[Lldb-commits] [PATCH] D124957: When picking a row from an UnwindPlan on a mid-stack frame, decr pc to get within bounds of the CALL instruction

Wed May 4 18:23:28 PDT 2022

jasonmolenda added a comment.

Ah, I can't share the binary/corefile that led me to this issue but I can show what it looks like.  I have a function with a noreturn call, it's a crashing scenario where (as always) this is the most important bit to get right, to show the crash,

      0xfffffff02058d2c4 <+3404>: mov    x1, x19
      0xfffffff02058d2c8 <+3408>: bl     -0xfdf3b49dc              ; panic_with_thread_kernel_state 
  ->  0xfffffff02058d2cc <+3412>: mov    x0, x19
      0xfffffff02058d2d0 <+3416>: mov    x1, x24

and the unwind plan rules for these instructions look like

  row[115]: 3396: CFA=fp+16 => x5= <same> x8= <same> x19=[CFA-24] x20=[CFA-32] x21=[CFA-40] x22=[CFA-48] x23=[CFA-56] x24=[CFA-64] x25=[CFA-72] x26=[CFA-80] x27=[CFA-88] x28=[CFA-96] fp=[CFA-16] lr=[CFA-8] 
  row[116]: 3412: CFA=fp+16 => x19= <same> x20= <same> x21= <same> x22= <same> x23= <same> x24= <same> x25= <same> x26= <same> x27= <same> x28= <same> fp= <same> lr= <same> 
  row[117]: 3428: CFA=fp+16 => x8=[CFA-128] x19=[CFA-24] x20=[CFA-32] x21=[CFA-40] x22=[CFA-48] x23=[CFA-56] x24=[CFA-64] x25=[CFA-72] x26=[CFA-80] x27=[CFA-88] x28=[CFA-96] fp=[CFA-16] lr=[CFA-8] 

We're under the BL call here, and if we use

  row[115]: 3396: CFA=fp+16 => x5= <same> x8= <same> x19=[CFA-24] x20=[CFA-32] x21=[CFA-40] x22=[CFA-48] x23=[CFA-56] x24=[CFA-64] x25=[CFA-72] x26=[CFA-80] x27=[CFA-88] x28=[CFA-96] fp=[CFA-16] lr=[CFA-8] 

we'll walk the stack correctly.  But instead we're using the return address which has an unwind rule

  row[116]: 3412: CFA=fp+16 => x19= <same> x20= <same> x21= <same> x22= <same> x23= <same> x24= <same> x25= <same> x26= <same> x27= <same> x28= <same> fp= <same> lr= <same> 

(which is honestly real suspect in its own right and I'll be looking at what codepath lldb was following when it came up with that, it's a complex function and I don't have an opinion at first blush)

But the problem is obvious when you see this - the unwind state after a noreturn could be any old thing, and we can't use it reliably.

Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D124957/new/

https://reviews.llvm.org/D124957