Fix C++ template call segfault#360
Conversation
…t args Root cause: unbound template parameters flowed through cbm_type_substitute as NULL, and call-expression return handling then dereferenced the NULL substituted type. Reproduced on MangoHud's src/hud_elements.cpp. - type_rep: cbm_type_substitute now returns the original param `t` (not NULL) when a type arg is unbound, in both the TYPE_PARAM and named-param paths — unbound params stay intact instead of poisoning the type. - c_lsp: guard `if (!ret) return cbm_type_unknown();` before unwrapping the substituted return type; guard the substitute result before use; add template_function call-node resolution (qualified/scoped/plain names). - extract_defs: factor template-inner lookup into find_cpp_template_inner_node, which recurses into nested template_declarations and also handles field_declaration; reuse it from unwrap_template_inner. - tests: clsp_nocrash_template_function_multi_param_nested_call (the nested reproducer) and typerep_substitute_unbound_param_preserved. Distilled from #360 onto current main. The formal-parameter-count clamp that overlapped this PR already landed via #322, so only the additive crash fixes are taken here. Contributes to the C++ stability cluster (#390; relates to #215/#312).
|
Thank you, @Smiie-2! 🙏 This is a really solid crash fix and the root-cause analysis was excellent — you correctly identified that unbound template parameters were flowing through I reviewed each change closely:
One note on landing: the formal-parameter-count clamp that your PR also included had meanwhile landed independently via #322, so to avoid a double-fix I took only the additive parts of your change (substitution NULL-preservation, the return guards, the template lookup, and both of your new tests). I distilled it onto current main and credited you as the commit author: Landed in d895c16. Verified locally: build clean, all 3,619 tests pass — including your |
- cbm_arena_alloc returns NULL on a NULL arena (both arena.c copies) instead of dereferencing it — defense-in-depth against the NULL-arena type-allocation path that could crash the LSP type layer. - discover: add "vendored" to the always-skip directory list. Distilled from #374, taking the parts not already on main. The PR's ts_lsp tuple-arena allocation, the C/C++ template formal-count clamp, and the type_rep unbound-param preservation it also carried all landed independently in v0.7.0 / via #322 / #360, so only these two defensive improvements remain. Relates to #390.
2 participants
This fixes a crash in the C/C++ LSP path when resolving nested template function calls with default template arguments. The underlying issue was that unbound template parameters could flow through substitution as
NULL, and call-expression return handling assumed the substituted type was always valid.Example
MangoHud’s src/hud_elements.cpp was one reproducer, but the fix targets the general case of calls like a nested template function inside another call expression
What changed:
NULL.Verification:
make -f Makefile.cbm cbmmake -f Makefile.cbm build/c/test-runnerclsp_nocrash_template_function_multi_param_nested_call PASStyperep_substitute_unbound_param_preserved PASS