C++ Scope Management Assertion Failure

[gaborbernat]

Universal Ctags crashes with assertion failure in cxxScopePushTop at parsers/cxx/cxx_scope.c:238 when parsing complex C++ template specializations. The assertion false indicates an unexpected state in the scope stack management when handling member function pointer template specializations. Note, for this to crash the binary you need to run in debug mode.

Reproduced by:

// C++ template specialization that triggers scope management bug
template <class T>
struct TestUtil {
    static bool isNull(const T&) { return false; }
};

template <class T>
struct TestUtil<T*> {
    static bool isNull(T* f) { return 0 == f; }
};

template <class CLASS, class MEMTYPE>
inline
bool
TestUtil<MEMTYPE CLASS::*>::isNull(MEMTYPE CLASS::* f)
{
    return 0 == f;
}

# Save the above as scope_crash.h and run:
# This crashes with: cxxScopePushTop: Assertion `false' failed
./ctags -o /tmp/test scope_crash.h

Suggested fix: Improve the C++ scope stack management to properly handle complex template specializations, especially member function pointer specializations. The scope parser needs better logic to track nested template contexts and their specializations.

[masatake]

Thank you for reporting.

template <class CLASS, class MEMTYPE>
inline
bool
TestUtil<MEMTYPE>::isNull(MEMTYPE CLASS::* f)
{
    return 0 == f;
}

For this input, ctags --sort=no --tag-relative=always -G -o - --fields-all='*' --extras-all='*' --extras=-pq --kinds-all='*' --roles-all.'*'='*' /tmp/foo.cxx emits:

isNull	foo.cxx	/^TestUtil<MEMTYPE>::isNull(MEMTYPE CLASS::* f)$/;"	kind:function	line:4	language:C++	scope:class:TestUtil	typeref:typename:bool	signature:(MEMTYPE CLASS::* f)	roles:def	end:7	template:<class CLASS,class MEMTYPE>	properties:inline,scopespecialization,specialization
CLASS	foo.cxx	/^template <class CLASS, class MEMTYPE>$/;"	kind:tparam	line:1	language:C++	scope:function:TestUtil::isNull	typeref:meta:class	roles:def	nth:0
MEMTYPE	foo.cxx	/^template <class CLASS, class MEMTYPE>$/;"	kind:tparam	line:1	language:C++	scope:function:TestUtil::isNull	typeref:meta:class	roles:def	nth:1
f	foo.cxx	/^TestUtil<MEMTYPE>::isNull(MEMTYPE CLASS::* f)$/;"	kind:parameter	line:4	language:C++	scope:function:TestUtil::isNull	typeref:typename:MEMTYPE CLASS::*	file:	roles:def	extras:fileScope	nth:0
foo.cxx	foo.cxx	1;"	kind:file	line:1	language:C++	roles:def	extras:inputFile	end:7	epoch:1763022585

The first question is, is this output o.k.?
About isNull, scope:class:TestUtil is attached. I expect this should be scope:class:TestUtil<MEMTYPE>.

The second question is what ctags should emits for:

template <class CLASS, class MEMTYPE>
inline
bool
TestUtil<MEMTYPE CLASS::*>::isNull(MEMTYPE CLASS::* f)
{
    return 0 == f;
}

If my expectation for the first question is correct, I expect ctags should emit:

isNull	foo.cxx	/^TestUtil<MEMTYPE CLASS::*>::isNull(MEMTYPE CLASS::* f)$/;"	kind:function	line:4	language:C++	scope:class:TestUtil<MEMTYPE CLASS::*>	typeref:typename:bool	signature:(MEMTYPE CLASS::* f)	roles:def	end:7	template:<class CLASS,class MEMTYPE>	properties:inline,scopespecialization,specialization
CLASS ...
MEMTYPE ...
f...
foo.cxx...

[masatake]

@gaborbernat I'm struggling to understand this issue.

ctags should not crash for any input. This is the principal rule.
However, when given broken input, ctags emits broken output. This is the second rule. Thinking about ideal tags output for broken input is a waste of time.

So I have a question.

template <class CLASS, class MEMTYPE>
inline
bool
TestUtil<MEMTYPE CLASS::*>::isNull(MEMTYPE CLASS::* f)
{
    return 0 == f;
}
[yamato@dev64]/tmp% gcc -c foo.cpp            
foo.cpp:4:9: error: expected initializer before ‘<’ token
    4 | TestUtil<MEMTYPE CLASS::*>::isNull(MEMTYPE CLASS::* f)
      |         ^

The input is invalid as a C++ source file.
So ctags emits any tags file as long as it doesn't crash.

[gaborbernat]

Should user give a broken input should they still expect that ctags will not crash? (Because today it does crash, indepedent of what the output should be in this case).

[masatake]

Yes, ctags should not crash for any input, though there are many bug reports about crashes.
For broken input, we just need to avoid the crash.
For valid input, we should make ctags emit good tags in addition to avoiding the crash.

[gaborbernat]

I guessIn that case, this issue is to not crash 😊

[masatake]

I see. Thank you. I will inspect more.