Bug gdb/29712 identifies a problem with the Python disassembler API.
In some cases GDB will try to throw an exception through the
libopcodes disassembler code, however, not all targets include
exception unwind information when compiling C code, for targets that
don't include this information GDB will terminate when trying to pass
the exception through libopcodes.
To explain what GDB is trying to do, consider the following trivial
use of the Python disassembler API:
class ExampleDisassembler(gdb.disassembler.Disassembler):
class MyInfo(gdb.disassembler.DisassembleInfo):
def __init__(self, info):
super().__init__(info)
def read_memory(self, length, offset):
return super().read_memory(length, offset)
def __init__(self):
super().__init__("ExampleDisassembler")
def __call__(self, info):
info = self.MyInfo(info)
return gdb.disassembler.builtin_disassemble(info)
This disassembler doesn't add any value, it defers back to GDB to do
all the actual work, but it serves to allow us to discuss the problem.
The problem occurs when a Python exception is raised by the
MyInfo.read_memory method. The MyInfo.read_memory method is called
from the C++ function gdbpy_disassembler::read_memory_func. The C++
stack at the point this function is called looks like this:
#0 gdbpy_disassembler::read_memory_func (memaddr=4198805, buff=0x7fff9ab9d2a8 "\220ӹ\232\377\177", len=1, info=0x7fff9ab9d558) at ../../src/gdb/python/py-disasm.c:510
#1 0x000000000104ba06 in fetch_data (info=0x7fff9ab9d558, addr=0x7fff9ab9d2a9 "ӹ\232\377\177") at ../../src/opcodes/i386-dis.c:305
#2 0x000000000104badb in ckprefix (ins=0x7fff9ab9d100) at ../../src/opcodes/i386-dis.c:8571
#3 0x000000000104e28e in print_insn (pc=4198805, info=0x7fff9ab9d558, intel_syntax=-1) at ../../src/opcodes/i386-dis.c:9548
#4 0x000000000104f4d4 in print_insn_i386 (pc=4198805, info=0x7fff9ab9d558) at ../../src/opcodes/i386-dis.c:9949
#5 0x00000000004fa7ea in default_print_insn (memaddr=4198805, info=0x7fff9ab9d558) at ../../src/gdb/arch-utils.c:1033
#6 0x000000000094fe5e in i386_print_insn (pc=4198805, info=0x7fff9ab9d558) at ../../src/gdb/i386-tdep.c:4072
#7 0x0000000000503d49 in gdbarch_print_insn (gdbarch=0x5335560, vma=4198805, info=0x7fff9ab9d558) at ../../src/gdb/gdbarch.c:3351
#8 0x0000000000bcc8c6 in disasmpy_builtin_disassemble (self=0x7f2ab07f54d0, args=0x7f2ab0789790, kw=0x0) at ../../src/gdb/python/py-disasm.c:324
### ... snip lots of frames as we pass through Python itself ...
#22 0x0000000000bcd860 in gdbpy_print_insn (gdbarch=0x5335560, memaddr=0x401195, info=0x7fff9ab9e3c8) at ../../src/gdb/python/py-disasm.c:783
#23 0x00000000008995a5 in ext_lang_print_insn (gdbarch=0x5335560, address=0x401195, info=0x7fff9ab9e3c8) at ../../src/gdb/extension.c:939
#24 0x0000000000741aaa in gdb_print_insn_1 (gdbarch=0x5335560, vma=0x401195, info=0x7fff9ab9e3c8) at ../../src/gdb/disasm.c:1078
#25 0x0000000000741bab in gdb_disassembler::print_insn (this=0x7fff9ab9e3c0, memaddr=0x401195, branch_delay_insns=0x0) at ../../src/gdb/disasm.c:1101
So gdbpy_disassembler::read_memory_func is called from the libopcodes
disassembler to read memory, this C++ function then calls into user
supplied Python code to do the work.
If the user supplied Python code raises an gdb.MemoryError exception
indicating the memory read failed, this is fine. The C++ code
converts this exception back into a return value that libopcodes can
understand, and returns to libopcodes.
However, if the user supplied Python code raises some other exception,
what we want is for this exception to propagate through GDB and appear
as if raised by the call to gdb.disassembler.builtin_disassemble. To
achieve this, when gdbpy_disassembler::read_memory_func spots an
unknown Python exception, we must pass the information about this
exception from frame #0 to frame #8 in the above backtrace. Frame #8
is the C++ implementation of gdb.disassembler.builtin_disassemble, and
so it is this function that we want to re-raise the unknown Python
exception, so the user can, if they want, catch the exception in their
code.
The previous mechanism by which the exception was passed was to pack
the details of the Python exception into a C++ exception, then throw
the exception from frame #0, and catch the exception in frame #8,
unpack the details of the Python exception, and re-raise it.
However, this relies on the exception passing through frames #1 to #7,
some of which are in libopcodes, which is C code, and so, might not be
compiled with exception support.
This commit proposes an alternative solution that does not rely on
throwing a C++ exception.
When we spot an unhandled Python exception in frame #0, we will store
the details of this exception within the gdbpy_disassembler object
currently in use. Then we return to libopcodes a value indicating
that the memory_read failed.
libopcodes will now continue to disassemble as though that memory read
failed (with one special case described below), then, when we
eventually return to disasmpy_builtin_disassemble we check to see if
there is an exception stored in the gdbpy_disassembler object. If
there is then this exception can immediately be installed, and then we
return back to Python, when the user will be able to catch the
exception.
There is one extra change in gdbpy_disassembler::read_memory_func.
After the first call that results in an exception being stored on the
gdbpy_disassembler object, any future calls to the ::read_memory_func
function will immediately return as if the read failed. This avoids
any additional calls into user supplied Python code.
My thinking here is that should the first call fail with some unknown
error, GDB should not keep trying with any additional calls. This
maintains the illusion that the exception raised from
MyInfo.read_memory is immediately raised by
gdb.disassembler.builtin_disassemble. I have no tests for this change
though - to trigger this issue would rely on a libopcodes disassembler
that will try to read further memory even after the first failed
read. I'm not aware of any such disassembler that currently does
this, but that doesn't mean such a disassembler couldn't exist in the
future.
With this change in place the gdb.python/py-disasm.exp test should now
pass on AArch64.
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=29712
Approved-By: Simon Marchi <simon.marchi@efficios.com>
I noticed that execution_control_state has a 'reset' method, and
there's also a 'reset_ecs' function that calls it. This patch cleans
this area up a little by adding a parameter to the constructor and (a
change Simon suggested) removing the reset method. Some extraneous
variables are also removed, like:
- struct execution_control_state ecss;
- struct execution_control_state *ecs = &ecss;
Here 'ecs' is never changed, so this patch removes it entirely in
favor of just using the object everywhere.
Regression tested on x86-64 Fedora 34.
Approved-By: Simon Marchi <simon.marchi@efficios.com>
From glibc 2.35 and later, the "map_failed" stap probe is no longer
included in glibc. The removal of the probe looks like an accident,
but it was caused by a glibc commit which meant that the "map_failed"
probe could no longer be reached; the compiler then helpfully
optimised out the probe.
In GDB, in solib-svr4.c, we have a list of probes that we look for
related to the shared library loading detection. If any of these
probes are missing then GDB will fall back to the non-probe based
mechanism for detecting shared library loading. The "map_failed"
probe is include in the list of required probes.
This means that on glibc 2.35 (or later) systems, GDB is going to
always fall back to the non-probes based mechanism for detecting
shared library loading.
I raised a glibc bug to discuss this issue:
https://sourceware.org/bugzilla/show_bug.cgi?id=29818
But, whatever the ultimate decision from the glibc team, given there
are version of glibc in the wild without the "map_failed" probe, we
probably should update GDB to handle this situation.
The "map_failed" probe is already a little strange, very early
versions of glibc didn't include this probe, so, in some cases, if
this probe is missing GDB is happy to ignore it. This is fine, the
action associated with this probe inside GDB is DO_NOTHING, this means
the probe isn't actually required in order for GDB to correctly detect
the loading of shared libraries.
In this commit I propose changing the rules so that any probe whose
action is DO_NOTHING, is optional.
There is one possible downside to this change, and that concerns 'set
stop-on-solib-events on'. If a probe is removed from glibc, but the
old style breakpoint based mechanism is still in place within glibc
for that same event, then GDB will stop when using the old style
non-probe based mechanism, but not when using the probes based
mechanism.
For the map_failed case this is not a problem, both the map_failed
probe, and the call to the old style breakpoint location were
optimised out, and so neither event (probes based, or breakpoint
based) will trigger. This would only become an issue if glibc removed
a probe, but left the breakpoint in place (this would almost certainly
be a bug in glibc).
For now, I'm proposing that we just don't worry about this. Because
some probes have actions that are not DO_NOTHING, then we know the
user will always seem _some_ stops when a shared library is
loaded/unloaded, and (I'm guessing), in most cases, that's all they
care about. I figure when someone complains then we can figure out
what the right solution is then.
With this commit in place, then, when using a glibc 2.35 or later
system, GDB will once again use the stap probes for shared library
detection.
Reviewed-By: Lancelot SIX <lancelot.six@amd.com>
On powerpc64le-linux I run into:
...
(gdb) PASS: gdb.ada/task_watch.exp: info tasks before inserting breakpoint
watch -location value task 3^M
Watchpoint 2: -location value^M
(gdb) PASS: gdb.ada/task_watch.exp: watch -location value task 3
continue^M
Continuing.^M
[Thread 0x7ffff7ccf170 (LWP 65550) exited]^M
[Thread 0x7ffff7abf170 (LWP 65551) exited]^M
FAIL: gdb.ada/task_watch.exp: continue to watchpoint (timeout)
...
On x86_64-linux (where the test-case passes), a hardware watchpoint is used:
...
(gdb) PASS: gdb.ada/task_watch.exp: info tasks before inserting breakpoint
watch -location value task 3^M
Hardware watchpoint 2: -location value^M
...
and after forcing "set can-use-hw-watchpoints 0" we can intermittently
reproduce the same failure.
In the gdb documentation related to watchpoints in multi-threaded programs, we
read:
...
Warning: In multi-threaded programs, software watchpoints have only limited
usefulness. If GDB creates a software watchpoint, it can only watch the value
of an expression in a single thread. If you are confident that the expression
can only change due to the current thread’s activity (and if you are also
confident that no other thread can become current), then you can use software
watchpoints as usual. However, GDB may not notice when a non-current thread’s
activity changes the expression. (Hardware watchpoints, in contrast, watch an
expression in all threads.)
...
Since the ada task construct is mapped onto threads, it seems that the
same limitation holds for tasks.
Fix this by using skip_hw_watchpoint_tests.
Tested on powerpc64-linux.
Tested-By: Carl Love <cel@us.ibm.com>
On powerpc64le-linux, with test-case gdb.ada/out_of_line_in_inlined.exp I run
into:
...
(gdb) run ^M
Starting program: foo_o224_021-all ^M
^M
Breakpoint 1, 0x0000000010002f48 in foo_o224_021.child1.child2 (s=...) at \
foo_o224_021.adb:24^M
24 function Child2 (S : String) return Boolean is -- STOP^M
(gdb) FAIL: gdb.ada/out_of_line_in_inlined.exp: scenario=all: \
run to foo_o224_021.child1.child2
...
The breakpoint is correctly set at the local entry point, and given that the
local entry point doesn't correspond to a line number entry, the instruction
address of the breakpoint is shown.
The problem is that test-case doesn't expect the breakpoint address.
Fix this by allowing the breakpoint address to occur.
Tested on powerpc64le-linux.
I broke gdb.ada/start.exp, and did not notice it, because it outputs an
UNTESTED if gdb_start_cmd fails. I don't really see when start would
fail and it's not a problem that should be looked at. Change all spots
that call untested after a gdb_start_cmd failure, use fail instead.
Doing so caused some failures with the native-gdbserver board. Some
tests that use "start" were relying on the fact that start would fail
with that board to just return with "untested". Change them to add an
early return if use_gdb_stub returns true.
Some gdb.pascal tests also failed with native-gdbserver, because they
did use gdb_start_cmd to start the inferior, for no good reason.
Convert them to use runto_main instead, which does the right thing if
the target is a stub.
A further refactoring could be to make gdb_start_cmd match the expected
breakpoint hit and the prompt, which it doesn't do currently (it leaves
that to the callers, but not all of them do).
Change-Id: I097370851213e798ff29fb6cf8ba25ef7d2be007
Reviewed-By: Bruno Larsen <blarsen@redhat.com>
Approved-By: Andrew Burgess <aburgess@redhat.com>
The code to create a range type has a heuristic to decide whether the
range is unsigned. However, this heuristic can fail if the upper
bound of the range has its high bit set, because the test is done
using LONGEST.
With this patch, if the underlying type of a range is unsigned, then
the range will always be unsigned. A new test is included.
Regression tested on x86-64 Fedora 34. We've also been using this
internally at AdaCore for a while.
New in this version:
- Better comment in target_kill
- Uncomment line in test to avoid hanging when exiting, when testing on
native-extended-gdbserver
PR 28275 shows that doing a sequence of:
- Run inferior in background (run &)
- kill that inferior
- Run again
We get into this assertion:
/home/smarchi/src/binutils-gdb/gdb/target.c:2590: internal-error: target_wait: Assertion `!proc_target->commit_resumed_state' failed.
#0 internal_error_loc (file=0x5606b344e740 "/home/smarchi/src/binutils-gdb/gdb/target.c", line=2590, fmt=0x5606b344d6a0 "%s: Assertion `%s' failed.") at /home/smarchi/src/binutils-gdb/gdbsupport/errors.cc:54
#1 0x00005606b6296475 in target_wait (ptid=..., status=0x7fffb9390630, options=...) at /home/smarchi/src/binutils-gdb/gdb/target.c:2590
#2 0x00005606b5767a98 in startup_inferior (proc_target=0x5606bfccb2a0 <the_amd64_linux_nat_target>, pid=3884857, ntraps=1, last_waitstatus=0x0, last_ptid=0x0) at /home/smarchi/src/binutils-gdb/gdb/nat/fork-inferior.c:482
#3 0x00005606b4e6c9c5 in gdb_startup_inferior (pid=3884857, num_traps=1) at /home/smarchi/src/binutils-gdb/gdb/fork-child.c:132
#4 0x00005606b50f14a5 in inf_ptrace_target::create_inferior (this=0x5606bfccb2a0 <the_amd64_linux_nat_target>, exec_file=0x604000039f50 "/home/smarchi/build/binutils-gdb/gdb/test", allargs="", env=0x61500000a580, from_tty=1)
at /home/smarchi/src/binutils-gdb/gdb/inf-ptrace.c:105
#5 0x00005606b53b6d23 in linux_nat_target::create_inferior (this=0x5606bfccb2a0 <the_amd64_linux_nat_target>, exec_file=0x604000039f50 "/home/smarchi/build/binutils-gdb/gdb/test", allargs="", env=0x61500000a580, from_tty=1)
at /home/smarchi/src/binutils-gdb/gdb/linux-nat.c:978
#6 0x00005606b512b79b in run_command_1 (args=0x0, from_tty=1, run_how=RUN_NORMAL) at /home/smarchi/src/binutils-gdb/gdb/infcmd.c:468
#7 0x00005606b512c236 in run_command (args=0x0, from_tty=1) at /home/smarchi/src/binutils-gdb/gdb/infcmd.c:526
When running the kill command, commit_resumed_state for the
process_stratum_target (linux-nat, here) is true. After the kill, when
there are no more threads, commit_resumed_state is still true, as
nothing touches this flag during the kill operation. During the
subsequent run command, run_command_1 does:
scoped_disable_commit_resumed disable_commit_resumed ("running");
We would think that this would clear the commit_resumed_state flag of
our native target, but that's not the case, because
scoped_disable_commit_resumed iterates on non-exited inferiors in order
to find active process targets. And after the kill, the inferior is
exited, and the native target was unpushed from it anyway. So
scoped_disable_commit_resumed doesn't touch the commit_resumed_state
flag of the native target, it stays true. When reaching target_wait, in
startup_inferior (to consume the initial expect stop events while the
inferior is starting up and working its way through the shell),
commit_resumed_state is true, breaking the contract saying that
commit_resumed_state is always false when calling the targets' wait
method.
(note: to be correct, I think that startup_inferior should toggle
commit_resumed between the target_wait and target_resume calls, but I'll
ignore that for now)
I can see multiple ways to fix this. In the end, we need
commit_resumed_state to be cleared by the time we get to that
target_wait. It could be done at the end of the kill command, or at the
beginning of the run command.
To keep things in a coherent state, I'd like to make it so that after
the kill command, when the target is left with no threads, its
commit_resumed_state flag is left to false. This way, we can keep
working with the assumption that a target with no threads (and therefore
no running threads) has commit_resumed_state == false.
Do this by adding a scoped_disable_commit_resumed in target_kill. It
clears the target's commit_resumed_state on entry, and leaves it false
if the target does not have any resumed thread on exit. That means,
even if the target has another inferior with stopped threads,
commit_resumed_state will be left to false, which makes sense.
Add a test that tries to cover various combinations of actions done
while an inferior is running (and therefore while commit_resumed_state
is true on the process target).
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=28275
Change-Id: I8e6fe6dc1f475055921520e58cab68024039a1e9
Approved-By: Andrew Burgess <aburgess@redhat.com>
New in this version: add a dedicated test.
When I do this:
$ ./gdb -nx --data-directory=data-directory -q \
/bin/sleep \
-ex "maint set target-non-stop on" \
-ex "tar ext :1234" \
-ex "set remote exec-file /bin/sleep" \
-ex "run 1231 &" \
-ex add-inferior \
-ex "inferior 2"
Reading symbols from /bin/sleep...
(No debugging symbols found in /bin/sleep)
Remote debugging using :1234
Starting program: /bin/sleep 1231
Reading /lib64/ld-linux-x86-64.so.2 from remote target...
warning: File transfers from remote targets can be slow. Use "set sysroot" to access files locally instead.
Reading /lib64/ld-linux-x86-64.so.2 from remote target...
Reading /usr/lib/debug/.build-id/a6/7a1408f18db3576757eea210d07ba3fc560dff.debug from remote target...
[New inferior 2]
Added inferior 2 on connection 1 (extended-remote :1234)
[Switching to inferior 2 [<null>] (<noexec>)]
(gdb) Reading /lib/x86_64-linux-gnu/libc.so.6 from remote target...
attach 3659848
Attaching to process 3659848
/home/smarchi/src/binutils-gdb/gdb/thread.c:85: internal-error: inferior_thread: Assertion `current_thread_ != nullptr' failed.
Note the "attach" command just above. When doing it on the command-line
with a -ex switch, the bug doesn't trigger.
The internal error of GDB is actually caused by GDBserver crashing, and
the error recovery of GDB is not on point. This patch aims to fix just
the GDBserver crash, not the GDB problem.
GDBserver crashes with a segfault here:
(gdb) bt
#0 0x00005555557fb3f4 in find_one_thread (ptid=...) at /home/smarchi/src/binutils-gdb/gdbserver/thread-db.cc:177
#1 0x00005555557fd5cf in thread_db_thread_handle (ptid=<error reading variable: Cannot access memory at address 0xffffffffffffffa0>, handle=0x7fffffffc400, handle_len=0x7fffffffc3f0)
at /home/smarchi/src/binutils-gdb/gdbserver/thread-db.cc:461
#2 0x000055555578a0b6 in linux_process_target::thread_handle (this=0x5555558a64c0 <the_x86_target>, ptid=<error reading variable: Cannot access memory at address 0xffffffffffffffa0>, handle=0x7fffffffc400,
handle_len=0x7fffffffc3f0) at /home/smarchi/src/binutils-gdb/gdbserver/linux-low.cc:6905
#3 0x00005555556dfcc6 in handle_qxfer_threads_worker (thread=0x60b000000510, buffer=0x7fffffffc8a0) at /home/smarchi/src/binutils-gdb/gdbserver/server.cc:1645
#4 0x00005555556e00e6 in operator() (__closure=0x7fffffffc5e0, thread=0x60b000000510) at /home/smarchi/src/binutils-gdb/gdbserver/server.cc:1696
#5 0x00005555556f54be in for_each_thread<handle_qxfer_threads_proper(buffer*)::<lambda(thread_info*)> >(struct {...}) (func=...) at /home/smarchi/src/binutils-gdb/gdbserver/gdbthread.h:159
#6 0x00005555556e0242 in handle_qxfer_threads_proper (buffer=0x7fffffffc8a0) at /home/smarchi/src/binutils-gdb/gdbserver/server.cc:1694
#7 0x00005555556e04ba in handle_qxfer_threads (annex=0x629000000213 "", readbuf=0x621000019100 '\276' <repeats 200 times>..., writebuf=0x0, offset=0, len=4097)
at /home/smarchi/src/binutils-gdb/gdbserver/server.cc:1732
#8 0x00005555556e1989 in handle_qxfer (own_buf=0x629000000200 "qXfer:threads", packet_len=26, new_packet_len_p=0x7fffffffd630) at /home/smarchi/src/binutils-gdb/gdbserver/server.cc:2045
#9 0x00005555556e720a in handle_query (own_buf=0x629000000200 "qXfer:threads", packet_len=26, new_packet_len_p=0x7fffffffd630) at /home/smarchi/src/binutils-gdb/gdbserver/server.cc:2685
#10 0x00005555556f1a01 in process_serial_event () at /home/smarchi/src/binutils-gdb/gdbserver/server.cc:4176
#11 0x00005555556f4457 in handle_serial_event (err=0, client_data=0x0) at /home/smarchi/src/binutils-gdb/gdbserver/server.cc:4514
#12 0x0000555555820f56 in handle_file_event (file_ptr=0x607000000250, ready_mask=1) at /home/smarchi/src/binutils-gdb/gdbsupport/event-loop.cc:573
#13 0x0000555555821895 in gdb_wait_for_event (block=1) at /home/smarchi/src/binutils-gdb/gdbsupport/event-loop.cc:694
#14 0x000055555581f533 in gdb_do_one_event (mstimeout=-1) at /home/smarchi/src/binutils-gdb/gdbsupport/event-loop.cc:264
#15 0x00005555556ec9fb in start_event_loop () at /home/smarchi/src/binutils-gdb/gdbserver/server.cc:3512
#16 0x00005555556f0769 in captured_main (argc=4, argv=0x7fffffffe0d8) at /home/smarchi/src/binutils-gdb/gdbserver/server.cc:3992
#17 0x00005555556f0e3f in main (argc=4, argv=0x7fffffffe0d8) at /home/smarchi/src/binutils-gdb/gdbserver/server.cc:4078
The reason is a wrong current process when find_one_thread is called.
The current process is the 2nd one, which was just attached. It does
not yet have thread_db data (proc->priv->thread_db is nullptr). As we
iterate on all threads of all process to fulfull the qxfer:threads:read
request, we get to a thread of process 1 for which we haven't read
thread_db information yet (lwp_info::thread_known is false), so we get
into find_one_thread. find_one_thread uses
`current_process ()->priv->thread_db`, assuming the current process
matches the ptid passed as a parameter, which is wrong. A segfault
happens when trying to dereference that thread_db pointer.
Fix this by making find_one_thread not assume what the current process /
current thread is. If it needs to call into libthread_db, which we know
will try to read memory from the current process, then temporarily set
the current process.
In the case where the thread is already know and we return early, we
don't need to switch process.
Add a test to reproduce this specific situation.
Change-Id: I09b00883e8b73b7e5f89d0f47cb4e9c0f3d6caaa
Approved-By: Andrew Burgess <aburgess@redhat.com>
PR cli/29800 points out that "document" will now crash when the
argument is an undefined command. This is a regression due to the
"document user-defined aliases" patch.
Approved-By: Joel Brobecker <brobecker@adacore.com>
Reviewed-By: Philippe Waroquiers <philippe.waroquiers@skynet.be>
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=29800
On powerpc64le-linux, I run into:
...
(gdb) PASS: gdb.opt/solib-intra-step.exp: first-hit
step^M
28 { /* first-retry */^M
(gdb) FAIL: gdb.opt/solib-intra-step.exp: second-hit
...
It's a bit easier to understand what happens if we do a full stepping session:
...
Temporary breakpoint 1, main ()
at solib-intra-step-main.c:23
23 shlib_first ();
(gdb) step
shlib_first () at solib-intra-step-lib.c:29
29 shlib_second (0); /* first-hit */
(gdb) step
28 { /* first-retry */
(gdb) step
29 shlib_second (0); /* first-hit */
(gdb) step
shlib_second (dummy=0)
at solib-intra-step-lib.c:23
23 abort (); /* second-hit */
...
and compare that to the line info:
...
CU: solib-intra-step-lib.c:
File name Line number Starting address View Stmt
solib-intra-step-lib.c 22 0x710 x
solib-intra-step-lib.c 23 0x724 x
solib-intra-step-lib.c 28 0x740 x
solib-intra-step-lib.c 29 0x74c x
solib-intra-step-lib.c 28 0x750 x
solib-intra-step-lib.c 29 0x758 x
solib-intra-step-lib.c 30 0x760 x
solib-intra-step-lib.c - 0x77c
...
So we step from line 29 to line 28, and back to line 29, which is behaviour
that matches the line table. The peculiar order is due to using optimization.
The problem is that the test-case doesn't expect this order.
Fix this by allowing this order in the test-case.
Tested on powerpc64le-linux.
PR testsuite/29792
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=29792
This commit addresses one of the issues identified in PR gdb/28275.
Bug gdb/28275 identifies a number of situations in which this assert:
Assertion `!proc_target->commit_resumed_state' failed.
could be triggered. There's actually a number of similar places where
this assert is found in GDB, the two of interest in gdb/28275 are in
target_wait and target_stop.
In one of the comments:
https://sourceware.org/bugzilla/show_bug.cgi?id=28275#c1
steps to trigger the assertion within target_stop were identified when
using a modified version of the gdb.threads/detach-step-over.exp test
script.
In the gdb.threads/detach-step-over.exp test, we attach to a
multi-threaded inferior, and continue the inferior in asynchronous
(background) mode. Each thread is continuously hitting a conditional
breakpoint where the condition is always false. While the inferior is
running we detach. The goal is that we detach while GDB is performing a
step-over for the conditional breakpoint in at least one thread.
While detaching, if a step-over is in progress, then GDB has to
complete the step over before we can detach. This involves calling
target_stop and target_wait (see prepare_for_detach).
As far as gdb/28275 is concerned, the interesting part here, is the
the process_stratum_target::commit_resumed_state variable must be
false when target_stop and target_wait are called.
This is currently ensured because, in detach_command (infrun.c), we
create an instance of scoped_disable_commit_resumed, this ensures that
when target_detach is called, ::commit_resumed_state will be false.
The modification to the test that I propose here, and which exposed
the bug, is that, instead of using "detach" to detach from the
inferior, we instead use "quit". Quitting GDB after attaching to an
inferior will cause GDB to first detach, and then exit.
When we quit GDB we end up calling target_detach via a different code
path, the stack looks like:
#0 target_detach
#1 kill_or_detach
#2 quit_force
#3 quit_command
Along this path there is no scoped_disable_commit_resumed created.
::commit_resumed_state can be true when we reach prepare_for_detach,
which calls target_wait and target_stop, so the assertion will trigger.
In this commit, I propose fixing this by adding the creation of a
scoped_disable_commit_resumed into target_detach. This will ensure
that ::commit_resumed_state is false when calling prepare_for_detach
from within target_detach.
I did consider placing the scoped_disable_commit_resumed in
prepare_for_detach, however, placing it in target_detach ensures that
the target's commit_resumed_state flag is left to false if the detached
inferior was the last one for that target. It's the same rationale as
for patch "gdb: disable commit resumed in target_kill" that comes later
in this series, but for detach instead of kill.
detach_command still includes a scoped_disable_commit_resumed too, but I
think it is still relevant to cover the resumption at the end of the
function.
Co-Authored-By: Simon Marchi <simon.marchi@efficios.com>
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=28275
Change-Id: Ie128f7aba6ef0e018859275eca372e6ea738e96f
Factor out some bits of gdb.threads/detach-step-over.exp to procs in
preparation to adding some new variations of the test. Rename the
existing "test" proc and make it use proc_with_prefix.
Co-Authored-By: Simon Marchi <simon.marchi@efficios.com>
Change-Id: Ib4412545c81c8556029e0f7bfa9dd48d7a9f3189
Before doing further changes to this file, change to use the :: notation
instead of declaring global variables with the `global` keyword.
Change-Id: I72301fd8f4693fea61aac054ba17245a1f4442fb
Approved-By: Andrew Burgess <aburgess@redhat.com>
On powerpc64le-linux, using gcc 4.8.5, I run into:
...
(gdb) PASS: gdb.arch/altivec-regs.exp: next (1)
next^M
11 c = vec_add (a, b);^M
(gdb) PASS: gdb.arch/altivec-regs.exp: next (2)
print/x a^M
$67 = {0xfefefefe, 0xfefefefe, 0xfefefefe, 0xfefefefe}^M
(gdb) FAIL: gdb.arch/altivec-regs.exp: print vector parameter a
...
Looking at the disassembly and the debug info, it's clear why there's
a FAIL.
The debug info says that the variable can be found at some stack location, but
the instructions don't seem to be writing there.
We can work around this by marking variable a volatile. Likewise for b.
Note that marking the variables as volatile doesn't change the location
information.
Tested on power64le-linux.
With test-case gdb.base/msym-bp-shl.exp on powerpc64le-linux, I run into:
...
(gdb) PASS: gdb.base/msym-bp-shl.exp: debug=0: before run: break foo
info breakpoint^M
Num Type Disp Enb Address What^M
1 breakpoint keep y <MULTIPLE> ^M
1.1 y 0x00000000000008d4 <foo+12>^M
1.2 y 0x0000000000000a34 crti.S:88^M
(gdb) FAIL: gdb.base/msym-bp-shl.exp: debug=0: before run: info breakpoint
...
The problem is that the prologue skipper walks from foo@plt at 0xa28 to 0xa34:
...
0000000000000a28 <foo@plt>:
a28: c0 ff ff 4b b 9e8 <__glink_PLTresolve>
Disassembly of section .fini:
0000000000000a2c <_fini>:
a2c: 02 00 4c 3c addis r2,r12,2
a30: d4 74 42 38 addi r2,r2,29908
a34: a6 02 08 7c mflr r0
...
This is caused by ppc_elfv2_elf_make_msymbol_special which marks foo@plt as
having a local entry point, due to incorrectly accessing an asymbol struct
using a (larger) elf_symbol_type.
Fix this by simply ignoring artificial symbols in
ppc_elfv2_elf_make_msymbol_special.
Tested on powerpc64le.
Approved-By: Ulrich Weigand <uweigand@de.ibm.com>
Reviewed-By: Carl Love <cel@us.ibm.com>
Tested-By: Carl Love <cel@us.ibm.com>
PR tdep/29814
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=29814
Valgrind reports a leak in the dwarf reader (see details below).
The function dw2_get_file_names_reader is interning in the per_objfile
all the file names it finds, except the name of 'fnd file name and directory'.
Instead, it was xstrdup-ing the name.
Fix the leaks by also interning the name.
This was validated running the tests natively, and under valgrind.
Leaks have decreased as mentionned below.
Valgrind detected no error such as double free or use after free.
Stack trace of the leak:
==4113266== 490,735 bytes in 17,500 blocks are definitely lost in loss record 7,061 of 7,074
==4113266== at 0x483979B: malloc (vg_replace_malloc.c:393)
==4113266== by 0x25A454: xmalloc (alloc.c:57)
==4113266== by 0x7D1E1E: xstrdup (xstrdup.c:34)
==4113266== by 0x39D141: dw2_get_file_names_reader (read.c:2825)
==4113266== by 0x39D141: dw2_get_file_names(dwarf2_per_cu_data*, dwarf2_per_objfile*) (read.c:2851)
==4113266== by 0x39DD6C: dw_expand_symtabs_matching_file_matcher(dwarf2_per_objfile*, gdb::function_view<bool (char const*, bool)>) (read.c:4149)
==4113266== by 0x3BC8B5: cooked_index_functions::expand_symtabs_matching(objfile*, gdb::function_view<bool (char const*, bool)>, lookup_name_info const*, gdb::function_view<bool (char const*)>, gdb::function_view<bool (compunit_symtab*)>, enum_flags<block_search_flag_values>, domain_enum, search_domain) (read.c:18688)
==4113266== by 0x5DD1EA: objfile::map_symtabs_matching_filename(char const*, char const*, gdb::function_view<bool (symtab*)>) (symfile-debug.c:207)
==4113266== by 0x5F04CC: iterate_over_symtabs(char const*, gdb::function_view<bool (symtab*)>) (symtab.c:633)
==4113266== by 0x477EE3: collect_symtabs_from_filename(char const*, program_space*) (linespec.c:3712)
==4113266== by 0x477FC1: symtabs_from_filename(char const*, program_space*) (linespec.c:3726)
==4113266== by 0x47A9B8: convert_explicit_location_spec_to_linespec(linespec_state*, linespec*, char const*, char const*, symbol_name_match_type, char const*, line_offset) (linespec.c:2329)
==4113266== by 0x47E86E: convert_explicit_location_spec_to_sals (linespec.c:2388)
==4113266== by 0x47E86E: location_spec_to_sals(linespec_parser*, location_spec const*) (linespec.c:3104)
==4113266== by 0x47EDAC: decode_line_full(location_spec*, int, program_space*, symtab*, int, linespec_result*, char const*, char const*) (linespec.c:3149)
...
Without the fix, the top 10 leaks are:
./gdb/testsuite/outputs/gdb.base/condbreak-bad/gdb.log:345:==3213924== definitely lost: 130,937 bytes in 5,409 blocks
./gdb/testsuite/outputs/gdb.base/hbreak2/gdb.log:619:==3758919== definitely lost: 173,323 bytes in 7,204 blocks
./gdb/testsuite/outputs/gdb.mi/mi-var-cp/gdb.log:1320:==4152873== definitely lost: 172,826 bytes in 7,207 blocks
./gdb/testsuite/outputs/gdb.base/advance-until-multiple-locations/gdb.log:398:==2992643== definitely lost: 172,965 bytes in 7,211 blocks
./gdb/testsuite/outputs/gdb.mi/mi-var-cmd/gdb.log:2302:==4159476== definitely lost: 173,129 bytes in 7,211 blocks
./gdb/testsuite/outputs/gdb.cp/gdb2384/gdb.log:222:==3811851== definitely lost: 218,106 bytes in 7,761 blocks
./gdb/testsuite/outputs/gdb.cp/mb-templates/gdb.log:310:==3787344== definitely lost: 290,311 bytes in 10,340 blocks
./gdb/testsuite/outputs/gdb.mi/mi-var-rtti/gdb.log:2568:==4158350== definitely lost: 435,427 bytes in 15,507 blocks
./gdb/testsuite/outputs/gdb.mi/mi-catch-cpp-exceptions/gdb.log:1704:==4119722== definitely lost: 435,405 bytes in 15,510 blocks
./gdb/testsuite/outputs/gdb.mi/mi-vla-fortran/gdb.log:768:==4113266== definitely lost: 508,585 bytes in 18,109 blocks
With the fix:
./gdb/testsuite/outputs/gdb.base/fork-running-state/gdb.log:1536:==2924193== indirectly lost: 13,848 bytes in 98 blocks
./gdb/testsuite/outputs/gdb.base/fork-running-state/gdb.log:1675:==2928777== indirectly lost: 13,848 bytes in 98 blocks
./gdb/testsuite/outputs/gdb.python/py-inferior-leak/gdb.log:4729:==3353335== definitely lost: 3,360 bytes in 140 blocks
./gdb/testsuite/outputs/gdb.base/kill-detach-inferiors-cmd/gdb.log:210:==2746927== indirectly lost: 13,246 bytes in 154 blocks
./gdb/testsuite/outputs/gdb.base/inferior-clone/gdb.log:179:==3034984== indirectly lost: 12,921 bytes in 161 blocks
./gdb/testsuite/outputs/gdb.base/interrupt-daemon/gdb.log:209:==3006248== indirectly lost: 20,683 bytes in 174 blocks
./gdb/testsuite/outputs/gdb.threads/watchpoint-fork/gdb.log:714:==3512403== indirectly lost: 20,707 bytes in 175 blocks
./gdb/testsuite/outputs/gdb.threads/watchpoint-fork/gdb.log:962:==3514498== indirectly lost: 20,851 bytes in 178 blocks
./gdb/testsuite/outputs/gdb.base/multi-forks/gdb.log:336:==2585839== indirectly lost: 53,630 bytes in 386 blocks
./gdb/testsuite/outputs/gdb.base/multi-forks/gdb.log:1338:==2592417== indirectly lost: 100,008 bytes in 1,154 blocks
Approved-By: Simon Marchi <simon.marchi@efficios.com>
Some class members were changed to bool, but there was
still some assignments or comparisons using 0/1.
Approved-By: Simon Marchi <simon.marchi@efficios.com>
When running test-case gdb.base/bt-on-fatal-signal.exp on powerpc64le-linux I
noticed:
...
FAIL: gdb.base/bt-on-fatal-signal.exp: SEGV: scan for backtrace (timeout)
...
The timeout is 10 seconds, but generating the core file takes more than a
minute, probably due to slow NFS.
I managed to reproduce this behaviour independently of gdb, by compiling
"int main (void) { __builtin_abort (); }" and running it, which took 1.5
seconds for a core file 50 times smaller than the one for gdb.
Fix this by preventing the core file from being generated, using a wrapper
around gdb that does "ulimit -c 0".
Tested on x86_64-linux.
If we instrument cc-with-tweaks.sh to remove the .gnu_debugaltlink file after
dwz has created it, with test-case
gdb.threads/access-mem-running-thread-exit.exp and target board cc-with-dwz-m
we run into:
...
(gdb) file access-mem-running-thread-exit^M
Reading symbols from access-mem-running-thread-exit...^M
could not find '.gnu_debugaltlink' file for access-mem-running-thread-exit^M
...
followed a bit later by:
...
(gdb) file access-mem-running-thread-exit^M
Reading symbols from access-mem-running-thread-exit...^M
gdb/dwarf2/read.c:7284: internal-error: create_all_units: \
Assertion `per_objfile->per_bfd->all_units.empty ()' failed.^M
...
The problem is that create_units does not catch the error thrown by
dwarf2_get_dwz_file.
Fix this by catching the error and performing the necessary cleanup, getting
the same result for the first and second file command.
PR symtab/29805
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=29805
Move all the remaining tests to a single test_break proc. It's a bit
big, but all of these are kind of tied together. The procs starts by
setting breakpoints, checks that we can see them in "info breakpoints",
and tries stopping on them.
Move all the "set bp_locationX" calls together at the top.
Change-Id: Id05f98957e1a3462532d2dbd577cd0a7c7263900
Approved-By: Kevin Buettner <kevinb@redhat.com>
Leave setting bp_location11 in the global scope, so that it's accessible
to other procs.
Change-Id: I8928f01640d3a1e993649b2168b9eda0724ee1d9
Approved-By: Kevin Buettner <kevinb@redhat.com>
One special thing here is that the part just above this one, that sets
catchpoints and verifies they are not hit, requires that we resume
execution to verify that the catchpoints are indeed not hit. I guess
it was previously achieved by the until command, but it doesn't happen
now that the until is moved into test_break_default. Add a
gdb_continue_to_end after setting the catchpoints. If any catchpoint
were to be hit, it would catch the problem.
Change-Id: I5d4b43da91886b1beda9f6e56b05aa04331a9c05
Approved-By: Kevin Buettner <kevinb@redhat.com>
This one is a bit tricky. The clear tests seem to depend on the various
breakpoints that have been set before, starting with the "silent"
breakpoints. So, move all this in a single chunk, it can always be
split later if needed.
Change-Id: I7ba61a5b130ade63eda0c4790534840339f8a72f
Approved-By: Kevin Buettner <kevinb@redhat.com>
This one is already in a proc, just make the proc use proc_with_prefix,
for consistency.
Change-Id: I313ecf5097ff04526c29396529baeba84e37df5a
Approved-By: Kevin Buettner <kevinb@redhat.com>
For v8m, the EXC_RETURN pattern, without security extension, consists of
FType, Mode and SPSEL. These are the same bits that are used in v7m.
This patch extends the list of patterns to include also the FType bit
and not just Mode and SPSEL bits for v8m targets without security
extension.
Signed-off-by: Torbjörn SVENSSON <torbjorn.svensson@foss.st.com>
On powerpc64le-linux I ran into this FAIL:
...
(gdb) p exceptions.throw_function()^M
terminate called after throwing an instance of 'int'^M
^M
Program received signal SIGABRT, Aborted.^M
0x00007ffff7979838 in raise () from /lib64/libc.so.6^M
The program being debugged was signaled while in a function called from GDB.^M
GDB remains in the frame where the signal was received.^M
To change this behavior use "set unwindonsignal on".^M
Evaluation of the expression containing the function^M
(SimpleException::throw_function()) will be abandoned.^M
When the function is done executing, GDB will silently stop.^M
(gdb) FAIL: gdb.cp/gdb2495.exp: call a function that raises an exception \
without a handler.
...
The following happens:
- we start an inferior call
- an internal breakpoint is set on the global entry point of std::terminate
- the inferior call uses the local entry point
- the breakpoint is not triggered
- we run into std::terminate
We can fix this by simply adding the missing gdbarch_skip_entrypoint call in
create_std_terminate_master_breakpoint, but we try to do this a bit more
generic, by:
- adding a variant of function create_internal_breakpoint which takes a
minimal symbol instead of an address as argument
- in the new function:
- using both gdbarch_convert_from_func_ptr_addr and gdbarch_skip_entrypoint
- documenting why we don't need to use gdbarch_addr_bits_remove
- adding a note about possibly
needing gdbarch_deprecated_function_start_offset.
- using the new function in:
- create_std_terminate_master_breakpoint
- create_exception_master_breakpoint_hook, which currently uses only
gdbarch_convert_from_func_ptr_addr.
Note: we could use the new function in more locations in breakpoint.c, but
as we're not aware of any related failures, we declare this out of scope for
this patch.
Tested on x86_64-linux, powerpc64le-linux.
Co-Authored-By: Ulrich Weigand <uweigand@de.ibm.com>
Tested-by: Carl Love <cel@us.ibm.com>
PR tdep/29793
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=29793
This uses custom collect/supply regset handlers which pass the TLS
register number from the gdbarch_tdep as the base register number.
Approved-By: Simon Marchi <simon.marchi@efficios.com>
This uses custom collect/supply regset handlers which pass the TLS
register number from the gdbarch_tdep as the base register number.
Approved-By: Simon Marchi <simon.marchi@efficios.com>
This is needed to permit using the helpers for register sets with a
variable base. In particular regnum needs to be converted into a
relative register number before passed to regcache_map_supplies.
Approved-By: Simon Marchi <simon.marchi@efficios.com>
fbsd-nat includes various helper routines for fetching and storing
register sets via ptrace where the register set is described by a
regset. These helper routines directly invoke the
supply/collect_regset regcache methods which doesn't permit a regset
to provide custom logic when fetching or storing a register set.
Instead, just use the function pointers from the struct regset
directly.
Approved-By: Simon Marchi <simon.marchi@efficios.com>
Some register sets described by an array of regcache_map_entry
structures do not have fixed register numbers in their associated
architecture but do describe a block of registers whose numbers are at
fixed offsets relative to some base register value. An example of
this are the TLS register sets for the ARM and AArch64 architectures.
Currently OS-specific architectures create register maps and register
sets dynamically using the register base number. However, this
requires duplicating the code to create the register map and register
set. To reduce duplication, add variants of the collect_regset and
supply_regset regcache methods which accept a base register number.
For valid register map entries (i.e. not REGCACHE_MAP_SKIP), add this
base register number to the value from the map entry to determine the
final register number.
Approved-By: Simon Marchi <simon.marchi@efficios.com>
As part of the rebase of the patch, I managed to loose the local
changes I had for the comments from Tomas in
https://sourceware.org/pipermail/gdb-patches/2022-November/193413.html
This patch corrects the obvious two typos.
Signed-off-by: Torbjörn SVENSSON <torbjorn.svensson@foss.st.com>
With the recent changes to the dwarf assembler, there is no longer a
need to test for gcc in gdb.dwarf2/clang-cli-macro.exp and mark it as
untested. This commit removes that logic.
The test py-objfile.exp unloads the current file while debugging the process.
This results in bpstat bs->b->loc to become nullptr.
Handle this case in breakpoint.c:bpstat_locno.
Note: GDB crashes on this problem with an internal error,
but the end of gdb summary shows:
...
=== gdb Summary ===
# of expected passes 36
The output also does not contain a 'FAIL:'.
After the fix, the nr of expected passes increased.
In the gdb.log output, one can see:
...
Fatal signal: Segmentation fault
----- Backtrace -----
0x55698905c5b9 gdb_internal_backtrace_1
../../binutils-gdb/gdb/bt-utils.c:122
0x55698905c5b9 _Z22gdb_internal_backtracev
...
ERROR: Couldn't send python print(objfile.filename) to GDB.
ERROR: : spawn id exp9 not open
while executing
"expect {
-i exp9 -timeout 10
-re ".*A problem internal to GDB has been detected" {
fail "$message (GDB internal error)"
gdb_internal_error..."
("uplevel" body line 1)
invoked from within
....
Wondering if it might be possible to improve gdb_test to have
gdb_test "python print(objfile.filename)" "None" \
"objfile.filename after objfile is unloaded"
reporting a failed result instead of just producing the internal error.
If the commands of the bpstat bs contain commands such as step or next or
continue, the BS and its commands are freed by execute_control_command.
So, we cannot remember the BS that was printed. Instead, remember
the bpnum and locno.
Regtested on debian/amd64 and re-run a few tests under valgrind.
step-over-syscall.exp has some specific tests for gdbserver.
The regexp matching breakpoint hit must take the added locno into account.
Test re-run in 3 modes (normal, native-gdbserver and native-extended-gdbserver).
