carbon-language/carbon-lang

Invalid parse tree generated

Open

#7247 opened on May 21, 2026

View on GitHub
 (0 comments) (0 reactions) (0 assignees)C++ (33,701 stars) (1,535 forks)batch import
good first issuetoolchain

Description

What did you do, or what's a simple way to reproduce the bug?

echo 'fn{p>fn()}' > /tmp/fuzz.carbon
bazel run -c dbg //toolchain -- compile --phase=parse /tmp/fuzz.carbon

What did you expect to happen?

Diagnostics reported, and completing without crashing.

What actually happened?

FATAL failure at toolchain/parse/parse.cpp:68: Invalid tree returned by Parse(): NodeId #nodeA couldn't be extracted as a FunctionDefinition. Trace:
Aggregate N6Carbon5Parse18FunctionDefinitionE: begin
Vector: begin
NodeIdInCategory Decl|Statement: kind ExprStatement consumed
NodeIdInCategory Decl|Statement error: kind IdentifierNameExpr doesn't match
Vector: end
NodeIdForKind error: wrong kind IdentifierNameExpr, expected FunctionDefinitionStart
Aggregate N6Carbon5Parse18FunctionDefinitionE: error
Error: IdentifierNameExpr node left unconsumed.

Any other information, logs, or outputs that you want to share?

The checking of the produce parse tree does not occur in an -c opt build.

This issue was found by fuzzing.

Contributor guide

Tech stack
cpp
Domain
tooling
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
C++ programmingParsing fundamentalsBazel build system
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
35
Research direction
Start by examining the error trace in toolchain/parse/parse.cpp line 68. The issue is that a FunctionDefinition node cannot be extracted because an IdentifierNameExpr is left unconsumed. Investigate the parsing logic for function definitions to understand why this occurs. Use the provided reproduction command with a debug build to reproduce the crash. Look at how the parser handles 'fn{p>fn()}' and ensure that parse tree validation succeeds.