Re: [libunwind] libunwind segv with gcc 2.96 programs run on Redhat EL 3 with GLIBC 2.3.2

[David Mosberger]

Hi Jerry,

>>>>> On Wed, 4 Feb 2004 11:28:13 -0500, "Harrow, Jerry" <address@hidden> said:

  Jerry> My project has been using libunwind to trace the stack at
  Jerry> event points within a process.  When testing with the new
  Jerry> Redhat EL V3 on Itanium (glibc 2.3.2) we started to see a
  Jerry> segv from libunwind when attempting to unwind through main().

  Jerry> [snip...]

  Jerry> If the main program has been built on RH AS 2.1 (with gcc
  Jerry> 2.96), and we attempt to unwind past main() we get a segv.

Thanks for providing a test-case that reproduces the problem.  I
looked into it and it turns out it's a stupid typo in libunwind.  The
attached patch should fix it.  Well, I only tried it on your test-case
so far, and that one no longer seg-faults.  The problem was caused by
the fact that the register containing the call-chain-terminating
NULL-pointer got spilled into memory and the bug had the effect that
the NaT-bit info overwrote the register-value info and that led to the
crash.

What this points out is that I finally need to add some explicit
test-cases that check for the correct handling of the various NaT-bit
cases.  Clearly the whitebox-testing so far doesn't cover these cases
sufficiently.

Note that this affects pretty much all interesting versions of
libunwind.  So if you're shipping older versions of libunwind, it's
probably worthwhile to update those with the attached patch.

Jerry, just to be clear: even so, libunwind doesn't (and really
cannot) guarantee that local unwinding with bad unwind info won't
cause a crash (remote unwinding doesn't have this issue).  So if you
want to be super-safe, you may want to install a SIGSEGV handler.

        --david

===== src/ia64/Gscript-ia64.c 1.26 vs edited =====
--- 1.26/src/ia64/Gscript-ia64.c        Thu Jan 29 16:01:21 2004
+++ edited/src/ia64/Gscript-ia64.c      Fri Feb 13 16:31:21 2004
@@ -288,7 +288,7 @@
       return;
     }
   insn.opc = opc;
-  insn.dst = i;
+  insn.dst = i + (UNW_IA64_NAT - UNW_IA64_GR);
   insn.val = val;
   script_emit (script, insn);
 }