[Bug other/70517] c++filt crashes when demangling a symbol

[nathan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70517
Bug 70517 depends on bug 78252, which changed state.

Bug 78252 Summary: C++ demangler crashes with infinite recursion with lambda 
(auto)
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=78252

   What|Removed |Added

 Status|ASSIGNED|RESOLVED
 Resolution|--- |FIXED

[Bug other/70517] c++filt crashes when demangling a symbol

[mark at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70517

Mark Wielaard  changed:

   What|Removed |Added

 CC||mark at gcc dot gnu.org
 Depends on||78252

--- Comment #4 from Mark Wielaard  ---
This related to Bug 78252 - C++ demangler crashes with infinite recursion with
lambda (auto)

With the patch proposed for that bug there is no crash anymore and the symbols
demangle.

_ZSt4moveIRZN11tconcurrent6futureIvE4thenIZ5awaitIS2_EDaOT_EUlRKS6_E_EENS1_INSt5decayIDTclfp_defpTEEE4typeEEES7_EUlvE_EONSt16remove_referenceIS6_E4typeES7_

demangles to:

std::remove_reference tconcurrent::future::then >(tconcurrent::future&&)::{lambda(auto&&
const&)#1}>(auto await(tconcurrent::future&&)::{lambda(auto&& const&)#1}&&
const)::{lambda()#1}&>::type&&
std::move
tconcurrent::future::then
>(tconcurrent::future
tconcurrent::future::then
>(tconcurrent::future&&)::{lambda(auto&& const&)#1}>(auto
await(tconcurrent::future&&)::{lambda(auto&&
const&)#1}&& const)::{lambda()#1}&)::{lambda(auto&&
const&)#1}>(tconcurrent::future
tconcurrent::future::then
>(tconcurrent::future&&)::{lambda(auto&& const&)#1}>(auto
await(tconcurrent::future&&)::{lambda(auto&&
const&)#1}&& const)::{lambda()#1}&
const)::{lambda()#1}&>(tconcurrent::future tconcurrent::future::then >(tconcurrent::future&&)::{lambda(auto&&
const&)#1}>(auto await(tconcurrent::future&&)::{lambda(auto&& const&)#1}&&
const)::{lambda()#1}& const)

_Z4moveIRZ5awaitIRiEDaOT_EUlRKS3_E_ES4_S4_

demangles to:

auto await(int&)::{lambda(auto&& const&)#1}& const move(auto await(int&)::{lambda(auto&& const&)#1}&)::{lambda(auto&&
const&)#1}&>(auto await(int&)::{lambda(auto&& const&)#1}& const)

_Z4moveIRZ5awaitIRiEDaOT_EUlRKS2_E_ES3_S3_

demangles to:

auto await(int&)::{lambda(auto const&)#1}& move(auto
await(int&)::{lambda(auto const&)#1}&)::{lambda(auto const&)#1}&>(auto
await(int&)::{lambda(auto const&)#1}&)


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=78252
[Bug 78252] C++ demangler crashes with infinite recursion with lambda (auto)

[Bug other/70517] c++filt crashes when demangling a symbol

[blastrock at free dot fr]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70517

blastrock at free dot fr changed:

   What|Removed |Added

  Attachment #38165|0   |1
is obsolete||
  Attachment #38166|0   |1
is obsolete||

--- Comment #3 from blastrock at free dot fr ---
Created attachment 38418
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=38418=edit
Very small test case

I investigated this bug a little more and managed to produce a very small test
case.

Compile this file with g++ 5.3.1 and clang 3.8 and you will get these two
symbols:

_Z4moveIRZ5awaitIRiEDaOT_EUlRKS3_E_ES4_S4_ from clang
_Z4moveIRZ5awaitIRiEDaOT_EUlRKS2_E_ES3_S3_ from gcc

When trying c++filt on the one got from gcc, it will just fail demangling it
and print it raw. But when we do it with the one produced by clang, we get a
crash. The only difference I see there is the substitutions which are shifted
by one on the clang version (I have no idea which compiler is right though).

I enabled the debug stuff from the demangle binary in libiberty and got this (I
added the addresses of the nodes for debugging):

0x7fffd620: typed name
  0x7fffd5d8: template
0x7fffd410: name 'move'
0x7fffd5c0: template argument list
  0x7fffd5a8: reference
0x7fffd590: local name
  0x7fffd518: typed name
0x7fffd488: template
  0x7fffd428: name 'await'
  0x7fffd470: template argument list
0x7fffd458: reference
  0x7fffd440: builtin type int
0x7fffd500: function type
  0x7fffd4a0: name 'auto'
  0x7fffd4e8: argument list
0x7fffd4d0: rvalue reference
  0x7fffd4b8: template parameter 0
  0x7fffd578: lambda 0
0x7fffd560: argument list
  0x7fffd548: reference
0x7fffd530: const
  0x7fffd4d0: rvalue reference
0x7fffd4b8: template parameter 0
  0x7fffd608: function type
0x7fffd530: const
  0x7fffd4d0: rvalue reference
0x7fffd4b8: template parameter 0
0x7fffd5f0: argument list
  0x7fffd530: const
0x7fffd4d0: rvalue reference
  0x7fffd4b8: template parameter 0

What I understand is that when libiberty goes down the first branch, the
"template parameter 0" references this same branch and so we get infinite
recursion. I guess we can at least prevent the crash if we keep in the state a
variable saying which template parameter we are referencing so that we don't go
down the same path infinitely.

My (de)mangling skills are still very low and I don't think I can solve this
one alone. Any help is appreciated.

[Bug other/70517] c++filt crashes when demangling a symbol

[blastrock at free dot fr]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70517

--- Comment #2 from blastrock at free dot fr ---
Created attachment 38166
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=38166=edit
preprocessed file by gcc 5.3.1

[Bug other/70517] c++filt crashes when demangling a symbol

[blastrock at free dot fr]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70517

--- Comment #1 from blastrock at free dot fr ---
Created attachment 38165
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=38165=edit
preprocessed file by clang 3.8