From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gdb-prs-return-13926-listarch-gdb-prs=sources.redhat.com@sourceware.org>
Received: (qmail 8422 invoked by alias); 27 Jun 2013 20:24:09 -0000
Mailing-List: contact gdb-prs-help@sourceware.org; run by ezmlm
Precedence: bulk
List-Id: <gdb-prs.sourceware.org>
List-Subscribe: <mailto:gdb-prs-subscribe@sourceware.org>
List-Archive: <http://sourceware.org/ml/gdb-prs/>
List-Post: <mailto:gdb-prs@sourceware.org>
List-Help: <mailto:gdb-prs-help@sourceware.org>, <http://sourceware.org/lists.html#faqs>
Sender: gdb-prs-owner@sourceware.org
Received: (qmail 8362 invoked by uid 48); 27 Jun 2013 20:24:09 -0000
From: "dje at google dot com" <sourceware-bugzilla@sourceware.org>
To: gdb-prs@sourceware.org
Subject: [Bug symtab/15695] New: value_struct_elt dereferences entire ptr
 chain?
Date: Thu, 27 Jun 2013 20:24:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gdb
X-Bugzilla-Component: symtab
X-Bugzilla-Version: HEAD
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: minor
X-Bugzilla-Who: dje at google dot com
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter
Message-ID: <bug-15695-4717@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2013-q2/txt/msg00515.txt.bz2

http://sourceware.org/bugzilla/show_bug.cgi?id=15695

            Bug ID: 15695
           Summary: value_struct_elt dereferences entire ptr chain?
           Product: gdb
           Version: HEAD
            Status: NEW
          Severity: minor
          Priority: P2
         Component: symtab
          Assignee: unassigned at sourceware dot org
          Reporter: dje at google dot com

While debugging an infinite loop in gdb I found it occurred here:

value_struct_elt:

    while (TYPE_CODE (t) == TYPE_CODE_PTR || TYPE_CODE (t) == TYPE_CODE_REF)
      {
        *argp = value_ind (*argp);
        /* Don't coerce fn pointer to fn and then back again!  */
        if (TYPE_CODE (value_type (*argp)) != TYPE_CODE_FUNC)
          *argp = coerce_array (*argp);
        t = check_typedef (value_type (*argp));
      }

The comment for value_struct_elt says:

 /* Given *ARGP, a value of type (pointer to a)* structure/union,

There's no suggestion of *ARGP being a pointer to a pointer to a pointer to ...
a pointer to a struct/union.
If this is an ease of use feature for the user, this seems like too low a level
a routine to implement this feature.

One possibility is that the loop is just a simple way to handle ptr->ref, with
ptr->ptr->ptr->... being accidental fallout.

IWBN to clarify this.

The TYPE_CODE (value_type (*argp)) needs a call to check_typedef.

Another related bug is why is there a check for a function inside the loop?
We're only interested in structs/unions here.
I suspect it's because coerce_array is misnamed/confusing: it also coerces
functions to be pointer to functions.  And if we didn't do the check we would
be stuck in an infinite loop.  Alas we still are in an infinite loop if *argp
is ptr->typedef->func.

-- 
You are receiving this mail because:
You are on the CC list for the bug.