5.3.15Build Systems & Toolchain

GDB debugging — breakpoints, watchpoints, step, next, backtrace

2,066 words9 min readdifficulty · medium4 backlinks

WHAT each tool is


WHY breakpoints work (first principles, no magic)

So a breakpoint is byte substitution + a trap. There's no formula to derive, but there IS an overhead model worth deriving (below).


Deriving the cost model (Forecast-then-Verify)

Figure — GDB debugging — breakpoints, watchpoints, step, next, backtrace

A full worked debugging session

Buggy program (bug.c):

int factorial(int n) {
    int result = 1;
    for (int i = 1; i <= n; i++)
        result *= i;          // overflow for big n
    return result;
}
int main() {
    int x = factorial(5);
    return 0;
}

Common mistakes (Steel-man + fix)


Flashcards

What instruction byte does GDB insert to implement a software breakpoint on x86?
0xCC (the INT3 trap), after saving the original byte.
Difference between step and next?
step descends into function calls; next runs them to completion and stays at the current level.
What is a watchpoint (vs a breakpoint)?
Stops when an expression's value changes (data), not when a line is reached (location).
Why are software watchpoints slow but hardware ones fast?
Software single-steps every line and re-reads the value (T0+NcT_0+Nc); hardware uses CPU debug registers that trap on write automatically (~no overhead).
What does bt (backtrace) show, and why use it first on a crash?
The chain of active function calls (the stack); it reveals who called the crashing function, often where the real bug lives.
Why compile with -g -O0 before debugging?
-g adds debug symbols (names/line numbers); -O0 stops the optimizer from deleting/merging variables that you want to inspect.
What does finish do?
Runs until the current function returns and prints its return value.
Slowdown formula for a software watchpoint?
S=1+Nc/T0S = 1 + Nc/T_0 where NN=lines, cc=per-line trap cost, T0T_0=normal time.
How many hardware watchpoints does x86 typically allow?
~4 (debug registers DR0–DR3), each watching ≤8 bytes.
Command to switch which stack frame's variables you inspect?
frame <n> (or up/down).

Recall Feynman: explain it to a 12-year-old

Imagine a super-fast cartoon flipbook that flips a million pages a second — you can't see any single drawing. A breakpoint is sticking a bookmark on a chosen page so the flipping stops there and you can look. A watchpoint is saying "stop the moment this character's hat changes color" no matter what page. Step means "turn exactly one page, and if that page sends you into a sub-story, follow it in." Next means "turn one page, but if it sends you into a sub-story, just let that whole sub-story finish and come back." Backtrace is the trail of bookmarks showing which doors you opened to get here. Bugs hide in fast motion; the debugger makes time stop so you can catch them.

Connections

  • Compilation & -g debug symbols
  • Optimization levels -O0 -O2 -O3
  • Stack frames & calling conventions
  • Signals — SIGSEGV SIGTRAP
  • CPU debug registers DR0–DR7
  • Memory debugging — Valgrind & AddressSanitizer
  • The scientific method in debugging

Concept Map

freezes

inserts

implements

byte substitution + SIGTRAP

stops on value change

software impl

hardware impl

derives

near-zero overhead

descends into calls

steps over

prints

GDB debugger

Running program

Traps / INT3 0xCC

Breakpoint at line

Watchpoint on expression

Single-step whole program

CPU debug registers DR0-DR3

Slowdown S = 1 + Nc/T0

Fast but limited to 4

step s

Function calls

next n

backtrace bt

Call stack chain

Hinglish (regional understanding)

Intuition Hinglish mein samjho

Socho tumhara program ek bahut fast race car hai jo billions of instructions per second chalata hai — tum naked eye se kuch dekh hi nahi sakte. GDB ek debugger hai jo is car ko chosen jagah pe rok deta hai taaki tum andar jhaank sako. Ek breakpoint matlab "iss line pe rok do"; technically GDB us address pe ek special trap byte (0xCC, INT3) daal deta hai, CPU wahan pahunche to ruk jaata hai. Ek watchpoint matlab "jab yeh variable ki value badle tab rok do" — yeh location pe nahi, data pe based hota hai.

Sabse zyada confusion step aur next mein hota hai. step ek microscope hai — agar line mein koi function call hai to uske andar ghus jaata hai. next ek stopwatch hai — call ko poora chala deta hai par tum apne hi level pe rehte ho. Apne suspect function ko debug karna ho to step; trusted library call skip karni ho to next. Aur bt (backtrace) crash ke time sabse pehla command — yeh poori call chain dikhata hai, ki kaun-kaun se function se hote hue yahan pahunche. Asli bug aksar ek frame upar hota hai (jisne galat value pass ki).

Ek important practical baat: software watchpoint bahut slow hota hai kyunki GDB har line single-step karke value check karta hai — slowdown S=1+Nc/T0S = 1 + Nc/T_0, jo 10810^8 lines pe 100x+ ho sakta hai. Isliye GDB jab possible ho to hardware watchpoint use karta hai (CPU ke debug registers, ~4 hi milte hain) jisme slowdown almost zero hota hai. Aur hamesha gcc -g -O0 se compile karo — -g se variable naam aur line numbers milte hain, -O0 se optimizer tumhare variables delete nahi karta warna <optimized out> dikhega.

Go deeper — visual, from zero

Test yourself — Build Systems & Toolchain

Connections