[RFA] Fix inline frame crash in handle_inferior_event

[RFA] Fix inline frame crash in handle_inferior_event

[Maciej W. Rozycki]

Hi,

 Jan's recent change to enable mcheck has triggered a segfault in 
gdb.opt/inline-cmds.exp on mips-sde-elf and mips-linux-gnu targets (any 
multilibs).  I have tracked the problem down to dereferencing a pointer to 
a frame structure that has been already freed.  The cause is in 
handle_inferior_event, where skip_inline_frames is called and that may 
invalidate the frame cache.  That doesn't stop handle_inferior_event 
though from trying to use a stale pointer to the current frame structure 
in the next step.  This path is only used for targets that have delay 
slots (gdbarch_single_step_through_delay_p is true; that applies to CRIS 
and MIPS targets only), which I infer is why it wasn't caught straight 
away.  This must be a long-standing bug.

 The change below works for me, the gdbarch_single_step_through_delay_p 
check that guards the problematic pointer dereference uses gdbarch 
determined by the invalidated frame too, so I've decided to reinit both 
frame and gdbarch unconditionally.

 No regressions in mips-sde-elf, mips-linux-gnu or i686-linux-gnu targets.  

 OK to apply?

2012-06-13  Maciej W. Rozycki  <macro@codesourcery.com>

	gdb/
	* infrun.c (handle_inferior_event): Re-fetch frame and gdbarch
	after hiding inline functions.

  Maciej

gdb-wait-inline-frames.diff
Index: gdb-fsf-trunk-quilt/gdb/infrun.c
===================================================================
--- gdb-fsf-trunk-quilt.orig/gdb/infrun.c	2012-06-08 23:45:43.000000000 +0100
+++ gdb-fsf-trunk-quilt/gdb/infrun.c	2012-06-12 08:29:31.063547656 +0100
@@ -4084,7 +4084,13 @@ handle_inferior_event (struct execution_
                && pc_at_non_inline_function (aspace,
                                              ecs->event_thread->prev_pc,
 					     &ecs->ws)))
-	skip_inline_frames (ecs->ptid);
+	{
+	  skip_inline_frames (ecs->ptid);
+	  /* Re-fetch current thread's frame in case that invalidated
+	     the frame cache.  */
+	  frame = get_current_frame ();
+	  gdbarch = get_frame_arch (frame);
+	}
     }
 
   if (ecs->event_thread->suspend.stop_signal == GDB_SIGNAL_TRAP

Re: [RFA] Fix inline frame crash in handle_inferior_event

[Jan Kratochvil]

On Wed, 13 Jun 2012 07:12:54 +0200, Maciej W. Rozycki wrote:
> 2012-06-13  Maciej W. Rozycki  <macro@codesourcery.com>
> 
> 	gdb/
> 	* infrun.c (handle_inferior_event): Re-fetch frame and gdbarch
> 	after hiding inline functions.

This is PR backtrace/13866.


> --- gdb-fsf-trunk-quilt.orig/gdb/infrun.c	2012-06-08 23:45:43.000000000 +0100
> +++ gdb-fsf-trunk-quilt/gdb/infrun.c	2012-06-12 08:29:31.063547656 +0100
> @@ -4084,7 +4084,13 @@ handle_inferior_event (struct execution_
>                 && pc_at_non_inline_function (aspace,
>                                               ecs->event_thread->prev_pc,
>  					     &ecs->ws)))
> -	skip_inline_frames (ecs->ptid);
> +	{
> +	  skip_inline_frames (ecs->ptid);

Empty line before comment.


> +	  /* Re-fetch current thread's frame in case that invalidated
> +	     the frame cache.  */
> +	  frame = get_current_frame ();
> +	  gdbarch = get_frame_arch (frame);
> +	}
>      }
>  
>    if (ecs->event_thread->suspend.stop_signal == GDB_SIGNAL_TRAP

Yes, fine with me.


Thanks,
Jan

Re: [RFA] Fix inline frame crash in handle_inferior_event

[Maciej W. Rozycki]

On Wed, 13 Jun 2012, Jan Kratochvil wrote:

> > 	gdb/
> > 	* infrun.c (handle_inferior_event): Re-fetch frame and gdbarch
> > 	after hiding inline functions.
> 
> This is PR backtrace/13866.
> 
> 
> > --- gdb-fsf-trunk-quilt.orig/gdb/infrun.c	2012-06-08 23:45:43.000000000 +0100
> > +++ gdb-fsf-trunk-quilt/gdb/infrun.c	2012-06-12 08:29:31.063547656 +0100
> > @@ -4084,7 +4084,13 @@ handle_inferior_event (struct execution_
> >                 && pc_at_non_inline_function (aspace,
> >                                               ecs->event_thread->prev_pc,
> >  					     &ecs->ws)))
> > -	skip_inline_frames (ecs->ptid);
> > +	{
> > +	  skip_inline_frames (ecs->ptid);
> 
> Empty line before comment.

 Applied with these changes, thanks for your review.

  Maciej