clangd hangs on valid C++

[kadircet]

foo.cc:

template <class T>
void foo() {
  T bar;
  auto baz = (bar, bar);
  baz.foo();
}

clangd --check=foo.cc hangs starting with 7fd8426 when building inlay hints. It terminates almost immediately at previous commit.

[llvmbot]

@llvm/issue-subscribers-clangd

Author: kadir çetinkaya (kadircet)

foo.cc: ``` template <class T> void foo() { T bar; auto baz = (bar, bar); baz.foo(); } ```

clangd --check=foo.cc hangs starting with 7fd8426 when building inlay hints. It terminates almost immediately at previous commit.

[kadircet]

This is triggering on some real world code in our code base, preventing us from cutting releases for clangd. So I'd really appreciate a revert if the fix-forward doesn't look trivial.

[HighCommander4]

This is triggering on some real world code in our code base, preventing us from cutting releases for clangd. So I'd really appreciate a revert if the fix-forward doesn't look trivial.

Thanks for the report! I'll have a look this evening and post either a fix or a revert for you to review tomorrow.

(If you need a solution sooner than that, please feel free to revert it today.)

[HighCommander4]

Explanation of the problem:

In simplifyType(), we have a loop which applies a simplification to a type on each iteration. The type is represented as a QualType, but the function also takes as input the expression whose type is represented, and in some cases looks at the expression for additional type information not stored in the QualType itself.

Some simplification steps produce the type of a subexpression as their result. So a simplification step conceptually takes a (type, expression) pair as input, and produces a new (type, expression) pair as output, where the expression can potentially be different as well as the type.

The bug is that the loop is only updating the type after each step, but reuses the original input expression. As a result, in some cases the simplification procedure can "jump back" to operating on the original expression, resulting in an infinite loop.

[HighCommander4]

Proposed fix: #126689

[HighCommander4]

See also #126690 as a potential additional hardening against this type of issue in the future.