Re: Crash free()ing unallocated memory.

[Paul Pluzhnikov <ppluzhnikov at google dot com>]

On Thu, Nov 6, 2008 at 10:40 AM, Tom Tromey <tromey@redhat.com> wrote:
>>>>>> "Paul" == Paul Pluzhnikov <ppluzhnikov@google.com> writes:
>
> I think we should add a new flag to pyty_type_object, and set the flag
> in clean_up_objfile_types.

I've just confirmed that clean_up_objfile_types() is never called
on the path to crash ...

So it is probably premature to fix this.

In addition, I rebuilt gdb-py with python2.6, and now it doesn't
hit the original problem (and Valgrind is happy), but instead hits
a new one :-(

  File "<string>", line 90, in printstdmap
  File "/home/ppluzhnikov/python2.6/lib/python2.6/encodings/__init__.py",
line 100, in search_function
    level=0)
  TypeError: SetupPathsAndImport() got an unexpected keyword argument 'level'

Where __init__.py reads:


def search_function(encoding):

    # Cache lookup
    entry = _cache.get(encoding, _unknown)
    if entry is not _unknown:
        return entry

    # Import the module:
    #
    # First try to find an alias for the normalized encoding
    # name and lookup the module using the aliased name, then try to
    # lookup the module using the standard import scheme, i.e. first
    # try in the encodings package, then at top-level.
    #
    norm_encoding = normalize_encoding(encoding)
    aliased_encoding = _aliases.get(norm_encoding) or \
                       _aliases.get(norm_encoding.replace('.', '_'))
    if aliased_encoding is not None:
        modnames = [aliased_encoding,
                    norm_encoding]
    else:
        modnames = [norm_encoding]
    for modname in modnames:
        if not modname or '.' in modname:
            continue
        try:
            # Import is absolute to prevent the possibly malicious import of a
            # module with side-effects that is not in the 'encodings' package.
            mod = __import__('encodings.' + modname, fromlist=_import_tail,
line 100 --->                level=0)


This doesn't make any sense to me :(
Complete stack trace is:

(top) bt
#0  PyErr_Format (exception=0xa1b480, format=0x91e990 "%.200s() got an
unexpected keyword argument '%.400s'") at Python/errors.c:533
#1  0x000000000073f31e in PyEval_EvalCodeEx (co=0xbd5bb0,
globals=0xbbfe40, locals=0x0, args=0xc3ba18, argcount=1, kws=0xc3ba20,
kwcount=2, defs=0xb31df8, defcount=3, closure=0x0) at
Python/ceval.c:2815
#2  0x0000000000741b8b in fast_function (func=0xbd4870,
pp_stack=0x7fffffffc6c0, n=5, na=1, nk=2) at Python/ceval.c:3775
#3  0x0000000000741866 in call_function (pp_stack=0x7fffffffc6c0,
oparg=513) at Python/ceval.c:3700
#4  0x000000000073db19 in PyEval_EvalFrameEx (f=0xc3b840, throwflag=0)
at Python/ceval.c:2370
#5  0x000000000073f9d0 in PyEval_EvalCodeEx (co=0xb39f30,
globals=0xc0c130, locals=0x0, args=0x15536368, argcount=1, kws=0x0,
kwcount=0, defs=0x0, defcount=0, closure=0x0) at Python/ceval.c:2942
#6  0x00000000007b5d24 in function_call (func=0xbc7a90,
arg=0x15536350, kw=0x0) at Objects/funcobject.c:524
#7  0x00000000006c0c99 in PyObject_Call (func=0xbc7a90,
arg=0x15536350, kw=0x0) at Objects/abstract.c:2487
#8  0x0000000000741026 in PyEval_CallObjectWithKeywords
(func=0xbc7a90, arg=0x15536350, kw=0x0) at Python/ceval.c:3548
#9  0x000000000074e273 in _PyCodec_Lookup (encoding=0x805ec0
"ISO-8859-1") at Python/codecs.c:147
#10 0x000000000074e4eb in codec_getitem (encoding=0x805ec0
"ISO-8859-1", index=1) at Python/codecs.c:211
#11 0x000000000074e763 in PyCodec_Decoder (encoding=0x805ec0
"ISO-8859-1") at Python/codecs.c:280
#12 0x000000000074ea66 in PyCodec_Decode (object=0xb6a1a50,
encoding=0x805ec0 "ISO-8859-1", errors=0x0) at Python/codecs.c:369
#13 0x000000000071f015 in PyUnicodeUCS2_Decode (
    s=0x1138dee0 "std::map<basic_string<char, std::char_traits<char>,
std::allocator<char> >...",
    size=363, encoding=0x805ec0 "ISO-8859-1", errors=0x0) at
Objects/unicodeobject.c:1149
#14 0x0000000000461e59 in typy_str (self=0x30ce510) at
../../gdb/python/python-type.c:252
#15 0x00000000006eb5b4 in _PyObject_Str (v=0x30ce510) at Objects/object.c:415
#16 0x00000000006eb6b6 in PyObject_Str (v=0x30ce510) at Objects/object.c:436
#17 0x0000000000700ec1 in string_new (type=0xa290c0, args=0x14fbf8a0,
kwds=0x0) at Objects/stringobject.c:4075
#18 0x0000000000708a34 in type_call (type=0xa290c0, args=0x14fbf8a0,
kwds=0x0) at Objects/typeobject.c:731
#19 0x00000000006c0c99 in PyObject_Call (func=0xa290c0,
arg=0x14fbf8a0, kw=0x0) at Objects/abstract.c:2487
#20 0x0000000000742006 in do_call (func=0xa290c0,
pp_stack=0x7fffffffcfb0, na=1, nk=0) at Python/ceval.c:3890
#21 0x000000000074187f in call_function (pp_stack=0x7fffffffcfb0,
oparg=1) at Python/ceval.c:3702
#22 0x000000000073db19 in PyEval_EvalFrameEx (f=0x14fbf670,
throwflag=0) at Python/ceval.c:2370
#23 0x000000000073f9d0 in PyEval_EvalCodeEx (co=0xd02140,
globals=0xb17dc0, locals=0x0, args=0xb6a1a38, argcount=1, kws=0x0,
kwcount=0, defs=0x0, defcount=0, closure=0x0) at Python/ceval.c:2942
#24 0x00000000007b5d24 in function_call (func=0xd041b0, arg=0xb6a1a20,
kw=0x0) at Objects/funcobject.c:524
#25 0x00000000006c0c99 in PyObject_Call (func=0xd041b0, arg=0xb6a1a20,
kw=0x0) at Objects/abstract.c:2487
#26 0x00000000006c1985 in PyObject_CallFunctionObjArgs
(callable=0xd041b0) at Objects/abstract.c:2718
#27 0x000000000045b466 in pretty_print_one_value (func=0xd041b0,
value=0x14696ac0, out_value=0x7fffffffd528, children=1) at
../../gdb/python/python.c:792
#28 0x000000000045b692 in apply_val_pretty_printer (type=0xeafc938,
valaddr=0xf828d50 "ïFF", embedded_offset=88, address=46912607798640,
stream=0xc58870, format=0, deref_ref=0, recurse=2,
pretty=Val_no_prettyprint, language=0x83c7c0)
    at ../../gdb/python/python.c:865
#29 0x00000000004a3ab5 in val_print (type=0xeafc938, valaddr=0xf828d50
"ïFF", embedded_offset=88, address=46912607798640, stream=0xc58870,
format=0, deref_ref=0, recurse=2, pretty=Val_no_prettyprint,
language=0x83c7c0)
    at ../../gdb/valprint.c:240
#30 0x000000000056bb64 in cp_print_value_fields (type=0xeb0aa50,
real_type=0xeb0aa50, valaddr=0xf828d50 "ïFF", offset=56,
address=46912607798608, stream=0xc58870, format=0, recurse=1,
pretty=Val_no_prettyprint, dont_print_vb=0x0,
    dont_print_statmem=0) at ../../gdb/cp-valprint.c:293
#31 0x000000000056a450 in c_val_print (type=0xeb0aa50,
valaddr=0xf828d50 "ïFF", embedded_offset=56, address=46912607798608,
stream=0xc58870, format=0, deref_ref=0, recurse=1,
pretty=Val_no_prettyprint) at ../../gdb/c-valprint.c:343
#32 0x00000000004a3b68 in val_print (type=0xeb0aa50, valaddr=0xf828d50
"ïFF", embedded_offset=56, address=46912607798608, stream=0xc58870,
format=0, deref_ref=0, recurse=1, pretty=Val_no_prettyprint,
language=0x83c7c0)
    at ../../gdb/valprint.c:255
#33 0x000000000056bb64 in cp_print_value_fields (type=0xeba7fc0,
real_type=0xeba7fc0, valaddr=0xf828d50 "ïFF", offset=0,
address=46912607798552, stream=0xc58870, format=0, recurse=0,
pretty=Val_no_prettyprint, dont_print_vb=0x0,
    dont_print_statmem=0) at ../../gdb/cp-valprint.c:293
#34 0x000000000056a450 in c_val_print (type=0xeba7fc0,
valaddr=0xf828d50 "ïFF", embedded_offset=0, address=46912607798552,
stream=0xc58870, format=0, deref_ref=1, recurse=0,
pretty=Val_no_prettyprint) at ../../gdb/c-valprint.c:343
#35 0x00000000004a3b68 in val_print (type=0xeba7fc0, valaddr=0xf828d50
"ïFF", embedded_offset=0, address=46912607798552, stream=0xc58870,
format=0, deref_ref=1, recurse=0, pretty=Val_pretty_default,
language=0x83c7c0)
    at ../../gdb/valprint.c:255
#36 0x000000000056b0b0 in c_value_print (val=0xf828ce0,
stream=0xc58870, format=0, pretty=Val_pretty_default) at
../../gdb/c-valprint.c:637
#37 0x00000000004a3df2 in value_print (val=0xf828ce0, stream=0xc58870,
format=0, raw=0, pretty=Val_pretty_default) at
../../gdb/valprint.c:350
#38 0x00000000004a63ed in print_formatted (val=0xf828ce0, format=0,
size=0, raw=0, stream=0xc58870) at ../../gdb/printcmd.c:314
#39 0x00000000004a746e in print_command_1 (exp=0xa831c2 "*this",
inspect=0, voidprint=1) at ../../gdb/printcmd.c:909
#40 0x00000000004a74e1 in print_command (exp=0xa831c2 "*this",
from_tty=0) at ../../gdb/printcmd.c:929
#41 0x0000000000449744 in do_cfunc (c=0xab12b0, args=0xa831c2 "*this",
from_tty=0) at ../../gdb/cli/cli-decode.c:60
#42 0x000000000044c19f in cmd_func (cmd=0xab12b0, args=0xa831c2
"*this", from_tty=0) at ../../gdb/cli/cli-decode.c:1669
#43 0x0000000000408114 in execute_command (p=0xa831c6 "s", from_tty=1)
at ../../gdb/top.c:457
#44 0x00000000004dcd5e in command_handler (command=0xa831c0 "p *this")
at ../../gdb/event-top.c:514
#45 0x00000000004dd41e in command_line_handler (rl=0x13eb1440
"ïïï\020") at ../../gdb/event-top.c:739
#46 0x00000000005c1a7d in rl_callback_read_char () at
../../readline/callback.c:205
#47 0x00000000004dc379 in rl_callback_read_char_wrapper
(client_data=0x0) at ../../gdb/event-top.c:178
#48 0x00000000004dcc24 in stdin_event_handler (error=0,
client_data=0x0) at ../../gdb/event-top.c:433
#49 0x00000000004db668 in handle_file_event (event_file_desc=0) at
../../gdb/event-loop.c:732
#50 0x00000000004dad03 in process_event () at ../../gdb/event-loop.c:341
#51 0x00000000004dad52 in gdb_do_one_event (data=0x0) at
../../gdb/event-loop.c:378
#52 0x00000000004d6dd1 in catch_errors (func=0x4dad18
<gdb_do_one_event>, func_args=0x0, errstring=0x7fb04b "", mask=6) at
../../gdb/exceptions.c:516
#53 0x0000000000467c50 in tui_command_loop (data=0x0) at
../../gdb/tui/tui-interp.c:153
#54 0x00000000004d73d8 in current_interp_command_loop () at
../../gdb/interps.c:290
#55 0x0000000000400369 in captured_command_loop (data=0x0) at
../../gdb/main.c:101
#56 0x00000000004d6dd1 in catch_errors (func=0x400358
<captured_command_loop>, func_args=0x0, errstring=0x7df8e2 "", mask=6)
at ../../gdb/exceptions.c:516
#57 0x00000000004015d5 in captured_main (data=0x7fffffffe5c0) at
../../gdb/main.c:885
#58 0x00000000004d6dd1 in catch_errors (func=0x40039b <captured_main>,
func_args=0x7fffffffe5c0, errstring=0x7df8e2 "", mask=6) at
../../gdb/exceptions.c:516
#59 0x0000000000401608 in gdb_main (args=0x7fffffffe5c0) at ../../gdb/main.c:895
#60 0x0000000000400354 in main (argc=2, argv=0x7fffffffe6b8) at
../../gdb/gdb.c:33

I did 'finish' from there, and all levels up to #27 returned NULL.

This problem trivially reproduces though:

1. Build gdb-py against python2.6
   My python was configured with '--disable-shared --without-threads
--without-pymalloc'
   in case it matters.

2. Compile this:

#include <vector>
int main()
{
   std::vector<int> v;
   return 0; // break here
}

3. Attempt 'print v' using Tom's pretty printers. Produces:

(gdb) p v
$2 = Traceback (most recent call last):
  File "<string>", line 12, in _format_children
  File "<string>", line 55, in children
  File "/home/ppluzhnikov/python2.6/lib/python2.6/encodings/__init__.py",
line 100, in search_function
    level=0)
TypeError: SetupPathsAndImport() got an unexpected keyword argument 'level'
Traceback (most recent call last):
  File "<string>", line 12, in _format_children
  File "<string>", line 55, in children
  File "/home/ppluzhnikov/python2.6/lib/python2.6/encodings/__init__.py",
line 100, in search_function
    level=0)
TypeError: SetupPathsAndImport() got an unexpected keyword argument 'level'
{<std::_Vector_base<int, std::allocator<int> >> = {_M_impl =
    {<std::allocator<int>> = {<__gnu_cxx::new_allocator<int>> = {<No
data fields>}, <No data fields>}, _M_start = 0x0, _M_finish = 0x0,
      _M_end_of_storage = 0x0}}, <No data fields>}
(gdb) q


-- 
Paul Pluzhnikov