Avoid crash in varobj deletion
authorTom Tromey <tromey@adacore.com>
Fri, 30 Jul 2021 17:18:36 +0000 (11:18 -0600)
committerTom Tromey <tromey@adacore.com>
Mon, 2 Aug 2021 15:48:58 +0000 (09:48 -0600)
commit3e5ec878a43ac06624a2cc816a329d9b22b95cac
treefcf5057bd539aa234d117ec17f784e4010ed1fed
parente4c1aea498ff84bcb3086509d125ac8249f35db2
Avoid crash in varobj deletion

PR varobj/28131 points out a crash in the varobj deletion code.  It
took a while to reproduce this, but essentially what happens is that a
top-level varobj deletes its root object, then deletes the "dynamic"
object.  However, deletion of the dynamic object may cause
~py_varobj_iter to run, which in turn uses gdbpy_enter_varobj:

gdbpy_enter_varobj::gdbpy_enter_varobj (const struct varobj *var)
: gdbpy_enter (var->root->exp->gdbarch, var->root->exp->language_defn)
{
}

However, because var->root has already been destroyed, this is
invalid.

I've added a new test case.  This doesn't reliably crash, but the
problem can easily be seen under valgrind (and, I presume, with ASAN,
though I did not try this).

Tested on x86-64 Fedora 32.  I also propose putting this on the GDB 11
branch, with a suitable ChangeLog entry of course.

Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=28131

(cherry picked from commit 4d0754c5f572b01cf2fe6c8ab292adba83331cbc)

gdb/ChangeLog
2021-08-02  Tom Tromey  <tromey@adacore.com>

PR varobj/28131
* varobj.c (~varobj): Delete 'dynamic' before 'root'.

gdb/testsuite/ChangeLog
2021-08-02  Tom Tromey  <tromey@adacore.com>

PR varobj/28131
* gdb.python/py-mi-var-info-path-expression.exp: Add regression
test.
gdb/ChangeLog
gdb/testsuite/ChangeLog
gdb/testsuite/gdb.python/py-mi-var-info-path-expression.exp
gdb/varobj.c
This page took 0.043328 seconds and 4 git commands to generate.