aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2022-12-19sim: dv-core: add hw_detach_address method [PR sim/25211]Mike Frysinger2-13/+18
The core device has an attach address method as the root of the tree which calls out to the sim API. But it doesn't have a corresponding detach method which means we just crash if anything tries to detach itself from the core. In practice, the m68hc11 is the only model that actually tries to detach itself on the fly, so no one noticed earlier. With this in place, we can delete the existing detach code from the m68hc11 model since it defaults to "passthru" callback which will in turn call the dv-core detach, and they have the same behavior -- call the sim core API to detach from the address space. Bug: https://sourceware.org/PR25211
2022-12-19gprofng: PR29646 Various warningsVladimir Mezentsev10-13/+22
gprofng/ChangeLog 2022-12-19 Vladimir Mezentsev <vladimir.mezentsev@oracle.com> PR gprofng/29646 * common/core_pcbe.c: Fix missingReturn warning. * libcollector/iolib.c: Fix -Waddress warnings. * src/Settings.cc: Likewise. * src/checks.cc: Likewise. * libcollector/linetrace.c: Likewise. * libcollector/iotrace.c: Fix va_end_missing error. * libcollector/libcol_util.c: Fix uninitvar warning. * src/Command.cc: Fix arrayIndexOutOfBounds error. * src/Function.cc: Fix uninitStructMember warning. * src/ipc.cc: Fix -Wwrite-strings warnings.
2022-12-20Automatic date update in version.inGDB Administrator1-1/+1
2022-12-19Avoid compiler warning in dwarf-do-refreshTom Tromey2-1/+5
The Emacs 28 compiler warns about dwarf-mode.el: Warning (comp): dwarf-mode.el:180:32: Warning: Unused lexical argument `ignore' This is easily fixed by prepending "_" to the parameter's name. binutils/ChangeLog 2022-12-19 Tom Tromey <tromey@adacore.com> * dwarf-mode.el (dwarf-do-refresh): Avoid compiler warning.
2022-12-19Use bool in bpstatTom Tromey6-30/+31
This changes bpstat to use 'bool' rather than 'char', and updates the uses.
2022-12-19Use bool constants for value_print_optionsTom Tromey19-60/+60
This changes the uses of value_print_options to use 'true' and 'false' rather than integers.
2022-12-19Remove quick_symbol_functions::relocatedTom Tromey4-91/+4
quick_symbol_functions::relocated is only needed for psymtabs, and there it is only needed for Rust. However, because we've switched the DWARF reader away from psymtabs, this means there's no longer a need for this method at all.
2022-12-19Remove MI version 1Tom Tromey11-126/+11
MI version 1 is long since obsolete. Several years ago, I filed PR mi/23170 for this. I think it's finally time to remove this. Any users of MI 1 can and should upgrade to a newer version. Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=23170
2022-12-19Remove vestiges of MI version 0Tom Tromey1-27/+0
I found a few vestiges of MI version 0 in the test suite. This patch removes them.
2022-12-19Tidy PR29893 and PR29908 fixAlan Modra1-20/+4
PR 29893 PR 29908 * dwarf.c (display_debug_addr): Combine dwarf5 unit_length checks. Delete dead code.
2022-12-19gdb: fix command lookup in execute_command ()Jan Vrany1-6/+2
Commit b5661ff2 ("gdb: fix possible use-after-free when executing commands") used lookup_cmd_exact () to lookup command again after its execution to avoid possible use-after-free error. However this change broke test gdb.base/define.exp which defines a post-hook for subcommand ("target testsuite"). In this case, lookup_cmd_exact () returned NULL because there's no command 'testsuite' in top-level commands. This commit fixes this case by looking up the command again using the original command line via lookup_cmd (). Approved-By: Simon Marchi <simon.marchi@efficios.com>
2022-12-19Fix potential illegal memory accesses when parsing corrupt DWARF data.Nick Clifton2-0/+22
PR 29914 * dwarf.c (fetch_indexed_value): Fail if the section is not big enough to contain a header size field. (display_debug_addr): Fail if the computed address size is too big or too small.
2022-12-19New Romainian translation for the GOLD subdirectory.Nick Clifton2-0/+4279
2022-12-19gprofng/testsuite: skip Java test without JDKJan Beulich3-1/+5
There's no point in even trying the Java test when gprofng was built without Java support, and when the building of the constituents of the testcase also would fail. On such systems this converts the respective tests from "unresolved" to "unsupported", making the overall testsuite run no longer report failure just because of this.
2022-12-19gprofng/testsuite: eliminate bogus castsJan Beulich2-2/+2
Casting pointers to unsigned int is generally problematic and hence compilers tend to warn about such. While here they're used only in fprintf(), it still seems better to omit such casts, even if only to avoid setting bad precedents.
2022-12-19gprofng/testsuite: correct line continuation in endcases.cJan Beulich1-1/+1
A backslash used to indicate line continuation (in a macro definition here) is not supposed to be followed by blanks or other white space; the end-of-line indicator is to follow immediately.
2022-12-19gprofng/testsuite: correct names for signal handling testsJan Beulich1-2/+2
The signal handling tests spend most of their time in the signal handlers, and hence for profile output to match anything in program output, the respective name fields need to hold the handler function names. This converts both respective tests from "unresolved" to actually succeeding.
2022-12-19gprofng/testsuite: adjust linking of synprogJan Beulich1-1/+1
In order for so_syn.so and so_syx.so to be able to access the main program's "testtime" variable, that variable needs exposing in the dynamic symbol table. Since this is a test program only, do it the brute force way and simply expose all global symbols.
2022-12-19Arm: break gas dependency on libopcodesJan Beulich2-2/+2
gas doesn't use anything from libopcodes (anymore?) - suppress linking in that library.
2022-12-19x86: omit Cpu prefixes from opcode tableJan Beulich2-2220/+2238
These enumerators can be used in only one specific field, and hence the Cpu prefix isn't needed ther for disambiguation / name space separation.
2022-12-19Automatic date update in version.inGDB Administrator1-1/+1
2022-12-18Comment bfd_get_section_limit_octets and bfd_get_section_alloc_sizeAlan Modra4-13/+12
* bfd.c (bfd_get_section_limit_octets): Add comment. (bfd_get_section_alloc_size): Likewise. * libbfd.c (_bfd_generic_get_section_contents): Use bfd_get_section_limit_octets. * section.c (bfd_get_section_contents): Likewise. * bfd-in2.h: Regenerate.
2022-12-18ld bootstrap test in build dir with path containing symlinksAlan Modra1-1/+1
This allows the bootstrap test to run if you have a symlink somewhere in the build path directory. $ld depends on $base_dir which is set via tcl [pwd], collapsing the symlink like /usr/bin/pwd, while $objdir contains the symlink. * testsuite/ld-bootstrap/bootstrap.exp: Normalize paths when checking for ld build directory.
2022-12-18Update gdb/NEWS after GDB 13 branch creation.Joel Brobecker1-1/+3
This commit a new section for the next release branch, and renames the section of the current branch, now that it has been cut.
2022-12-18Bump version to 14.0.50.DATE-git.Joel Brobecker2-2/+2
Now that the GDB 13 branch has been created, this commit bumps the version number in gdb/version.in to 14.0.50.DATE-git For the record, the GDB 13 branch was created from commit 71c90666e601c511a5f495827ca9ba545e4cb463. Also, as a result of the version bump, the following changes have been made in gdb/testsuite: * gdb.base/default.exp: Change $_gdb_major to 14.
2022-12-18Automatic date update in version.ingdb-13-branchpointGDB Administrator1-1/+1
2022-12-17bfd_get_relocated_section_contents allow NULL data bufferAlan Modra18-51/+143
This patch removes the bfd_malloc in default_indirect_link_order and bfd_simple_get_relocated_section_contents, pushing the allocation down to bfd_get_relocated_section_contents. The idea is to make use of the allocation done with sanity checking in bfd_get_full_section_contents, which is called by bfd_generic_get_relocated_section_contents. Doing this exposed a bug in bfd_get_full_section_contents. With relaxation it is possible that an input section rawsize is different to the section size. In that case we want to use the larger of rawsize (the on-disk size for input sections) and size. * reloc.c (bfd_generic_get_relocated_section_contents), * reloc16.c (bfd_coff_reloc16_get_relocated_section_contents), * coff-alpha.c (alpha_ecoff_get_relocated_section_contents), * coff-sh.c (sh_coff_get_relocated_section_contents), * elf-m10200.c (mn10200_elf_get_relocated_section_contents), * elf-m10300.c (mn10300_elf_get_relocated_section_contents), * elf32-avr.c (elf32_avr_get_relocated_section_contents), * elf32-cr16.c (elf32_cr16_get_relocated_section_contents), * elf32-crx.c (elf32_crx_get_relocated_section_contents), * elf32-h8300.c (elf32_h8_get_relocated_section_contents), * elf32-nds32.c (nds32_elf_get_relocated_section_contents), * elf32-sh.c (sh_elf_get_relocated_section_contents), * elfxx-mips.c (_bfd_elf_mips_get_relocated_section_contents): Handle NULL data buffer. * bfd.c (bfd_get_section_alloc_size): New function. * bfd-in2.h: Regenerate. * compress.c (bfd_get_full_section_contents): Correct section malloc size. * linker.c (default_indirect_link_order): Don't malloc memory here before calling bfd_get_relocated_section_contents. * simple.c (bfd_simple_get_relocated_section_contents): Likewise.
2022-12-17asan: elf.c:12621:18: applying zero offset to null pointerAlan Modra1-1/+1
That's this line in elf_parse_notes: while (p < buf + size) * elf.c (_bfd_elf_make_section_from_shdr): Don't call elf_parse_notes when sh_size is zero.
2022-12-17Re: The problem with warning in elf_object_pAlan Modra9-75/+279
Commit 5aa0f10c424e added a per_xvec_warn array to provide support for warnings from elf_object_p (and a later patch for warnings from pe_bfd_object_p) to be cached and then only printed if the target matches. It was quite limited in the style of message supported, only one message could be printed, and didn't really meet the stated aim of only warning when a target matches: There are many other errors and warnings that can be emitted by functions called from elf_object_p. So this patch extends the error handler functions to support printing to a string buffer, extends per_xvec_warn to support multiple errors/ warnings, and hooks this all into bfd_check_format_matches. If bfd_check_format_matches succeeds then any errors/warnings are printed for the matching target. If bfd_check_format_matches fails either due to no match or to multiple matches and only one target vector produced errors, then those errors are printed. * bfd.c (MAX_ARGS): Define, use throughout. (print_func): New typedef. (_bfd_doprnt): Add new print param. Replace calls to fprintf with print. (PRINT_TYPE): Similarly. (error_handler_fprintf): Renamed from error_handler_internal. Use _bfd_get_error_program_name. Add fprintf arg. Move code setting up args.. (_bfd_doprnt_scan): ..to here. Add ap param. (struct buf_stream): New. (err_sprintf): New function. (error_handler_bfd): New static variable. (error_handler_sprintf): New function. (_bfd_set_error_handler_caching): New function. (_bfd_get_error_program_name): New function. * elfcode.h (elf_swap_shdr_in): Use _bfd_error_handler in warning messages. (elf_object_p): Likewise. * format.c (print_warnmsg): New function. (clear_warnmsg): Rewrite. (null_error_handler): New function. (bfd_check_format_matches): Ignore warnings from recursive calls checking first element of an archive. Use caching error handler otherwise. Print warnings on successful match, or when only one target has emitted warnings/errors. * peicode.h (pe_bfd_object_p): Use _bfd_error_handler in warning messages. * targets.c (per_xvec_warn): Change type of array elements. (struct per_xvec_message): New. (_bfd_per_xvec_warn): Rewrite. * Makefile.am (LIBBFD_H_FILES): Add bfd.c. * Makefile.in: Regenerate. * bfd-in2.h: Regenerate. * libbfd.h: Regenerate.
2022-12-16sframe: doc: update spec for the mangled-RA bit in FREIndu Bhagat1-2/+2
ChangeLog: * libsframe/doc/sframe-spec.texi
2022-12-16gas: sframe: testsuite: add testcase for .cfi_negate_ra_stateIndu Bhagat3-0/+39
Add a new test to check that .cfi_negate_ra_state on aarch64 is handled well (a non-empty SFrame section with valid SFrame FREs is generated). ChangeLog: * testsuite/gas/cfi-sframe/cfi-sframe-aarch64-2.d: New test. * testsuite/gas/cfi-sframe/cfi-sframe-aarch64-2.s: Likewise. * testsuite/gas/cfi-sframe/cfi-sframe.exp: Adjust the list accordingly.
2022-12-16objdump/readelf: sframe: emit marker for FREs with mangled RAIndu Bhagat1-2/+9
In the textual dump of the SFrame section, when an SFrame FRE recovers a mangled RA, use string "[s]" in the output to indicate that the return address is a signed (mangled) one. ChangeLog: * libsframe/sframe-dump.c (dump_sframe_func_with_fres): Postfix with "[s]" if RA is signed with authorization code.
2022-12-16libsframe: provide new access API for mangled RA bitIndu Bhagat2-0/+25
include/ChangeLog: * sframe-api.h (sframe_fre_get_ra_mangled_p): New declaration. ChangeLog: * libsframe/sframe.c (sframe_get_fre_ra_mangled_p): New definition. (sframe_fre_get_ra_mangled_p): New static function.
2022-12-16gas: sframe: add support for .cfi_negate_ra_stateIndu Bhagat5-41/+39
DW_CFA_AARCH64_negate_ra_state in aarch64 is multiplexed with DW_CFA_GNU_window_save in the DWARF format. Remove the common-empty-4 testcase because the generated SFrame section will not be be empty anymore. A relevant test will be added in a later commit. ChangeLog: * gas/gen-sframe.c (sframe_v1_set_fre_info): Add new argument for mangled_ra_p. (sframe_set_fre_info): Likewise. (output_sframe_row_entry): Handle mangled_ra_p. (sframe_row_entry_new): Reset mangled_ra_p. (sframe_row_entry_initialize): Initialize mangled_ra_p. (sframe_xlate_do_gnu_window_save): New definition. (sframe_do_cfi_insn): Handle DW_CFA_GNU_window_save. * gas/gen-sframe.h (struct sframe_row_entry): New member. (struct sframe_version_ops): Add a new argument for mangled_ra_p. * gas/testsuite/gas/cfi-sframe/cfi-sframe.exp: Remove test. * gas/testsuite/gas/cfi-sframe/common-empty-4.d: Removed. * gas/testsuite/gas/cfi-sframe/common-empty-4.s: Removed.
2022-12-16sframe.h: add support for .cfi_negate_ra_stateIndu Bhagat1-8/+15
Use the last remaining bit in the 'SFrame FRE info' word to store whether the RA is signed/unsigned with PAC authorization code: this bit is named as the "mangled RA" bit. This bit is still unused for x86-64. The behaviour of the mangled-RA info bit in SFrame format closely follows the behaviour of DW_CFA_AARCH64_negate_ra_state in DWARF. During unwinding, whenever an SFrame FRE with non-zero "mangled RA" bit is encountered, it means the upper bits of the return address contain Pointer Authentication code. The unwinder, hence, must use appropriate means to restore LR correctly in such cases. include/ChangeLog: * sframe.h (SFRAME_V1_FRE_INFO_UPDATE_MANGLED_RA_P): New macro. (SFRAME_V1_FRE_MANGLED_RA_P): Likewise.
2022-12-17Automatic date update in version.inGDB Administrator1-1/+1
2022-12-16Delay checking whether /proc/pid/mem is writable (PR gdb/29907)Pedro Alves1-3/+6
As of 1bcb0708f229 ("gdb/linux-nat: Check whether /proc/pid/mem is writable"), GDB checks if /proc/pid/mem is writable. This is done early at GDB startup, in order to get a consistent warning, instead of a warning that depends on whenever GDB writes to inferior memory. PR gdb/29907 points out that some build systems (like QEMU's, apparently) may call 'gdb --version' to check GDB's presence & its version on the system, and that Gentoo's build process has sandboxing which blocks the /proc/pid/mem access and thus GDB warns, which results in build fails. To help with that, this patch delays the /proc/pid/mem check until we start or attach to an inferior. Ends up potentially emiting a warning close where we already emit other ptrace- and /proc- related warnings, which just Feels Right. Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=29907 Change-Id: I5537653ecfbbe76a04ab035e40e59d09b4980763
2022-12-16Fix previous delta to allow for compilation on 32-bit systemsNick Clifton5-3/+60
2022-12-16[gdb/testsuite] Fix race in gdb.threads/detach-step-over.expTom de Vries1-8/+26
Once in a while I run into: ... FAIL: gdb.threads/detach-step-over.exp: \ breakpoint-condition-evaluation=host: target-non-stop=off: non-stop=off: \ displaced=off: iter 1: all threads running ... In can easily reproduce this by doing: ... # Wait a bit, to give time for the threads to hit the # breakpoint. - sleep 1 return true ... Fix this by counting the running threads in a loop, effectively allowing 10 seconds (instead of 1) for the threads to start running, but only sleeping if needed. Reduces total execution time from 1m27s to 56s. Tested on x86_64-linux.
2022-12-16gdb: fix crash when getting the value of a label symbolAndrew Burgess3-14/+103
When the source program contains a goto label, it turns out it's actually pretty hard for a user to find out more about that label. For example: (gdb) p some_label No symbol "some_label" in current context. (gdb) disassemble some_label No symbol "some_label" in current context. (gdb) x/10i some_label No symbol "some_label" in current context. (gdb) break some_label Breakpoint 2 at 0x401135: file /tmp/py-label-symbol-value.c, line 35. In all cases, some_label is a goto label within the current frame. Only placing a breakpoint on the label worked. This all seems a little strange to me, it feels like asking about a goto label would not be an unreasonable thing for a user to do. This commit doesn't fix any of the above issues, I mention them just to provide a little context for why the following issue has probably not been seen before. It turns out there is one way a user can access the symbol for a goto label, through the Python API: python frame = gdb.selected_frame() python frame_pc = frame.pc() python block = gdb.current_progspace().block_for_pc(frame_pc) python symbol,_ = gdb.lookup_symbol('some_label', block, gdb.SYMBOL_LABEL_DOMAIN) python print(str(symbol.value())) ../../src/gdb/findvar.c:204: internal-error: store_typed_address: Assertion `type->is_pointer_or_reference ()' failed. The problem is that label symbols are created using the builtin_core_addr type, which is a pure integer type. When GDB tries to fetch the value of a label symbol then we end up in findvar.c, in the function language_defn::read_var_value, in the LOC_LABEL case. From here store_typed_address is called to store the address of the label into a value object with builtin_core_addr type. The problem is that store_typed_address requires that the destination type be a pointer or reference, which the builtin_core_addr type is not. Now it's not clear what type a goto label address should have, but GCC has an extension that allows users to take the address of a goto label (using &&), in that case the result is of type 'void *'. I propose that when we convert the CORE_ADDR value to a GDB value object, we use builtin_func_ptr type instead of builtin_core_addr, this means the result will be of type 'void (*) ()'. The benefit of this approach is that when gdbarch_address_to_pointer is called the target type will be correctly identified as a pointer to code, which should mean any architecture specific adjustments are done correctly. We can then cast the new value to 'void *' type with a call to value_cast_pointer, this should not change the values bit representation, but will just update the type. After this asking for the value of a label symbol works just fine: (gdb) python print(str(symbol.value())) 0x401135 <main+35> And the type is maybe what we'd expect: (gdb) python print(str(symbol.value().type)) void *
2022-12-16gdb: convert linux-osdata.c from buffer to std::stringSimon Marchi1-139/+148
Replace the use of struct buffer in linux-osdata.c with std::string. There is no change in the logic, so there should be no user-visible change. Change-Id: I27f53165d401650bbd0bebe8ed88221e25545b3f Approved-By: Pedro Alves <pedro@palves.net>
2022-12-16gdbsupport: add string_xml_appendfSimon Marchi2-0/+115
Add a version of buffer_xml_printf (defined in gdbsupport/buffer.{c,h}) that appends to an std::string, rather than a struct buffer. Call it "string" rather than "buffer" since it operates on an std::string rather than a buffer. And call it "appendf" rather than "printf", since it appends to and does not replace the string's content. This mirrors string_appendf. Place the new version in gdbsupport/xml-utils.h. The code is a direct copy of buffer_xml_printf. The old version is going to disappear at some point, which is why I didn't do any effort to share code. Change-Id: I30e030627ab4970fd0b9eba3b7e8cec78fa561ba Approved-By: Pedro Alves <pedro@palves.net>
2022-12-16gdb: clean up some inefficient std::string usageAndrew Burgess2-3/+2
This commit: commit 53cf95c3389a3ecd97276d322e4a60fe3396a201 Date: Wed Dec 14 14:17:44 2022 +0000 gdb: make more use of make_target_connection_string Introduced a couple of inefficient uses of std::string, both of which are fixed in this commit. There should be no user visible changes after this commit. Approved-By: Simon Marchi <simon.marchi@efficios.com>
2022-12-16Fix a potential illegal memory access when parsing corrupt DWARF information.Nick Clifton2-1/+25
PR 29908 * dwarf.c (display_debug_addr): Check for corrupt header lengths.
2022-12-16gdb/testsuite: add test for Python commands redefining itselfJan Vrany1-0/+30
This commit adds a test that creates a Python command that redefines itself during its execution. This is to test use-after-free in execute_command (). This test needs run with ASan enabled in order to fail when it should. Approved-By: Simon Marchi <simon.marchi@efficios.com>
2022-12-16[aarch64] Fix removal of non-address bits for PAuthLuis Machado16-73/+314
PR gdb/28947 The address_significant gdbarch setting was introduced as a way to remove non-address bits from pointers, and it is specified by a constant. This constant represents the number of address bits in a pointer. Right now AArch64 is the only architecture that uses it, and 56 was a correct option so far. But if we are using Pointer Authentication (PAuth), we might use up to 2 bytes from the address space to store the required information. We could also have cases where we're using both PAuth and MTE. We could adjust the constant to 48 to cover those cases, but this doesn't cover the case where GDB needs to sign-extend kernel addresses after removal of the non-address bits. This has worked so far because bit 55 is used to select between kernel-space and user-space addresses. But trying to clear a range of bits crossing the bit 55 boundary requires the hook to be smarter. The following patch renames the gdbarch hook from significant_addr_bit to remove_non_address_bits and passes a pointer as opposed to the number of bits. The hook is now responsible for removing the required non-address bits and sign-extending the address if needed. While at it, make GDB and GDBServer share some more code for aarch64 and add a new arch-specific testcase gdb.arch/aarch64-non-address-bits.exp. Bug-url: https://sourceware.org/bugzilla/show_bug.cgi?id=28947 Approved-By: Simon Marchi <simon.marchi@efficios.com>
2022-12-16gas: restore Dwarf info generation after macro diagnostic adjustmentsJan Beulich6-5/+29
While 6fdb723799e2 ("gas: re-work line number tracking for macros and their expansions") was meant to leave generated Dwarf as is, it really didn't (and the testcase intended to catch that wasn't covering the case which broke). Its adjustment to buffer_and_nest() didn't go far enough, leading to the "linefile" directive inserted at the top to also be processed later in the PRĀ gas/16908 workaround (which clearly isn't intended - it's being put there for processing during macro expansion only). That unnoticed flaw in turn led me to work around it by a (suspicious to me already at the time) conditional in as_where().
2022-12-16x86: change representation of extension opcodeJan Beulich3-2286/+2288
Having a "None" field in the vast majority of entries is needlessly cluttering the overall table. Instead of this being a separate field, use a representation matching that of Intel SDM and AMD PM for the main use of the field: Append the value after a / as the separator.
2022-12-15gdbsupport: change xml_escape_text_append's parameter from pointer to referenceSimon Marchi5-12/+12
The passed in string can't be nullptr, it makes more sense to pass in a reference. Change-Id: Idc8bd38abe1d6d9b44aa227d7856956848c233b3
2022-12-15gdb: remove static buffer in command_line_inputSimon Marchi13-108/+102
[I sent this earlier today, but I don't see it in the archives. Resending it through a different computer / SMTP.] The use of the static buffer in command_line_input is becoming problematic, as explained here [1]. In short, with this patch [2] that attempt to fix a post-hook bug, when running gdb.base/commands.exp, we hit a case where we read a "define" command line from a script file using command_command_line_input. The command line is stored in command_line_input's static buffer. Inside the define command's execution, we read the lines inside the define using command_line_input, which overwrites the define command, in command_line_input's static buffer. After the execution of the define command, execute_command does a command look up to see if a post-hook is registered. For that, it uses a now stale pointer that used to point to the define command, in the static buffer, causing a use-after-free. Note that the pointer in execute_command points to the dynamically-allocated buffer help by the static buffer in command_line_input, not to the static object itself, hence why we see a use-after-free. Fix that by removing the static buffer. I initially changed command_line_input and other related functions to return an std::string, which is the obvious but naive solution. The thing is that some callees don't need to return an allocated string, so this this an unnecessary pessimization. I changed it to passing in a reference to an std::string buffer, which the callee can use if it needs to return dynamically-allocated content. It fills the buffer and returns a pointers to the C string inside. The callees that don't need to return dynamically-allocated content simply don't use it. So, it started with modifying command_line_input as described above, all the other changes derive directly from that. One slightly shady thing is in handle_line_of_input, where we now pass a pointer to an std::string's internal buffer to readline's history_value function, which takes a `char *`. I'm pretty sure that this function does not modify the input string, because I was able to change it (with enough massaging) to take a `const char *`. A subtle change is that we now clear a UI's line buffer using a SCOPE_EXIT in command_line_handler, after executing the command. This was previously done by this line in handle_line_of_input: /* We have a complete command line now. Prepare for the next command, but leave ownership of memory to the buffer . */ cmd_line_buffer->used_size = 0; I think the new way is clearer. [1] https://inbox.sourceware.org/gdb-patches/becb8438-81ef-8ad8-cc42-fcbfaea8cddd@simark.ca/ [2] https://inbox.sourceware.org/gdb-patches/20221213112241.621889-1-jan.vrany@labware.com/ Change-Id: I8fc89b1c69870c7fc7ad9c1705724bd493596300 Reviewed-By: Tom Tromey <tom@tromey.com>