Bug#858798: Wrong debug line numbers from g++ with varargs function

[Felix Dreissig <f30@f30.me>]

Package: g++
Version: 4:6.3.0-1
Severity: normal

Dear maintainers,

I observed some unexpected behavior with g++ (4:6.3.0-1) and GDB (7.12-6) on Stretch:

Please have a look at the attached source file, which is the minimal example I
could come up with to demonstrate the issue.

We compile it (I tested on AMD64 with and without `-m32`, which made no
difference):

  g++ -std=c++11 -Wall -Wextra -Wno-unused-but-set-variable -Wno-unused-parameter -O0 -g -o demo demo.cc

… and execute it with GDB. Now we set a breakpoint on `func()`:

  (gdb) b func
  Breakpoint 1 at 0xa63: file demo.cc, line 20.

This already seems strange, as line 20 clearly is the `return` statement of
`func()` and not its begin!
But let's see what actually is at address 0xa63:

  (gdb) disassemble func
  Dump of assembler code for function func(int, ...):
     0x0000000000000a00 <+0>:	push   %rbp
     0x0000000000000a01 <+1>:	mov    %rsp,%rbp
     0x0000000000000a04 <+4>:	push   %r13
     0x0000000000000a06 <+6>:	push   %r12
     0x0000000000000a08 <+8>:	push   %rbx
     0x0000000000000a09 <+9>:	sub    $0x108,%rsp
     0x0000000000000a10 <+16>:	mov    %edi,-0x114(%rbp)
     0x0000000000000a16 <+22>:	mov    %rsi,-0xc8(%rbp)
     0x0000000000000a1d <+29>:	mov    %rdx,-0xc0(%rbp)
     0x0000000000000a24 <+36>:	mov    %rcx,-0xb8(%rbp)
     0x0000000000000a2b <+43>:	mov    %r8,-0xb0(%rbp)
     0x0000000000000a32 <+50>:	mov    %r9,-0xa8(%rbp)
     0x0000000000000a39 <+57>:	test   %al,%al
     0x0000000000000a3b <+59>:	je     0xa63 <func(int, ...)+99>
     0x0000000000000a3d <+61>:	movaps %xmm0,-0xa0(%rbp)
     0x0000000000000a44 <+68>:	movaps %xmm1,-0x90(%rbp)
     0x0000000000000a4b <+75>:	movaps %xmm2,-0x80(%rbp)
     0x0000000000000a4f <+79>:	movaps %xmm3,-0x70(%rbp)
     0x0000000000000a53 <+83>:	movaps %xmm4,-0x60(%rbp)
     0x0000000000000a57 <+87>:	movaps %xmm5,-0x50(%rbp)
     0x0000000000000a5b <+91>:	movaps %xmm6,-0x40(%rbp)
     0x0000000000000a5f <+95>:	movaps %xmm7,-0x30(%rbp)
     0x0000000000000a63 <+99>:	mov    %rsp,%rax
     0x0000000000000a66 <+102>:	mov    %rax,%rbx

This clearly is not the `return` statement from line 20, but the end of the
prologue. So the breakpoint appears to be set at the right location and only
displayed wrongly.
Let's confirm:

  (gdb) r
  Starting program: /home/felix/demo

  Breakpoint 1, func (a=1) at demo.cc:20
  20		return 0;
  (gdb) p $pc
  $1 = (void (*)(void)) 0x555555554a63 <func(int, ...)+99>
  (gdb) s
  5		size_t arg_num = 2;
  (gdb) p $pc
  $2 = (void (*)(void)) 0x555555554a69 <func(int, ...)+105>
  (gdb) s
  7		int arg_vals[arg_num];
  (gdb) finish
  Run till exit from #0  func (a=1) at demo.cc:7
  a is: 1
  main (argc=1, argv=0x7fffffffe348) at demo.cc:25
  25	}
  Value returned is $3 = 0

If I'd have to guess, I'd say the wrong line number ended up in the debug
symbols.
Note that this also happens when explicitly trying to set a breakpoint
on the `return` statement:

  (gdb) b demo.cc:20
  Breakpoint 1 at 0xa63: file demo.cc, line 20.
  (gdb) r
  Starting program: /home/felix/demo

  Breakpoint 1, func (a=1) at demo.cc:20
  20		return 0;
  (gdb) s
  5		size_t arg_num = 2;
  (gdb) finish
  Run till exit from #0  func (a=1) at demo.cc:5
  a is: 1
  main (argc=1, argv=0x7fffffffe348) at demo.cc:25
  25	}
  Value returned is $1 = 0

I have also checked the behavior on Jessie with (g++ 4:4.9.2-2,
GDB 7.7.1+dfsg-5) and everything seems alright there.
However, if I copy the binary from Strech over to Jessie, the error still
occurs, so I believe this is a bug in g++ rather than in GDB.

Best regards,
Felix

Attachment: demo.cc
Description: Binary data