[LLVMbugs] [Bug 9793] New: seg fault in recursive template instantiation: stack overflow

[bugzilla-daemon at llvm.org]

http://llvm.org/bugs/show_bug.cgi?id=9793

           Summary: seg fault in recursive template instantiation: stack
                    overflow
           Product: clang
           Version: unspecified
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: C++
        AssignedTo: unassignedclangbugs at nondot.org
        ReportedBy: richard-llvm at metafoo.co.uk
                CC: llvmbugs at cs.uiuc.edu, dgregor at apple.com


This causes clang to crash:

struct T {};
template<typename T> decltype(f(T())) f(T);

void g() {
  f(T());
}

The crash looks like a stack overflow. The repeated section is quite long, and
only manages to repeat 498 times before we run out of stack (the default ulimit
on my machine is 8MiB). Here it is:

#17 0x0000000000fc2d68 in clang::Sema::SubstDecl (this=0x1a1a6e0, D=0x1a35380,
Owner=0x1a093a8, TemplateArgs=...) at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaTemplateInstantiateDecl.cpp:1892
#18 0x0000000000f66dc8 in clang::Sema::FinishTemplateArgumentDeduction
(this=0x1a1a6e0, FunctionTemplate=0x1a35420, Deduced=...,
NumExplicitlySpecified=0, Specialization=@0x7fffff602670, Info=...)
    at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaTemplateDeduction.cpp:2302
#19 0x0000000000f684dd in clang::Sema::DeduceTemplateArguments (this=0x1a1a6e0,
FunctionTemplate=0x1a35420, ExplicitTemplateArgs=0x0, Args=0x7fffff605bd0,
NumArgs=1, Specialization=@0x7fffff602670, Info=...)
    at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaTemplateDeduction.cpp:2749
#20 0x0000000000ed7e21 in clang::Sema::AddTemplateOverloadCandidate
(this=0x1a1a6e0, FunctionTemplate=0x1a35420, FoundDecl=...,
ExplicitTemplateArgs=0x0, Args=0x7fffff605bd0, NumArgs=1, CandidateSet=...,
SuppressUserConversions=false)
    at /home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaOverload.cpp:4197
#21 0x0000000000ede478 in clang::Sema::AddArgumentDependentLookupCandidates
(this=0x1a1a6e0, Name=..., Operator=false, Args=0x7fffff605bd0, NumArgs=1,
ExplicitTemplateArgs=0x0, CandidateSet=..., PartialOverloading=false, 
    StdNamespaceIsAssociated=false) at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaOverload.cpp:6193
#22 0x0000000000ee2d94 in clang::Sema::AddOverloadedCallCandidates
(this=0x1a1a6e0, ULE=0x1adbf10, Args=0x7fffff605bd0, NumArgs=1,
CandidateSet=..., PartialOverloading=false)
    at /home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaOverload.cpp:7699
#23 0x0000000000ee32e6 in clang::Sema::BuildOverloadedCallExpr (this=0x1a1a6e0,
S=0x0, Fn=0x1adbf10, ULE=0x1adbf10, LParenLoc=..., Args=0x7fffff605bd0,
NumArgs=1, RParenLoc=..., ExecConfig=0x0)
    at /home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaOverload.cpp:7787
#24 0x0000000000e3f2c8 in clang::Sema::ActOnCallExpr (this=0x1a1a6e0, S=0x0,
Fn=0x1adbf10, LParenLoc=..., args=..., RParenLoc=..., ExecConfig=0x0) at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaExpr.cpp:4924
#25 0x0000000000f9d42d in RebuildCallExpr (this=0x7fffff6060f0,
Callee=0x1adbf10, LParenLoc=..., Args=..., RParenLoc=..., ExecConfig=0x0) at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/TreeTransform.h:1380
#26 0x0000000000f9851c in TransformCallExpr (this=0x7fffff6060f0, E=0x1a35200)
at /home/tla/Projects/llvm/src/tools/clang/lib/Sema/TreeTransform.h:5803
#27 0x0000000000f92ab7 in TransformCallExpr (this=0x7fffff6060f0, CE=0x1a35200)
at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaTemplateInstantiate.cpp:781
#28 0x0000000000f9b8e6 in TransformExpr (this=0x7fffff6060f0, E=0x1a35200) at
/home/tla/Projects/llvm/build/tools/clang/lib/Sema/../../include/clang/AST/StmtNodes.inc:241
#29 0x0000000000fa011b in TransformDecltypeType (this=0x7fffff6060f0, TLB=...,
TL=...) at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/TreeTransform.h:4065
#30 0x0000000000f99d40 in TransformType (this=0x7fffff6060f0, TLB=..., T=...)
at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/../../include/clang/AST/TypeNodes.def:86
#31 0x0000000000f99309 in TransformFunctionProtoType (this=0x7fffff6060f0,
TLB=..., TL=...) at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/TreeTransform.h:3899
#32 0x0000000000f94705 in TransformFunctionProtoType (this=0x7fffff6060f0,
TLB=..., TL=...) at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaTemplateInstantiate.cpp:1176
#33 0x0000000000f99bc6 in TransformType (this=0x7fffff6060f0, TLB=..., T=...)
at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/../../include/clang/AST/TypeNodes.def:79
#34 0x0000000000f955f3 in clang::Sema::SubstFunctionDeclType (this=0x1a1a6e0,
T=0x1a35358, Args=..., Loc=..., Entity=...) at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaTemplateInstantiate.cpp:1415
#35 0x0000000000fc34fa in clang::TemplateDeclInstantiator::SubstFunctionType
(this=0x7fffff606950, D=0x1a35380, Params=...) at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaTemplateInstantiateDecl.cpp:2062
#36 0x0000000000fbf5a4 in clang::TemplateDeclInstantiator::VisitFunctionDecl
(this=0x7fffff606950, D=0x1a35380, TemplateParams=0x0) at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaTemplateInstantiateDecl.cpp:1044
#37 0x0000000000fb91ac in clang::DeclVisitor<clang::TemplateDeclInstantiator,
clang::Decl*>::Visit (this=0x7fffff606950, D=0x1a35380) at
/home/tla/Projects/llvm/build/tools/clang/lib/Sema/../../include/clang/AST/DeclNodes.inc:307
#38 0x0000000000fc2d68 in clang::Sema::SubstDecl (this=0x1a1a6e0, D=0x1a35380,
Owner=0x1a093a8, TemplateArgs=...) at
/home/tla/Projects/llvm/src/tools/clang/lib/Sema/SemaTemplateInstantiateDecl.cpp:1892

The failure is not caused by overflowing the stack before we reach the
instantiation depth limit: running with -ftemplate-depth 1 still crashes in the
same way without hitting the limit. On this Debug+Asserts build, we would not
reach the instantiation depth limit before crashing anyway.

-- 
Configure bugmail: http://llvm.org/bugs/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.