gdb: fix crash during command completion

In some cases GDB will fail when attempting to complete a command that
involves a rust symbol, the failure can manifest as a crash.

The problem is caused by the completion_match_for_lcd object being
left containing invalid data during calls to cp_symbol_name_matches_1.

The first question to address is why we are calling a C++ support
function when handling a rust symbol.  That's due to GDB's auto
language detection for msymbols, in some cases GDB can't tell if a
symbol is a rust symbol, or a C++ symbol.

The test application contains symbols for functions which are
statically linked in from various rust support libraries.  There's no
DWARF for these symbols, so all GDB has is the msymbols built from the
ELF symbol table.

Here's the problematic symbol that leads to our crash:

    mangled: _ZN4core3str21_$LT$impl$u20$str$GT$5parse17h5111d2d6a50d22bdE
  demangled: core::str::<impl str>::parse

As an msymbol this is initially created with language auto, then GDB
eventually calls symbol_find_demangled_name, which loops over all
languages calling language_defn::sniff_from_mangled_name, the first
language that can demangle the symbol gets assigned as the language
for that symbol.

Unfortunately, there's overlap in the mangled symbol names,
some (legacy) rust symbols can be demangled as both rust and C++, see
cplus_demangle in libiberty/cplus-dem.c where this is mentioned.

And so, because we check the C++ language before we check for rust,
then the msymbol is (incorrectly) given the C++ language.

Now it's true that is some cases we might be able to figure out that a
demangled symbol is not actually a valid C++ symbol, for example, in
our case, the construct '::<impl str>::' is not, I believe, valid in a
C++ symbol, we could look for ':<' and '>:' and refuse to accept this
as a C++ symbol.

However, I'm not sure it is always possible to tell that a demangled
symbol is rust or C++, so, I think, we have to accept that some times
we will get this language detection wrong.

If we accept that we can't fix the symbol language detection 100% of
the time, then we should make sure that GDB doesn't crash when it gets
the language wrong, that is what this commit addresses.

In our test case the user tries to complete a symbol name like this:

  (gdb) complete break pars

This results in GDB trying to find all symbols that match 'pars',
eventually we consider our problematic symbol, and we end up with a
call stack that looks like this:

  #0  0x0000000000f3c6bd in strncmp_iw_with_mode
  #1  0x0000000000706d8d in cp_symbol_name_matches_1
  #2  0x0000000000706fa4 in cp_symbol_name_matches
  #3  0x0000000000df3c45 in compare_symbol_name
  #4  0x0000000000df3c91 in completion_list_add_name
  #5  0x0000000000df3f1d in completion_list_add_msymbol
  #6  0x0000000000df4c94 in default_collect_symbol_completion_matches_break_on
  #7  0x0000000000658c08 in language_defn::collect_symbol_completion_matches
  #8  0x0000000000df54c9 in collect_symbol_completion_matches
  #9  0x00000000009d98fb in linespec_complete_function
  #10 0x00000000009d99f0 in complete_linespec_component
  #11 0x00000000009da200 in linespec_complete
  #12 0x00000000006e4132 in complete_address_and_linespec_locations
  #13 0x00000000006e4ac3 in location_completer

In cp_symbol_name_matches_1 we enter a loop, this loop repeatedly
tries to match the demangled problematic symbol name against the user
supplied text ('pars').  Each time around the loop another component
of the symbol name is stripped off, thus, we check 'pars' against
these options:

  core::str::<impl str>::parse
  str::<impl str>::parse
  <impl str>::parse
  parse

As soon as we get a match the cp_symbol_name_matches_1 exits its loop
and returns.  In our case, when we're looking for 'pars', the match
occurs on the last iteration of the loop, when we are comparing to
'parse'.

Now the problem here is that cp_symbol_name_matches_1 uses the
strncmp_iw_with_mode, and inside strncmp_iw_with_mode we allow for
skipping over template parameters.  This allows GDB to match the
symbol name 'foo<int>(int,int)' if the user supplies 'foo(int,'.
Inside strncmp_iw_with_mode GDB will record any template arguments
that it has skipped over inside the completion_match_for_lcd object
that is passed in as an argument.

And so, when GDB tries to match against '<impl str>::parse', the first
thing it sees is '<impl str>', GDB assumes this is a template argument
and records this as a skipped region within the
completion_match_for_lcd object.  After '<impl str>' GDB sees a ':'
character, which doesn't match with the 'pars' the user supplied, so
strncmp_iw_with_mode returns a value indicating a non-match.  GDB then
removes the '<impl str>' component from the symbol name and tries
again, this time comparing to 'parse', which does match.

Having found a match, then in cp_symbol_name_matches_1 we record the
match string, and the full symbol name within the
completion_match_result object, and return.

The problem here is that the skipped region, the '<impl str>' that we
recorded in the penultimate loop iteration was never discarded, its
still there in our returned result.

If we look at what the pointers held in the completion_match_result
that cp_symbol_name_matches_1 returns, this is what we see:

  core::str::<impl str>::parse
  |          \________/  |
  |               |      '--- completion match string
  |               '---skip range
  '--- full symbol name

When GDB calls completion_match_for_lcd::finish, GDB tries to create a
string using the completion match string (parse), but excluding the
skip range, as the stored skip range is before the start of the
completion match string, then GDB tries to do some weird string
creation, which will cause GDB to crash.

The reason we don't often see this problem in C++ is that for C++
symbols there is always some non-template text before the template
argument.  This non-template text means GDB is likely to either match
the symbol, or reject the symbol without storing a skip range.

However, notice, I did say, we don't often see this problem.  Once I
understood the issue, I was able to reproduce the crash using a pure
C++ example:

  template<typename S>
  struct foo
  {
    template<typename T>
    foo (int p1, T a)
    {
      s = 0;
    }

    S s;
  };

  int
  main ()
  {
    foo<int> obj (2.3, 0);
    return 0;
  }

Then in GDB:

  (gdb) complete break foo(int

The problem here is that the C++ symbol for the constructor looks like
this:

  foo<int>::foo<double>(int, double)

When GDB enters cp_symbol_name_matches_1 the symbols it examines are:

  foo<int>::foo<double>(int, double)
  foo<double>(int, double)

The first iteration of the loop will match the 'foo', then add the
'<int>' template argument will be added as a skip range.  When GDB
find the ':' after the '<int>' the first iteration of the loop fails
to match, GDB removes the 'foo<int>::' component, and starts the
second iteration of the loop.

Again, GDB matches the 'foo', and now adds '<double>' as a skip
region.  After that the '(int' successfully matches, and so the second
iteration of the loop succeeds, but, once again we left the '<int>' in
place as a skip region, even though this occurs before the start of
our match string, and this will cause GDB to crash.

This problem was reported to the mailing list, and a solution
discussed in this thread:

  https://sourceware.org/pipermail/gdb-patches/2023-January/195166.html

The solution proposed here is similar to one proposed by the original
bug reported, but implemented in a different location within GDB.
Instead of placing the fix in strncmp_iw_with_mode, I place the fix in
cp_symbol_name_matches_1.  I believe this is a better location as it
is this function that implements the loop, and it is this loop, which
repeatedly calls strncmp_iw_with_mode, that should be resetting the
result object state (I believe).

What I have done is add an assert to strncmp_iw_with_mode that the
incoming result object is empty.

I've also added some other asserts in related code, in
completion_match_for_lcd::mark_ignored_range, I make some basic
assertions about the incoming range pointers, and in
completion_match_for_lcd::finish I also make some assertions about how
the skip ranges relate to the match pointer.

There's two new tests.  The original rust example that was used in the
initial bug report, and a C++ test.  The rust example depends on which
symbols are pulled in from the rust libraries, so it is possible that,
at some future date, the problematic symbol will disappear from this
test program.  The C++ test should be more reliable, as this only
depends on symbols from within the C++ source code.

Since I originally posted this patch to the mailing list, the
following patch has been merged:

  commit 6e7eef72164c00d6a5a7b0bce9fa01f5481f33cb
  Date:   Sun Mar 19 09:13:10 2023 -0600

      Use rust_demangle to fix a crash

This solves the problem of a rust symbol ending up in the C++ specific
code by changing the order languages are sorted.  However, this new
commit doesn't address the issue in the C++ code which was fixed with
this commit.

Given that the C++ issue is real, and has a reproducer, I'm still
going to merge this fix.  I've left the discussion of rust in this
commit message as I originally wrote it, but it should be read within
the context of GDB prior to commit 6e7eef72164c00d6a5a7.

Co-Authored-By:  Zheng Zhan <zzlossdev@163.com>

2 files changed, 25 insertions, 0 deletions

diff --git a/gdb/testsuite/gdb.cp/cpcompletion.cc b/gdb/testsuite/gdb.cp/cpcompletion.cc
index 54ddaaf..b854d81 100644
--- a/gdb/testsuite/gdb.cp/cpcompletion.cc
+++ b/gdb/testsuite/gdb.cp/cpcompletion.cc
@@ -52,8 +52,31 @@ int qux;
 
 } /* namespace Test_NS */
 
+/* The important thing with class baz is that both the class and the
+   constructor must have a template argument, we need the symbol to look
+   like:
+
+   baz<TYPE_1>::baz<TYPE_2>(int,....whatever...)
+
+   It doesn't really matter if TYPE_1 and TYPE_2 are the same or different,
+   but we create them differently in this test as it makes debugging GDB
+   slightly easier.  */
+
+template<typename S>
+struct baz
+{
+  template<typename T>
+  baz (int p1, T a)
+  {
+    s = 0;
+  }
+
+  S s;
+};
+
 int main ()
 {
+  baz<int> obj (2.3, 0.1);
   // Anonymous struct with method.
   struct {
     int get() { return 5; }
diff --git a/gdb/testsuite/gdb.cp/cpcompletion.exp b/gdb/testsuite/gdb.cp/cpcompletion.exp
index 8c5c90b..5838a54 100644
--- a/gdb/testsuite/gdb.cp/cpcompletion.exp
+++ b/gdb/testsuite/gdb.cp/cpcompletion.exp
@@ -135,3 +135,5 @@ with_test_prefix "expression with namespace" {
     # Add a disambiguating character and we get a unique completion.
     test_gdb_complete_unique "p Test_NS::f" "p Test_NS::foo"
 }
+
+test_gdb_complete_unique "break baz(int" "break baz(int, double)"