[Bug gdb/34375] New: [gdb] typed DWARF ops accept non-base type DIEs

https://sourceware.org/bugzilla/show_bug.cgi?id=34375

            Bug ID: 34375
           Summary: [gdb] typed DWARF ops accept non-base type DIEs
           Product: gdb
           Version: HEAD
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: gdb
          Assignee: unassigned at sourceware dot org
          Reporter: firmiana402 at gmail dot com
  Target Milestone: ---

Is this an implementation/specification mismatch in GDB's DWARF
expression evaluator?

DWARF v5 describes the type operand of the typed expression operators
as a DIE that must be a "DW_TAG_base_type" entry.  This applies to
DW_OP_const_type, DW_OP_regval_type, DW_OP_deref_type, and to the
nonzero DIE-reference operand of DW_OP_convert and DW_OP_reinterpret.

GDB's own interface documents the same contract.  In
gdb/dwarf2/expr.h, get_base_type is declared as:

    /* Return the base type given by the indicated DIE at DIE_CU_OFF.
       This can throw an exception if the DIE is invalid or does not
       represent a base type.  */
    struct type *get_base_type (cu_offset die_cu_off);

However, the implementation in gdb/dwarf2/expr.c only resolves the
DIE to a struct type and checks for null:

    struct type *
    dwarf_expr_context::get_base_type (cu_offset die_cu_off)
    {
      if (this->m_per_cu == nullptr)
        return builtin_type (...)->builtin_int;

      struct type *result
        = dwarf2_get_die_type (die_cu_off, this->m_per_cu,
                               this->m_per_objfile);
      if (result == nullptr)
        error (_("Could not find type for operation"));

      return result;
    }

It does not check whether the referenced DIE's tag is
DW_TAG_base_type.  Therefore, a non-base type DIE that still resolves
to a GDB type can pass through this helper.  For example,
DW_TAG_pointer_type is clearly not a base type, and DW_TAG_typedef is
also not a DW_TAG_base_type even when its DW_AT_type eventually points
to one.

This means the typed-operator path accepts more DIE kinds than DWARF
v5 allows, and more than get_base_type's own comment says it should
accept.

I would appreciate others' thoughts on whether this should be tightened 
in the DWARF expression evaluator.

-- 
You are receiving this mail because:
You are on the CC list for the bug.