Stack overflow in clippy_utils::check_proc_macro::ty_search_pat

[azriel91]

Summary

When running cargo clippy .. on my project, a stack overflow happens.

The backtrace is:

#0  0x00007ffff38a3a43 in _int_malloc (av=av@entry=0x7fffe4000030, bytes=bytes@entry=8) at ./malloc/malloc.c:3771
#1  0x00007ffff38a51b9 in __GI___libc_malloc (bytes=8) at ./malloc/malloc.c:3329
#2  0x00007ffff3bb7114 in alloc::raw_vec::finish_grow<alloc::alloc::Global> () at library/core/src/result.rs:827
#3  0x00007ffff3bb6fb2 in alloc::raw_vec::RawVec::grow_amortized<u8, alloc::alloc::Global> () at library/alloc/src/raw_vec.rs:404
#4  alloc::raw_vec::{impl#1}::reserve::do_reserve_and_handle<u8, alloc::alloc::Global> () at library/alloc/src/raw_vec.rs:289
#5  0x00007ffff3bb6f36 in alloc::raw_vec::RawVec::reserve<u8, alloc::alloc::Global> () at library/alloc/src/raw_vec.rs:293
#6  alloc::vec::Vec::reserve<u8, alloc::alloc::Global> () at library/alloc/src/vec/mod.rs:909
#7  alloc::vec::Vec::append_elements<u8, alloc::alloc::Global> () at library/alloc/src/vec/mod.rs:1994
#8  alloc::vec::spec_extend::{impl#4}::spec_extend<u8, alloc::alloc::Global> () at library/alloc/src/vec/spec_extend.rs:55
#9  alloc::vec::Vec::extend_from_slice<u8, alloc::alloc::Global> () at library/alloc/src/vec/mod.rs:2440
#10 alloc::string::String::push_str () at library/alloc/src/string.rs:903
#11 alloc::string::{impl#67}::write_str () at library/alloc/src/string.rs:2818
#12 core::fmt::{impl#0}::write_str<alloc::string::String> () at library/core/src/fmt/mod.rs:199
#13 0x00007ffff3bc9abc in core::fmt::rt::Argument::fmt () at library/core/src/fmt/rt.rs:138
#14 core::fmt::write () at library/core/src/fmt/mod.rs:1094
#15 0x00007ffff3bb8964 in core::fmt::Write::write_fmt<alloc::string::String> () at library/core/src/fmt/mod.rs:192
#16 alloc::fmt::format::format_inner () at library/alloc/src/fmt.rs:610
#17 0x0000555555d0b23c in clippy_utils::check_proc_macro::ty_search_pat ()
#18 0x0000555555d0b254 in clippy_utils::check_proc_macro::ty_search_pat ()
#19 0x0000555555d0b254 in clippy_utils::check_proc_macro::ty_search_pat ()
#20 0x0000555555d0b254 in clippy_utils::check_proc_macro::ty_search_pat ()
#21 0x0000555555d0b254 in clippy_utils::check_proc_macro::ty_search_pat ()
#22 0x0000555555d0b254 in clippy_utils::check_proc_macro::ty_search_pat ()
#23 0x0000555555d0b254 in clippy_utils::check_proc_macro::ty_search_pat ()
// this frame repeats forever

Reproducer

I couldn't come up with an MCVE, but here are commands to obtain the code and what I use to run clippy:

git clone git@github.com:azriel91/peace.git
cd peace
git switch -d df6cd535 # the commit with the issue

cargo clippy \
  --workspace \
  --features "cli error_reporting output_progress" \
  --fix \
  --exclude peace_rt_model_web \
  -- -D warnings

Also seen on github actions

The commit that introduced this behaviour is likely a55d4584 (2 commits back), and I suspect the overflow may be to do with: crate/cmd_rt/src/cmd_execution.rs:136, i.e.

• the async fn cmd_outcome_task (crazy signature, sorry), in combination with
• CmdBlockRtBox, which is a type alias for Pin<Box<dyn CmdBlockRt<..>>
• many trait bounds

---

Here's the tricky thing:

1. I reproduced this with rustc nightly which was maybe from 2023-09-12.
2. I got the clippy-driver command to run in gdb from that.
3. I upgraded rustc (so I don't know what it was in 1).
4. The new rust nightly still produces the stack overflow, but doesn't produce the same clippy-driver command, instead it runs .../cargo .../rustc ....

gdb command, from nightly maybe 2023-09-12

Added -vv to the cargo clippy .. command to get the following (I added the gdb args):

CARGO=/home/azriel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/cargo CARGO_CRATE_NAME=peace_cmd_rt CARGO_MANIFEST_DIR=/mnt/data/work/github/azriel91/peace/crate/cmd_rt CARGO_PKG_AUTHORS='Azriel Hoh <azriel91@gmail.com>' CARGO_PKG_DESCRIPTION='Runtime types for commands for the Peace framework.' CARGO_PKG_HOMEPAGE='https://peace.mk' CARGO_PKG_LICENSE='MIT OR Apache-2.0' CARGO_PKG_LICENSE_FILE='' CARGO_PKG_NAME=peace_cmd_rt CARGO_PKG_README=../../README.md CARGO_PKG_REPOSITORY='https://github.com/azriel91/peace' CARGO_PKG_RUST_VERSION='' CARGO_PKG_VERSION=0.0.11 CARGO_PKG_VERSION_MAJOR=0 CARGO_PKG_VERSION_MINOR=0 CARGO_PKG_VERSION_PATCH=11 CARGO_PKG_VERSION_PRE='' CLICOLOR_FORCE=1 LD_LIBRARY_PATH='/mnt/data/work/github/azriel91/peace/target/debug/deps:/home/azriel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib:/home/azriel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib' gdb --args /home/azriel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/clippy-driver /home/azriel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/rustc --crate-name peace_cmd_rt --edition=2021 crate/cmd_rt/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --diagnostic-width=239 --crate-type lib --emit=dep-info,metadata -C embed-bitcode=no -C debuginfo=2 --cfg 'feature="default"' -C metadata=4be734e634324805 -C extra-filename=-4be734e634324805 --out-dir /mnt/data/work/github/azriel91/peace/target/debug/deps -C linker=clang -C incremental=/mnt/data/work/github/azriel91/peace/target/debug/incremental -L dependency=/mnt/data/work/github/azriel91/peace/target/debug/deps --extern async_trait=/mnt/data/work/github/azriel91/peace/target/debug/deps/libasync_trait-c5013087acb4b4cb.so --extern cfg_if=/mnt/data/work/github/azriel91/peace/target/debug/deps/libcfg_if-d488aff7a2e4faf1.rmeta --extern futures=/mnt/data/work/github/azriel91/peace/target/debug/deps/libfutures-4bc0c0a10863790d.rmeta --extern peace_cfg=/mnt/data/work/github/azriel91/peace/target/debug/deps/libpeace_cfg-c15f55a7cdcce3a3.rmeta --extern peace_cmd=/mnt/data/work/github/azriel91/peace/target/debug/deps/libpeace_cmd-bef016c47763165e.rmeta --extern peace_resources=/mnt/data/work/github/azriel91/peace/target/debug/deps/libpeace_resources-fb2bd2b92dd9f3cb.rmeta --extern peace_rt_model=/mnt/data/work/github/azriel91/peace/target/debug/deps/libpeace_rt_model-3f218570f0eb0c4e.rmeta --extern thiserror=/mnt/data/work/github/azriel91/peace/target/debug/deps/libthiserror-428fa5d46cfc06a0.rmeta --extern tokio=/mnt/data/work/github/azriel91/peace/target/debug/deps/libtokio-09b336b67c68e420.rmeta --extern tynm=/mnt/data/work/github/azriel91/peace/target/debug/deps/libtynm-8017746ff81c2074.rmeta -C link-arg=-fuse-ld=/usr/local/bin/mold

Version

rustc 1.74.0-nightly (203c57dbe 2023-09-17)
binary: rustc
commit-hash: 203c57dbe20aee67eaa8f7be45d1e4ef0b274109
commit-date: 2023-09-17
host: x86_64-unknown-linux-gnu
release: 1.74.0-nightly
LLVM version: 17.0.0

Additional Labels

No response

[y21]

MCVE:

fn cmd_outcome_task2(x: &mut fn()) {
}

Backtrace of just before reaching ty_search_pat:

Expand

#7969 0x0000561846dbd4cc in clippy_utils::check_proc_macro::ty_search_pat ()
#7970 0x0000561846dbd4cc in clippy_utils::check_proc_macro::ty_search_pat ()
#7971 0x0000561846dbd4cc in clippy_utils::check_proc_macro::ty_search_pat ()
#7972 0x0000561846dbd4cc in clippy_utils::check_proc_macro::ty_search_pat ()
#7973 0x0000561846dbd4cc in clippy_utils::check_proc_macro::ty_search_pat ()
#7974 0x0000561846dbd338 in clippy_utils::check_proc_macro::ty_search_pat ()
#7975 0x0000561846e7c64d in <rustc_hir::hir::Ty as clippy_utils::check_proc_macro::WithSearchPat>::search_pat ()
#7976 0x0000561846a6d5e2 in clippy_utils::check_proc_macro::is_from_proc_macro ()
#7977 0x00005618464a5775 in clippy_lints::needless_pass_by_ref_mut::should_skip ()
#7978 0x00005618463fd275 in <clippy_lints::needless_pass_by_ref_mut::NeedlessPassByRefMut as rustc_lint::passes::LateLintPass>::check_fn::{{closure}} ()
#7979 0x00005618463fcb51 in core::ops::function::impls::<impl core::ops::function::FnMut<A> for &mut F>::call_mut ()
#7980 0x0000561846690888 in core::iter::traits::iterator::Iterator::find::check::{{closure}} ()
#7981 0x000056184666f40c in core::iter::traits::iterator::Iterator::try_fold ()
#7982 0x000056184666bd32 in core::iter::traits::iterator::Iterator::find ()
#7983 0x0000561846435235 in <core::iter::adapters::filter::Filter<I,P> as core::iter::traits::iterator::Iterator>::next ()
#7984 0x0000561846671d1e in <core::iter::adapters::peekable::Peekable<I> as core::iter::traits::iterator::Iterator>::next ()
#7985 0x00005618464a659b in <clippy_lints::needless_pass_by_ref_mut::NeedlessPassByRefMut as rustc_lint::passes::LateLintPass>::check_fn ()
#7986 0x00007fa96ee85015 in <rustc_lint::late::LateContextAndPass<rustc_lint::late::RuntimeCombinedLateLintPass> as rustc_hir::intravisit::Visitor>::visit_fn ()
#7987 0x00007fa96eea196d in rustc_hir::intravisit::walk_item::<rustc_lint::late::LateContextAndPass<rustc_lint::late::RuntimeCombinedLateLintPass>> ()
#7988 0x00007fa96ee82b9b in <rustc_lint::late::LateContextAndPass<rustc_lint::late::RuntimeCombinedLateLintPass> as rustc_hir::intravisit::Visitor>::visit_nested_item ()
#7989 0x00007fa96eea06da in rustc_hir::intravisit::walk_mod::<rustc_lint::late::LateContextAndPass<rustc_lint::late::RuntimeCombinedLateLintPass>> ()

Happens in the needless_pass_by_ref_mut lint

[y21]

Looks like clippy recurses forever when passing a BareFn to ty_search_pat:

rust-clippy/clippy_utils/src/check_proc_macro.rs

Lines 334 to 337 in 4022591

	TyKind::BareFn(bare_fn) => (
	Pat::OwnedStr(format!("{}{} fn", bare_fn.unsafety.prefix_str(), bare_fn.abi.name())),
	ty_search_pat(ty).1,
	),

ty passed to ty_search_pat here is the parameter, so this keeps on calling itself with the same param.
Looks like this function was initially introduced here e97f190

I'm not too sure how this function works, so, cc @Centri3 (commit author) for awareness :D

[Centri3]

Think I copied that from the other arms, yet there's no shadowing of ty here ^^

We should change this to either having an empty end (Pat::Str("")) or reconstruct the parameters and return type from decl.

[azriel91]

Update: clippy shipped with Rust 1.73.0 stable also has this issue.

[matthiaskrgr]

Just ran into this while fuzzing 🙃
fn bar(_: &mut fn(&mut String)) {}