eh_call.cc:__cxa_call_unexpected
does:
      if (catch_type->__do_catch(&bad_exc, 0, 1))
i.e., passes a null pointer as the second argument to the __do_catch method.
libstdc++-v3/libsupc++/class_type_info.cc:__do_catch passes this argument on as
the second argument to __do_upcast.
In libstdc++-v3/libsupc++/class_type_info.cc:__do_upcast there is:
  __do_upcast (dst_type, *obj_ptr, result);
i.e., unconditionally dereferencing OBJ_PTR (the second argument).

I'd like to see this get fixed on the trunk and 4.8 at least.
I'd be glad to pursue the fix myself if I had any idea what it should be.

[Bug libstdc++/59392] crash on throw from "unexpected exception" handler with ARM EABI unwinder

[mseaborn at chromium dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59392

Mark Seaborn <mseaborn at chromium dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mseaborn at chromium dot org

--- Comment #1 from Mark Seaborn <mseaborn at chromium dot org> ---
Instead of:

  if (catch_type->__do_catch(&bad_exc, NULL, 1))

I think this should be:

  // We don't have a thrown object to compare against, but since
  // bad_exception doesn't have virtual bases, that's OK; just pass 0.
  void *obj = NULL;
  if (catch_type->__do_catch(&bad_exc, &obj, 1))

or to avoid the comment, just:

  std::bad_exception ex;
  void *obj = &ex;
  if (catch_type->__do_catch(&typeid(ex), &obj, 1))

The non-EABI equivalent is the second check_exception_spec() call in
__cxa_call_unexpected() in eh_personality.cc.

[Bug libstdc++/59392] crash on throw from "unexpected exception" handler with ARM EABI unwinder

[roland at gnu dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59392

--- Comment #2 from roland at gnu dot org ---
Fix posted: http://gcc.gnu.org/ml/gcc-patches/2013-12/msg00753.html

[Bug libstdc++/59392] crash on throw from "unexpected exception" handler with ARM EABI unwinder

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59392

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-03-12
     Ever confirmed|0                           |1

--- Comment #3 from Jonathan Wakely <redi at gcc dot gnu.org> ---
The posted patch is OK, approved for trunk and 4.8

[Bug libstdc++/59392] crash on throw from "unexpected exception" handler with ARM EABI unwinder

[roland at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59392

--- Comment #4 from roland at gcc dot gnu.org ---
Author: roland
Date: Wed Mar 12 22:42:13 2014
New Revision: 208519

URL: http://gcc.gnu.org/viewcvs?rev=208519&root=gcc&view=rev
Log:
PR libstdc++/59392: Fix ARM EABI uncaught throw from unexpected exception
handler

libstdc++-v3/
    PR libstdc++/59392
    * libsupc++/eh_call.cc (__cxa_call_unexpected): Call __do_catch with
    the address of a null pointer, not with a null pointer to pointer.
    Copy comment for this case from eh_personality.cc:__cxa_call_unexpected.
    * testsuite/18_support/bad_exception/59392.cc: New file.

Added:
    trunk/libstdc++-v3/testsuite/18_support/bad_exception/59392.cc   (with
props)
Modified:
    trunk/libstdc++-v3/ChangeLog
    trunk/libstdc++-v3/libsupc++/eh_call.cc

Propchange: trunk/libstdc++-v3/testsuite/18_support/bad_exception/59392.cc
            ('svn:eol-style' added)

[Bug libstdc++/59392] crash on throw from "unexpected exception" handler with ARM EABI unwinder

[roland at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59392

--- Comment #5 from roland at gcc dot gnu.org ---
Author: roland
Date: Wed Mar 12 22:44:09 2014
New Revision: 208520

URL: http://gcc.gnu.org/viewcvs?rev=208520&root=gcc&view=rev
Log:
PR libstdc++/59392: Fix ARM EABI uncaught throw from unexpected exception
handler

libstdc++-v3/
    PR libstdc++/59392
    * libsupc++/eh_call.cc (__cxa_call_unexpected): Call __do_catch with
    the address of a null pointer, not with a null pointer to pointer.
    Copy comment for this case from eh_personality.cc:__cxa_call_unexpected.
    * testsuite/18_support/bad_exception/59392.cc: New file.

Added:
   
branches/gcc-4_8-branch/libstdc++-v3/testsuite/18_support/bad_exception/59392.cc
  (with props)
Modified:
    branches/gcc-4_8-branch/libstdc++-v3/ChangeLog
    branches/gcc-4_8-branch/libstdc++-v3/libsupc++/eh_call.cc

Propchange:
branches/gcc-4_8-branch/libstdc++-v3/testsuite/18_support/bad_exception/59392.cc
            ('svn:eol-style' added)

[Bug libstdc++/59392] crash on throw from "unexpected exception" handler with ARM EABI unwinder

[roland at gnu dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59392

roland at gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from roland at gnu dot org ---
Fixed on trunk and 4.8.