b774b86094
The content of this branch was automatically imported from Fedora ELN with the following as its source: https://src.fedoraproject.org/rpms/gdb#6aff62077bcb16ebf2ba3c498634bce35eda276b
195 lines
7.6 KiB
Diff
195 lines
7.6 KiB
Diff
http://sourceware.org/ml/gdb-patches/2014-07/msg00530.html
|
|
Subject: [read_frame_arg patch] Handle partially optimized out values similarly to unavailable values (Re: [patchv2] Fix crash on optimized-out entry data values)
|
|
|
|
|
|
--V88s5gaDVPzZ0KCq
|
|
Content-Type: text/plain; charset=us-ascii
|
|
Content-Disposition: inline
|
|
|
|
On Thu, 17 Jul 2014 14:23:06 +0200, Pedro Alves wrote:
|
|
> On 07/16/2014 10:58 PM, Jan Kratochvil wrote:
|
|
> > This patch is apparently not suitable for gdb-7.8 which is I guess often
|
|
> > crashing on -O2 -g entry values so there could be some rather minimal crash
|
|
> > avoiding patch instead.
|
|
>
|
|
> Yeah.
|
|
>
|
|
> So this was originally "caused" (more exposed) by 4f14910f:
|
|
>
|
|
> gdb/ChangeLog
|
|
> 2013-11-26 Andrew Burgess <aburgess@broadcom.com>
|
|
>
|
|
> * value.c (allocate_optimized_out_value): Mark value as non-lazy.
|
|
>
|
|
> I tried a few approaches in value_available_contents_eq
|
|
> today, and ended up thinking that the simplest should be to
|
|
> just revert that patch until we have the fuller fix in place.
|
|
|
|
OK, that seems as the best solution for 7.8 to me.
|
|
|
|
|
|
> While doing just that fixes the crash, it surprisingly causes
|
|
> one of your new tests to FAIL:
|
|
>
|
|
> (gdb) frame
|
|
> #0 bar (ref=ref@entry=@0x7fffffffd184: 10) at gdb.arch/amd64-entry-value-paramref.cc:23
|
|
> 23 vv++; /* break-here */
|
|
> (gdb) FAIL: gdb.arch/amd64-entry-value-paramref.exp: frame
|
|
|
|
There is a bug in that entry value code of mine, fix attached.
|
|
The testcase then PASSes with the reverted optimization by Andrew Burgess.
|
|
|
|
For the attached fix - if you nitpick the missing conditional case:
|
|
value_optimized_out (val_deref) && value_optimized_out (entryval_deref)
|
|
It is not detected there but that IMO does not matter much as
|
|
* It is for 7.8 only, for trunk it will get compared correctly thanks to the
|
|
new implementation of value_available_contents_eq()
|
|
called value_contents_eq().
|
|
* If the conditional
|
|
if (val != val_deref
|
|
&& !value_optimized_out (val_deref)
|
|
&& !value_optimized_out (entryval_deref)
|
|
&& value_available_contents_eq (val_deref, 0,
|
|
entryval_deref, 0,
|
|
TYPE_LENGTH (type_deref)))
|
|
val_equal = 1;
|
|
fails it may just print
|
|
bar (ref=@0x7fffffffd904: <optimized out>, ref@entry=@0x7fffffffd904: <optimized out>)
|
|
(or some variant with some partially optimized-out/unavailable parts)
|
|
instead of the more correct
|
|
bar (ref=ref@entry=@0x7fffffffd904: <optimized out>)
|
|
which is not much a bug.
|
|
|
|
The attached fix no longe makes sense after the new implementation
|
|
of value_available_contents_eq() called value_contents_eq() gets applied as it
|
|
handles all the optimized-out/unavailable values on its own, therefore the
|
|
attached patch is really only for 7.8.
|
|
|
|
|
|
> Turns out it's the code disabled in value_of_dwarf_reg_entry:
|
|
>
|
|
> target_val = dwarf_entry_parameter_to_value (parameter,
|
|
> TYPE_LENGTH (target_type),
|
|
> target_type, caller_frame,
|
|
> caller_per_cu);
|
|
>
|
|
> /* value_as_address dereferences TYPE_CODE_REF. */
|
|
> addr = extract_typed_address (value_contents (outer_val), checked_type);
|
|
>
|
|
> /* The target entry value has artificial address of the entry value
|
|
> reference. */
|
|
> VALUE_LVAL (target_val) = lval_memory;
|
|
> set_value_address (target_val, addr);
|
|
>
|
|
> It looks quite wrong to me to just change a value's lval like that.
|
|
>
|
|
> I ran the testsuite with that code disabled (like in the patch below),
|
|
> and that caused no regressions. I can't say I really understand the
|
|
> intention here though. What would we be missing if we removed that code?
|
|
|
|
I cannot reproduce any wrong case having the code above #if 0-ed.
|
|
|
|
I just do not find it correct to have it disabled. But at the same time I do
|
|
like much / I do not find correct the code myself. It is a bit problematic to
|
|
have struct value describing a memory content which is no longer present
|
|
there.
|
|
|
|
What happens there:
|
|
------------------------------------------------------------------------------
|
|
volatile int vv;
|
|
static __attribute__((noinline)) int
|
|
bar (int &ref) {
|
|
ref = 20;
|
|
vv++; /* break-here */
|
|
return ref;
|
|
}
|
|
int main (void) {
|
|
int var = 10;
|
|
return bar (var);
|
|
}
|
|
------------------------------------------------------------------------------
|
|
<4><c7>: Abbrev Number: 13 (DW_TAG_GNU_call_site_parameter)
|
|
<c8> DW_AT_location : 1 byte block: 55 (DW_OP_reg5 (rdi))
|
|
<ca> DW_AT_GNU_call_site_value: 2 byte block: 91 74 (DW_OP_fbreg: -12)
|
|
<cd> DW_AT_GNU_call_site_data_value: 1 byte block: 3a (DW_OP_lit10)
|
|
------------------------------------------------------------------------------
|
|
gdb -ex 'b value_addr' -ex r --args ../gdb ./1 -ex 'watch vv' -ex r -ex 'p &ref@entry'
|
|
->
|
|
6 return ref;
|
|
bar (ref=@0x7fffffffd944: 20, ref@entry=@0x7fffffffd944: 10) at 1.C:25
|
|
------------------------------------------------------------------------------
|
|
At /* break-here */ struct value variable 'ref' is TYPE_CODE_REF.
|
|
|
|
With FSF GDB HEAD:
|
|
(gdb) x/gx arg1.contents
|
|
0x6004000a4ad0: 0x00007fffffffd944
|
|
(gdb) p ((struct value *)arg1.location.computed.closure).lval
|
|
$1 = lval_memory
|
|
(gdb) p/x ((struct value *)arg1.location.computed.closure).location.address
|
|
$3 = 0x7fffffffd944
|
|
|
|
With your #if0-ed code:
|
|
(gdb) x/gx arg1.contents
|
|
0x6004000a4ad0: 0x00007fffffffd944
|
|
(gdb) p ((struct value *)arg1.location.computed.closure).lval
|
|
$8 = not_lval
|
|
(gdb) p/x ((struct value *)arg1.location.computed.closure).location.address
|
|
$9 = 0x0
|
|
|
|
I do not see how to access
|
|
((struct value *)arg1.location.computed.closure).location.address
|
|
from GDB CLI. Trying
|
|
(gdb) p &ref@entry
|
|
will invoke value_addr()'s:
|
|
if (TYPE_CODE (type) == TYPE_CODE_REF)
|
|
/* Copy the value, but change the type from (T&) to (T*). We
|
|
keep the same location information, which is efficient, and
|
|
allows &(&X) to get the location containing the reference. */
|
|
and therefore the address gets fetched already from
|
|
arg1.contents
|
|
and not from
|
|
((struct value *)arg1.location.computed.closure).location.address
|
|
.
|
|
|
|
And for any other type than TYPE_CODE_REF this code you #if 0-ed does not get
|
|
executed at all. This DW_AT_GNU_call_site_data_value DWARF was meant
|
|
primarily for Fortran but with -O0 entry values do not get produced
|
|
and with -Og and higher Fortran always optimizes out the passing by reference.
|
|
|
|
If you do not like the #if 0 code there I am OK with removing it as I do not
|
|
know how to make it's use reproducible for user anyway. In the worst case
|
|
- if there really is some way how to exploit it - one should just get
|
|
Attempt to take address of value not located in memory.
|
|
instead of some wrong value and it may be easy to fix then.
|
|
|
|
|
|
Thanks for the analysis,
|
|
Jan
|
|
|
|
--V88s5gaDVPzZ0KCq
|
|
Content-Type: text/plain; charset=us-ascii
|
|
Content-Disposition: inline; filename=1
|
|
|
|
gdb/
|
|
2014-07-20 Jan Kratochvil <jan.kratochvil@redhat.com>
|
|
|
|
* stack.c (read_frame_arg): Verify value_optimized_out before calling
|
|
value_available_contents_eq.
|
|
|
|
diff --git a/gdb/stack.c b/gdb/stack.c
|
|
index 0d6d8e7..4db5df5 100644
|
|
--- a/gdb/stack.c
|
|
+++ b/gdb/stack.c
|
|
@@ -413,6 +413,8 @@ read_frame_arg (struct symbol *sym, struct frame_info *frame,
|
|
/* If the reference addresses match but dereferenced
|
|
content does not match print them. */
|
|
if (val != val_deref
|
|
+ && !value_optimized_out (val_deref)
|
|
+ && !value_optimized_out (entryval_deref)
|
|
&& value_available_contents_eq (val_deref, 0,
|
|
entryval_deref, 0,
|
|
TYPE_LENGTH (type_deref)))
|
|
|
|
--V88s5gaDVPzZ0KCq--
|
|
|