[libc++] Fix double file closing in `std::filesystem::remove_all()`.

[var-const]

Summary

According to Linux documentation (see e.g. https://linux.die.net/man/3/closedir):

A successful call to closedir() also closes the underlying file
descriptor associated with dirp.

Thus, calling close() after a successful call to closedir() is at
best redundant. Worse, should a different thread open a file in-between
the calls to closedir() and close() and get the same file descriptor,
the call to close() might actually close a different file than was
intended:

// Thread 1.
int fd = ::openat(AT_FDCWD, "foo", O_DIRECTORY);

DIR* stream = ::fdopendir(fd);
int result = ::closedir(stream);
assert(result == 0); // `fd` is now closed.

{
  // Thread 2.
  int fd2 = ::openat(AT_FDCWD, "BAR", O_DIRECTORY);
  assert(fd2 == fd); // Quite possible.
}

// Thread 1.
result = ::close(fd);
assert(result == 0);
// The call to `close` succeeds but closes a different file ("BAR",
// which was never opened by this function).

rdar://89251874

[var-const]

According to Linux documentation [...]

I couldn't see the same note in BSD documentation but it works the same in practice.

[var-const]

More detailed demonstration: https://godbolt.org/z/cMzjvh93x

[var-const]

I'm not sure if it's possible to test this -- please let me know if I'm missing something.

[ldionne]

LGTM, thanks for fixing this. I'll land this on main and cherry-pick to release/14.x because I think it's important to fix this bug.

libcxx/src/filesystem/operations.cpp

 
 uintmax_t remove_all_impl(int parent_directory, const path& p, error_code& ec) {
   // First, try to open the path as a directory.
   const int options = O_CLOEXEC | O_RDONLY | O_DIRECTORY | O_NOFOLLOW;
   int fd = ::openat(parent_directory, p.c_str(), options);
   if (fd != -1) {
     // If that worked, iterate over the contents of the directory and
     // remove everything in it, recursively.
-    scope_exit close_fd([=] { ::close(fd); });
     DIR* stream = ::fdopendir(fd);
     if (stream == nullptr) {
+      ::close(fd);
       ec = detail::capture_errno();
       return 0;
     }
+    // Note: `::closedir` will also close the associated file descriptor, so
+    // there should be no call to `close(fd)`.
     scope_exit close_stream([=] { ::closedir(stream); });
 
     uintmax_t count = 0;
     while (true) {
       auto [str, type] = detail::posix_readdir(stream, ec);
       static_assert(std::is_same_v<decltype(str), std::string_view>);
       if (str == "." || str == "..") {
         continue;