[Bug gdb/13716] New: crash on finish

[Bug gdb/13716] New: crash on finish

[orgads at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13716

             Bug #: 13716
           Summary: crash on finish
           Product: gdb
           Version: 7.4
            Status: NEW
          Severity: normal
          Priority: P2
         Component: gdb
        AssignedTo: unassigned@sourceware.org
        ReportedBy: orgads@gmail.com
    Classification: Unclassified


Created attachment 6229
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6229
backtrace

gdb is compiled for target mips64-octeon-linux-gnu (from vanilla sources).

'finish' crashes gdb on frame.c:338: fi->unwind->this_id (fi,
&fi->prologue_cache, &fi->this_id.value);

fi->unwind is 0x7f.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug gdb/13716] crash on finish

[orgads at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13716

Orgad Shaneh <orgads at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |orgads at gmail dot com

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug gdb/13716] crash on finish

[orgads at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13716

--- Comment #1 from Orgad Shaneh <orgads at gmail dot com> 2012-02-21 08:06:09 UTC ---
Created attachment 6231
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6231
overwrite backtrace

I found the location in which unwind is overwritten.

frame's address is 0xf5d1ca0.

First, on utils.c:3487 - void hashtab_obstack_allocate (void *data, size_t
size, size_t count)

obstack_alloc returns frame's address, then memset is called on it, which
resets part of unwind.

After that, the same function is called and resets the rest of unwind.

The more interesting part, which is described in the attached backtrace is:

hashtab.c:313: result = (htab_t) (*alloc_f) (alloc_arg, 1, sizeof (struct
htab));

result gets frame's address, and when it assigns size, it overwrites frame's
unwind (and other fields as well)...

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug gdb/13716] crash on finish

[orgads at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13716

--- Comment #2 from Orgad Shaneh <orgads at gmail dot com> 2012-02-21 08:12:12 UTC ---
One more thing - This is a regression from 7.3.1...

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug gdb/13716] crash on finish

[orgads at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13716

Orgad Shaneh <orgads at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|                            |mips64-octeon-linux-gnu
               Host|                            |i686-pc-mingw32
              Build|                            |i686-pc-mingw32

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug gdb/13716] crash on finish

[jan.kratochvil at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13716

Jan Kratochvil <jan.kratochvil at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jan.kratochvil at redhat
                   |                            |dot com

--- Comment #3 from Jan Kratochvil <jan.kratochvil at redhat dot com> 2012-02-21 22:44:14 UTC ---
Guessing it may be by inappropriate reinit_frame_cache somewhere,
could you put a breakpoint on it?
One must not keep frame_info * across reinit_frame_cache.
Some tool like valgrind may say the problem clearly but I am not aware what
memory ownership tracking tools are available on MS-Windows.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug gdb/13716] crash on finish

[orgads at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13716

--- Comment #4 from Orgad Shaneh <orgads at gmail dot com> 2012-02-22 06:37:35 UTC ---
Created attachment 6235
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6235
Backtrace of reinit_frame_cache

The frame that causes the crash is now 0xf7b2860. reinit_frame_cache is called
with its 'next'. This backtrace was taken on the second iteration, when fi is
the investigated frame

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug gdb/13716] crash on finish

[jan.kratochvil at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13716

--- Comment #5 from Jan Kratochvil <jan.kratochvil at redhat dot com> 2012-02-22 21:26:37 UTC ---
Created attachment 6237
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6237
Some fix.

I still do not see a cause of this crash.

I have found one stale frame * but that does not seem to cause it IMO.

I do not see interconnections between the backtraces as they are from different
GDB runs.  Could you explain more what do you think is wrong where?

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug gdb/13716] crash on finish

[orgads at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13716

--- Comment #6 from Orgad Shaneh <orgads at gmail dot com> 2012-02-23 06:42:15 UTC ---
That solved it. Thanks a lot!

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug backtrace/13716] crash on finish

[jan.kratochvil at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13716

Jan Kratochvil <jan.kratochvil at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
          Component|gdb                         |backtrace
         AssignedTo|unassigned at sourceware    |jan.kratochvil at redhat
                   |dot org                     |dot com

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug backtrace/13716] crash on finish

[cvs-commit at gcc dot gnu.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=13716

--- Comment #7 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> 2012-02-23 08:15:19 UTC ---
CVSROOT:    /cvs/src
Module name:    src
Changes by:    jkratoch@sourceware.org    2012-02-23 08:15:05

Modified files:
    gdb            : ChangeLog infcmd.c 

Log message:
    gdb/
    PR backtrace/13716
    * infcmd.c (finish_forward): New variable frame_id, initialize it, use
    it after set_momentary_breakpoint.

Patches:
http://sourceware.org/cgi-bin/cvsweb.cgi/src/gdb/ChangeLog.diff?cvsroot=src&r1=1.13857&r2=1.13858
http://sourceware.org/cgi-bin/cvsweb.cgi/src/gdb/infcmd.c.diff?cvsroot=src&r1=1.297&r2=1.298

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug backtrace/13716] crash on finish

[cvs-commit at gcc dot gnu.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=13716

--- Comment #8 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> 2012-02-23 08:18:46 UTC ---
CVSROOT:    /cvs/src
Module name:    src
Branch:     gdb_7_4-branch
Changes by:    jkratoch@sourceware.org    2012-02-23 08:18:42

Modified files:
    gdb            : ChangeLog infcmd.c 

Log message:
    gdb/
    PR backtrace/13716
    * infcmd.c (finish_forward): New variable frame_id, initialize it, use
    it after set_momentary_breakpoint.

Patches:
http://sourceware.org/cgi-bin/cvsweb.cgi/src/gdb/ChangeLog.diff?cvsroot=src&only_with_tag=gdb_7_4-branch&r1=1.13614.2.46&r2=1.13614.2.47
http://sourceware.org/cgi-bin/cvsweb.cgi/src/gdb/infcmd.c.diff?cvsroot=src&only_with_tag=gdb_7_4-branch&r1=1.291.2.2&r2=1.291.2.3

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug backtrace/13716] crash on finish

[jan.kratochvil at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13716

Jan Kratochvil <jan.kratochvil at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED
   Target Milestone|---                         |7.4

--- Comment #9 from Jan Kratochvil <jan.kratochvil at redhat dot com> 2012-02-23 08:24:42 UTC ---
[commit+7.4] Fix stale frame_info * (PR 13716)
http://sourceware.org/ml/gdb-patches/2012-02/msg00500.html

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.