latest cppcheck: (template-related?) segfault

[Martin]

Hi,

I've recently updated my local cppcheck, resulting in a new segfault, most definitely related to templates (file attached).

old commit: 56124f0c5d113876b57aacd9e4ad21ab16ffef9a (working)
new commit: 6012cd4fd92e988d403b1047b0cb8bc1ff8bdd35 (segfault)

./cppcheck /home/user/Desktop/ex6.cpp
Checking /home/user/Desktop/ex6.cpp ...
Segmentation fault (core dumped)

Could you please check?

Thanks,
Martin

[Robert Reif]

I have a fix. The hard part will be reducing the example for the regression test.

[Robert Reif]

I need code that complies in order to get creduce to generate valid reduced code.

Does this fix your real problem?

diff --git a/lib/symboldatabase.cpp b/lib/symboldatabase.cpp
index adf5cfdd8..f2ed70bb0 100644
--- a/lib/symboldatabase.cpp
+++ b/lib/symboldatabase.cpp
@@ -3100,7 +3100,7 @@ bool Type::findDependency(const Type* ancestor) const
     if (this==ancestor)
         return true;
     for (std::vector<BaseInfo>::const_iterator parent=derivedFrom.begin(); parent!=derivedFrom.end(); ++parent) {
-        if (parent->type && parent->type->findDependency(ancestor))
+        if (parent->type && parent->type != this && parent->type->findDependency(ancestor))
             return true;
     }
     return false;

[Robert Reif]

This is a better patch:

diff --git a/lib/symboldatabase.cpp b/lib/symboldatabase.cpp
index adf5cfdd8..ec2fafcd4 100644
--- a/lib/symboldatabase.cpp
+++ b/lib/symboldatabase.cpp
@@ -3100,7 +3100,7 @@ bool Type::findDependency(const Type* ancestor) const
     if (this==ancestor)
         return true;
     for (std::vector<BaseInfo>::const_iterator parent=derivedFrom.begin(); parent!=derivedFrom.end(); ++parent) {
-        if (parent->type && parent->type->findDependency(ancestor))
+        if (parent->type && (parent->type == this || parent->type->findDependency(ancestor)))
             return true;
     }
     return false;

[Martin]

Thanks, the latter patch did fix the segfault.

Regarding the reduction of the sample: I intentionally left it quite untouched this time, since I didn't know if it contained more than one piece of code which leads to a segfault, or more than one "type of code" each of which requiring its own fix .

What I can say is this:
(1) with the patch, the whole (original) file can now be analyzed.
(2) one boiled-down example of code that previously resulted in a segfault, but now doesn't any more is:

template < EDatagramType Type, EDatagramType T, EDatagramType... Types >
struct Contains< Type, T, Types... > : Contains< Type, Types... >
{
};

template < EDatagramType Type, EDatagramType... Types >
struct ArrayContains< Type, DatagramTypeArray< Types... > > : public Contains< Type, Types... >
{
};

[Martin]

Is this test keeping you from pushing the patch to master?

[Robert Reif]

Yes. I want to understand the problem. I know it's a template derived from itself but that's a valid case. I need a simple valid test with an instantiation that compiles so I can see how it's instantiated. My patch fixes the crash but I don't know if the instantiated code is correct. I'm working on other unrelated patches now so I'll get to this eventually.

[Robert Reif]

I now have something I can reduce from daca now that the crash reports are working again.

[Robert Reif]

Fixed by: https://github.com/danmar/cppcheck/commit/5810171336fd6b35ea5cf00788a357d9e3ae7dae

[Martin]

Thanks!

[Martin]

Ok, unfortunately now some other old code segfaults:

template<size_t n="">
struct BitInt : public BitInt<n+1> { };</n+1></size_t>

Could you please check?

[Robert Reif]

There is a pull request here: https://github.com/danmar/cppcheck/pull/3111

[Martin]

Ok, unfortunately now some other old code segfaults:

template<size_t n="">
struct BitInt : public BitInt<n+1> { };</n+1></size_t>

Could you please check?

[Martin]

template<size_t n="">
struct BitInt : public BitInt<n+1> { };</n+1></size_t>

Sorry, seems to be too early in the morning to get copy-pasting right on the first try :-|

[Martin]

wtf ... there seems to be some annoying automatic syntax change in this forum .... I've attached the code as a file

[Daniel Marjamäki]

for information, there is a button above the editbox that looks like </> .. if you hoover over it the tooltip says "code" and when you use that then your code is kept intact.

template<size_t N>
struct BitInt : public BitInt<N+1> { };