Hi,
Some tests in gdb.threads/multiple-step-overs.exp fail on arm target
when the displaced stepping on, but they pass when displaced stepping
is off.
FAIL: gdb.threads/multiple-step-overs.exp: displaced=on: step: step
FAIL: gdb.threads/multiple-step-overs.exp: displaced=on: next: next
FAIL: gdb.threads/multiple-step-overs.exp: displaced=on: continue: continue
FAIL: gdb.threads/multiple-step-overs.exp: displaced=on: signal thr1: continue to sigusr1_handler
when displaced stepping is on,
Sending packet: $vCont;c#a8...infrun: infrun_async(1)^M <--- [1]
infrun: prepare_to_wait^M
infrun: target_wait (-1.0.0, status) =^M
infrun: -1.0.0 [Thread 0],^M
infrun: status->kind = ignore^M
infrun: TARGET_WAITKIND_IGNORE^M
infrun: prepare_to_wait^M
Packet received: T05swbreak:;0b:f8faffbe;0d:409ee7b6;0f:d0880000;thread:p635.636;core:0;^M
infrun: target_wait (-1.0.0, status) =^M
infrun: 1589.1590.0 [Thread 1590],^M
infrun: status->kind = stopped, signal = GDB_SIGNAL_TRAP^M
infrun: TARGET_WAITKIND_STOPPED^M
infrun: stop_pc = 0x88d0^M
infrun: context switch^M
infrun: Switching context from Thread 1591 to Thread 1590^
GDB resumes the whole process (all threads) rather than the specific
thread for which GDB wants to step over the breakpoint (as shown in [1]).
That is wrong because we resume a single thread and leave others stopped
when doing a normal step over where we temporarily remove the breakpoint,
single-step, reinsert the breakpoint, is that if we let other threads run
in the period while the breakpoint is removed, then these other threads
could miss the breakpoint. Since with displaced stepping, we don't ever
remove the breakpoint, it should be fine to let other threads run. However,
there's another reason that we should not let other threads run: that is
the case where some of those threads are also stopped for a breakpoint that
itself needs to be stepped over. If we just let those threads run, then
they immediately re-trap their breakpoint again.
when displaced stepping is off, GDB behaves correctly, only resumes
the specific thread (as shown in [2]).
Sending packet: $vCont;c:p611.613#b2...infrun: infrun_async(1)^M <-- [2]
infrun: prepare_to_wait^M
infrun: target_wait (-1.0.0, status) =^M
infrun: -1.0.0 [Thread 0],^M
infrun: status->kind = ignore^M
infrun: TARGET_WAITKIND_IGNORE^M
infrun: prepare_to_wait^M
Packet received: T05swbreak:;0b:f8faffbe;0d:409e67b6;0f:48880000;thread:p611.613;core:1;^M
infrun: target_wait (-1.0.0, status) =^M
infrun: 1553.1555.0 [Thread 1555],^M
infrun: status->kind = stopped, signal = GDB_SIGNAL_TRAP^M
infrun: TARGET_WAITKIND_STOPPED^M
infrun: clear_step_over_info^M
infrun: stop_pc = 0x8848
The current logic in GDB on deciding the set of threads to resume is:
/* Decide the set of threads to ask the target to resume. */
if ((step || thread_has_single_step_breakpoints_set (tp))
&& tp->control.trap_expected)
{
/* We're allowing a thread to run past a breakpoint it has
hit, by single-stepping the thread with the breakpoint
removed. In which case, we need to single-step only this
thread, and keep others stopped, as they can miss this
breakpoint if allowed to run. */
resume_ptid = inferior_ptid;
}
else
resume_ptid = internal_resume_ptid (user_step);
it doesn't handle the case correctly that GDB continue (instead of
single step) the thread for displaced stepping.
I also update the comment below to reflect the code. I remove the
"with the breakpoint removed" comment, because GDB doesn't remove
breakpoints in displaced stepping, so we don't have to worry that
other threads may miss the breakpoint.
Patch is regression tested on both x86_64-linux and arm-linux.
gdb:
2015-11-17 Yao Qi <yao.qi@linaro.org>
* infrun.c (resume): Check control.trap_expected only
when deciding the set of threads to resume.
We currently throw exceptions from signal handlers (e.g., for
Quit/ctrl-c). But throwing C++ exceptions from signal handlers is
undefined. (That doesn't restore signal masks, like siglongjmp does,
and, because asynchronous signals can arrive at any instruction, we'd
have to build _everything_ with -fasync-unwind-tables to make it
reliable.) It happens to work on x86_64 GNU/Linux at least, but it's
likely broken on other ports.
Until we stop throwing from signal handlers, use setjmp/longjmp based
exceptions in C++ mode as well.
gdb/ChangeLog:
2015-11-17 Pedro Alves <palves@redhat.com>
* common/common-exceptions.h (GDB_XCPT_SJMP, GDB_XCPT_TRY)
(GDB_XCPT_RAW_TRY, GDB_XCPT): Define.
Replace __cplusplus checks with GDB_XCPT checks throughout.
* common/common-exceptions.c: Replace __cplusplus checks with
GDB_XCPT checks throughout.
Cross building gdbserver for --host=x86_64-w64-mingw32 with gcc 4.8.4
20141219 (Fedora MinGW 4.8.4-1.fc20), I get:
src/gdb/gdbserver/tracepoint.c: In function 'cmd_qtdp':
src/gdb/gdbserver/tracepoint.c:2577:7: error: unknown conversion type character 'l' in format [-Werror=format=]
trace_debug ("Defined %stracepoint %d at 0x%s, "
^
src/gdb/gdbserver/tracepoint.c:2577:7: error: unknown conversion type character 'l' in format [-Werror=format=]
src/gdb/gdbserver/tracepoint.c:2577:7: error: too many arguments for format [-Werror=format-extra-args]
src/gdb/gdbserver/tracepoint.c: In function 'stop_tracing':
src/gdb/gdbserver/tracepoint.c:3447:7: error: unknown conversion type character 'l' in format [-Werror=format=]
trace_debug ("Stopping the trace because "
^
src/gdb/gdbserver/tracepoint.c:3447:7: error: too many arguments for format [-Werror=format-extra-args]
src/gdb/gdbserver/tracepoint.c: In function 'collect_data_at_tracepoint':
src/gdb/gdbserver/tracepoint.c:4651:3: error: unknown conversion type character 'l' in format [-Werror=format=]
trace_debug ("Making new traceframe for tracepoint %d at 0x%s, hit %" PRIu64,
^
src/gdb/gdbserver/tracepoint.c:4651:3: error: too many arguments for format [-Werror=format-extra-args]
src/gdb/gdbserver/tracepoint.c: In function 'collect_data_at_step':
src/gdb/gdbserver/tracepoint.c:4687:3: error: unknown conversion type character 'l' in format [-Werror=format=]
trace_debug ("Making new step traceframe for "
^
trace_debug is a macro that calls:
static void trace_vdebug (const char *, ...) ATTRIBUTE_PRINTF (1, 2);
The calls that fail checking use PRIu64, etc., like:
trace_debug ("Defined %stracepoint %d at 0x%s, "
"enabled %d step %" PRIu64 " pass %" PRIu64,
tpoint->type == fast_tracepoint ? "fast "
: tpoint->type == static_tracepoint ? "static " : "",
tpoint->number, paddress (tpoint->address), tpoint->enabled,
tpoint->step_count, tpoint->pass_count);
gnulib's stdio/printf module replacements may make %llu, etc. work on
mingw, instead of the MS-specific %I64u, and thus may make PRIu64
expand to %llu. However, gcc isn't aware of that, because libiberty's
ansidecl.h defines ATTRIBUTE_PRINTF as using attribute format(printf).
But, with that format, gcc checks for MS-style format strings (%I64u).
In order to have gcc expect gnu/standard formats, we need to use
gnu_printf format instead. Which version to use (printf/gnu_printf)
depends on msvcrt and mingw version, and so gnulib has a
configure-time check, and defines _GL_ATTRIBUTE_FORMAT_PRINTF
accordingly.
Since _GL_ATTRIBUTE_FORMAT_PRINTF is compatible with ATTRIBUTE_PRINTF,
the fix is simply to make use of the former.
gdb/ChangeLog:
2015-11-17 Pedro Alves <palves@redhat.com>
* common/common-defs.h (ATTRIBUTE_PRINTF): Redefine in terms of
_GL_ATTRIBUTE_FORMAT_PRINTF after including ansidecl.h.
With some toolchains, building in C++ mode stumbles on many instances
of:
In file included from ../../src/gdb/../include/splay-tree.h:43:0,
from ../../src/gdb/dcache.c:26:
build-gnulib/import/inttypes.h:61:3: error: #error "This file assumes that 'int' has exactly 32 bits. Please report your platform and compiler to <bug-gnulib@gnu.org>."
# error "This file assumes that 'int' has exactly 32 bits. Please report your platform and compiler to <bug-gnulib@gnu.org>."
^
make: *** [dcache.o] Error 1
That's:
#if !(INT_MIN == INT32_MIN && INT_MAX == INT32_MAX)
# error "This file assumes that 'int' has exactly 32 bits. Please report your platform and compiler to <bug-gnulib@gnu.org>."
#endif
I see it when cross building for --host=x86_64-w64-mingw32 using
Fedora 20's g++ (gcc version 4.8.4 20141219 (Fedora MinGW
4.8.4-1.fc20)), Simon reports seeing this on several cross compilers
too.
The issue is that on some hosts that predate C++11, when using C++ one
must define __STDC_CONSTANT_MACROS/__STDC_LIMIT_MACROS to make visible
the definitions of INTMAX_C / INTMAX_MAX etc.
This was a C99 requirement that later C++11 -- the first to define
stdint.h -- removed, and then C11 removed it as well.
https://www.gnu.org/software/gnulib/manual/html_node/stdint_002eh.html
says that gnulib's stdint.h fixes this, but because we run gnulib's
configure tests with a C compiler, gnulib determines that mingw's
stdint.h is C99-compliant, and doesn't actually replace it. Actually,
even though configuring gnulib with a C++ compiler does result in
gnulib replacing stdint.h, the resulting replacement is broken for
mingw, because it defines uintptr_t incorrectly. I sent a gnulib
patch upstream to fix that, here:
https://lists.gnu.org/archive/html/bug-gnulib/2015-11/msg00004.html
but then even with that, gnulib still stumbles on other
configured-with-C++-compiler problems.
So for now, until gnulib + C++ is fixed upstream and then gdb's copy
is updated, which may take a while, I think it's best to keep
configuring gnulib in C, and define
__STDC_LIMIT_MACROS/__STDC_CONSTANT_MACROS ourselves, just like C99
intended.
gdb/ChangeLog:
2015-11-17 Pedro Alves <palves@redhat.com>
* common/common-defs.h (__STDC_CONSTANT_MACROS)
(__STDC_LIMIT_MACROS): Define before including stdint.h.
Building in C++ errors out with:
../../src/gdb/windows-nat.c: In function 'int get_windows_debug_event(target_ops*, int, target_waitstatus*)':
../../src/gdb/windows-nat.c:1503:13: warning: invalid conversion from 'int' to 'gdb_signal' [-fpermissive]
last_sig = 1;
^
../../src/gdb/windows-nat.c:1533:43: warning: invalid conversion from 'int' to 'gdb_signal' [-fpermissive]
windows_resume (ops, minus_one_ptid, 0, 1);
^
../../src/gdb/windows-nat.c:1228:1: warning: initializing argument 4 of 'void windows_resume(target_ops*, ptid_t, int, gdb_signal)' [-fpermissive]
windows_resume (struct target_ops *ops,
^
Looking at the code, I can't figure out why we treat first chance
exceptions any different here.
AFAICS, we set last_sig to 1, and then call windows_resume passing
signal==1, so the DBG_EXCEPTION_NOT_HANDLED code path in win32_resume
is taken:
~~~
if (sig != GDB_SIGNAL_0)
{
if (current_event.dwDebugEventCode != EXCEPTION_DEBUG_EVENT)
{
OUTMSG (("Cannot continue with signal %d here.\n", sig));
}
else if (sig == last_sig)
continue_status = DBG_EXCEPTION_NOT_HANDLED;
else
OUTMSG (("Can only continue with recieved signal %d.\n", last_sig));
}
~~~
Fix this by removing this special casing. gdbserver also goes
straight to continuing with DBG_EXCEPTION_NOT_HANDLED, AFAICS.
gdb/ChangeLog:
2015-11-17 Pedro Alves <palves@redhat.com>
* windows-nat.c (handle_exception): Return 0 for first chance
exceptions.
(get_windows_debug_event): Adjust.
Building in C++ caught a buglet here:
../../../src/gdb/gdbserver/win32-low.c: In function 'void win32_resume(thread_resume*, size_t)':
../../../src/gdb/gdbserver/win32-low.c:929:11: error: invalid conversion from 'int' to 'gdb_signal' [-fpermissive]
sig = resume_info[0].sig;
^
../../../src/gdb/gdbserver/win32-low.c:934:11: error: invalid conversion from 'int' to 'gdb_signal' [-fpermissive]
sig = 0;
^
Signals in the "struct thread_resume" structure are host signals, not
gdb signals. The current code happens to work because the only
signals that the Windows port supports have the same number as the gdb
equivalent (see handle_exception for the win32 exception -> gdb signal
mapping).
gdb/gdbserver/ChangeLog:
2015-11-17 Pedro Alves <palves@redhat.com>
* win32-low.c (win32_resume): Use gdb_signal_from_host,
GDB_SIGNAL_0 and gdb_signal_to_string.
Fixes:
../../src/gdb/windows-nat.c:287:11: error: invalid conversion from 'int' to 'gdb_signal' [-fpermissive]
{-1, -1}};
^
The signal number here doesn't really matter.
gdb/ChangeLog:
2015-11-17 Pedro Alves <palves@redhat.com>
* windows-nat.c (xslate): Use GDB_SIGNAL_UNKNOWN instead of -1 as
signal number for terminator.
Fixes:
../../../src/gdb/gdbserver/win32-low.c: In function 'int win32_kill(int)':
../../../src/gdb/gdbserver/win32-low.c:823:46: error: invalid conversion from 'int' to 'target_waitkind' [-fpermissive]
struct target_waitstatus our_status = { 0 };
^
handle_output_debug_string doesn't use the parameter for anything
(it's an output parameter in the gdb version), so just remove it.
gdb/gdbserver/ChangeLog:
2015-11-17 Pedro Alves <palves@redhat.com>
* win32-low.c (handle_output_debug_string): Remove parameter.
(win32_kill): Remove our_status local and adjust call to
handle_output_debug_string.
(get_child_debug_event): Adjust call to
handle_output_debug_string.
Fixes a set of errors like:
../../src/gdb/windows-nat.c: In function 'void _initialize_loadable()':
../../src/gdb/windows-nat.c:2778:30: error: invalid conversion from 'void*' to 'BOOL (*)(DWORD) {aka int (*)(long unsigned int)}' [-fpermissive]
DebugActiveProcessStop = (void *)
^
gdb/ChangeLog:
2015-11-17 Pedro Alves <palves@redhat.com>
* windows-nat.c (AdjustTokenPrivileges_ftype)
(DebugActiveProcessStop_ftype, DebugBreakProcess_ftype)
(DebugSetProcessKillOnExit_ftype, EnumProcessModules_ftype)
(GetCurrentConsoleFont_ftype, GetModuleInformation_ftype)
(LookupPrivilegeValueA_ftype, OpenProcessToken_ftype)
(GetConsoleFontSize_ftype): New typedefs.
(AdjustTokenPrivileges, DebugActiveProcessStop)
(DebugBreakProcess, DebugSetProcessKillOnExit, EnumProcessModules)
(GetConsoleFontSize, GetCurrentConsoleFont, GetModuleInformation)
(LookupPrivilegeValueA, OpenProcessToken, GetConsoleFontSize):
Adjust.
(GetModuleFileNameEx_ftype): New typedef.
(GetModuleFileNameEx): Use it.
(_initialize_loadable): Define GPA macro and use it.
c_string_type contains values meant to be OR'ed together (even though
some bits are mutually exclusive), so it makes sense to make it an
enum flags type.
gdb/ChangeLog:
2015-11-17 Simon Marchi <simon.marchi@ericsson.com>
* c-exp.y (exp): Adjust, change enum c_string_type to
c_string_type.
(parse_string_or_char): Likewise.
* c-lang.c (charset_for_string_type): Likewise.
(classify_type): Likewise.
(c_printchar): Likewise.
(c_printstr): Likewise.
(evaluate_subexp_c): Likewise. And change cast to enum
c_string_type_values.
* c-lang.h: Include "common/enum_flags.h".
(enum c_string_type): Rename to...
(enum c_string_type_values): ...this.
(c_string_type): Define new enum flags type.
This patch fixes C++ build errors like this:
/home/pedro/gdb/mygit/cxx-convertion/src/gdb/linux-tdep.c:1126:35: error: invalid conversion from ‘int’ to ‘filterflags’ [-fpermissive]
| COREFILTER_HUGETLB_PRIVATE);
^
This is a case of enums used as bit flags. Unlike "regular" enums,
these values are supposed to be or'ed together. However, in C++, the
type of "(ENUM1 | ENUM2)" is int, and you then can't assign an int to
an enum variable without a cast. That means that this:
enum foo_flags flags = 0;
if (...)
flags |= FOO_FLAG1;
if (...)
flags |= FOO_FLAG2;
... would have to be written as:
enum foo_flags flags = (enum foo_flags) 0;
if (...)
flags = (enum foo_flags) (flags | FOO_FLAG1);
if (...)
flags = (enum foo_flags) (flags | FOO_FLAG2);
which is ... ugly. Alternatively, we'd have to use an int for the
variable's type, which isn't ideal either.
This patch instead adds an "enum flags" class. "enum flags" are
exactly the enums where the values are bits that are meant to be ORed
together.
This allows writing code like the below, while with raw enums this
would fail to compile without casts to enum type at the assignments to
'f':
enum some_flag
{
flag_val1 = 1 << 1,
flag_val2 = 1 << 2,
flag_val3 = 1 << 3,
flag_val4 = 1 << 4,
};
DEF_ENUM_FLAGS_TYPE(enum some_flag, some_flags)
some_flags f = flag_val1 | flag_val2;
f |= flag_val3;
It's also possible to assign literal zero to an enum flags variable
(meaning, no flags), dispensing either adding an awkward explicit "no
value" value to the enumeration or the cast to assignments from 0.
For example:
some_flags f = 0;
f |= flag_val3 | flag_val4;
Note that literal integers other than zero do fail to compile:
some_flags f = 1; // error
C is still supported -- DEF_ENUM_FLAGS_TYPE is just a typedef in that
case.
gdb/ChangeLog:
2015-11-17 Pedro Alves <palves@redhat.com>
* btrace.h: Include common/enum-flags.h.
(btrace_insn_flags): Define.
(struct btrace_insn) <flags>: Change type.
(btrace_function_flags): Define.
(struct btrace_function) <flags>: Change type.
(btrace_thread_flags): Define.
(struct btrace_thread_info) <flags>: Change type.
* c-exp.y (token_flags): Rename to ...
(token_flag): ... this.
(token_flags): Define.
(struct token) <flags>: Change type.
* common/enum-flags.h: New file.
* compile/compile-c-types.c (convert_qualified): Change type of
'quals' local.
* compile/compile-internal.h: Include "common/enum-flags.h".
(gcc_qualifiers_flags): Define.
* completer.c (enum reg_completer_targets): Rename to ...
(enum reg_completer_target): ... this.
(reg_completer_targets): Define.
(reg_or_group_completer_1): Change type of 'targets' parameter.
* disasm.c (do_mixed_source_and_assembly_deprecated): Change type
of 'psl_flags' local.
(do_mixed_source_and_assembly): Change type of 'psl_flags' local.
* infrun.c: Include "common/enum-flags.h".
(enum step_over_what): Rename to ...
(enum step_over_what_flag): ... this.
(step_over_what): Change type.
(start_step_over): Change type of 'step_what' local.
(thread_still_needs_step_over): Now returns a step_over_what.
Adjust.
(keep_going_pass_signal): Change type of 'step_what' local.
* linux-tdep.c: Include "common/enum-flags.h".
(enum filterflags): Rename to ...
(enum filter_flag): ... this.
(filter_flags): Define.
(dump_mapping_p): Change type of 'filterflags' parameter.
(linux_find_memory_regions_full): Change type of 'filterflags'
local.
(linux_find_memory_regions_full): Pass the address of an unsigned
int to sscanf instead of the address of an enum.
* record-btrace.c (btrace_print_lines): Change type of local
'psl_flags'.
(btrace_call_history): Replace 'flags' parameter
with 'int_flags' parameter. Adjust.
(record_btrace_call_history, record_btrace_call_history_range)
(record_btrace_call_history_from): Rename 'flags' parameter to
'int_flags'. Use record_print_flags.
* record.h: Include "common/enum-flags.h".
(record_print_flags): Define.
* source.c: Include "common/enum-flags.h".
(print_source_lines_base, print_source_lines): Change type of
flags parameter.
* symtab.h: Include "common/enum-flags.h".
(enum print_source_lines_flags): Rename to ...
(enum print_source_lines_flag): ... this.
(print_source_lines_flags): Define.
(print_source_lines): Change prototype.
Instead of adding a cast at the memory_error call, as needed for C++,
and have the reader understand the indirection, make it simple and
hardcode the generic memory error at the memory_error call site.
gdb/ChangeLog:
2015-11-17 Pedro Alves <palves@redhat.com>
* guile/scm-disasm.c (gdbscm_disasm_read_memory): Return -1 on
error instead of TARGET_XFER_E_IO.
(gdbscm_disasm_memory_error): Always pass TARGET_XFER_E_IO to
memory_error.
This patch fixes all occurences of left-shifting negative constants in C cod
which is undefined by the C standard.
gdb/testsuite/ChangeLog:
* lib/dwarf.exp (_note): Fix left shift of negative value.
* gdb.trace/trace-condition.exp: Likewise.
This patch fixes all occurences of left-shifting negative constants in C cod
which is undefined by the C standard.
gdb/ChangeLog:
* hppa-tdep.c (hppa_sign_extend, hppa_low_hppa_sign_extend)
(prologue_inst_adjust_sp, hppa_frame_cache): Fix left shift of negative
value.
* dwarf2read.c (read_subrange_type): Likewise.
This code tries to shift an integer 31 bits which triggers a werror:
gas/config/tc-microblaze.c:742:21: error: integer overflow in expression [-Werror=overflow]
e->X_add_number |= -(1 << 31);
Cast the 1 to offsetT to match X_add_number to fix things.
Hi,
I build GDB with -fsanitize=address, and run testsuite. In
gdb.base/callfuncs.exp, I see the following error,
p/c fun1()
=================================================================^M
==9601==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffee858530 at pc 0x6df079 bp 0x7fffee8583a0 sp 0x7fffee858398
WRITE of size 16 at 0x7fffee858530 thread T0
#0 0x6df078 in regcache_raw_read /home/yao/SourceCode/gnu/gdb/git/gdb/regcache.c:673
#1 0x6dfe1e in regcache_cooked_read /home/yao/SourceCode/gnu/gdb/git/gdb/regcache.c:751
#2 0x4696a3 in aarch64_extract_return_value /home/yao/SourceCode/gnu/gdb/git/gdb/aarch64-tdep.c:1708
#3 0x46ae57 in aarch64_return_value /home/yao/SourceCode/gnu/gdb/git/gdb/aarch64-tdep.c:1918
We are extracting return value from V registers (128 bit), but only
allocate X_REGISTER_SIZE-byte array, which isn't sufficient. This
patch changes the array to V_REGISTER_SIZE.
gdb:
2015-11-16 Yao Qi <yao.qi@linaro.org>
* aarch64-tdep.c (aarch64_extract_return_value): Change array
buf's length to V_REGISTER_SIZE.
This patch changes the last argument of functions pass_in_x_or_stack,
pass_in_v_or_stack, pass_on_stack, and pass_in_x to type value *.
gdb:
2015-11-16 Yao Qi <yao.qi@linaro.org>
* aarch64-tdep.c (pass_in_x_or_stack): Change argument type
from bfd_byte * to value *. Caller updated.
(pass_in_x): Likewise.
(pass_in_v_or_stack): Likewise.
(pass_on_stack): Likewise.
Both aarch64_push_dummy_call and bfin_push_dummy_call only use args[i]
contents but then never write to them, so that we can use
value_contents instead.
gdb:
2015-11-16 Yao Qi <yao.qi@linaro.org>
* aarch64-tdep.c (aarch64_push_dummy_call): Call value_contents instead
of value_contents_writeable.
* bfin-tdep.c (bfin_push_dummy_call): Likewise.
When I build GDB with -fsanitize=address, and run testsuite,
some gdb.base/*.exp test triggers the ERROR below,
=================================================================
==7646==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000242810 at pc 0x487844 bp 0x7fffe32e84e0 sp 0x7fffe32e84d8
READ of size 4 at 0x603000242810 thread T0
#0 0x487843 in push_stack_item /home/yao/SourceCode/gnu/gdb/git/gdb/arm-tdep.c:3405
#1 0x48998a in arm_push_dummy_call /home/yao/SourceCode/gnu/gdb/git/gdb/arm-tdep.c:3960
In that path, GDB passes value on stack, in an INT_REGISTER_SIZE slot,
but the value contents' length can be less than INT_REGISTER_SIZE, so
the contents will be accessed out of the bound. This patch adds an
array buf[INT_REGISTER_SIZE], and copy val to buf before writing them
to stack.
gdb:
2015-11-16 Yao Qi <yao.qi@linaro.org>
* arm-tdep.c (arm_push_dummy_call): New array buf. Store regval
to buf. Pass buf instead of val to push_stack_item.
Now that all arches (for the most part) have moved over, move sim-stop.o,
sim-reason.o, and sim-reg.o to the common object list and out of all the
arch ports.
Now that we have access to the sim state everywhere, we can convert to
the common engine logic for overall processing. This frees us up from
tracking exception state ourselves.
The cr16 port has a lot of translation/offset logic baked into it, but
it all looks like copy & paste from the d10v port rather than something
the cr16 port wants.
By itself, this commit doesn't really change anything. It lays the
groundwork for using the cpu state in follow up commits, both for
engine state and for cpu state. Splitting things up this way so it
is easier to see how things have changed.
Now that we have access to the sim state everywhere, we can convert to
the common engine logic for overall processing. This frees us up from
tracking exception state ourselves.
By itself, this commit doesn't really change anything. It lays the
groundwork for using the cpu state in follow up commits, both for
engine state and for cpu state. Splitting things up this way so it
is easier to see how things have changed.
This avoids using global variables to hold the cpu state so we can
better integrate with the sim common code.
There's also a minor fix here where we move the pc register back into
the state that is accessible by the asints array. When it was pulled
out previously, the reg store/fetch functions broke, but no one really
noticed as the mcore gdb port was dropped a while back.
This is not entirely useful as mcore doesn't (yet) store its register
state in the cpu state, but it does allow for switching to the common
code for these functions.
Other than the nice advantage of all sims having to declare one fewer
common function, this also fixes leakage in pretty much every sim.
Many were not freeing any resources, and a few were inconsistent as
to the ones they did. Now we have a single module that takes care of
all the logic for us.
Most of the non-cgen based ones could be deleted outright. The cgen
ones required adding a callback to the arch-specific cleanup func.
The few that still have close callbacks are to manage their internal
state.
We do not convert erc32, m32c, ppc, rl78, or rx as they do not use
the common sim core.
