[Bug symtab/29334] [gdb, debug-types, debug-names] segfault in dwarf2_per_objfile::symtab_set_p

["vries at gcc dot gnu.org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=29334

--- Comment #1 from Tom de Vries <vries at gcc dot gnu.org> ---
Happens because dwarf2_per_objfile::symtab_set_p is called with per_cu ==
nullptr.

This happens the first time we process a DW_IDX_type_unit in
dw2_debug_names_iterator::next:
...
        case DW_IDX_type_unit:
          /* Don't crash on bad data.  */
          if (ull >= per_bfd->tu_stats.nr_tus)
            {
              complaint (_(".debug_names entry has bad TU index %s"
                           " [in module %s]"),
                         pulongest (ull),
                         objfile_name (objfile));
              continue;
            }
          per_cu = per_bfd->get_cu (ull + per_bfd->tu_stats.nr_tus);
          break;
...

We have a reference to type unit 14:
...
(gdb) p ull
$2 = 14
...

The CU table in .debug_names contains 6 entries (0-5) and the TU table contains
62 (0-61).

So type unit 14 is a valid index.

We correctly kept track of the number of TUs:
...
(gdb) p per_bfd->tu_stats.nr_tus
$3 = 62
...

And the all_comp_units.size () is 68, which indeed 62 + 6:
...
(gdb) s
dwarf2_per_bfd::get_cu (this=0x3659360, index=76) at
/home/vries/gdb_versions/devel/src/gdb/dwarf2/read.h:401
401         return this->all_comp_units[index].get ();
(gdb) p this->all_comp_units.size ()
$4 = 68
...

However, the index used is 76, which is too big.

Looking at the CU/TU table, we have:
...
CU table:
[  0] 0x0
[  1] 0x2e
[  2] 0x6d
[  3] 0x8f
[  4] 0x4db7
[  5] 0x4f6f

TU table:
[  0] 0x0
[  1] 0x15b
[  2] 0x2e0
...

And:
...
(gdb) p this->all_comp_units[0].get().sect_off
$16 = 0
(gdb) p this->all_comp_units[1].get().sect_off
$17 = (unknown: 0x2e)
(gdb) p this->all_comp_units[2].get().sect_off
$18 = (unknown: 0x6d)
...
and:
...
(gdb) p this->all_comp_units[6].get().sect_off
$19 = 0
(gdb) p this->all_comp_units[7].get().sect_off
$20 = (unknown: 0x15b)
(gdb) p this->all_comp_units[8].get().sect_off
$21 = (unknown: 0x2e0)
...

So, at first glance, it seems the fix should be something like:
...
-          per_cu = per_bfd->get_cu (ull + per_bfd->tu_stats.nr_tus);
+          per_cu = per_bfd->get_cu (ull + per_bfd->cu_stats.nr_cus);
...

-- 
You are receiving this mail because:
You are on the CC list for the bug.