Re: GDB crash due to endless recursion in namespace lookup

[sami wagiaalla <swagiaal@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1771 bytes --]

Hi Ulrich,

Thanks for reporting things and the test case. I have attached a fix and 
added your test case to the test suite.

Thoughts ?
   Sami

On 06/24/2010 02:09 PM, Ulrich Weigand wrote:
> Hello,
>
> since one of this year's C++ namespace search related changes,
> GDB will go into an endless recursion and crash due to stack
> overflow when looking up symbols in the presence of a cycle
> in the "using" directive graph.
>
> For example, with the following test:
>
> namespace A
> {
>    namespace B
>      {
>        using namespace ::A;
>      }
>    using namespace B;
> }
>
> using namespace A;
>
> class test { };
> test x;
>
> int main() { }
>
> I'm seeing:
>
> (gdb) start
> Temporary breakpoint 1 at 0x80000626: file xxx.cc, line 16.
> Starting program: /home7/uweigand/fsf/gdb-head-build/gdb/a.out
>
> Temporary breakpoint 1, main () at xxx.cc:16
> 16      int main() { }
> (gdb) print x[0]
> Segmentation fault (core dumped)
>
> (The lookup that happens here is for operator[] -- which doesn't
> exist, but in trying to find it we run into the endless loop.)
>
> This is particularly annyoing as the SLES10 system library on
> s390 and ppc contains exactly this construct in the header
> /usr/include/c++/4.1.2/bits/localefwd.h:
>
> namespace std
> {
>    namespace __gnu_cxx_ldbl128
>      {
>        using namespace ::std;
>      }
>    using namespace __gnu_cxx_ldbl128 __attribute__((__strong__));
>
> which means it is present in just about every C++ executable.
>
> (This seems specific to the SLES backport of the long-double
> compatibility support.  The upstream implementation does not
> have this cycle ...  But still, the general construct looks
> to be valid C++ as far as I can tell.)
>
> Any thoughts how to fix this?
>
> Bye,
> Ulrich
>


[-- Attachment #2: namespace-loop.patch --]
[-- Type: text/plain, Size: 4490 bytes --]

2010-06-24  Sami Wagiaalla  <swagiaal@redhat.com>

	* cp-namespace.c (reset_directive_searched): moved from here...
	* cp-support.c (reset_directive_searched): ... to here.
	(make_symbol_overload_list_using): Added check for search flag.

2010-06-24  Sami Wagiaalla  <swagiaal@redhat.com>

	* gdb.cp/operator.cc: Created an import loop.
	* gdb.cp/operator.exp: Added testcase for import loop.

diff --git a/gdb/cp-namespace.c b/gdb/cp-namespace.c
index 0daf732..525a90d 100644
--- a/gdb/cp-namespace.c
+++ b/gdb/cp-namespace.c
@@ -273,16 +273,6 @@ cp_lookup_symbol_in_namespace (const char *namespace,
     }
 }
 
-/* Used for cleanups to reset the "searched" flag incase
-   of an error.  */
-
-static void
-reset_directive_searched (void *data)
-{
-  struct using_direct *direct = data;
-  direct->searched = 0;
-}
-
 /* Search for NAME by applying all import statements belonging
    to BLOCK which are applicable in SCOPE.  If DECLARATION_ONLY the search
    is restricted to using declarations.
diff --git a/gdb/cp-support.c b/gdb/cp-support.c
index 41af7ae..6e403ed 100644
--- a/gdb/cp-support.c
+++ b/gdb/cp-support.c
@@ -838,6 +838,16 @@ make_symbol_overload_list_adl (struct type **arg_types, int nargs,
   return sym_return_val;
 }
 
+/* Used for cleanups to reset the "searched" flag incase
+   of an error.  */
+
+void
+reset_directive_searched (void *data)
+{
+  struct using_direct *direct = data;
+  direct->searched = 0;
+}
+
 /* This applies the using directives to add namespaces to search in,
    and then searches for overloads in all of those namespaces.  It
    adds the symbols found to sym_return_val.  Arguments are as in
@@ -847,8 +857,9 @@ static void
 make_symbol_overload_list_using (const char *func_name,
 				 const char *namespace)
 {
-  const struct using_direct *current;
+  struct using_direct *current;
   const struct block *block;
+  struct cleanup *searched_cleanup;
 
   /* First, go through the using directives.  If any of them apply,
      look in the appropriate namespaces for new functions to match
@@ -861,12 +872,23 @@ make_symbol_overload_list_using (const char *func_name,
 	current != NULL;
 	current = current->next)
       {
-        /* If this is a namespace alias or imported declaration ignore it.  */
-        if (current->alias != NULL || current->declaration != NULL)
+        /* If this import statement has been explored before, or if this is a
+           namespace alias or imported declaration ignore it.  */
+        if (current->searched
+            || current->alias != NULL
+            || current->declaration != NULL)
           continue;
 
         if (strcmp (namespace, current->import_dest) == 0)
-          make_symbol_overload_list_using (func_name, current->import_src);
+          {
+            current->searched = 1;
+            searched_cleanup = make_cleanup (reset_directive_searched, current);
+
+            make_symbol_overload_list_using (func_name, current->import_src);
+
+            discard_cleanups (searched_cleanup);
+            current->searched = 0;
+          }
       }
 
   /* Now, add names for this namespace.  */
diff --git a/gdb/cp-support.h b/gdb/cp-support.h
index ddc4c93..5e4e1e9 100644
--- a/gdb/cp-support.h
+++ b/gdb/cp-support.h
@@ -179,4 +179,9 @@ extern char *cp_comp_to_string (struct demangle_component *result,
 
 extern struct cmd_list_element *maint_cplus_cmd_list;
 
+/* Used for cleanups to reset the "searched" flag incase
+   of an error.  */
+
+extern void reset_directive_searched (void *data);
+
 #endif /* CP_SUPPORT_H */
diff --git a/gdb/testsuite/gdb.cp/operator.cc b/gdb/testsuite/gdb.cp/operator.cc
index cc925a0..8431376 100644
--- a/gdb/testsuite/gdb.cp/operator.cc
+++ b/gdb/testsuite/gdb.cp/operator.cc
@@ -157,6 +157,22 @@ using namespace N;
 
 //------------------
 
+namespace O
+{
+  namespace P
+    {
+      using namespace ::O;
+    }
+  using namespace P;
+}
+
+using namespace O;
+
+class test { };
+test x;
+
+//------------------
+
 int main ()
 {
   A a;
diff --git a/gdb/testsuite/gdb.cp/operator.exp b/gdb/testsuite/gdb.cp/operator.exp
index ac89d2b..0e36e4c 100644
--- a/gdb/testsuite/gdb.cp/operator.exp
+++ b/gdb/testsuite/gdb.cp/operator.exp
@@ -56,3 +56,6 @@ gdb_test "p j == 1" "Cannot resolve function operator== to any overloaded instan
 
 # Test that indirectly imported operators work
 gdb_test "p l == 1" "= 88"
+
+# Test that we don't fall into an import loop
+gdb_test {p x[0]} {No symbol "operator\[\]" in current context.}