Fuzzer crashes

[aleksisch]

Crashes found by the grammar fuzzer against bdbad337f. Repros are complete files; run with plain daslang repro.das.

1. SIGSEGV in SourceCollector::preVisit(ExprCall*) — self-referential typedef in a struct template

struct template r{def v=>0
typedef r=r<iterator<a>[@{0=(0,C())}]>}

$ daslang repro.das
CRASH: SIGSEGV (Segmentation fault) (signal 11) at address 0x80

#0  das::SourceCollector::preVisit(das::ExprCall*)
#1  das::ExprCall::visit(das::Visitor&)
#2  das::appendSources(...)
#3  das::AliasMarker::preVisit(das::ExprMakeTuple*)

Reached through alias marking, not type inference. The fault address (0x80) and the shallow backtrace rule out stack exhaustion, so this is a null dereference rather than the recursion seen in #3858.

Each part is load-bearing: dropping template, the iterator<>, the [...] dimension, or the undefined call C() all turn it into a normal compile error.

Minimized with afl-tmin (590 -> 110 bytes) then reduced by hand.

[aleksisch]

2. SIGSEGV in InferTypes::visitStructureField — duplicate field name in a class deriving from a template

Still present on 6dbf62f0c (verified after the fixes for #3858 landed).

class template T;class e:T{f:r<t>;sealed f:int}

$ daslang repro.das
CRASH: SIGSEGV (Segmentation fault) (signal 11) at address 0x20

#0  das::InferTypes::visitStructureField(das::Structure*, das::Structure::FieldDeclaration&, bool)
#1  das::Program::visitStructure(das::Visitor&, das::Structure*)
#2  das::Program::visitModule(das::Visitor&, das::Module*, bool, bool)

Three things are needed together; drop any one and it becomes a normal diagnostic:

• inheritance from a template class or struct (without it: error[30320])
• two fields with the same name, the second sealed (without sealed: error[20503])
• the first field typed with an unresolved generic r<t> (a known type there: error[30805])

struct template behaves the same as class template. The second field's type does not matter (int works).

Minimized with afl-tmin (343 -> 100 bytes) then reduced by hand. Note the afl-tmin pass ran against a pre-fix build, so the result was re-verified against 6dbf62f0c before reducing.

[aleksisch]

Three more from the fuzzer on 67bf113a3, after the fixes for #3858 landed. Minimized with afl-tmin then reduced by hand.

3. SIGSEGV in ExprLooksLikeCall::visit — debug() of a void expression

def v {}
[export]
def main{ debug(v()); }

$ daslang repro.das
CRASH: SIGSEGV (Segmentation fault) (signal 11)

#0  das::ExprLooksLikeCall::visit(das::Visitor&)
#1  das::ExprLikeCall<das::ExprDebug>::visit(das::Visitor&)
#2  das::ExprBlock::visit(das::Visitor&)

Crashes on a plain run and under -aot. debug(1) is fine — it is specifically a void-typed argument. When the void expression is a handled-type call instead, the AOT path survives to emit C++ that does not compile: implicit instantiation of undefined template 'das::cast<void>'.

4. SIGSEGV in Function::findArgument — typeinfo is_argument inside a type declaration

require UnitTest
struct l{f:r<b[typeinfo is_argument(UNIT_TEST_CONSTANT)]>}

$ daslang repro.das
CRASH: SIGSEGV (Segmentation fault) (signal 11) at address 0x68

#0  das::Function::findArgument(std::string const&)
#1  das::InferTypes::visit(das::ExprTypeInfo*)
#2  das::ExprOp2::visit(das::Visitor&)
#3  das::TypeDecl::visit(das::Visitor&)

is_argument asks whether a name is a function argument; reached from a type declaration there is no enclosing function, and the lookup dereferences null. typeinfo is_ref(...) in the same position gives a normal error[30821], so it is specific to the argument-lookup traits. This accounted for 22 of 36 crashes in the run.

5. goto <expr> inside a captured block — undeclared label in AOT C++

def f:int { return 6; }
[export]
def main{ invoke($() { goto f(); }); label 6:; }

error: use of undeclared label 'label_6'

The same goto outside the block is clean, so this is the computed-goto form of the case fixed by infer: a goto out of a captured block is a compile error — that fix covers goto label N, but goto <expr> still reaches codegen and emits a jump to a label that is not in scope in the generated lambda.

[aleksisch]

6. goto over a variable declaration emits invalid C++ in AOT

The interpreter runs this correctly (prints ok); daslang -aot emits C++ that clang rejects. Requires options optimize = false — with optimization on, the dead variable is removed and the jump no longer crosses an initializer.

options optimize = false

[export]
def main {
    if (true) { goto label 3 }
    var z = 5
    label 3:
    print("ok\n")
}

$ daslang -aot t.das t.cpp
t.cpp:71:9: error: cannot jump from this goto statement to its label
    goto label_3;
        ^
t.cpp:73:13: note: jump bypasses variable initialization
    int32_t __z_rename_at_6_0 = 5;

The forward goto is emitted as a C++ goto that crosses the initialization of __z_rename_at_6_0, which C++ forbids.