[PATCH 0/1] perf libdw: fix outer-frame name and spurious "(inlined)" tag

[PATCH 0/1] perf libdw: fix outer-frame name and spurious "(inlined)" tag

[Michael Liang]

When perf is built with libdw support, addr2line uses libdw and
cu_walk_functions_at() walks the containing DW_TAG_subprogram DIE
plus every DW_TAG_inlined_subroutine DIE at the sample address. The
libdw_a2l_cb() callback treated the outer subprogram DIE the same
way as inlined subroutines, causing two bugs on the outer frame:

  1. C++ frames lost their namespace/class qualification, because
     die_name() returns the unqualified DW_AT_name -- so
     ns::Class::method rendered as method.

  2. Any DWARF-vs-ELF name mismatch on the outer frame tripped
     new_inline_sym()'s fallback path, which fabricates a fake
     symbol tagged "(inlined)". This hit C++ (die_name()'s
     unqualified string never matched the demangled ELF symbol)
     *and* it hit C functions renamed by GCC IPA-clone (foo vs
     foo.isra.0 / .constprop / .part / .cold), since
     DW_AT_linkage_name doesn't reflect those renames either.

The patch does two things:

  * Prefer die_get_linkage_name() (mangled, fully qualified),
    falling back to die_name() when absent (C, extern "C").
    new_inline_sym() already demangles via dso__demangle_sym().

  * For the outer DW_TAG_subprogram DIE, use base_sym directly --
    the DIE tag already tells us it is the outer function, so we
    skip the name comparison entirely for both C++ qualification
    and IPA-clone renames.

Testing
=======

Reproduced with a small C++ program that exercises both a
non-inline namespaced class method (which GCC also IPA-SRA-clones
into a .isra.0 symbol) and an always_inline helper:

    namespace demo {
    static volatile std::uint64_t sink;

    class Worker {
    public:
        __attribute__((noinline))
        void run_one_io_task(std::uint64_t seed) {
            std::uint64_t x = seed;
            for (int i = 0; i < 400000; ++i)
                x = x * 2862933555777941757ULL + 3037000493ULL;
            sink = x;
        }

        __attribute__((always_inline))
        inline void spin(std::uint64_t seed) {
            std::uint64_t x = seed;
            for (int i = 0; i < 300000; ++i)
                x = x * 3935559000370003845ULL + 2691343689449507681ULL;
            sink = x;
        }
    };
    } // namespace demo

    int main() {
        demo::Worker w;
        for (int i = 0; i < 400; ++i) {
            w.run_one_io_task(i);
            w.spin(i ^ 0xa5a5a5a5a5a5a5a5ULL);
        }
    }

Build:
    g++ -O2 -g -fno-omit-frame-pointer demo.cpp -o demo

Then:
    perf record -g -F 999 -- ./demo
    perf script | head

On unpatched perf, every C++ frame comes out unqualified and tagged
"(inlined)" -- including the outer IPA-cloned frame:

    run_one_io_task+0x24  (inlined)     [WRONG: unqualified, not inlined]
    spin+0x40             (inlined)     [WRONG: unqualified]

With this patch:

    demo::Worker::run_one_io_task(unsigned long) [clone .isra.0]+0x24
    demo::Worker::spin(unsigned long)+0x40  (inlined)   [true inline]

The outer frame is fully qualified and no longer carries a spurious
"(inlined)" tag; the truly-inlined helper stays correctly tagged.
The same mis-tagging behavior is reproducible in pure C by taking
any function GCC IPA-clones (e.g. a static helper that gets .isra
/ .constprop applied) -- unpatched perf tags the outer frame
"(inlined)"; with the patch it renders as the base symbol.

Michael Liang (1):
  perf libdw: Fix outer-frame name resolution and spurious "(inlined)"
    tag

 tools/perf/util/libdw.c | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

--
2.34.1

[PATCH 1/1] perf libdw: Fix outer-frame name resolution and spurious "(inlined)" tag

[Michael Liang]

cu_walk_functions_at() calls libdw_a2l_cb() with the containing
DW_TAG_subprogram DIE first, then each DW_TAG_inlined_subroutine
nested inside.  The callback treated both the same way, causing two
bugs:

  1) die_name() returns the unqualified DW_AT_name, so every C++
     frame lost its namespace/class prefix (ns::Class::method
     collapsed to method).

  2) new_inline_sym() re-uses base_sym only when funcname matches
     base_sym->name exactly; otherwise it fabricates a fake symbol
     tagged "(inlined)".  Any mismatch between the DWARF name and
     the ELF symbol name mis-tags an outer, non-inline frame as
     inlined.  This hits C++ (die_name()'s unqualified output never
     matches the demangled ELF symbol) and it also hits C functions
     that GCC IPA-cloned (foo vs foo.isra.0 / .constprop / .part /
     .cold), since DW_AT_linkage_name doesn't reflect those renames.

Fix both:

  * Prefer die_get_linkage_name() (mangled, fully qualified),
    falling back to die_name() when absent (C, extern "C").
    new_inline_sym() already demangles via dso__demangle_sym().

  * For DW_TAG_subprogram DIEs, use base_sym directly -- the DIE
    tag already tells us it is the outer function, sidestepping
    the name comparison entirely for both C++ qualification and
    GCC IPA-clone renames.

Fixes: 88c51002d06f9a68 ("perf addr2line: Add a libdw implementation")
Signed-off-by: Michael Liang <mliang@purestorage.com>
---
 tools/perf/util/libdw.c | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/tools/perf/util/libdw.c b/tools/perf/util/libdw.c
index d5d2958902c0..4ca7e7e4fbe9 100644
--- a/tools/perf/util/libdw.c
+++ b/tools/perf/util/libdw.c
@@ -82,13 +82,39 @@ struct libdw_a2l_cb_args {
 static int libdw_a2l_cb(Dwarf_Die *die, void *_args)
 {
 	struct libdw_a2l_cb_args *args  = _args;
-	struct symbol *inline_sym = new_inline_sym(args->dso, args->sym, die_name(die));
 	const char *call_fname = die_get_call_file(die);
 	int call_lineno = die_get_call_lineno(die);
 	char *call_srcline = srcline__unknown;
-
-	if (!inline_sym)
-		goto abort_enomem;
+	struct symbol *inline_sym;
+
+	if (dwarf_tag(die) == DW_TAG_subprogram && args->sym) {
+		/*
+		 * cu_walk_functions_at() opens the walk with the
+		 * containing DW_TAG_subprogram DIE (the non-inlined outer
+		 * function). That's just the base symbol -- use it
+		 * directly. Avoids a fragile name-vs-name compare in
+		 * new_inline_sym() that misfires when GCC IPA passes
+		 * (.isra/.constprop/.part/.cold) rename the ELF symbol
+		 * while DWARF keeps the pre-clone linkage name, which
+		 * left the outer frame spuriously tagged "(inlined)".
+		 */
+		inline_sym = args->sym;
+	} else {
+		/*
+		 * Prefer DW_AT_linkage_name so C++ inline frames keep
+		 * their namespace/class qualification. new_inline_sym()
+		 * runs the name through dso__demangle_sym(), so the
+		 * mangled linkage name is turned back into
+		 * "Namespace::Class::method". Fall back to DW_AT_name
+		 * (unqualified) when no linkage name is present, e.g.
+		 * for C code or extern "C" functions.
+		 */
+		const char *funcname = die_get_linkage_name(die) ?: die_name(die);
+
+		inline_sym = new_inline_sym(args->dso, args->sym, funcname);
+		if (!inline_sym)
+			goto abort_enomem;
+	}
 
 	/* Assign caller information to the parent. */
 	if (call_fname)
-- 
2.34.1

Re: [PATCH 1/1] perf libdw: Fix outer-frame name resolution and spurious "(inlined)" tag

[James Clark]

On 28/07/2026 9:42 pm, Michael Liang wrote:
> cu_walk_functions_at() calls libdw_a2l_cb() with the containing
> DW_TAG_subprogram DIE first, then each DW_TAG_inlined_subroutine
> nested inside.  The callback treated both the same way, causing two
> bugs:
> 
>    1) die_name() returns the unqualified DW_AT_name, so every C++
>       frame lost its namespace/class prefix (ns::Class::method
>       collapsed to method).
> 
>    2) new_inline_sym() re-uses base_sym only when funcname matches
>       base_sym->name exactly; otherwise it fabricates a fake symbol
>       tagged "(inlined)".  Any mismatch between the DWARF name and
>       the ELF symbol name mis-tags an outer, non-inline frame as
>       inlined.  This hits C++ (die_name()'s unqualified output never
>       matches the demangled ELF symbol) and it also hits C functions
>       that GCC IPA-cloned (foo vs foo.isra.0 / .constprop / .part /
>       .cold), since DW_AT_linkage_name doesn't reflect those renames.
> 
> Fix both:
> 
>    * Prefer die_get_linkage_name() (mangled, fully qualified),
>      falling back to die_name() when absent (C, extern "C").
>      new_inline_sym() already demangles via dso__demangle_sym().
> 
>    * For DW_TAG_subprogram DIEs, use base_sym directly -- the DIE
>      tag already tells us it is the outer function, sidestepping
>      the name comparison entirely for both C++ qualification and
>      GCC IPA-clone renames.
> 
> Fixes: 88c51002d06f9a68 ("perf addr2line: Add a libdw implementation")
> Signed-off-by: Michael Liang <mliang@purestorage.com>

Reviewed-by: James Clark <james.clark@linaro.org>

> ---
>   tools/perf/util/libdw.c | 34 ++++++++++++++++++++++++++++++----
>   1 file changed, 30 insertions(+), 4 deletions(-)
> 
> diff --git a/tools/perf/util/libdw.c b/tools/perf/util/libdw.c
> index d5d2958902c0..4ca7e7e4fbe9 100644
> --- a/tools/perf/util/libdw.c
> +++ b/tools/perf/util/libdw.c
> @@ -82,13 +82,39 @@ struct libdw_a2l_cb_args {
>   static int libdw_a2l_cb(Dwarf_Die *die, void *_args)
>   {
>   	struct libdw_a2l_cb_args *args  = _args;
> -	struct symbol *inline_sym = new_inline_sym(args->dso, args->sym, die_name(die));
>   	const char *call_fname = die_get_call_file(die);
>   	int call_lineno = die_get_call_lineno(die);
>   	char *call_srcline = srcline__unknown;
> -
> -	if (!inline_sym)
> -		goto abort_enomem;
> +	struct symbol *inline_sym;
> +
> +	if (dwarf_tag(die) == DW_TAG_subprogram && args->sym) {
> +		/*
> +		 * cu_walk_functions_at() opens the walk with the
> +		 * containing DW_TAG_subprogram DIE (the non-inlined outer
> +		 * function). That's just the base symbol -- use it
> +		 * directly. Avoids a fragile name-vs-name compare in
> +		 * new_inline_sym() that misfires when GCC IPA passes
> +		 * (.isra/.constprop/.part/.cold) rename the ELF symbol
> +		 * while DWARF keeps the pre-clone linkage name, which
> +		 * left the outer frame spuriously tagged "(inlined)".
> +		 */
> +		inline_sym = args->sym;
> +	} else {
> +		/*
> +		 * Prefer DW_AT_linkage_name so C++ inline frames keep
> +		 * their namespace/class qualification. new_inline_sym()
> +		 * runs the name through dso__demangle_sym(), so the
> +		 * mangled linkage name is turned back into
> +		 * "Namespace::Class::method". Fall back to DW_AT_name
> +		 * (unqualified) when no linkage name is present, e.g.
> +		 * for C code or extern "C" functions.
> +		 */
> +		const char *funcname = die_get_linkage_name(die) ?: die_name(die);
> +
> +		inline_sym = new_inline_sym(args->dso, args->sym, funcname);
> +		if (!inline_sym)
> +			goto abort_enomem;
> +	}
>   
>   	/* Assign caller information to the parent. */
>   	if (call_fname)