[all-commits] [llvm/llvm-project] 1bf9ce: [lldb] Fix crash on a trailing '-' in a legacy var...

[Yao Qi via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 1bf9ce86b462aa5a184865ab3a2f7e7ea0b4b350
      https://github.com/llvm/llvm-project/commit/1bf9ce86b462aa5a184865ab3a2f7e7ea0b4b350
  Author: Yao Qi <yao_qi at apple.com>
  Date:   2026-09-23 (Wed, 23 Sep 2026)

  Changed paths:
    M lldb/source/Target/StackFrame.cpp
    M lldb/test/API/commands/frame/var/TestFrameVar.py

  Log Message:
  -----------
  [lldb] Fix crash on a trailing '-' in a legacy variable expression path (#225661)

`StackFrame::LegacyGetValueForVariableExpressionPath` walks a variable
expression path one separator character at a time. On seeing a `-` it
checks that the following character is `>`, to confirm this is really
the `->` operator and not something else:
```
    case '-':
      expr_is_ptr = true;
      if (var_expr.size() >= 2 && var_expr[1] != '>')
        return ValueObjectSP();
      ...
      var_expr = var_expr.drop_front(); // Remove the '-'
      [[fallthrough]];
    case '.': {
      var_expr = var_expr.drop_front(); // Remove the '.' or '>'
```
The `var_expr.size() >= 2` guard is only meant to make the `var_expr[1]`
read safe, but it also disables the whole check when `var_expr` is
exactly `"-"` (size 1) with nothing after it. Execution falls through
the `if`, drops the `-` (leaving an empty `StringRef`), then falls
through into the `.` case, which unconditionally drops a second
character on that now-empty string. `StringRef::drop_front` asserts
`size() >= N`, so this aborts.

Reproduced with `settings set target.experimental.use-DIL false` (the
legacy, non-DIL variable-expression-path parser) and a trailing `-`
with no variable-path continuation after it:
```
    (lldb) settings set target.experimental.use-DIL false
    (lldb) frame variable somevar-
    Assertion failed: (size() >= N && "Dropping more elements than exist"), function drop_front, file StringRef.h, line 636.
```
Fix the guard to also reject when `var_expr` is too short to contain a
character after the `-`, not only when that character exists and is
wrong. After the fix the same command reports an ordinary parse error
instead of crashing:
```
    (lldb) frame variable somevar-
    error: unable to find any variable expression path that matches 'somevar-'
```
Add
`TestFrameVar.test_legacy_expression_path_malformed_trailing_operator`,
which runs `frame variable` on a trailing `-`, a trailing `>`, and `-`
followed by something other than `>`, under `use-DIL false`, and checks
each one fails as an ordinary command error rather than crashing lldb.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications