dwarflint: ranges in .debug_loc vs. PCc claimed for containing DIE

[Petr Machata <pmachata at redhat dot com>]

I've implemented the test for $SUBJ, and am running into lots of 
violations that look genuine.  Current criteria are: for each attribute 
with loclist value (i.e. VS_location, .is_list holds) check that the 
address ranges of that location list form a subset of PC ranges of 
containing PC-ful DIE.

One violator is src/size form elfutils:

error: .debug_info: DIE 0x13c1: attribute `location': range [0x4014a6, 
0x401561) runs off DIE scope
error: .debug_info: DIE 0x13bc: DIE scope is: [4013d4, 40155a), [4018c0, 
4018cf), [401db6, 401e03)

DWARF section [29] '.debug_info' at offset 0x34c5:
  [Offset]
  Compilation unit at offset 0:
  Version: 2, Abbreviation section offset: 0, Address size: 8, Offset 
size: 4
  [     b]  compile_unit
            producer             "GNU C 4.4.1 20090725 (Red Hat 4.4.1-2)"
            language             ISO C99 (12)
            name                 "../../elfutils/src/size.c"
            comp_dir 
"/home/petr/proj/elfutils/dwarflint/build/src"
            low_pc               0x0000000000401050 <print_version>
            high_pc              0x0000000000402429
            stmt_list            0
  [  125b]    subprogram
              name                 "handle_elf"
              decl_file            1
              decl_line            667
              prototyped
              low_pc               0x0000000000401320 <handle_elf>
              high_pc              0x0000000000401ed0 <handle_ar>
              frame_base           location list [   320]
              sibling              [  16ae]
  [  1390]      inlined_subroutine
                abstract_origin      [  11a9]
                entry_pc             0x00000000004013d4 <handle_elf+0xb4>
                ranges               range list [   280]
                call_file            1
                call_line            692
                sibling              [  1439]
  [  13bc]        lexical_block
                  ranges               range list [   2c0]
  [  13c1]          variable
                    abstract_origin      [  11e7]
                    location             location list [   74c]

(In following, the values on the right match those on the left after 
adding CU's low_pc.)

DWARF section [34] '.debug_ranges' at offset 0x7771:
  [   2c0]  0x0000000000000384..0x000000000000050a 0x4013d4 0x40155a
            0x0000000000000d66..0x0000000000000db3 0x401db6 0x401e03
            0x0000000000000870..0x000000000000087f 0x4018c0 0x4018cf

DWARF section [33] '.debug_loc' at offset 0x6209:
  [   74c]  0x00000003d9..0x0000000456 [   0] reg13 0x401429 0x4014a6
            0x0000000456..0x0000000511 [   0] reg12 0x4014a6 0x401561
            0x0000000870..0x000000087f [   0] reg12 0x4018c0 0x4018cf
            0x0000000d66..0x0000000db3 [   0] reg13 0x401db6 0x401e03

So that all looks genuine--the ranges cited by dwarflint are all there 
and they really do run off of the PC space of DIE 13bc.  I don't see how 
to explain this other than by error of toolchain--if a variable is 
inside a lexical_block, it's range of validity should not leak out of 
that scope.

There are more violations like that.  I only examined a couple, total 
output has dozens of cases.

I guess I'll just document this on the wiki, dunno what more to do at 
this point.  Obviously, anyone is welcome to point out errors in my 
reasoning above.

How to handle these in the writer?  Should we correct this e.g. by 
trimming location ranges to their claimed PC scope?

Thanks,
PM