Re: [PATCH] [gdb/symtab] Fix off-by-one error in cooked_indexer::recurse

[Tom de Vries <tdevries@suse.de>]

On 8/9/23 17:08, Tom de Vries via Gdb-patches wrote:
> Test-case gdb.dwarf2/pr13961.exp contains:
> ...
>   <1><25>: Abbrev Number: 8 (DW_TAG_class_type)
>      <26>   DW_AT_specification: <0x2a>
>   <1><2a>: Abbrev Number: 2 (DW_TAG_class_type)
>      <2b>   DW_AT_name        : foo
>      <2f>   DW_AT_byte_size   : 4
>      <30>   DW_AT_decl_file   : 1
>      <31>   DW_AT_decl_line   : 1
>      <32>   DW_AT_sibling     : <0x44>
> ...
> 
> The DIE at 0x25 contains an intra-CU forward reference, and is deferred during
> DIE indexing in the cooked_index, by adding it to m_deferred_entries.
> 
> The resulting cooked index entries are:
> ...
>      [12] ((cooked_index_entry *) 0x3dbbd00)
>      name:       foo
>      canonical:  foo
>      DWARF tag:  DW_TAG_class_type
>      flags:      0x0 []
>      DIE offset: 0x25
>      parent:     ((cooked_index_entry *) 0x3dbbca0) [foo]
> 
>      [13] ((cooked_index_entry *) 0x3dbbca0)
>      name:       foo
>      canonical:  foo
>      DWARF tag:  DW_TAG_class_type
>      flags:      0x0 []
>      DIE offset: 0x2a
>      parent:     ((cooked_index_entry *) 0)
> ...
> 
> Notice that 0x2a is the parent of 0x25.
> 
> The parent field is documented as:
> ...
>    /* The parent entry.  This is NULL for top-level entries.
>       Otherwise, it points to the parent entry, such as a namespace or
>       class.  */
>    const cooked_index_entry *parent_entry;
> ...
> so I'd expect no parent for 0x25.
> 
> The parent is set here in cooked_indexer::make_index:
> ...
>    for (const auto &entry : m_deferred_entries)
>      {
>        void *obj = m_die_range_map.find (entry.spec_offset);
>        cooked_index_entry *parent = static_cast<cooked_index_entry *> (obj);
>        m_index_storage->add (entry.die_offset, entry.tag, entry.flags,
> 			    entry.name, parent, m_per_cu);
>      }
> ...
> and AFAICT, we store in m_die_range_map the parent of the respective
> spec_offset DIE (though that's not clear from the comment describing it).
> 
> So, the root cause of this is that when we lookup the parent for DIE 0x25, we get
> m_die_range_map.find (0x2a) == 0x2a.
> 
> This is an off-by-one error, fixed in cooked_indexer::recurse by:
> ...
> -      CORE_ADDR start = form_addr (parent_entry->die_offset,
> +      CORE_ADDR start = form_addr (parent_entry->die_offset + 1,
> ...
> which gives us:
> ...
>      [12] ((cooked_index_entry *) 0x41e21f0)
>      name:       foo
>      canonical:  foo
>      DWARF tag:  DW_TAG_class_type
>      flags:      0x0 []
>      DIE offset: 0x25
>      parent:     ((cooked_index_entry *) 0)
> 
>      [13] ((cooked_index_entry *) 0x41e2190)
>      name:       foo
>      canonical:  foo
>      DWARF tag:  DW_TAG_class_type
>      flags:      0x0 []
>      DIE offset: 0x2a
>      parent:     ((cooked_index_entry *) 0)
> ...
> 
> Tested on x86_64-linux.
> 

I've submitted a v2 that includes a test-case, which required a 
preliminary patch:
- [PATCH v2 1/2] [gdb/symtab] Dump qualified name of cooked_index_entry
   https://sourceware.org/pipermail/gdb-patches/2023-August/201511.html
- [PATCH v2 2/2] [gdb/symtab] Fix off-by-one error in
   cooked_indexer::recurse
   https://sourceware.org/pipermail/gdb-patches/2023-August/201512.html

Thanks,
- Tom

> PR symtab/30739
> Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30739
> ---
>   gdb/dwarf2/read.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/gdb/dwarf2/read.c b/gdb/dwarf2/read.c
> index dd4fac52ca8..a64f82bd24a 100644
> --- a/gdb/dwarf2/read.c
> +++ b/gdb/dwarf2/read.c
> @@ -16477,7 +16477,9 @@ cooked_indexer::recurse (cutu_reader *reader,
>   
>     if (parent_entry != nullptr)
>       {
> -      CORE_ADDR start = form_addr (parent_entry->die_offset,
> +      /* Both start and end are inclusive, so use both "+ 1" and "- 1" to
> +	 limit the range to the children of parent_entry.  */
> +      CORE_ADDR start = form_addr (parent_entry->die_offset + 1,
>   				   reader->cu->per_cu->is_dwz);
>         CORE_ADDR end = form_addr (sect_offset (info_ptr - 1 - reader->buffer),
>   				 reader->cu->per_cu->is_dwz);
> 
> base-commit: 3cdc2d7e66ab6a48014dcd425c88cfd42a964321