llvm / llvm/llvm-project

[Clang] Frontend crash: Illegal instruction: 4 (SIGILL) parsing deeply nested template arguments with -ftemplate-depth

Open
#224,114 3 comments 0 reactions 0 assignees View on GitHub
clang:frontend crash generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

> **Note / Full transparency:** I was running an experiment with an AI coding agent exploring compiler boundaries on Apple Silicon, and the agent isolated this crash reproducer. If this is already a known limitation or considered unintended AI noise/slop, please feel free to close/remove it right away! Just wanted to share the minimal snippet in case it helps frontend parser robustness.

### Problem Description
When compiling C++ source code containing deeply nested template argument brackets under `-ftemplate-depth`, the Clang frontend crashes abruptly with `SIGILL` (`Illegal instruction: 4`) during parsing.

### Environment
- **Clang version:** `Apple clang version 21.0.0 (clang-2100.3.34.2)` (Target: `arm64-apple-darwin27.0.0`)
- **System:** macOS on Apple Silicon (ARM64)

### Minimal Reproducible Example
Generating and compiling the reproducer:

```bash
python3 -c '
s = "int"
for _ in range(2200): s = f"S<{s}>"
code = f"template struct S {{}};\ntemplate struct Eval {{ using type = T; }};\ntemplate struct Eval> {{ using type = S::type>; }};\nusing Trigger = Eval<{s}>::type;\nint main() {{ return 0; }}\n"
open("reproduce.cpp", "w").write(code)
'

clang++ -std=c++20 -fsyntax-only -ftemplate-depth=10000000 reproduce.cpp
```

### Error Output
```text
clang++: error: unable to execute command: Illegal instruction: 4
clang++: error: clang frontend command failed due to signal (use -v to see invocation)
Apple clang version 21.0.0 (clang-2100.3.34.2)
Target: arm64-apple-darwin27.0.0
```

### Observation
While `-ftemplate-depth` configures the semantic template instantiation recursion limit, the recursive descent parser (`clang::Parser::ParseTemplateId`) recurses through the nested angle brackets without an equivalent recursion limit guard, tripping the Darwin stack probe / guard page and resulting in `SIGILL`.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the crash with the provided Python generator and clang++ command, then inspect clang::Parser::ParseTemplateId, which the report identifies as the recursive parsing entry point. Done means the deeply nested reproduce.cpp input no longer crashes the Clang frontend with SIGILL; use the same command to verify the result.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.