[Lldb-commits] [lldb] 7b3455e - [lldb] Fix double free in CommandPluginInterfaceImplementation (#131658)

[via lldb-commits]

Author: Jonas Devlieghere
Date: 2025-03-18T09:48:34-07:00
New Revision: 7b3455e24ab5aa090e5b2b9ce50c249843c45754

URL: https://github.com/llvm/llvm-project/commit/7b3455e24ab5aa090e5b2b9ce50c249843c45754
DIFF: https://github.com/llvm/llvm-project/commit/7b3455e24ab5aa090e5b2b9ce50c249843c45754.diff

LOG: [lldb] Fix double free in CommandPluginInterfaceImplementation (#131658)

The class was taking ownership of the SBCommandPluginInterface pointer
it was passed in, by wrapping it in a shared pointer. This causes a
double free in the unit test when the object is destroyed and the same
pointer gets freed once when the SBCommandPluginInterface goes away and
then again when the shared pointer hits a zero refcount.

Added: 
    

Modified: 
    lldb/source/API/SBCommandInterpreter.cpp
    lldb/unittests/API/SBCommandInterpreterTest.cpp

Removed: 
    


################################################################################
diff  --git a/lldb/source/API/SBCommandInterpreter.cpp b/lldb/source/API/SBCommandInterpreter.cpp
index d153e2acdf853..de22a9dd96bd8 100644
--- a/lldb/source/API/SBCommandInterpreter.cpp
+++ b/lldb/source/API/SBCommandInterpreter.cpp
@@ -77,7 +77,7 @@ class CommandPluginInterfaceImplementation : public CommandObjectParsed {
     SBDebugger debugger_sb(m_interpreter.GetDebugger().shared_from_this());
     m_backend->DoExecute(debugger_sb, command.GetArgumentVector(), sb_return);
   }
-  std::shared_ptr<lldb::SBCommandPluginInterface> m_backend;
+  lldb::SBCommandPluginInterface *m_backend;
   std::optional<std::string> m_auto_repeat_command;
 };
 } // namespace lldb_private

diff  --git a/lldb/unittests/API/SBCommandInterpreterTest.cpp b/lldb/unittests/API/SBCommandInterpreterTest.cpp
index 941b738e84ac8..5651e1c3dc63f 100644
--- a/lldb/unittests/API/SBCommandInterpreterTest.cpp
+++ b/lldb/unittests/API/SBCommandInterpreterTest.cpp
@@ -6,24 +6,28 @@
 //
 //===----------------------------------------------------------------------===/
 
-#include "gtest/gtest.h"
-
 // Use the umbrella header for -Wdocumentation.
 #include "lldb/API/LLDB.h"
 
+#include "TestingSupport/SubsystemRAII.h"
+#include "lldb/API/SBDebugger.h"
+#include "gtest/gtest.h"
 #include <cstring>
 #include <string>
 
 using namespace lldb;
+using namespace lldb_private;
 
 class SBCommandInterpreterTest : public testing::Test {
 protected:
   void SetUp() override {
-    SBDebugger::Initialize();
-    m_dbg = SBDebugger::Create(/*source_init_files=*/false);
+    debugger = SBDebugger::Create(/*source_init_files=*/false);
   }
 
-  SBDebugger m_dbg;
+  void TearDown() override { SBDebugger::Destroy(debugger); }
+
+  SubsystemRAII<lldb::SBDebugger> subsystems;
+  SBDebugger debugger;
 };
 
 class DummyCommand : public SBCommandPluginInterface {
@@ -44,7 +48,7 @@ class DummyCommand : public SBCommandPluginInterface {
 TEST_F(SBCommandInterpreterTest, SingleWordCommand) {
   // We first test a command without autorepeat
   DummyCommand dummy("It worked");
-  SBCommandInterpreter interp = m_dbg.GetCommandInterpreter();
+  SBCommandInterpreter interp = debugger.GetCommandInterpreter();
   interp.AddCommand("dummy", &dummy, /*help=*/nullptr);
   {
     SBCommandReturnObject result;
@@ -78,7 +82,7 @@ TEST_F(SBCommandInterpreterTest, SingleWordCommand) {
 }
 
 TEST_F(SBCommandInterpreterTest, MultiWordCommand) {
-  SBCommandInterpreter interp = m_dbg.GetCommandInterpreter();
+  SBCommandInterpreter interp = debugger.GetCommandInterpreter();
   auto command = interp.AddMultiwordCommand("multicommand", /*help=*/nullptr);
   // We first test a subcommand without autorepeat
   DummyCommand subcommand("It worked again");