[PATCH] [gdb/symtab] Fix off-by-one error in cooked_indexer::recurse

[PATCH] [gdb/symtab] Fix off-by-one error in cooked_indexer::recurse

[Tom de Vries]

Test-case gdb.dwarf2/pr13961.exp contains:
...
 <1><25>: Abbrev Number: 8 (DW_TAG_class_type)
    <26>   DW_AT_specification: <0x2a>
 <1><2a>: Abbrev Number: 2 (DW_TAG_class_type)
    <2b>   DW_AT_name        : foo
    <2f>   DW_AT_byte_size   : 4
    <30>   DW_AT_decl_file   : 1
    <31>   DW_AT_decl_line   : 1
    <32>   DW_AT_sibling     : <0x44>
...

The DIE at 0x25 contains an intra-CU forward reference, and is deferred during
DIE indexing in the cooked_index, by adding it to m_deferred_entries.

The resulting cooked index entries are:
...
    [12] ((cooked_index_entry *) 0x3dbbd00)
    name:       foo
    canonical:  foo
    DWARF tag:  DW_TAG_class_type
    flags:      0x0 []
    DIE offset: 0x25
    parent:     ((cooked_index_entry *) 0x3dbbca0) [foo]

    [13] ((cooked_index_entry *) 0x3dbbca0)
    name:       foo
    canonical:  foo
    DWARF tag:  DW_TAG_class_type
    flags:      0x0 []
    DIE offset: 0x2a
    parent:     ((cooked_index_entry *) 0)
...

Notice that 0x2a is the parent of 0x25.

The parent field is documented as:
...
  /* The parent entry.  This is NULL for top-level entries.
     Otherwise, it points to the parent entry, such as a namespace or
     class.  */
  const cooked_index_entry *parent_entry;
...
so I'd expect no parent for 0x25.

The parent is set here in cooked_indexer::make_index:
...
  for (const auto &entry : m_deferred_entries)
    {
      void *obj = m_die_range_map.find (entry.spec_offset);
      cooked_index_entry *parent = static_cast<cooked_index_entry *> (obj);
      m_index_storage->add (entry.die_offset, entry.tag, entry.flags,
			    entry.name, parent, m_per_cu);
    }
...
and AFAICT, we store in m_die_range_map the parent of the respective
spec_offset DIE (though that's not clear from the comment describing it).

So, the root cause of this is that when we lookup the parent for DIE 0x25, we get
m_die_range_map.find (0x2a) == 0x2a.

This is an off-by-one error, fixed in cooked_indexer::recurse by:
...
-      CORE_ADDR start = form_addr (parent_entry->die_offset,
+      CORE_ADDR start = form_addr (parent_entry->die_offset + 1,
...
which gives us:
...
    [12] ((cooked_index_entry *) 0x41e21f0)
    name:       foo
    canonical:  foo
    DWARF tag:  DW_TAG_class_type
    flags:      0x0 []
    DIE offset: 0x25
    parent:     ((cooked_index_entry *) 0)

    [13] ((cooked_index_entry *) 0x41e2190)
    name:       foo
    canonical:  foo
    DWARF tag:  DW_TAG_class_type
    flags:      0x0 []
    DIE offset: 0x2a
    parent:     ((cooked_index_entry *) 0)
...

Tested on x86_64-linux.

PR symtab/30739
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30739
---
 gdb/dwarf2/read.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/gdb/dwarf2/read.c b/gdb/dwarf2/read.c
index dd4fac52ca8..a64f82bd24a 100644
--- a/gdb/dwarf2/read.c
+++ b/gdb/dwarf2/read.c
@@ -16477,7 +16477,9 @@ cooked_indexer::recurse (cutu_reader *reader,
 
   if (parent_entry != nullptr)
     {
-      CORE_ADDR start = form_addr (parent_entry->die_offset,
+      /* Both start and end are inclusive, so use both "+ 1" and "- 1" to
+	 limit the range to the children of parent_entry.  */
+      CORE_ADDR start = form_addr (parent_entry->die_offset + 1,
 				   reader->cu->per_cu->is_dwz);
       CORE_ADDR end = form_addr (sect_offset (info_ptr - 1 - reader->buffer),
 				 reader->cu->per_cu->is_dwz);

base-commit: 3cdc2d7e66ab6a48014dcd425c88cfd42a964321
-- 
2.35.3

Re: [PATCH] [gdb/symtab] Fix off-by-one error in cooked_indexer::recurse

[Tom de Vries]

On 8/9/23 17:08, Tom de Vries via Gdb-patches wrote:
> Test-case gdb.dwarf2/pr13961.exp contains:
> ...
>   <1><25>: Abbrev Number: 8 (DW_TAG_class_type)
>      <26>   DW_AT_specification: <0x2a>
>   <1><2a>: Abbrev Number: 2 (DW_TAG_class_type)
>      <2b>   DW_AT_name        : foo
>      <2f>   DW_AT_byte_size   : 4
>      <30>   DW_AT_decl_file   : 1
>      <31>   DW_AT_decl_line   : 1
>      <32>   DW_AT_sibling     : <0x44>
> ...
> 
> The DIE at 0x25 contains an intra-CU forward reference, and is deferred during
> DIE indexing in the cooked_index, by adding it to m_deferred_entries.
> 
> The resulting cooked index entries are:
> ...
>      [12] ((cooked_index_entry *) 0x3dbbd00)
>      name:       foo
>      canonical:  foo
>      DWARF tag:  DW_TAG_class_type
>      flags:      0x0 []
>      DIE offset: 0x25
>      parent:     ((cooked_index_entry *) 0x3dbbca0) [foo]
> 
>      [13] ((cooked_index_entry *) 0x3dbbca0)
>      name:       foo
>      canonical:  foo
>      DWARF tag:  DW_TAG_class_type
>      flags:      0x0 []
>      DIE offset: 0x2a
>      parent:     ((cooked_index_entry *) 0)
> ...
> 
> Notice that 0x2a is the parent of 0x25.
> 
> The parent field is documented as:
> ...
>    /* The parent entry.  This is NULL for top-level entries.
>       Otherwise, it points to the parent entry, such as a namespace or
>       class.  */
>    const cooked_index_entry *parent_entry;
> ...
> so I'd expect no parent for 0x25.
> 
> The parent is set here in cooked_indexer::make_index:
> ...
>    for (const auto &entry : m_deferred_entries)
>      {
>        void *obj = m_die_range_map.find (entry.spec_offset);
>        cooked_index_entry *parent = static_cast<cooked_index_entry *> (obj);
>        m_index_storage->add (entry.die_offset, entry.tag, entry.flags,
> 			    entry.name, parent, m_per_cu);
>      }
> ...
> and AFAICT, we store in m_die_range_map the parent of the respective
> spec_offset DIE (though that's not clear from the comment describing it).
> 
> So, the root cause of this is that when we lookup the parent for DIE 0x25, we get
> m_die_range_map.find (0x2a) == 0x2a.
> 
> This is an off-by-one error, fixed in cooked_indexer::recurse by:
> ...
> -      CORE_ADDR start = form_addr (parent_entry->die_offset,
> +      CORE_ADDR start = form_addr (parent_entry->die_offset + 1,
> ...
> which gives us:
> ...
>      [12] ((cooked_index_entry *) 0x41e21f0)
>      name:       foo
>      canonical:  foo
>      DWARF tag:  DW_TAG_class_type
>      flags:      0x0 []
>      DIE offset: 0x25
>      parent:     ((cooked_index_entry *) 0)
> 
>      [13] ((cooked_index_entry *) 0x41e2190)
>      name:       foo
>      canonical:  foo
>      DWARF tag:  DW_TAG_class_type
>      flags:      0x0 []
>      DIE offset: 0x2a
>      parent:     ((cooked_index_entry *) 0)
> ...
> 
> Tested on x86_64-linux.
> 

I've submitted a v2 that includes a test-case, which required a 
preliminary patch:
- [PATCH v2 1/2] [gdb/symtab] Dump qualified name of cooked_index_entry
   https://sourceware.org/pipermail/gdb-patches/2023-August/201511.html
- [PATCH v2 2/2] [gdb/symtab] Fix off-by-one error in
   cooked_indexer::recurse
   https://sourceware.org/pipermail/gdb-patches/2023-August/201512.html

Thanks,
- Tom

> PR symtab/30739
> Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30739
> ---
>   gdb/dwarf2/read.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/gdb/dwarf2/read.c b/gdb/dwarf2/read.c
> index dd4fac52ca8..a64f82bd24a 100644
> --- a/gdb/dwarf2/read.c
> +++ b/gdb/dwarf2/read.c
> @@ -16477,7 +16477,9 @@ cooked_indexer::recurse (cutu_reader *reader,
>   
>     if (parent_entry != nullptr)
>       {
> -      CORE_ADDR start = form_addr (parent_entry->die_offset,
> +      /* Both start and end are inclusive, so use both "+ 1" and "- 1" to
> +	 limit the range to the children of parent_entry.  */
> +      CORE_ADDR start = form_addr (parent_entry->die_offset + 1,
>   				   reader->cu->per_cu->is_dwz);
>         CORE_ADDR end = form_addr (sect_offset (info_ptr - 1 - reader->buffer),
>   				 reader->cu->per_cu->is_dwz);
> 
> base-commit: 3cdc2d7e66ab6a48014dcd425c88cfd42a964321

Re: [PATCH] [gdb/symtab] Fix off-by-one error in cooked_indexer::recurse

[Tom Tromey]

>>>>> "Tom" == Tom de Vries via Gdb-patches <gdb-patches@sourceware.org> writes:

Tom> Test-case gdb.dwarf2/pr13961.exp contains:
Tom> ...
Tom>  <1><25>: Abbrev Number: 8 (DW_TAG_class_type)
Tom>     <26>   DW_AT_specification: <0x2a>
Tom>  <1><2a>: Abbrev Number: 2 (DW_TAG_class_type)
Tom>     <2b>   DW_AT_name        : foo
Tom>     <2f>   DW_AT_byte_size   : 4
Tom>     <30>   DW_AT_decl_file   : 1
Tom>     <31>   DW_AT_decl_line   : 1
Tom>     <32>   DW_AT_sibling     : <0x44>

It took me a while to understand the problem here, but I get it now.
Thanks for doing this.

Approved-By: Tom Tromey <tom@tromey.com>

BTW this is maybe my least favorite part of DWARF, though the
competition is pretty tough.

Tom