[PATCH v3 0/3] Fix some use-after-free errors in varobj code

[PATCH v3 0/3] Fix some use-after-free errors in varobj code

[Lancelot SIX]

Hi,

Here is a V3 for https://sourceware.org/pipermail/gdb-patches/2022-June/190172.html.

Pedro did notify me off-list that with V2 he saw errors on his system which has
separate debug info for system libraries.  It turns out that the fix I proposed
in V2 did not account correctly for this scenario.

It is possible to reproduce the problem with V2 by testing using the
cc-with-gnu-debuglink board.  This V3 ensures that we account correctly for
separate debug info scenarios.

Noticeable changes since V2:

- The series is rebased on top of current upstream
- Patch #1 is unchanged.
- Patch #2:
  - Change lambda indentations according to the guidelines proposed by Pedro in
    https://sourceware.org/pipermail/gdb-patches/2022-June/190457.html.
  - Fix the separate debug info scenario.
  - Extend the testcase so the entire test is executed once as before, and once
    using gdb_gnu_strip_debug to exercise the separate objfile scenario. This
    would have caught the error.
- Patch #3: Adjusted the test part to apply on top of patch #2.

All feedback are welcome.
Best,
Lancelot.

---

Hi, this is a V2 for https://sourceware.org/pipermail/gdb-patches/2022-June/190138.html.

Noticeable changes since V1:

Patch #1:
  - Added a hunk which somehow slipped into patch #2 in the previous iteration.
Patch #2:
  - Address Andrew's comments.
  - Removed the change in gdb/testsuite/lib/mi-support.exp as this change really
    belonged to Patch #1.
  - Reworked the testcase
    - Only rely on dlclose to trigger the new code. Do not reload the binary
      and restart the process as this involves varobj_invalidate.  This part of
      the test is moved to patch #3.
  - Remove the var->root->exp == nullptr from value_of_root as this case
    cannot happen as discussed in https://sourceware.org/pipermail/gdb-patches/2022-June/190171.html
Patch #3:
  - Reworked the testcase to highlight that a varobj tracking a global from
    the main executable is re-created when reloading the process while a varobj
    tracking a global in a lazily loaded shlib stays invalidated.

---

Hi,

This series aims at fixing some use-after free errors we have observed around
the varobj code.  When a objfile is freed, the varobj can keep references to
the objfile and to objects that used to live on the objfile's objstack (types
among other things).

This can mainly be observed when debugging code which loads and unloads shared
libraries during its lifetime.  Without such scenario the problems exist but
are rarely exposed as the references to freed memory are not used.

The first patch of the series was originally written by Pedro.  It improves
mi-support.exp so `mi_runto` now accepts a `-pending` flag, which will be used
in the following patch.

Patch #2 fixes the actual use-after free errors by ensuring that we clear all
references to the objfile before it is freed.

Patch #3 fix some inaccuracies in the current varobj_invalidate mechanism which
is used to invalidate/recreate varobj when loading a new objfile.

All feedback are welcome.
Regression tested on x86_64.

Lancelot SIX (2):
  gdb/varobj: Fix use after free in varobj
  gdb/varobj: Fix varobj_invalidate_iter

Pedro Alves (1):
  MI: mi_runto -pending

 .../gdb.mi/mi-var-invalidate-shlib-lib.c      |  30 ++++
 .../gdb.mi/mi-var-invalidate-shlib.c          |  43 ++++++
 .../gdb.mi/mi-var-invalidate-shlib.exp        | 137 ++++++++++++++++++
 gdb/testsuite/lib/mi-support.exp              |  68 ++++++++-
 gdb/value.c                                   |  27 ++++
 gdb/varobj.c                                  |  86 ++++++++++-
 6 files changed, 376 insertions(+), 15 deletions(-)
 create mode 100644 gdb/testsuite/gdb.mi/mi-var-invalidate-shlib-lib.c
 create mode 100644 gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.c
 create mode 100644 gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.exp


base-commit: 97a8d0ab534d0353c8585816fe400ef2a468c30a
-- 
2.25.1

[PATCH v3 1/3] MI: mi_runto -pending

[Lancelot SIX]

From: Pedro Alves <pedro@palves.net>

With the CLI testsuite's runto proc, we can pass "allow-pending" as an
option, like:

  runto func allow-pending

That is currently not possible with MI's mi_runto, however.  This
patch makes it possible, by adding a new "-pending" option to
mi_runto.

A pending breakpoint shows different MI attributes compared to a
breakpoint with a location, so the regexp returned by
mi_make_breakpoint isn't suitable.  Thus, add a new
mi_make_breakpoint_pending proc for pending breakpoints.

Tweak mi_runto to let it take and pass down arguments.

Change-Id: I185fef00ab545a1df2ce12b4dbc3da908783a37c
---
 gdb/testsuite/lib/mi-support.exp | 68 ++++++++++++++++++++++++++++----
 1 file changed, 61 insertions(+), 7 deletions(-)

diff --git a/gdb/testsuite/lib/mi-support.exp b/gdb/testsuite/lib/mi-support.exp
index e578a7e6f9b..ca56e12b06b 100644
--- a/gdb/testsuite/lib/mi-support.exp
+++ b/gdb/testsuite/lib/mi-support.exp
@@ -1114,21 +1114,34 @@ proc mi_clean_restart { args } {
 # Supported options:
 #
 #  -qualified -- pass --qualified to -break-insert
+#  -pending   -- pass -f to -break-insert to create a pending
+#                breakpoint.
 
 proc mi_runto_helper {func run_or_continue args} {
   global mi_gdb_prompt expect_out
   global hex decimal fullname_syntax
 
-  parse_args {{qualified}}
+  parse_args {{qualified} {pending}}
 
   set test "mi runto $func"
-  set bp [mi_make_breakpoint -type breakpoint -disp del \
-	      -func $func\(\\\(.*\\\)\)?]
+  if {$pending} {
+      set bp [mi_make_breakpoint_pending -type breakpoint -disp del]
+  } else {
+      set bp [mi_make_breakpoint -type breakpoint -disp del \
+		  -func $func\(\\\(.*\\\)\)?]
+  }
   set extra_opts ""
+  set extra_output ""
   if {$qualified} {
-      append extra_opts "--qualified"
+      lappend extra_opts "--qualified"
   }
-  mi_gdb_test "200-break-insert $extra_opts -t $func" "200\\^done,$bp" \
+  if {$pending} {
+      lappend extra_opts "-f"
+      # MI prints "Function FUNC not defined", "No line NNN in current
+      # file.", etc. to the CLI stream.
+      set extra_output "&\"\[^\r\n\]+\"\r\n"
+  }
+  mi_gdb_test "200-break-insert [join $extra_opts " "] -t $func" "${extra_output}200\\^done,$bp" \
       "breakpoint at $func"
 
   if {$run_or_continue == "run"} {
@@ -1142,8 +1155,8 @@ proc mi_runto_helper {func run_or_continue args} {
   mi_expect_stop "breakpoint-hit" $func ".*" ".*" "\[0-9\]+" { "" "disp=\"del\"" } $test
 }
 
-proc mi_runto {func} {
-    return [mi_runto_helper $func "run"]
+proc mi_runto {func args} {
+    return [mi_runto_helper $func "run" {*}$args]
 }
 
 # Just like runto_main but works with the MI interface.
@@ -2683,6 +2696,47 @@ proc mi_make_breakpoint_multi {args} {
     return $result
 }
 
+# Construct a breakpoint regexp, for a pending breakpoint.  This may
+# be used to test the output of -break-insert, -dprintf-insert, or
+# -break-info for pending breakpoints.
+#
+# Arguments for the breakpoint may be specified using the options
+# number, type, disp, enabled, pending.
+#
+# Example: mi_make_breakpoint_pending -number 2 -pending func
+# will return the breakpoint:
+# bkpt={number="2",type=".*",disp=".*",enabled=".*",addr="<PENDING>",
+#       pending="func", times="0".*original-location=".*"}
+
+proc mi_make_breakpoint_pending {args} {
+    parse_args {{number .*} {type .*} {disp .*} {enabled .*}
+	{pending .*} {original-location .*}}
+
+    set attr_list {}
+    foreach attr [list number type disp enabled] {
+	lappend attr_list $attr [set $attr]
+    }
+
+    lappend attr_list "addr" "<PENDING>"
+
+    foreach attr [list pending] {
+	lappend attr_list $attr [set $attr]
+    }
+
+    set ignore 0
+    set times 0
+    set script ""
+    set cond ""
+    set evaluated-by ""
+
+    set result [mi_make_breakpoint_1 \
+		    $attr_list $cond ${evaluated-by} $times \
+		    $ignore $script ${original-location}]
+
+    append result "\\\}"
+    return $result
+}
+
 # Construct a breakpoint regexp.  This may be used to test the output of
 # -break-insert, -dprintf-insert, or -break-info.
 #
-- 
2.25.1

[PATCH v3 2/3] gdb/varobj: Fix use after free in varobj

[Lancelot SIX]

Varobj object contains references to types, variables (i.e. struct
variable) and expression.  All of those can reference data on an
objfile's obstack.  It is possible for this objfile to be deleted (and
the obstack to be feed), while the varobj remains valid.  Later, if the
user uses the varobj, this will result in a use-after-free error.  With
address sanitizer build, this leads to a plain error.  For non address
sanitizer build we might see undefined behaviour, which manifest
themself as assertion failures when accessing data backed by feed
memory.

This can be observed if we create a varobj that refers to ta symbol in a
shared library, after either the objfile gets reloaded (using the `file`
command) or after the shared library is unloaded (with a call to dlclose
for example).

This patch fixes those issues by:

- Adding cleanup procedure to the free_objfile observable.  When
  activated this observer clears expressions referencing the objfile
  being freed, and removes references to blocks belonging to this
  objfile.
- Adding varobj support in the `preserve_values` (gdb.value.c).  This
  ensures that before the objfile is unloaded, any type owned by the
  objfile referenced by the varobj is replaced by an equivalent type
  not owned by the objfile.  This process is done here instead of in the
  free_objfile observer in order to reuse the type hash table already
  used for similar purpose when replacing types of values kept in the
  value history.

This patch also makes sure to keep a reference to the expression's
gdbarch and language_defn members when the varobj->root->exp is
initialized.  Those structures outlive the objfile, so this is safe.
This is done because those references might be used initialize a python
context even after exp is invalidated.  Another approach could have been
to initialize the python context with default gdbarch and language_defn
(i.e. nullptr) if expr is NULL, but since we might still try to display
the value which was obtained by evaluating exp when it was still valid,
keeping track of the context which was used at this time seems
reasonable.

Tested on x86_64-Linux.

Co-Authored-By: Pedro Alves <pedro@palves.net>
---
 .../gdb.mi/mi-var-invalidate-shlib-lib.c      | 30 ++++++
 .../gdb.mi/mi-var-invalidate-shlib.c          | 41 ++++++++
 .../gdb.mi/mi-var-invalidate-shlib.exp        | 93 +++++++++++++++++++
 gdb/value.c                                   | 27 ++++++
 gdb/varobj.c                                  | 66 ++++++++++++-
 5 files changed, 256 insertions(+), 1 deletion(-)
 create mode 100644 gdb/testsuite/gdb.mi/mi-var-invalidate-shlib-lib.c
 create mode 100644 gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.c
 create mode 100644 gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.exp

diff --git a/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib-lib.c b/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib-lib.c
new file mode 100644
index 00000000000..3d4c7aa11b6
--- /dev/null
+++ b/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib-lib.c
@@ -0,0 +1,30 @@
+/* Copyright 2022 Free Software Foundation, Inc.
+
+   This file is part of GDB.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+
+struct bar
+{
+  int a;
+  int b;
+};
+
+struct bar global_shlib_var = { 2, 2 };
+
+void
+foo ()
+{
+  struct bar local_var = { 1, 1 };
+}
diff --git a/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.c b/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.c
new file mode 100644
index 00000000000..f9237c3b853
--- /dev/null
+++ b/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.c
@@ -0,0 +1,41 @@
+/* Copyright 2022 Free Software Foundation, Inc.
+
+   This file is part of GDB.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+
+#include <dlfcn.h>
+
+static void
+no_varobj_in_scope (void)
+{
+}
+
+static void
+floating_varobj_in_scope (void)
+{
+  int local_var = 0;
+}
+
+int
+main (int argc, char *argv [])
+{
+  void *shlib = dlopen (SHLIB_PATH, RTLD_LAZY);
+  void (*foo)() = dlsym (shlib, "foo");
+  foo ();
+  dlclose (shlib);
+
+  no_varobj_in_scope ();
+  floating_varobj_in_scope ();
+}
diff --git a/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.exp b/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.exp
new file mode 100644
index 00000000000..b405c832f29
--- /dev/null
+++ b/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.exp
@@ -0,0 +1,93 @@
+# Copyright 2007-2022 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# Test that varobj are invalidated after the shlib they point to goes
+# away.
+
+
+load_lib mi-support.exp
+set MIFLAGS "-i=mi"
+
+if { [skip_shlib_tests] } {
+    return 0
+}
+
+standard_testfile .c -lib.c
+set shlib_path [standard_output_file ${testfile}-lib.so]
+
+if { [gdb_compile_shlib $srcdir/$subdir/$srcfile2 $shlib_path {debug}] != "" } {
+    untested "failed to compile"
+    return -1
+}
+
+
+set opts [list shlib_load debug additional_flags=-DSHLIB_PATH="${shlib_path}"]
+if  { [gdb_compile "${srcdir}/${subdir}/${srcfile}" "${binfile}" executable $opts] != "" } {
+    untested "failed to compile"
+    return -1
+}
+
+proc do_test { separate_debuginfo } {
+    if { $separate_debuginfo } {
+	gdb_gnu_strip_debug $::shlib_path
+    }
+
+    if { [mi_clean_restart] } {
+	unsupported "failed to start GDB"
+	return
+    }
+
+    # Start the process once and create varobjs referencing the loaded objfiles.
+    with_test_prefix "setup" {
+	mi_load_shlibs $::shlib_path
+	if { $separate_debuginfo } {
+	    mi_load_shlibs ${::shlib_path}.debug
+	}
+	mi_delete_breakpoints
+	mi_gdb_reinitialize_dir $::srcdir/$::subdir
+	mi_gdb_load $::binfile
+
+	mi_runto foo -pending
+
+	mi_create_varobj global_shlib_var global_shlib_var "create global gloal_shlib_var"
+	mi_create_floating_varobj floating_local local_var "create floating local_var"
+
+	# Advance to a point where the shlib's objfile have been deleted.
+	mi_continue_to "no_varobj_in_scope"
+    }
+
+    with_test_prefix "after objfile deleted" {
+	# The global shlib var was invalidated when the objfile got unloaded.
+	mi_gdb_test "-var-update global_shlib_var" \
+	    "\\^done,changelist=\\\[\{name=\"global_shlib_var\",in_scope=\"invalid\",has_more=\"0\"\}\]" \
+	    "global_shlib_var invalidated"
+
+	# The floating var is still valid but not in scope.
+	mi_gdb_test "-var-update floating_local" \
+	    "\\^done,changelist=\\\[{name=\"floating_local\",in_scope=\"false\",type_changed=\"false\",has_more=\"0\"}\\\]" \
+	    "floating_local still valid but not in scope"
+
+	# The varobj can be re-evaluated if the expression is valid in the current
+	# frame.
+	mi_continue_to "floating_varobj_in_scope"
+	mi_gdb_test "-var-update floating_local" \
+	    "\\^done,changelist=\\\[{name=\"floating_local\",in_scope=\"true\",type_changed=\"true\",new_type=\"int\",new_num_children=\"0\",has_more=\"0\"}\\\]" \
+	    "floating_local in scope with new type and value"
+    }
+}
+
+foreach_with_prefix separate_debuginfo {0 1} {
+    do_test $separate_debuginfo
+}
diff --git a/gdb/value.c b/gdb/value.c
index 022fca91a42..51ee4e72fa5 100644
--- a/gdb/value.c
+++ b/gdb/value.c
@@ -46,6 +46,7 @@
 #include "cli/cli-style.h"
 #include "expop.h"
 #include "inferior.h"
+#include "varobj.h"
 
 /* Definition of a user function.  */
 struct internal_function
@@ -2596,6 +2597,25 @@ preserve_one_internalvar (struct internalvar *var, struct objfile *objfile,
     }
 }
 
+/* Make sure that all types and values referenced by VAROBJ are updated before
+   OBJFILE is discarded.  COPIED_TYPES is used to prevent cycles and
+   duplicates.  */
+
+static void
+preserve_one_varobj (struct varobj *varobj, struct objfile *objfile,
+		     htab_t copied_types)
+{
+  if (varobj->type->is_objfile_owned ()
+      && varobj->type->objfile_owner () == objfile)
+    {
+      varobj->type
+	= copy_type_recursive (objfile, varobj->type, copied_types);
+    }
+
+  if (varobj->value != nullptr)
+    preserve_one_value (varobj->value.get (), objfile, copied_types);
+}
+
 /* Update the internal variables and value history when OBJFILE is
    discarded; we must copy the types out of the objfile.  New global types
    will be created for every convenience variable which currently points to
@@ -2617,6 +2637,13 @@ preserve_values (struct objfile *objfile)
   for (var = internalvars; var; var = var->next)
     preserve_one_internalvar (var, objfile, copied_types.get ());
 
+  /* For the remaining varobj, check that none has type owned by OBJFILE.  */
+  all_root_varobjs ([&copied_types, objfile] (struct varobj *varobj)
+    {
+      preserve_one_varobj (varobj, objfile,
+			   copied_types.get ());
+    });
+
   preserve_ext_lang_values (objfile, copied_types.get ());
 }
 
diff --git a/gdb/varobj.c b/gdb/varobj.c
index 1aca015a21a..8d835cee81f 100644
--- a/gdb/varobj.c
+++ b/gdb/varobj.c
@@ -32,6 +32,7 @@
 #include "parser-defs.h"
 #include "gdbarch.h"
 #include <algorithm>
+#include "observable.h"
 
 #if HAVE_PYTHON
 #include "python/python.h"
@@ -72,6 +73,12 @@ struct varobj_root
   /* The expression for this parent.  */
   expression_up exp;
 
+  /* Cached arch from exp, for use in case exp gets invalidated.  */
+  struct gdbarch *gdbarch = nullptr;
+
+  /* Cached language from exp, for use in case exp gets invalidated.  */
+  const struct language_defn *language_defn = nullptr;
+
   /* Block for which this expression is valid.  */
   const struct block *valid_block = NULL;
 
@@ -206,7 +213,7 @@ is_root_p (const struct varobj *var)
 
 /* See python-internal.h.  */
 gdbpy_enter_varobj::gdbpy_enter_varobj (const struct varobj *var)
-: gdbpy_enter (var->root->exp->gdbarch, var->root->exp->language_defn)
+: gdbpy_enter (var->root->gdbarch, var->root->language_defn)
 {
 }
 
@@ -303,6 +310,11 @@ varobj_create (const char *objname,
       try
 	{
 	  var->root->exp = parse_exp_1 (&p, pc, block, 0, &tracker);
+
+	  /* Cache gdbarch and language_defn as they might be used even
+	     after var is invalidated and var->root->exp cleared.  */
+	  var->root->gdbarch = var->root->exp->gdbarch;
+	  var->root->language_defn = var->root->exp->language_defn;
 	}
 
       catch (const gdb_exception_error &except)
@@ -2373,6 +2385,55 @@ varobj_invalidate (void)
   all_root_varobjs (varobj_invalidate_iter);
 }
 
+/* Ensure that no varobj keep references to OBJFILE.  */
+
+static void
+varobj_invalidate_if_uses_objfile (struct objfile *objfile)
+{
+  if (objfile->separate_debug_objfile_backlink != nullptr)
+    objfile = objfile->separate_debug_objfile_backlink;
+
+  all_root_varobjs ([objfile] (struct varobj *var)
+    {
+      if (var->root->valid_block != nullptr)
+        {
+	  struct objfile *bl_objfile = block_objfile (var->root->valid_block);
+	  if (bl_objfile->separate_debug_objfile_backlink != nullptr)
+	    bl_objfile = bl_objfile->separate_debug_objfile_backlink;
+
+	  if (bl_objfile == objfile)
+	    {
+	      /* The varobj is tied to a block which is going away.  There is
+		 no way to reconstruct something later, so invalidate the
+		 varobj completly and drop the reference to the block which is
+		 being freed.  */
+	      var->root->is_valid = false;
+	      var->root->valid_block = nullptr;
+	    }
+	}
+
+      if (var->root->exp != nullptr
+	  && exp_uses_objfile (var->root->exp.get (), objfile))
+	{
+	  /* The varobj's current expression references the objfile.  For
+	     globals and floating, it is possible that when we try to
+	     re-evaluate the expression later it is still valid with
+	     whatever is in scope at that moment.  Just invalidate the
+	     expression for now.  */
+	  var->root->exp.reset ();
+
+	  /* It only makes sense to keep a floating varobj around.  */
+	  if (!var->root->floating)
+	    var->root->is_valid = false;
+	}
+
+      /* var->value->type and var->type might also reference the objfile.
+	 This is taken care of in value.c:preserve_values which deals with
+	 making sure that objfile-owend types are replaced with
+	 gdbarch-owned equivalents.  */
+    });
+}
+
 /* A hash function for a varobj.  */
 
 static hashval_t
@@ -2407,4 +2468,7 @@ _initialize_varobj ()
 			     _("When non-zero, varobj debugging is enabled."),
 			     NULL, show_varobjdebug,
 			     &setdebuglist, &showdebuglist);
+
+  gdb::observers::free_objfile.attach (varobj_invalidate_if_uses_objfile,
+				       "varobj");
 }
-- 
2.25.1

[PATCH v3 3/3] gdb/varobj: Fix varobj_invalidate_iter

[Lancelot SIX]

The varobj_invalidate function is meant to be called when restarting a
process, and check at this point if some of the previously existing
varobj can be recreated in the context of the new process.

Two kind of varobj are subject to re-creation:  global varobj (i.e.
varobj which reference a global variable), and floating varobj (i.e.
varobj which are always re-evaluated in the context of whatever is
the currently selected frame at the time of evaluation).

However, in the re-creation process, the varobj_invalidate_iter
recreates floating varobj as non-floating, due to an invalid parameter.
This patches fixes this and adds an assertion to check that if a varobj
is indeed recreated, it matches the original varobj "floating" property.

Another issue is that if at this recreation time the expression watched
by the floating varobj is not in scope, then the varobj is marked as
invalid.  If later the user selects a frame where the expression becomes
valid, the varobj remains invalid and this is wrong.  This patch also
make sure that floating varobj are not invalidated if they cannot be
evaluated.

The last important thing to note is that due to the previous patch, when
varobj_invalidate is executed (in the context of a new process), any
global var have already been invalidated (this has been done when the
objfile it referred to got invalidated).  As a consequence,
varobj_invalidate tries to recreate vars which are already marked as
invalid.  This does not entirely feels right, but I keep this behavior
for backward compatibility.

Tested on x86_64-linux
---
 .../gdb.mi/mi-var-invalidate-shlib.c          |  2 +
 .../gdb.mi/mi-var-invalidate-shlib.exp        | 44 +++++++++++++++++++
 gdb/varobj.c                                  | 20 ++++++---
 3 files changed, 59 insertions(+), 7 deletions(-)

diff --git a/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.c b/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.c
index f9237c3b853..2cb70104d80 100644
--- a/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.c
+++ b/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.c
@@ -17,6 +17,8 @@
 
 #include <dlfcn.h>
 
+int global_var = 5;
+
 static void
 no_varobj_in_scope (void)
 {
diff --git a/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.exp b/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.exp
index b405c832f29..87d1d4a6a9d 100644
--- a/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.exp
+++ b/gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.exp
@@ -61,6 +61,7 @@ proc do_test { separate_debuginfo } {
 
 	mi_runto foo -pending
 
+	mi_create_varobj global_var global_var "create global global_var"
 	mi_create_varobj global_shlib_var global_shlib_var "create global gloal_shlib_var"
 	mi_create_floating_varobj floating_local local_var "create floating local_var"
 
@@ -79,6 +80,10 @@ proc do_test { separate_debuginfo } {
 	    "\\^done,changelist=\\\[{name=\"floating_local\",in_scope=\"false\",type_changed=\"false\",has_more=\"0\"}\\\]" \
 	    "floating_local still valid but not in scope"
 
+	mi_gdb_test "-var-update global_var" \
+	    "\\^done,changelist=\\\[\\\]" \
+	    "global_var still valid"
+
 	# The varobj can be re-evaluated if the expression is valid in the current
 	# frame.
 	mi_continue_to "floating_varobj_in_scope"
@@ -86,6 +91,45 @@ proc do_test { separate_debuginfo } {
 	    "\\^done,changelist=\\\[{name=\"floating_local\",in_scope=\"true\",type_changed=\"true\",new_type=\"int\",new_num_children=\"0\",has_more=\"0\"}\\\]" \
 	    "floating_local in scope with new type and value"
     }
+
+    # Reload the entire process
+    with_test_prefix "restart process" {
+	mi_delete_breakpoints
+	mi_gdb_load ${::binfile}
+	mi_runto_main
+    }
+
+    with_test_prefix "in new process" {
+	# When reloading the symbol file, only the var for the global in the main
+	# executable is re-created.
+	mi_gdb_test "-var-update global_var" \
+	    "\\^done,changelist=\\\[{name=\"global_var\",in_scope=\"true\",type_changed=\"false\",has_more=\"0\"}\\\]" \
+	    "global_var recreated"
+	mi_gdb_test "-var-update global_shlib_var" \
+	    "\\^done,changelist=\\\[{name=\"global_shlib_var\",in_scope=\"invalid\",has_more=\"0\"}\\\]" \
+	    "global_shlib_var invalid"
+
+	# Floating varobj should still be valid, but out of scope at the moment.
+	mi_gdb_test "-var-update floating_local" \
+	    "\\^done,changelist=\\\[{name=\"floating_local\",in_scope=\"false\",type_changed=\"false\",has_more=\"0\"}\\\]" \
+	    "floating_local still valid but not in scope"
+
+	# Continue inside foo
+	mi_gdb_test "299-break-insert -f -t foo" \
+	    "&\"Function \\\\\"foo\\\\\" not defined.\\\\n\"\r\n299\\^done,[mi_make_breakpoint_pending -type breakpoint -disp del -pending foo]"
+	mi_send_resuming_command "exec-continue" "continue to foo"
+	mi_expect_stop "breakpoint-hit" foo ".*" ".*" "\[0-9\]+" { "" "disp=\"del\"" } "arrived at foo"
+
+	# Floating varobj is still valid, and now in scope.
+	mi_gdb_test "-var-update floating_local" \
+	    "\\^done,changelist=\\\[{name=\"floating_local\",in_scope=\"true\",type_changed=\"true\",new_type=\"struct bar\",new_num_children=\"2\",has_more=\"0\"}\\\]" \
+	    "floating_local still valid and in scope"
+
+	# The var for the global in the shlib stays invalid even after reloading the shlib.
+	mi_gdb_test "-var-update global_shlib_var" \
+	    "\\^done,changelist=\\\[{name=\"global_shlib_var\",in_scope=\"invalid\",has_more=\"0\"}\\\]" \
+	    "global_shlib_var invalid after shlib loaded"
+    }
 }
 
 foreach_with_prefix separate_debuginfo {0 1} {
diff --git a/gdb/varobj.c b/gdb/varobj.c
index 8d835cee81f..5112b506f02 100644
--- a/gdb/varobj.c
+++ b/gdb/varobj.c
@@ -2354,22 +2354,28 @@ static void
 varobj_invalidate_iter (struct varobj *var)
 {
   /* global and floating var must be re-evaluated.  */
-  if (var->root->floating || var->root->valid_block == NULL)
+  if (var->root->floating || var->root->valid_block == nullptr)
     {
       struct varobj *tmp_var;
 
       /* Try to create a varobj with same expression.  If we succeed
 	 replace the old varobj, otherwise invalidate it.  */
-      tmp_var = varobj_create (NULL, var->name.c_str (), (CORE_ADDR) 0,
-			       USE_CURRENT_FRAME);
-      if (tmp_var != NULL) 
-	{ 
+      tmp_var = varobj_create (nullptr, var->name.c_str (), (CORE_ADDR) 0,
+			       var->root->floating
+			       ? USE_SELECTED_FRAME : USE_CURRENT_FRAME);
+      if (tmp_var != nullptr)
+	{
+	  gdb_assert (var->root->floating == tmp_var->root->floating);
 	  tmp_var->obj_name = var->obj_name;
 	  varobj_delete (var, 0);
 	  install_variable (tmp_var);
 	}
-      else
-	var->root->is_valid = false;
+      else if (!var->root->floating)
+	{
+	  /* Only invalidate globals as floating vars might still be valid in
+	     some other frame.  */
+	  var->root->is_valid = false;
+	}
     }
   else /* locals must be invalidated.  */
     var->root->is_valid = false;
-- 
2.25.1

Re: [PATCH v3 1/3] MI: mi_runto -pending

[Tom Tromey]

>>>>> "Lancelot" == Lancelot SIX via Gdb-patches <gdb-patches@sourceware.org> writes:

Lancelot> -proc mi_runto {func} {
Lancelot> -    return [mi_runto_helper $func "run"]
Lancelot> +proc mi_runto {func args} {
Lancelot> +    return [mi_runto_helper $func "run" {*}$args]
Lancelot>  }

This looks strange to me.  Is it some new Tcl syntax?  Anyway, "args" is
special in Tcl and means that the remaining arguments will be passed as
a list.  So unless Tcl added some apply-like syntactic feature I suspect
this isn't really what is intended.

Tom

Re: [PATCH v3 1/3] MI: mi_runto -pending

[Tom Tromey]

Lancelot> +proc mi_runto {func args} {
Lancelot> +    return [mi_runto_helper $func "run" {*}$args]

I did my own research and found:

https://wiki.tcl-lang.org/page/%7B%2A%7D

So TIL.  This seems fine after all.

Tom

Re: [PATCH v3 2/3] gdb/varobj: Fix use after free in varobj

[Tom Tromey]

>>>>> "Lancelot" == Lancelot SIX via Gdb-patches <gdb-patches@sourceware.org> writes:

Lancelot> This patch also makes sure to keep a reference to the expression's
Lancelot> gdbarch and language_defn members when the varobj->root->exp is
Lancelot> initialized.  Those structures outlive the objfile, so this is safe.
[...]

Thanks, this looks good to me.

Tom

Re: [PATCH v3 3/3] gdb/varobj: Fix varobj_invalidate_iter

[Tom Tromey]

>>>>> "Lancelot" == Lancelot SIX via Gdb-patches <gdb-patches@sourceware.org> writes:

Lancelot> However, in the re-creation process, the varobj_invalidate_iter
Lancelot> recreates floating varobj as non-floating, due to an invalid parameter.
Lancelot> This patches fixes this and adds an assertion to check that if a varobj
Lancelot> is indeed recreated, it matches the original varobj "floating" property.

This looks good to me.

Tom

RE: [PATCH v3 3/3] gdb/varobj: Fix varobj_invalidate_iter

[Six, Lancelot]

[AMD Official Use Only - General]

> This looks good to me.
> 
> Tom

Thanks.

I just pushed the 3 patches of the series.

Best,
Lancelot.