[Bug symtab/29334] New: [gdb, debug-types, debug-names] segfault in dwarf2_per_objfile::symtab_set_p

[Bug symtab/29334] New: [gdb, debug-types, debug-names] segfault in dwarf2_per_objfile::symtab_set_p

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29334

            Bug ID: 29334
           Summary: [gdb, debug-types, debug-names] segfault in
                    dwarf2_per_objfile::symtab_set_p
           Product: gdb
           Version: HEAD
            Status: NEW
          Severity: normal
          Priority: P2
         Component: symtab
          Assignee: unassigned at sourceware dot org
          Reporter: vries at gcc dot gnu.org
  Target Milestone: ---

When running test-case gdb.cp/cpexprs-debug-types.exp with target board
cc-with-debug-names, I run into:
...
(gdb) print base::operator new^M
^M
^M
Fatal signal: Segmentation fault^M
----- Backtrace -----^M
0x57ea46 gdb_internal_backtrace_1^M
        /home/vries/gdb_versions/devel/src/gdb/bt-utils.c:122^M
0x57eae9 _Z22gdb_internal_backtracev^M
        /home/vries/gdb_versions/devel/src/gdb/bt-utils.c:168^M
0x75b8ad handle_fatal_signal^M
        /home/vries/gdb_versions/devel/src/gdb/event-top.c:946^M
0x75ba19 handle_sigsegv^M
        /home/vries/gdb_versions/devel/src/gdb/event-top.c:1019^M
0x7f795f46a8bf ???^M
0x6d3cb1 _ZNK18dwarf2_per_objfile12symtab_set_pEPK18dwarf2_per_cu_data^M
        /home/vries/gdb_versions/devel/src/gdb/dwarf2/read.c:1515^M
...

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug symtab/29334] [gdb, debug-types, debug-names] segfault in dwarf2_per_objfile::symtab_set_p

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29334

--- Comment #1 from Tom de Vries <vries at gcc dot gnu.org> ---
Happens because dwarf2_per_objfile::symtab_set_p is called with per_cu ==
nullptr.

This happens the first time we process a DW_IDX_type_unit in
dw2_debug_names_iterator::next:
...
        case DW_IDX_type_unit:
          /* Don't crash on bad data.  */
          if (ull >= per_bfd->tu_stats.nr_tus)
            {
              complaint (_(".debug_names entry has bad TU index %s"
                           " [in module %s]"),
                         pulongest (ull),
                         objfile_name (objfile));
              continue;
            }
          per_cu = per_bfd->get_cu (ull + per_bfd->tu_stats.nr_tus);
          break;
...

We have a reference to type unit 14:
...
(gdb) p ull
$2 = 14
...

The CU table in .debug_names contains 6 entries (0-5) and the TU table contains
62 (0-61).

So type unit 14 is a valid index.

We correctly kept track of the number of TUs:
...
(gdb) p per_bfd->tu_stats.nr_tus
$3 = 62
...

And the all_comp_units.size () is 68, which indeed 62 + 6:
...
(gdb) s
dwarf2_per_bfd::get_cu (this=0x3659360, index=76) at
/home/vries/gdb_versions/devel/src/gdb/dwarf2/read.h:401
401         return this->all_comp_units[index].get ();
(gdb) p this->all_comp_units.size ()
$4 = 68
...

However, the index used is 76, which is too big.

Looking at the CU/TU table, we have:
...
CU table:
[  0] 0x0
[  1] 0x2e
[  2] 0x6d
[  3] 0x8f
[  4] 0x4db7
[  5] 0x4f6f

TU table:
[  0] 0x0
[  1] 0x15b
[  2] 0x2e0
...

And:
...
(gdb) p this->all_comp_units[0].get().sect_off
$16 = 0
(gdb) p this->all_comp_units[1].get().sect_off
$17 = (unknown: 0x2e)
(gdb) p this->all_comp_units[2].get().sect_off
$18 = (unknown: 0x6d)
...
and:
...
(gdb) p this->all_comp_units[6].get().sect_off
$19 = 0
(gdb) p this->all_comp_units[7].get().sect_off
$20 = (unknown: 0x15b)
(gdb) p this->all_comp_units[8].get().sect_off
$21 = (unknown: 0x2e0)
...

So, at first glance, it seems the fix should be something like:
...
-          per_cu = per_bfd->get_cu (ull + per_bfd->tu_stats.nr_tus);
+          per_cu = per_bfd->get_cu (ull + per_bfd->cu_stats.nr_cus);
...

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug symtab/29334] [gdb, debug-types, debug-names] segfault in dwarf2_per_objfile::symtab_set_p

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29334

--- Comment #2 from Tom de Vries <vries at gcc dot gnu.org> ---
Yep, that fixes it:
...
diff --git a/gdb/dwarf2/read.c b/gdb/dwarf2/read.c
index 23fe5679cbd..9f92b420645 100644
--- a/gdb/dwarf2/read.c
+++ b/gdb/dwarf2/read.c
@@ -4991,7 +4991,11 @@ dw2_debug_names_iterator::next ()
                         objfile_name (objfile));
              continue;
            }
-         per_cu = per_bfd->get_cu (ull + per_bfd->tu_stats.nr_tus);
+         {
+           int nr_cus = (per_bfd->all_comp_units.size ()
+                         - per_bfd->tu_stats.nr_tus);
+           per_cu = per_bfd->get_cu (nr_cus + ull);
+         }
          break;
        case DW_IDX_die_offset:
          /* In a per-CU index (as opposed to a per-module index), index
...

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug symtab/29334] [gdb, debug-types, debug-names] segfault in dwarf2_per_objfile::symtab_set_p

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29334

Tom de Vries <vries at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tromey at sourceware dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug symtab/29334] [gdb, debug-types, debug-names] segfault in dwarf2_per_objfile::symtab_set_p

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29334

Tom de Vries <vries at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.1

--- Comment #3 from Tom de Vries <vries at gcc dot gnu.org> ---
https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=3fa23bb5a5320dd82d32455036d59a026929fc2f

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug symtab/29334] [gdb, debug-types, debug-names] segfault in dwarf2_per_objfile::symtab_set_p

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29334

Tom de Vries <vries at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #4 from Tom de Vries <vries at gcc dot gnu.org> ---
Fixed.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug symtab/29334] [gdb, debug-types, debug-names] segfault in dwarf2_per_objfile::symtab_set_p

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29334

--- Comment #5 from Tom de Vries <vries at gcc dot gnu.org> ---
*** Bug 29323 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are on the CC list for the bug.