carbon-language/carbon-lang

Invalid parse tree generated

Open

#7,247 建立於 2026年5月21日

在 GitHub 查看
 (0 留言) (0 反應) (0 負責人)C++ (33,701 star) (1,535 fork)batch import
good first issuetoolchain

描述

What did you do, or what's a simple way to reproduce the bug?

echo 'fn{p>fn()}' > /tmp/fuzz.carbon
bazel run -c dbg //toolchain -- compile --phase=parse /tmp/fuzz.carbon

What did you expect to happen?

Diagnostics reported, and completing without crashing.

What actually happened?

FATAL failure at toolchain/parse/parse.cpp:68: Invalid tree returned by Parse(): NodeId #nodeA couldn't be extracted as a FunctionDefinition. Trace:
Aggregate N6Carbon5Parse18FunctionDefinitionE: begin
Vector: begin
NodeIdInCategory Decl|Statement: kind ExprStatement consumed
NodeIdInCategory Decl|Statement error: kind IdentifierNameExpr doesn't match
Vector: end
NodeIdForKind error: wrong kind IdentifierNameExpr, expected FunctionDefinitionStart
Aggregate N6Carbon5Parse18FunctionDefinitionE: error
Error: IdentifierNameExpr node left unconsumed.

Any other information, logs, or outputs that you want to share?

The checking of the produce parse tree does not occur in an -c opt build.

This issue was found by fuzzing.

貢獻者指南

技術棧
cpp
領域
tooling
議題類型
bug
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
3
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
1-2 days
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
fresh
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
C++ programmingParsing fundamentalsBazel build system
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
35
研究方向
Start by examining the error trace in toolchain/parse/parse.cpp line 68. The issue is that a FunctionDefinition node cannot be extracted because an IdentifierNameExpr is left unconsumed. Investigate the parsing logic for function definitions to understand why this occurs. Use the provided reproduction command with a debug build to reproduce the crash. Look at how the parser handles 'fn{p>fn()}' and ensure that parse tree validation succeeds.