GDB reverse debugging

Let's start with a simple C++ program in the file gdb-test.cpp:

#include <iostream>
 
const unsigned int SIZE = 10;
 
int main() {
 
  int b[SIZE];
 
  // intitialize
  for(int i=0; i <= SIZE; i++) {
    b[i]=0;
  }
 
  std::cout << "done!" << std::endl;
  return 0;
}

Let's comple and run it.

$ g++ -g gdb-test.cpp -o gdb-test
$ ./gdb-test

??? It doesn't stop!

Let's load it into gdb.

$ gdb ./gdb-test
GNU gdb (GDB) 7.1-ubuntu
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
[...]
Reading symbols from /home/larsr/gdb-test...done.
(gdb)

Now run it:

(gdb) r
Starting program: /home/larsr/gdb-test

Still dosn't stop! Stop it with ctrl-c:

^C
Program received signal SIGINT, Interrupt.
0x08048704 in main () at gdb-test.cpp:11
11    for(int i=0; i <= SIZE; i++) {
(gdb)

Let's look at the variable i.

(gdb) print i
$1 = 4
(gdb)

Looks normal enough! But strange that it didn't get further than 4... Well, let's run some more, break, and look at i.

(gdb) continue
Continuing.
^C
Program received signal SIGINT, Interrupt.
0x080486fc in main () at gdb-test.cpp:11
11    for(int i=0; i <= SIZE; i++) {
(gdb) print i
$2 = 7
(gdb) c
Continuing.
^C
Program received signal SIGINT, Interrupt.
0x080486f8 in main () at gdb-test.cpp:11
11    for(int i=0; i <= SIZE; i++) {
(gdb) print i
$4 = 6
(gdb)

What? First i was 7 and then it was 6! How did that happen? Lets start to record, and run some more!

(gdb) record
(gdb) c
Continuing.
^C
Program received signal SIGINT, Interrupt.
main () at gdb-test.cpp:11
11    for(int i=0; i <= SIZE; i++) {
(gdb) print i
$6 = 2
(gdb)

Something has modified i to become smaller! When did this happen? Let's watch i and go backwards.

(gdb) reverse-continue 
Continuing.
Hardware watchpoint 1: i
 
Old value = 2
New value = 1
main () at gdb-test.cpp:11
11    for(int i=0; i <= SIZE; i++) {

This makes sense. We are walking backswards, and in that direction we had a value of 2 which turned into 1. Let's keep going backwards.

(gdb) reverse-continue 
Continuing.
Hardware watchpoint 1: i
 
Old value = 1
New value = 0
main () at gdb-test.cpp:11
11    for(int i=0; i <= SIZE; i++) {
(gdb) reverse-continue 
Continuing.
Hardware watchpoint 1: i
 
Old value = 0
New value = 10
0x080486eb in main () at gdb-test.cpp:12
12      b[i]=0;
(gdb)

Here we see that as we went backwards, we went from 0 to 10. That means that when we ran forward, i went from 10 to 0, and it happened when we executed

b[i]=0;

Could it be that writing to b[10] overwrites the memory of i? Where are they located in memory?

(gdb) print &i
$7 = (int *) 0xbffff7bc
(gdb) print &b[i]
$8 = (int *) 0xbffff7bc
(gdb)

Yup, they are at the same address. Why? Doh! An array indexing error! b[10] is not within the array bounds! The last element is b[9].

Line 11 should use < instead of <= and read

for(int i=0; i <  SIZE; i++) {

Case closed.

An ugly observation is that programs like this bug out silently and "work" if you change the program to be initialized to 100 (or something bigger than SIZE).