rust-lang / rust-lang/rust-bindgen

Stack overflow when running into C++ union with variadic templates

Open
#1,836 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

A-C++ A-templates bug
Dominant language
Rust
Stars
5.3k
Forks
829
Avg merge
1d 1h
Merged PRs (30d)
15

Description

This bizarre edge case in a library I'm consuming has caused bindgen to segfault. I've simplified it the best I can:

// input.h
template<typename T, typename... U> union Foo {
  Foo<U...> foo;
};

I get no output from bindgen, just a segfault:

$ bindgen input.h -- -x c++
zsh: segmentation fault (core dumped)  bindgen input.h -- -x c++

I know that C++ templates (and especially variadic templates) are beyond the scope of bindgen, but I believe that it would probably be better if it output "Unhandled cursor kind" or something along those lines.

Some other notes for debugging:

  • --blacklist-type Foo works, but discovering the type when it's buried deep in a library's header files takes a while (speaking from experience 😉)

  • Removing T from the template does not invoke a segfault:

    template<typename... U> union Foo {
      Foo<U...> foo;
    };
    
    Bindgen output
    /* automatically generated by rust-bindgen 0.54.1 */
    
    #[repr(C)]
    pub struct __BindgenUnionField<T>(::std::marker::PhantomData<T>);
    impl<T> __BindgenUnionField<T> {
        #[inline]
        pub const fn new() -> Self {
            __BindgenUnionField(::std::marker::PhantomData)
        }
        #[inline]
        pub unsafe fn as_ref(&self) -> &T {
            ::std::mem::transmute(self)
        }
        #[inline]
        pub unsafe fn as_mut(&mut self) -> &mut T {
            ::std::mem::transmute(self)
        }
    }
    impl<T> ::std::default::Default for __BindgenUnionField<T> {
        #[inline]
        fn default() -> Self {
            Self::new()
        }
    }
    impl<T> ::std::clone::Clone for __BindgenUnionField<T> {
        #[inline]
        fn clone(&self) -> Self {
            Self::new()
        }
    }
    impl<T> ::std::marker::Copy for __BindgenUnionField<T> {}
    impl<T> ::std::fmt::Debug for __BindgenUnionField<T> {
        fn fmt(&self, fmt: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
            fmt.write_str("__BindgenUnionField")
        }
    }
    impl<T> ::std::hash::Hash for __BindgenUnionField<T> {
        fn hash<H: ::std::hash::Hasher>(&self, _state: &mut H) {}
    }
    impl<T> ::std::cmp::PartialEq for __BindgenUnionField<T> {
        fn eq(&self, _other: &__BindgenUnionField<T>) -> bool {
            true
        }
    }
    impl<T> ::std::cmp::Eq for __BindgenUnionField<T> {}
    #[repr(C)]
    pub struct Foo {
        pub foo: __BindgenUnionField<Foo>,
        pub bindgen_union_field: [u8; 0usize],
    }
    

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the crash with the provided input.h and the bindgen input.h -- -x c++ command, then trace the C++ union and variadic-template handling reached by that invocation. Done means this input no longer segfaults and instead produces a clear unsupported-cursor diagnostic or another graceful result.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, rust
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.