[PATCH] Avoid crash in dwarf2/read.c:determine_prefix

[PATCH] Avoid crash in dwarf2/read.c:determine_prefix

[Tom Tromey]

I found a gdb crash when using some changes to gnat-llvm to have it
emit unqualified names in the DWARF.  The crash happens because
determine_prefix does this:

	  return dwarf2_full_name (nullptr, parent, cu);

However, dwarf2_full_name can return NULL, causing a crash in the
caller.

The particular DWARF causing this is pretty strange -- it is a
function nested inside another nameless function.  This may be a bug
in gnat-llvm, something I plan to investigate.

Meanwhile, gdb shouldn't crash.  This patch changes determine_prefix
to avoid possible crashes here, by following its contract and not
returning NULL.

I'm not sure if it's worthwhile to write a test case for this.
---
 gdb/dwarf2/read.c | 39 ++++++++++++++++++++++-----------------
 1 file changed, 22 insertions(+), 17 deletions(-)

diff --git a/gdb/dwarf2/read.c b/gdb/dwarf2/read.c
index bc7b8b46d87..40271cea592 100644
--- a/gdb/dwarf2/read.c
+++ b/gdb/dwarf2/read.c
@@ -16628,23 +16628,28 @@ determine_prefix (struct die_info *die, struct dwarf2_cu *cu)
 	  }
 	return "";
       case DW_TAG_subprogram:
-	/* Nested subroutines in Fortran get a prefix with the name
-	   of the parent's subroutine.  Entry points are prefixed by the
-	   parent's namespace.  */
-	if (cu->lang () == language_fortran)
-	  {
-	    if ((die->tag ==  DW_TAG_subprogram)
-		&& (dwarf2_name (parent, cu) != NULL))
-	      return dwarf2_name (parent, cu);
-	    else if (die->tag == DW_TAG_entry_point)
-	      return determine_prefix (parent, cu);
-	  }
-	else if (cu->lang () == language_ada
-		 && (die->tag == DW_TAG_subprogram
-		     || die->tag == DW_TAG_inlined_subroutine
-		     || die->tag == DW_TAG_lexical_block))
-	  return dwarf2_full_name (nullptr, parent, cu);
-	return "";
+	{
+	  const char *name = nullptr;
+	  /* Nested subroutines in Fortran get a prefix with the name
+	     of the parent's subroutine.  Entry points are prefixed by the
+	     parent's namespace.  */
+	  if (cu->lang () == language_fortran)
+	    {
+	      if ((die->tag ==  DW_TAG_subprogram)
+		  && (dwarf2_name (parent, cu) != NULL))
+		name = dwarf2_name (parent, cu);
+	      else if (die->tag == DW_TAG_entry_point)
+		name = determine_prefix (parent, cu);
+	    }
+	  else if (cu->lang () == language_ada
+		   && (die->tag == DW_TAG_subprogram
+		       || die->tag == DW_TAG_inlined_subroutine
+		       || die->tag == DW_TAG_lexical_block))
+	    name = dwarf2_full_name (nullptr, parent, cu);
+	  if (name == nullptr)
+	    name = "";
+	  return name;
+	}
       case DW_TAG_enumeration_type:
 	parent_type = read_type_die (parent, cu);
 	if (parent_type->is_declared_class ())

base-commit: f797b25fdc7ca4a48c09802082426b71e56898aa
-- 
2.53.0

Re: [PATCH] Avoid crash in dwarf2/read.c:determine_prefix

[Simon Marchi]

On 2026-04-23 14:52, Tom Tromey wrote:
> I found a gdb crash when using some changes to gnat-llvm to have it
> emit unqualified names in the DWARF.  The crash happens because
> determine_prefix does this:
> 
> 	  return dwarf2_full_name (nullptr, parent, cu);
> 
> However, dwarf2_full_name can return NULL, causing a crash in the
> caller.
> 
> The particular DWARF causing this is pretty strange -- it is a
> function nested inside another nameless function.  This may be a bug
> in gnat-llvm, something I plan to investigate.
> 
> Meanwhile, gdb shouldn't crash.  This patch changes determine_prefix
> to avoid possible crashes here, by following its contract and not
> returning NULL.
> 
> I'm not sure if it's worthwhile to write a test case for this.

Seems fine.  Did you go around and check if other calls to
dwarf2_full_name handled nullptr correctly?  Most of them do, but others
seem like they would have a problem if dwarf2_full_name returned
nullptr.  Or perhaps if in some cases we can prove that dwarf2_full_name
can't return nullptr, then we could use a gdb_assert.

Approved-By: Simon Marchi <simon.marchi@efficios.com>

Simon

Re: [PATCH] Avoid crash in dwarf2/read.c:determine_prefix

[Tom Tromey]

>>>>> "Simon" == Simon Marchi <simark@simark.ca> writes:

Simon> On 2026-04-23 14:52, Tom Tromey wrote:
>> I found a gdb crash when using some changes to gnat-llvm to have it
>> emit unqualified names in the DWARF.  The crash happens because
>> determine_prefix does this:
>> 
>> return dwarf2_full_name (nullptr, parent, cu);
>> 
>> However, dwarf2_full_name can return NULL, causing a crash in the
>> caller.
>> 
>> The particular DWARF causing this is pretty strange -- it is a
>> function nested inside another nameless function.  This may be a bug
>> in gnat-llvm, something I plan to investigate.
>> 
>> Meanwhile, gdb shouldn't crash.  This patch changes determine_prefix
>> to avoid possible crashes here, by following its contract and not
>> returning NULL.
>> 
>> I'm not sure if it's worthwhile to write a test case for this.

Simon> Seems fine.  Did you go around and check if other calls to
Simon> dwarf2_full_name handled nullptr correctly?  Most of them do, but others
Simon> seem like they would have a problem if dwarf2_full_name returned
Simon> nullptr.  Or perhaps if in some cases we can prove that dwarf2_full_name
Simon> can't return nullptr, then we could use a gdb_assert.

I didn't generally look.  Looking now though they generally seem fine.

Really what we should do is rewrite all the name computation code.  It's
overly convoluted and confusing, and the cooked indexer proved that a
lot of the hair isn't needed.

Tom