[PATCH] [gdb/symtab] Handle self-reference DIE

[PATCH] [gdb/symtab] Handle self-reference DIE

[Tom de Vries]

While working on a dwarf assembly test-case I accidentally created the
following pathological dwarf:
...
 <1><be>: Abbrev Number: 3 (DW_TAG_class_type)
    <bf>   DW_AT_name        : c1
    <c2>   DW_AT_specification: <0xbe>
...
and noticed gdb segfaulting during cooked index creating due to running out of
stack.  This is a regression from gdb-12, where gdb just hung.

Fix this by inhibiting the scan_attributes self-recursion for self-references.

The same test-case with -readnow makes gdb hang, so also fix this in
dwarf2_attr and follow_die_ref.

Note that this doesn't fix the same problems for the more complicated case of:
...
 <1><be>: Abbrev Number: 3 (DW_TAG_class_type)
    <bf>   DW_AT_name        : c1
    <c2>   DW_AT_specification: <0xc6>
 <1><c6>: Abbrev Number: 4 (DW_TAG_class_type)
    <c7>   DW_AT_name        : c2
    <ca>   DW_AT_specification: <0xbe>
...
but the approach for deciding whether to fix pathological dwarf cases is as
per PR27981 comment 3:
...
yes if it is cheap/obvious, and no if it is something complicated or expensive.
...
and at this point I'm not sure whether fixing this will fall in the first
category.

Tested on x86_64-linux.
---
 gdb/dwarf2/read.c                      | 22 +++++++++--
 gdb/testsuite/gdb.dwarf2/self-spec.exp | 52 ++++++++++++++++++++++++++
 2 files changed, 71 insertions(+), 3 deletions(-)
 create mode 100644 gdb/testsuite/gdb.dwarf2/self-spec.exp

diff --git a/gdb/dwarf2/read.c b/gdb/dwarf2/read.c
index a64f82bd24a..245117cc1c7 100644
--- a/gdb/dwarf2/read.c
+++ b/gdb/dwarf2/read.c
@@ -16375,9 +16375,15 @@ cooked_indexer::scan_attributes (dwarf2_per_cu_data *scanning_per_cu,
 							   new_info_ptr,
 							   &bytes_read);
 	  new_info_ptr += bytes_read;
-	  scan_attributes (scanning_per_cu, new_reader, new_info_ptr, new_info_ptr,
-			   new_abbrev, name, linkage_name, flags, nullptr,
-			   parent_entry, maybe_defer, true);
+
+	  if (new_reader->cu == reader->cu && new_info_ptr == watermark_ptr)
+	    {
+	      /* Self-reference, we're done.  */
+	    }
+	  else
+	    scan_attributes (scanning_per_cu, new_reader, new_info_ptr,
+			     new_info_ptr, new_abbrev, name, linkage_name,
+			     flags, nullptr, parent_entry, maybe_defer, true);
 	}
     }
 
@@ -17888,7 +17894,11 @@ dwarf2_attr (struct die_info *die, unsigned int name, struct dwarf2_cu *cu)
       if (!spec)
 	break;
 
+      struct die_info *prev_die = die;
       die = follow_die_ref (die, spec, &cu);
+      if (die == prev_die)
+	/* Self-reference, we're done.  */
+	break;
     }
 
   return NULL;
@@ -20540,6 +20550,12 @@ follow_die_ref (struct die_info *src_die, const struct attribute *attr,
   struct dwarf2_cu *cu = *ref_cu;
   struct die_info *die;
 
+  if (attr->form != DW_FORM_GNU_ref_alt && src_die->sect_off == sect_off)
+    {
+      /* Self-reference, we're done.  */
+      return src_die;
+    }
+
   die = follow_die_offset (sect_off,
 			   (attr->form == DW_FORM_GNU_ref_alt
 			    || cu->per_cu->is_dwz),
diff --git a/gdb/testsuite/gdb.dwarf2/self-spec.exp b/gdb/testsuite/gdb.dwarf2/self-spec.exp
new file mode 100644
index 00000000000..71e7c1210a6
--- /dev/null
+++ b/gdb/testsuite/gdb.dwarf2/self-spec.exp
@@ -0,0 +1,52 @@
+# Copyright 2023 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Check that gdb doesn't hang or segfault on reading a DIE with a
+# specification reference to itself.
+
+load_lib dwarf.exp
+
+require dwarf2_support
+
+standard_testfile main.c .S
+
+# Create the DWARF.
+set asm_file [standard_output_file $srcfile2]
+Dwarf::assemble $asm_file {
+    cu {} {
+	compile_unit {{language @DW_LANG_C_plus_plus}} {
+	    declare_labels c1
+	    c1: class_type {
+		{name c1}
+		{specification :$c1}
+	    }
+	}
+    }
+}
+
+if [prepare_for_testing "failed to prepare" $testfile "${asm_file} ${srcfile}" {}] {
+    return -1
+}
+
+set index [have_index $binfile]
+require {string eq $index ""}
+
+require !readnow
+
+gdb_test "maint print objfiles $testfile" \
+    "\r\n *qualified: *c1\r\n.*" \
+    "class c1 in cooked index"
+
+gdb_test "maint expand-symtabs"

base-commit: da1f552dc79476275af282b65c5317ab3b4dbd9a
-- 
2.35.3

Re: [PATCH] [gdb/symtab] Handle self-reference DIE

[Tom Tromey]

>>>>> Tom de Vries via Gdb-patches <gdb-patches@sourceware.org> writes:

> Fix this by inhibiting the scan_attributes self-recursion for self-references.

Makes sense, thanks.

Approved-By: Tom Tromey <tom@tromey.com>

> Note that this doesn't fix the same problems for the more complicated case of:
> ...
>  <1><be>: Abbrev Number: 3 (DW_TAG_class_type)
>     <bf>   DW_AT_name        : c1
>     <c2>   DW_AT_specification: <0xc6>
>  <1><c6>: Abbrev Number: 4 (DW_TAG_class_type)
>     <c7>   DW_AT_name        : c2
>     <ca>   DW_AT_specification: <0xbe>
> ...
> but the approach for deciding whether to fix pathological dwarf cases is as
> per PR27981 comment 3:
> ...
> yes if it is cheap/obvious, and no if it is something complicated or expensive.
> ...
> and at this point I'm not sure whether fixing this will fall in the first
> category.

I suspect full recursion detection would be too expensive.

However, one idea would be to limit the number of specifications that
would be followed.  A small limit like 4 or 5 is probably more than
enough for all actually-existing DWARF.

I filed a dwarflint bug for this:

https://sourceware.org/bugzilla/show_bug.cgi?id=30772

Tom