[lldb-dev] Stackoverflow crash when evaluating an invalid expression

[Ben Ruthig via lldb-dev]

Hello all,

I am currently investigating an issue where LLDB is crashing due to a stack
overflow when attempting to evaluate an expression.  I have seen the same
issue in 6.0.1 and have reproduced it in 7.0.1.  Any help to diagnose and
fix would be greatly appreciated as I am trying to meet a release deadline
early next week!

The facts:
- The expression being evaluated is not a valid expression in the C++
domain. For example the expression is a datatype like 'Foobar'.  (For
reasons unexplained I am constrained to supporting this use case.)
- The crash occurs when using the C++ LLDB API but not when trying to
evaluate the expression via the LLDB shell or the LLDB Python script
shell.  However, when doing 'expr Foobar' there is no output and the
operation is completely silent.  It is similar when trying to do
'lldb.frame.EvaluateExpression("Foobar")'
in the Python shell as well.  I would expect to get some error output or an
SbValue in an error state but no such luck.
- I was able to capture a stack trace (attached) and it seems to be a
recursive loop bottoming out.  For brevity two 'loops' of stacktrace are
included here:

3387.  liblldb.dll!clang::ASTContext::getASTRecordLayout(const
clang::RecordDecl * D) Line 2965C++
3388.  liblldb.dll!`anonymous
namespace'::EmptySubobjectMap::ComputeEmptySubobjectSizes() Line 216C++
3389.  liblldb.dll!`anonymous
namespace'::EmptySubobjectMap::EmptySubobjectMap(const clang::ASTContext &
Context, const clang::CXXRecordDecl * Class) Line 172C++
3390.  liblldb.dll!clang::ASTContext::getASTRecordLayout(const
clang::RecordDecl * D) Line 2965C++
3391.  liblldb.dll!`anonymous
namespace'::EmptySubobjectMap::ComputeEmptySubobjectSizes() Line 216C++
3392.  liblldb.dll!`anonymous
namespace'::EmptySubobjectMap::EmptySubobjectMap(const clang::ASTContext &
Context, const clang::CXXRecordDecl * Class) Line 172C++
3393.  liblldb.dll!clang::ASTContext::getASTRecordLayout(const
clang::RecordDecl * D) Line 2965C++

Help please :S

Thanks,
Ben
...
3384.  liblldb.dll!clang::ASTContext::getASTRecordLayout(const 
clang::RecordDecl * D) Line 2965C++
3385.  liblldb.dll!`anonymous 
namespace'::EmptySubobjectMap::ComputeEmptySubobjectSizes() Line 216C++
3386.  liblldb.dll!`anonymous 
namespace'::EmptySubobjectMap::EmptySubobjectMap(const clang::ASTContext & 
Context, const clang::CXXRecordDecl * Class) Line 172C++
3387.  liblldb.dll!clang::ASTContext::getASTRecordLayout(const 
clang::RecordDecl * D) Line 2965C++
3388.  liblldb.dll!`anonymous 
namespace'::EmptySubobjectMap::ComputeEmptySubobjectSizes() Line 216C++
3389.  liblldb.dll!`anonymous 
namespace'::EmptySubobjectMap::EmptySubobjectMap(const clang::ASTContext & 
Context, const clang::CXXRecordDecl * Class) Line 172C++
3390.  liblldb.dll!clang::ASTContext::getASTRecordLayout(const 
clang::RecordDecl * D) Line 2965C++
3391.  liblldb.dll!`anonymous 
namespace'::EmptySubobjectMap::ComputeEmptySubobjectSizes() Line 216C++
3392.  liblldb.dll!`anonymous 
namespace'::EmptySubobjectMap::EmptySubobjectMap(const clang::ASTContext & 
Context, const clang::CXXRecordDecl * Class) Line 172C++
3393.  liblldb.dll!clang::ASTContext::getASTRecordLayout(const 
clang::RecordDecl * D) Line 2965C++
3394.  liblldb.dll!`anonymous 
namespace'::CGRecordLowering::CGRecordLowering(clang::CodeGen::CodeGenTypes & 
Types, const clang::RecordDecl * D, bool Packed) Line 220C++
3395.  liblldb.dll!clang::CodeGen::CodeGenTypes::ComputeRecordLayout(const 
clang::RecordDecl * D, llvm::StructType * Ty) Line 726C++
3396.  
liblldb.dll!clang::CodeGen::CodeGenTypes::ConvertRecordDeclType(const 
clang::RecordDecl * RD) Line 709C++
3397.  
liblldb.dll!clang::CodeGen::CodeGenTypes::ConvertRecordDeclType(const 
clang::RecordDecl * RD) Line 705C++
3398.  
liblldb.dll!clang::CodeGen::CodeGenTypes::ConvertType(clang::QualType T) Line 
390C++
3399.  
liblldb.dll!clang::CodeGen::CodeGenTypes::ConvertTypeForMem(clang::QualType T) 
Line 88C++
3400.  
liblldb.dll!clang::CodeGen::CodeGenTypes::ConvertType(clang::QualType T) Line 
518C++
3401.  liblldb.dll!`anonymous 
namespace'::X86_64ABIInfo::classifyArgumentType(clang::QualType Ty, unsigned 
int freeIntRegs, unsigned int & neededInt, unsigned int & neededSSE, bool 
isNamedArg) Line 3394C++
3402.  liblldb.dll!`anonymous 
namespace'::X86_64ABIInfo::computeInfo(clang::CodeGen::CGFunctionInfo & FI) 
Line 3591C++
3403.  
liblldb.dll!clang::CodeGen::CodeGenTypes::arrangeLLVMFunctionInfo(clang::CanQual
 resultType, bool instanceMethod, bool chainCall, 
llvm::ArrayRef > argTypes, 
clang::FunctionType::ExtInfo info, 
llvm::ArrayRef paramInfos, 
clang::CodeGen::RequiredArgs required) Line 769C++
3404.  liblldb.dll!arrangeLLVMFunctionInfo(clang::CodeGen::CodeGenTypes & 
CGT, bool instanceMethod, llvm::SmallVectorImpl > & 
prefix, clang::C

Re: [lldb-dev] Stackoverflow crash when evaluating an invalid expression

[Raphael Isemann via lldb-dev]

The most likely explanation is that we somehow build a Clang AST where
a class has it's itself as a base class or as a field type. Not sure
how that happened, but I assume something like CRTP could maybe
trigger such a bug.

Please break in `getASTRecordLayout` and run `D->dumpColor()` in two
different frames and post the output. Otherwise if you have a Release
build which you can modify, you can also add `D->dumpColor()` as the
first statement in clang::ASTContext::getASTRecordLayout (the file is
`llvm-project/clang/lib/AST/RecordLayoutBuilder.cpp:2965` ). This
should print the class which we presumably incorrectly reconstructed
and it's structure.

- Raphael

Am Do., 28. Feb. 2019 um 16:48 Uhr schrieb Ben Ruthig via lldb-dev
:
>
> Hello all,
>
> I am currently investigating an issue where LLDB is crashing due to a stack 
> overflow when attempting to evaluate an expression.  I have seen the same 
> issue in 6.0.1 and have reproduced it in 7.0.1.  Any help to diagnose and fix 
> would be greatly appreciated as I am trying to meet a release deadline early 
> next week!
>
> The facts:
> - The expression being evaluated is not a valid expression in the C++ domain. 
> For example the expression is a datatype like 'Foobar'.  (For reasons 
> unexplained I am constrained to supporting this use case.)
> - The crash occurs when using the C++ LLDB API but not when trying to 
> evaluate the expression via the LLDB shell or the LLDB Python script shell.  
> However, when doing 'expr Foobar' there is no output and the operation is 
> completely silent.  It is similar when trying to do 
> 'lldb.frame.EvaluateExpression("Foobar")' in the Python shell as well.  I 
> would expect to get some error output or an SbValue in an error state but no 
> such luck.
> - I was able to capture a stack trace (attached) and it seems to be a 
> recursive loop bottoming out.  For brevity two 'loops' of stacktrace are 
> included here:
>
> 3387.  liblldb.dll!clang::ASTContext::getASTRecordLayout(const 
> clang::RecordDecl * D) Line 2965C++
> 3388.  liblldb.dll!`anonymous 
> namespace'::EmptySubobjectMap::ComputeEmptySubobjectSizes() Line 216C++
> 3389.  liblldb.dll!`anonymous 
> namespace'::EmptySubobjectMap::EmptySubobjectMap(const clang::ASTContext & 
> Context, const clang::CXXRecordDecl * Class) Line 172C++
> 3390.  liblldb.dll!clang::ASTContext::getASTRecordLayout(const 
> clang::RecordDecl * D) Line 2965C++
> 3391.  liblldb.dll!`anonymous 
> namespace'::EmptySubobjectMap::ComputeEmptySubobjectSizes() Line 216C++
> 3392.  liblldb.dll!`anonymous 
> namespace'::EmptySubobjectMap::EmptySubobjectMap(const clang::ASTContext & 
> Context, const clang::CXXRecordDecl * Class) Line 172C++
> 3393.  liblldb.dll!clang::ASTContext::getASTRecordLayout(const 
> clang::RecordDecl * D) Line 2965C++
>
> Help please :S
>
> Thanks,
> Ben
> ___
> lldb-dev mailing list
> lldb-dev@lists.llvm.org
> https://lists.llvm.org/cgi-bin/mailman/listinfo/lldb-dev
___
lldb-dev mailing list
lldb-dev@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/lldb-dev