[Lldb-commits] [lldb] [lldb] Don't crash in DIL on an operand with no type system (PR #226908)
Yao Qi via lldb-commits
lldb-commits at lists.llvm.org
Mon Sep 28 00:44:49 PDT 2026
https://github.com/qiyao created https://github.com/llvm/llvm-project/pull/226908
A binary operator whose operand has no type system crashes lldb. A register
in a corefile that was loaded without its executable is such an operand:
```
(lldb) frame variable $x0
x0 = 0x1111111111111111 <invalid type>
(lldb) frame variable "$x0+$x1"
Process 85580 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = Null pointer use
frame #5: 0x00000001335285b0 liblldb.24.0git.dylib`lldb_private::dil::Interpreter::Visit(this=0x000000016fdfb650, node=<unavailable>) at DILEval.cpp:1369:19 [opt]
```
`Visit(BinaryOpNode)` compares the two operands' type systems by plugin name,
and dereferences each one without checking it.
```
(lldb) frame variable lhs_system
(lldb::TypeSystemSP) lhs_system = nullptr {
pointer = nullptr
}
(lldb) frame variable rhs_system
(lldb::TypeSystemSP) rhs_system = nullptr {
pointer = nullptr
}
```
Report a DIL error for such an operand instead, before the comparison. An
operand with no type system has nothing to compare and nothing to compute
with, so the expression cannot be evaluated either way:
```
(lldb) frame variable "$x0+$x1"
˄
╰─ error: operand has no type system
```
Both operands of the test's expression are registers because an integer
literal needs a type system from the frame's compile unit, which the same
corefile does not have either.
>From 80a2e6b4f4010da3e9336108a7a8e9d338e534ef Mon Sep 17 00:00:00 2001
From: Yao Qi <yao_qi at apple.com>
Date: Fri, 25 Sep 2026 16:15:45 +0100
Subject: [PATCH] [lldb] Don't crash in DIL on an operand with no type system
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
A binary operator whose operand has no type system crashes lldb. A register
in a corefile that was loaded without its executable is such an operand:
```
(lldb) frame variable $x0
x0 = 0x1111111111111111 <invalid type>
(lldb) frame variable "$x0+$x1"
Process 85580 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = Null pointer use
frame #5: 0x00000001335285b0 liblldb.24.0git.dylib`lldb_private::dil::Interpreter::Visit(this=0x000000016fdfb650, node=<unavailable>) at DILEval.cpp:1369:19 [opt]
```
`Visit(BinaryOpNode)` compares the two operands' type systems by plugin name,
and dereferences each one without checking it.
```
(lldb) frame variable lhs_system
(lldb::TypeSystemSP) lhs_system = nullptr {
pointer = nullptr
}
(lldb) frame variable rhs_system
(lldb::TypeSystemSP) rhs_system = nullptr {
pointer = nullptr
}
```
Report a DIL error for such an operand instead, before the comparison. An
operand with no type system has nothing to compare and nothing to compute
with, so the expression cannot be evaluated either way:
```
(lldb) frame variable "$x0+$x1"
˄
╰─ error: operand has no type system
```
Both operands of the test's expression are registers because an integer
literal needs a type system from the frame's compile unit, which the same
corefile does not have either.
---
lldb/source/ValueObject/DILEval.cpp | 6 ++++
.../Commands/command-dil-no-type-system.test | 30 +++++++++++++++++++
2 files changed, 36 insertions(+)
create mode 100644 lldb/test/Shell/Commands/command-dil-no-type-system.test
diff --git a/lldb/source/ValueObject/DILEval.cpp b/lldb/source/ValueObject/DILEval.cpp
index 81c5e383312fe..2527b782cbb4e 100644
--- a/lldb/source/ValueObject/DILEval.cpp
+++ b/lldb/source/ValueObject/DILEval.cpp
@@ -1364,8 +1364,14 @@ Interpreter::Visit(const BinaryOpNode &node) {
bool rhs_is_literal = node.GetRHS().IsConstLiteral();
lldb::TypeSystemSP lhs_system =
lhs->GetCompilerType().GetTypeSystem().GetSharedPointer();
+ if (!lhs_system)
+ return llvm::make_error<DILDiagnosticError>(
+ m_expr, "operand has no type system", node.GetLHS().GetLocation());
lldb::TypeSystemSP rhs_system =
rhs->GetCompilerType().GetTypeSystem().GetSharedPointer();
+ if (!rhs_system)
+ return llvm::make_error<DILDiagnosticError>(
+ m_expr, "operand has no type system", node.GetRHS().GetLocation());
if (lhs_system->GetPluginName() != rhs_system->GetPluginName()) {
// TODO: Attempt to convert values to current CU's type system
return llvm::make_error<DILDiagnosticError>(
diff --git a/lldb/test/Shell/Commands/command-dil-no-type-system.test b/lldb/test/Shell/Commands/command-dil-no-type-system.test
new file mode 100644
index 0000000000000..718db95341bde
--- /dev/null
+++ b/lldb/test/Shell/Commands/command-dil-no-type-system.test
@@ -0,0 +1,30 @@
+# A register in a corefile with no executable module has no type system. Check
+# that DIL reports that for a binary operator instead of dereferencing it.
+
+# RUN: yaml2obj %s -o %t
+# RUN: echo 'frame variable $x0' > %t.cmds
+# RUN: echo 'frame variable "$x0+$x1"' >> %t.cmds
+# RUN: %lldb -c %t -o "command source -e false %t.cmds" -o exit 2>&1 | FileCheck %s
+
+# CHECK: x0 = 0x1111111111111111 <invalid type>
+# CHECK: {{^ (\^|˄)}}
+# CHECK-NEXT: {{^ (╰─ )?}}error: operand has no type system
+
+--- !minidump
+Streams:
+ - Type: SystemInfo
+ Processor Arch: ARM64
+ Platform ID: MacOSX
+ CSD Version: 'macOS'
+ CPU:
+ CPUID: 0x00000000
+ - Type: ThreadList
+ Threads:
+ - Thread Id: 0x000003E8
+ # MinidumpContext_ARM64: context_flags, x[32], pc, cpsr, fpsr, fpcr,
+ # v[32*16]. x0 is 0x1111111111111111 and x1 is 0x2222222222222222.
+ Context: 06000080000000001111111111111111222222222222222200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000A134EBFC7F0000100000000100000000A034EBFC7F000004000000010000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+ Stack:
+ Start of Memory Range: 0x00007FFCEB34A000
+ Content: DEAD
+...
More information about the lldb-commits
mailing list