From 4d0754c5f572b01cf2fe6c8ab292adba83331cbc Mon Sep 17 00:00:00 2001 From: Tom Tromey Date: Fri, 30 Jul 2021 11:18:36 -0600 Subject: Avoid crash in varobj deletion PR varobj/28131 points out a crash in the varobj deletion code. It took a while to reproduce this, but essentially what happens is that a top-level varobj deletes its root object, then deletes the "dynamic" object. However, deletion of the dynamic object may cause ~py_varobj_iter to run, which in turn uses gdbpy_enter_varobj: gdbpy_enter_varobj::gdbpy_enter_varobj (const struct varobj *var) : gdbpy_enter (var->root->exp->gdbarch, var->root->exp->language_defn) { } However, because var->root has already been destroyed, this is invalid. I've added a new test case. This doesn't reliably crash, but the problem can easily be seen under valgrind (and, I presume, with ASAN, though I did not try this). Tested on x86-64 Fedora 32. I also propose putting this on the GDB 11 branch, with a suitable ChangeLog entry of course. Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=28131 --- gdb/varobj.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'gdb/varobj.c') diff --git a/gdb/varobj.c b/gdb/varobj.c index 7928d90..d0c857a 100644 --- a/gdb/varobj.c +++ b/gdb/varobj.c @@ -1844,10 +1844,12 @@ varobj::~varobj () } #endif + /* This must be deleted before the root object, because Python-based + destructors need access to some components. */ + delete var->dynamic; + if (is_root_p (var)) delete var->root; - - delete var->dynamic; } /* Return the type of the value that's stored in VAR, -- cgit v1.1