[Bug gdb/12623] New: Crashes on 'n' or 's' single stepping in'non-stop' mode.

["chris.hall at highwayman dot com" <sourceware-bugzilla at sourceware dot org>]

http://sourceware.org/bugzilla/show_bug.cgi?id=12623

           Summary: Crashes on 'n' or 's' single stepping in 'non-stop'
                    mode.
           Product: gdb
           Version: 7.2
            Status: NEW
          Severity: critical
          Priority: P2
         Component: gdb
        AssignedTo: unassigned@sourceware.org
        ReportedBy: chris.hall@highwayman.com


I am using gdb 7.2-14.fc14 to work on a large multi-threaded
application, in C, x86-64.  (AMD Phenom II X6 1090T)

I have .gdbinit, per the book:

  set target async 1
  set pagination off
  set non-stop on

When I step using 's' or 'n', as it leaves some subroutines I keep
getting SIGSEGV, such as:

  Program received signal SIGSEGV, Segmentation fault.
  signal_set (signo=Cannot access memory at address
0xffffffffffffff5c)
  at ...

When I 'disass' the current instruction is a leaveq.  Examining the
registers I observe that rbp is zero, which is clearly nonsense.

I found one instance which was repeatable, which happened to be before
any threads were started: if I 'ni' through a particular function, it
gets to the leaveq, and gets stuck there.  Each time I do ni, the rsp
and the rbp are updated by the repeated leaveq, until it goes bang.

So... this doesn't appear to be to do with multiple threads...
... here is a trivial test:

<<--test.c-----------------------------------------------
#include <stdio.h>
#include <stdlib.h>

static void
target(const char* message) {
    printf("%s ...BANG!\n", message) ;
}

int main(int argc, char* argv[]) {

    target("Light the blue touch paper") ;

    return 0 ;
}
------------------------------------------------------->>

Compiled by gcc 4.5.1 "-g -O0".

If I do "gdb test", stepping by "n":

<<-------------------------------------------------------
(gdb) show non-stop
Controlling the inferior in non-stop mode is on.
(gdb) b target
Breakpoint 1 at 0x4004d0: file test.c, line 6.
(gdb) run
Starting program: ...........test 

Breakpoint 1, target (message=0x400615 "Light the blue touch paper")
at test.c:6
6        printf("%s ...BANG!\n", message) ;
(gdb) n
Light the blue touch paper ...BANG!
7    }
(gdb) n

Program received signal SIGSEGV, Segmentation fault.
target (message=Cannot access memory at address 0xfffffffffffffff8
) at test.c:7
7    }
(gdb) info reg
....
rbp   0x0             0x0
rsp   0x7fffffffe248    0x7fffffffe248
....
rip   0x4004e9        0x4004e9     <target+37>
....
------------------------------------------------------->>

Or, stepping by 'ni':

<<-------------------------------------------------------
(gdb) show non-stop
Controlling the inferior in non-stop mode is on.
(gdb) b target
Breakpoint 1 at 0x4004d0: file test.c, line 6.
(gdb) disass target
Dump of assembler code for function target:
   0x00000000004004c4 <+0>:    push   %rbp
   0x00000000004004c5 <+1>:    mov    %rsp,%rbp
   0x00000000004004c8 <+4>:    sub    $0x10,%rsp
   0x00000000004004cc <+8>:    mov    %rdi,-0x8(%rbp)
   0x00000000004004d0 <+12>:    mov    $0x400608,%eax
   0x00000000004004d5 <+17>:    mov    -0x8(%rbp),%rdx
   0x00000000004004d9 <+21>:    mov    %rdx,%rsi
   0x00000000004004dc <+24>:    mov    %rax,%rdi
   0x00000000004004df <+27>:    mov    $0x0,%eax
   0x00000000004004e4 <+32>:    callq  0x4003b8 <printf@plt>
   0x00000000004004e9 <+37>:    leaveq 
   0x00000000004004ea <+38>:    retq   
End of assembler dump.
(gdb) disp/i $pc
(gdb) run
Starting program: .......test 

Breakpoint 1, target (message=0x400615 "Light the blue touch paper")
at test.c:6
6        printf("%s ...BANG!\n", message) ;
.....
1: x/i $pc
=> 0x4004e4 <target+32>:    callq  0x4003b8 <printf@plt>
(gdb) ni
Light the blue touch paper ...BANG!
7    }
1: x/i $pc
=> 0x4004e9 <target+37>:    leaveq 
(gdb) ni
target (message=0x100000000 <Address 0x100000000 out of bounds>) at
test.c:7
7    }
1: x/i $pc
=> 0x4004e9 <target+37>:    leaveq 
(gdb) ni
Cannot access memory at address 0x8
(gdb) ni
The program is not being run.
------------------------------------------------------->>

I note that if I turn off the "non-stop" option, it works.  So this is
something to do with debugging multi-threaded !

I note also that if I change the target to:

  static int
  target(const char* message) {
          printf("%s ...BANG!\n", message) ;
          return 0 ;
  }

the problem goes away... so one extra instruction between the callq
and the leaveq makes a difference:

   0x00000000004004dc <+24>:    mov    %rax,%rdi
   0x00000000004004df <+27>:    mov    $0x0,%eax
   0x00000000004004e4 <+32>:    callq  0x4003b8 <printf@plt>
   0x00000000004004e9 <+37>:    mov    $0x0,%eax
   0x00000000004004ee <+42>:    leaveq 
   0x00000000004004ef <+43>:    retq

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.