These bugs has surfaced during the refactoring D64712.
There are some test cases that passes paths with ".." in them to OverlayCDB and DirectoryBasedCDB, which were not failing before because (tested) users of these functions were handling the canonicalization.
It is also possible to have an LSP client sending over compile commands over the wire without canonicalizing them.
As for the second bug, it is easier to trigger for example a json comp db with an entry ("file": "/abs/path/build/../a.cc") will trigger that.
I am not sure if there are build systems generating this kind of output, but it looks valid from a comp db perspective, whereas it doesn't comply with clangd's assumption.
This patch lacks a bit of context (why are we changing this behavior).
Based on offline discussion, it's not clear to me why this particular change to getFallbackCommand is necessary or desirable. (Compared to others, which seem like fairly obvious bugs, even if the reason to fix them isn't obvious)