[clang] [clang] Prevent stack overflow on deeply nested template arguments (PR #224393)

[Daniel Petrovic via cfe-commits]

https://github.com/daniel-petrovic updated https://github.com/llvm/llvm-project/pull/224393

>From 90119a8e8bec2f685d5cc044ad94b78a755d417b Mon Sep 17 00:00:00 2001
From: Daniel Petrovic <daniel-dev at hotmail.de>
Date: Thu, 17 Sep 2026 21:44:57 +0200
Subject: [PATCH] [clang] Fix stack exhaustion if parsing deeply nested
 template arguments

Issue: Stack guard is missing on the path if parsing deeply nested template args.
Fix: Run template argument list parser under stack guard.
---
 clang/docs/ReleaseNotes.md        | 5 +++++
 clang/lib/Parse/ParseTemplate.cpp | 9 ++++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md
index a1f24a8caedae..1a8d932b8af8f 100644
--- a/clang/docs/ReleaseNotes.md
+++ b/clang/docs/ReleaseNotes.md
@@ -608,6 +608,11 @@ features cannot lower the translation-unit ABI level;
 - Fixed a crash when a using-declaration naming an unresolvable member of a
   dependent base was shadowed by an invalid using-declaration. (#GH209427)
 
+- Fixed a stack overflow when parsing deeply nested template arguments such
+  as ``S<S<S<...>>>``. Parsing now goes through the existing stack guard, which
+  continues on a fresh stack instead of crashing when the parser's stack is
+  nearly exhausted. (#GH224114)
+
 - Fixed a CTAD bug when combining with concepts. (#GH124715)
 
 - Fixed a regression where an internal-linkage function (e.g. a `static` or
diff --git a/clang/lib/Parse/ParseTemplate.cpp b/clang/lib/Parse/ParseTemplate.cpp
index 1e5aa55338309..fb41cace01a7b 100644
--- a/clang/lib/Parse/ParseTemplate.cpp
+++ b/clang/lib/Parse/ParseTemplate.cpp
@@ -1392,9 +1392,16 @@ bool Parser::ParseTemplateArgumentList(TemplateArgList &TemplateArgs,
         Template, TemplateArgs, OpenLoc);
   };
 
+  // Nested template-ids (e.g. `S<S<S<...>>>`) recurse through the parser's
+  // type/template disambiguation machinery, which is deeply recursive. Run the
+  // parse with the stack guard so that a deeply nested argument list (see
+  // https://github.com/llvm/llvm-project/issues/224114) continues on a fresh
+  // stack instead of overflowing the parser's stack.
   do {
     PreferredType.enterFunctionArgument(Tok.getLocation(), RunSignatureHelp);
-    ParsedTemplateArgument Arg = ParseTemplateArgument();
+    ParsedTemplateArgument Arg;
+    StackHandler.runWithSufficientStackSpace(
+        OpenLoc, [&Arg, this] { Arg = ParseTemplateArgument(); });
     SourceLocation EllipsisLoc;
     if (TryConsumeToken(tok::ellipsis, EllipsisLoc))
       Arg = Actions.ActOnPackExpansion(Arg, EllipsisLoc);