Tree-sitter: Segfault in Rust binding

[ubolonton]

I got segfault using the Rust binding. It can be reproduced with the CLI using this grammar and input.

The WASM binding works fine with the same grammar and input (through web-ui).

CLI version: tree-sitter 0.15.7 (5d43b58751ca4135a42e37b3b52f9bbea3055ab1)

This is the backtrace:

(lldb) target create "/Users/ubolonton/.config/yarn/global/node_modules/tree-sitter-cli/tree-sitter"
Current executable set to '/Users/ubolonton/.config/yarn/global/node_modules/tree-sitter-cli/tree-sitter' (x86_64).
(lldb) settings set -- target.run-args  "parse" "segfault.test"
(lldb) run
Process 58117 launched: '/Users/ubolonton/.config/yarn/global/node_modules/tree-sitter-cli/tree-sitter' (x86_64)
Process 58117 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x6)
    frame #0: 0x000000010022efa5 tree-sitter`ts_subtree_set_children + 885
tree-sitter`ts_subtree_set_children:
->  0x10022efa5 <+885>: cmpw   $0x0, (%rbx,%rcx,2)
    0x10022efaa <+890>: je     0x10022efe0               ; <+944>
    0x10022efac <+892>: testb  $0x1, %r15b
    0x10022efb0 <+896>: jne    0x10022f065               ; <+1077>
Target 0: (tree-sitter) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x6)
  * frame #0: 0x000000010022efa5 tree-sitter`ts_subtree_set_children + 885
    frame #1: 0x000000010022f501 tree-sitter`ts_subtree_new_node + 465
    frame #2: 0x0000000100232b5e tree-sitter`ts_parser__reduce + 510
    frame #3: 0x0000000100226a97 tree-sitter`ts_parser_parse + 10391
    frame #4: 0x000000010015b294 tree-sitter`tree_sitter_cli::parse::parse_file_at_path::he4f6c574e1714f0c + 2004
    frame #5: 0x0000000100009214 tree-sitter`tree_sitter::run::h2c02370c8b9eea76 + 12292
    frame #6: 0x0000000100006105 tree-sitter`tree_sitter::main::h3895a96a3873f0de + 21
    frame #7: 0x0000000100004666 tree-sitter`std::rt::lang_start::_$u7b$$u7b$closure$u7d$$u7d$::h2c2da74fab117b47 + 6
    frame #8: 0x000000010033f308 tree-sitter`std::panicking::try::do_call::h1252fc9a2ff235eb + 24
    frame #9: 0x0000000100347a6f tree-sitter`__rust_maybe_catch_panic + 31
    frame #10: 0x000000010033fd2e tree-sitter`std::rt::lang_start_internal::h4c054360e442146c + 542
    frame #11: 0x0000000100009f09 tree-sitter`main + 41
    frame #12: 0x00007fff717aa015 libdyld.dylib`start + 1
    frame #13: 0x00007fff717aa015 libdyld.dylib`start + 1
(lldb)

The backtrace when using a debug build of the Emacs binding (based on the Rust binding) is:

8   ???                             000000000000000000 0 + 0
9   tree-sitter-dyn.so              0x0000000103ba11ea ts_subtree_new_node + 474 (subtree.c:497)
10  tree-sitter-dyn.so              0x0000000103ba7103 ts_parser__reduce + 531 (parser.c:722)
11  tree-sitter-dyn.so              0x0000000103b996d0 ts_parser__advance + 1504 (parser.c:1338)
12  tree-sitter-dyn.so              0x0000000103b98887 ts_parser_parse + 1447 (parser.c:1698)
13  tree-sitter-dyn.so              0x0000000103b19fcf tree_sitter::Parser::parse_custom::hda4b5e9e5ba987ea + 191 (lib.rs:368)
14  tree-sitter-dyn.so              0x0000000103b19dcd tree_sitter::Parser::parse_with::h937ff9c687eaef68 + 45 (lib.rs:345)
15  tree-sitter-dyn.so              0x0000000103b1a18b tree_sitter::Parser::parse::h9f8dca6a7d94eaff + 139 (lib.rs:321)
16  tree-sitter-dyn.so              0x0000000103b1d71a tree_sitter_dyn::parser::parse_string::hfcf1a1e95550d779 + 74 

[issue-label-bot[bot]]

Issue-Label Bot is automatically applying the label bug to this issue, with a confidence of 0.99. Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!

Links: app homepage, dashboard and code for this bot.

[ubolonton]

It doesn't segfault if I remove uses of field from the grammar.

[maxbrunsfeld]

Thanks for the great reproduction case. I was generating the C code incorrectly in the case where the grammar used field but never used alias.

The fix is on master; I will probably publish a new release on Monday.