Extractor terminated with exit code 1 (error: the template argument list of the partial specialization includes a nontype argument [...])

[flowerhack]

Hi hello,

I'm a committer for the Chromium project & we've been experimenting with building CodeQL databases of Chromium.

Context

While building the Chromium CodeQL database, in addition to the previously-reported "catastrophic" errors ([1], [2]), we get many thousands of errors that, while they do not seem to cross the threshold to be logged as "catastrophic," they nonetheless cause the extractor to terminate with exit code 1 & lead to incomplete Chromium databases being created.

I've investigated these errors and have classed them into nine unique bug types. I intend to report all nine (this report is bug 1 of 9), with a reproducing test case for each.

The hope is that, if these bugs + the catastrophic errors are fixed, we will be able to have a complete build of a Chromium CodeQL database (barring, of course, the scenario where fixing these bugs serves to unmask new ones...!).

The Bug

When building the Chromium CodeQL database, we see ~8,500 errors of the following type:

"../../third_party/libc++/src/include/__iterator/segmented_iterator.h", line 72: error: the template argument list of the partial specialization includes a nontype argument whose type depends on a template parameter
  struct __has_specialization<_Tp, sizeof(_Tp) * 0> : true_type {};
         ^

Reproducing The Bug

I have created a standalone file which can be used to reproduce this bug, which is attached here as trace_process_ii.cc.txt (please remove the .txt extension; this was to make the Github attachment uploader happy).

Reproduction steps (assumes that trace_process_ii.cc is in /YOUR/ROOT/HERE; assumes Clang 19; assumes Linux):

(1) codeql database init --language=cpp --source-root=/YOUR/ROOT/HERE/SOME-EMPTY-DIRECTORY /YOUR/ROOT/HERE/repro-bug1-db --overwrite

(2) codeql database trace-command /YOUR_ROOT_HERE/repro-bug1-db --working-dir=/YOUR/ROOT/HERE -- clang -Wno-everything -fno-delete-null-pointer-checks -fno-ident -fno-strict-aliasing -fstack-protector -funwind-tables -fPIC -pthread -fcolor-diagnostics -fmerge-all-constants -mllvm -instcombine-lower-dbg-declare=0 -mllvm -split-threshold-for-reg-with-hint=0 -ffp-contract=off -fcomplete-member-pointers -m64 -msse3 -Wno-builtin-macro-redefined -D__DATE__= -D__TIME__= -D__TIMESTAMP__= -ffile-compilation-dir=. -no-canonical-prefixes -ftrivial-auto-var-init=pattern -O0 -fno-omit-frame-pointer -gdwarf-4 -g2 -gdwarf-aranges -gsplit-dwarf -ggnu-pubnames -fvisibility=hidden -Wheader-hygiene -Wstring-conversion -Wtautological-overlap-compare -sysroot/usr/lib/x86_64-linux-gnu/glib-2.0/include -DPROTOBUF_ALLOW_DEPRECATED=1 -Wenum-compare-conditional -Wno-c++11-narrowing-const-reference -Wno-undefined-bool-conversion -Wno-tautological-undefined-compare -std=c++20 -Wno-trigraphs -gsimple-template-names -fno-exceptions -fno-rtti -nostdinc++ -fvisibility-inlines-hidden -c ~/trace_process_ii.cc -o ~/some_file.o

(3) codeql database finalize -j=-1 /YOUR/ROOT/HERE/repro-bug1-db.

At the conclusion of these steps there should be logs in build-tracer.log and logs/extractor/ indicating the failure.

In addition to (1) trace_process_ii.cc.txt (the reproducer file), please find attached (2) the build-tracer.log and (3) the relevant extractor logfile (3d405.log) from running this on my own machine, which will hopefully be useful for debugging/triage.

I do have the logs for the entire Chromium build available upon request, but as you might imagine, those files are very large and may not be as useful to you as this standalone reproducer.

A fix for this bug (or, guidance on how we might be holding it wrong!) would be extremely helpful for us here in Chromium. Please let me know if you need any more information. Thank you!

3d405.log
build-tracer.log
trace_process_ii.cc.txt

[jketema]

Hi @flowerhack

Thanks for the report.

The offending code here seems to be:

template <class _Tp, size_t = 0>
struct __has_specialization : false_type {};

template <class _Tp>
struct __has_specialization<_Tp, sizeof(_Tp) * 0> : true_type {};

This code, however, only seems to be accepted by a clang compiler build from the llvm main branch, and not by any released clang compiler. Until a version of clang (19?) is released which accepts this code, I'm rather hesitant to follow up on this problem with our frontend provider, as there is no guarantee that this code will eventually be accepted by any released version of clang.

Note that this was different for the catastrophic errors you reported, as those we reducible to code that was accepted by clang 18.

[jketema]

Hi @flowerhack

I stand corrected. Apparently, this does compiler with older versions of clang, my reduced example was just not complete.

However, I'm not able to reproduce this problem with CodeQL 2.17.5. Does this problem still occur for you with the latest version of CodeQL?

[flowerhack]

Thanks for the heads-up re: clang versioning. Let me retry this with a newer CodeQL version & I'll report back shortly...