[binutils-gdb] [gdb] Fix segfault during inferior call to ifunc

[binutils-gdb] [gdb] Fix segfault during inferior call to ifunc

[Tom de Vries]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=08fd407675396cf9500519f02033e6cec270a4a6

commit 08fd407675396cf9500519f02033e6cec270a4a6
Author: Andrew Burgess <aburgess@redhat.com>
Date:   Tue Jan 3 10:18:48 2023 +0100

    [gdb] Fix segfault during inferior call to ifunc
    
    With a simple test-case:
    ...
    $ cat test.c
    char *p = "a";
    int main (void) {
      return strlen (p);
    }
    $ gcc -g test.c
    ...
    we run into this segfault:
    ...
    $ gdb -q -batch a.out -ex start -ex "p strlen (p)"
    Temporary breakpoint 1 at 0x1151: file test.c, line 4.
    [Thread debugging using libthread_db enabled]
    Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
    
    Temporary breakpoint 1, main () at test.c:4
    4         return strlen (p);
    
    Fatal signal: Segmentation fault
    ...
    
    The strlen is an ifunc, and consequently during the call to
    call_function_by_hand_dummy for "p strlen (p)" another call
    to call_function_by_hand_dummy is used to resolve the ifunc.
    
    This invalidates the get_current_frame () result in the outer call.
    
    Fix this by using prepare_reinflate and reinflate.
    
    Note that this series (
    https://inbox.sourceware.org/gdb-patches/20221214033441.499512-1-simon.marchi@polymtl.ca/ )
    should address this problem, but this patch is a simpler fix which is easy to
    backport.
    
    Tested on x86_64-linux.
    
    Co-Authored-By: Tom de Vries <tdevries@suse.de>
    PR gdb/29941
    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=29941

Diff:
---
 gdb/infcall.c                        | 3 +++
 gdb/testsuite/gdb.base/gnu-ifunc.exp | 9 +++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/gdb/infcall.c b/gdb/infcall.c
index 4d5780b6e30..ec2aa180daa 100644
--- a/gdb/infcall.c
+++ b/gdb/infcall.c
@@ -848,6 +848,7 @@ call_function_by_hand_dummy (struct value *function,
   bool stack_temporaries = thread_stack_temporaries_enabled_p (call_thread.get ());
 
   frame = get_current_frame ();
+  frame.prepare_reinflate ();
   gdbarch = get_frame_arch (frame);
 
   if (!gdbarch_push_dummy_call_p (gdbarch))
@@ -863,6 +864,8 @@ call_function_by_hand_dummy (struct value *function,
 	     "target calling convention."),
 	   get_function_name (funaddr, name_buf, sizeof (name_buf)));
 
+  frame.reinflate ();
+
   if (values_type == NULL || values_type->is_stub ())
     values_type = default_return_type;
   if (values_type == NULL)
diff --git a/gdb/testsuite/gdb.base/gnu-ifunc.exp b/gdb/testsuite/gdb.base/gnu-ifunc.exp
index 9a5052ef594..783b123e87a 100644
--- a/gdb/testsuite/gdb.base/gnu-ifunc.exp
+++ b/gdb/testsuite/gdb.base/gnu-ifunc.exp
@@ -240,14 +240,19 @@ proc misc_tests {resolver_attr resolver_debug final_debug} {
     # Test GDB will automatically indirect the call.
 
     if {!$resolver_debug && !$final_debug} {
+	# Do the test that is supposed to succeed first, to make sure
+	# elf_gnu_ifunc_record_cache is empty.  This excercises PR28224.
+	gdb_test "p (int) gnu_ifunc (3)" " = 4"
+
 	gdb_test "p gnu_ifunc()" \
 	    "'${dot}final' has unknown return type; cast the call to its declared return type"
 	gdb_test "p gnu_ifunc (3)" \
 	    "'${dot}final' has unknown return type; cast the call to its declared return type"
-	gdb_test "p (int) gnu_ifunc (3)" " = 4"
     } else {
-	gdb_test "p gnu_ifunc()" "Too few arguments in function call\\."
+	# Do the test that is supposed to succeed first, see above.
 	gdb_test "p gnu_ifunc (3)" " = 4"
+
+	gdb_test "p gnu_ifunc()" "Too few arguments in function call\\."
     }
 
     # Test that the resolver received its argument.