task: Stability — crashes, segfaults, and memory safety during indexing (14 issues) #390

Scope

Umbrella tracker for crashes, segfaults, and memory-safety failures during indexing. Clusters: C/C++ LSP template-call resolution, lsp_cross scale limits, parallel-extract on very large repos, and dump-phase crashes.

Sub-issues

Fixed in v0.7.0:

• SEGV in c_resolve_pending_template_calls: OOB read on NULL-terminated param_types array #215 — SEGV in c_resolve_pending_template_calls (OOB read) — fixed (fix(c-lsp): guard pending template call resolution #322)
• Binary crash (buffer overflow) when passing unrecognised project name to MCP tools #235 — buffer overflow on unrecognised project name — fixed
• Crash on simple C++ code snippet #312 — crash on simple C++ snippet — fixed (Fix C++ template call segfault #360)
• Segmentation fault (core dumped) #336 — segfault (core dumped) — fixed/verified (icinga2 indexes clean)
• fix(extraction): convert remaining fixed-size stacks in extract_channels.c to growable TSNodeStack #339 — fixed-size stacks in extract_channel → dynamic — fixed
• Segmentation fault at start of lsp_cross pass on repositories with 200+ files #340 — segfault at lsp_cross start on 200+-file repos — fixed
• SIGSEGV in lsp_cross pass when all_defs exceeds ~1189 entries (scale-dependent, not file-specific) #344 — SIGSEGV when all_defs > ~1189 (scale) — fixed
• Segmentation fault when running codebase-memory-mcp cli index_repository on dhw/xx_hash.h #355 — segfault on macro-dense xxhash header — fixed (fix(c-lsp): guard pending template call resolution #322/fix(c-lsp): cap expression type evaluation steps #323/Fix C++ template call segfault #360; proxy regression test clsp_nocrash_issue355_xxhash_header)
• Fix C++ template call segfault #360 / fix(c-lsp): guard pending template call resolution #322 / fix(c-lsp): cap expression type evaluation steps #323 — C-LSP template-call + expr-eval-step guards — merged
• Crash on large codebase #385 — crash on large codebase (kicad) — verified clean (88k nodes)

Awaiting v0.7.0 retest (old-version crashes; not reproducible without reporter's exact repo):

• Full-repo indexing crashes in parallel.extract on large AOSP-scale repository #141 — parallel.extract segfault on AOSP-scale repo — retest asked (extract/scale hardening fix(extraction): convert remaining fixed-size stacks in extract_channels.c to growable TSNodeStack #339/Segmentation fault at start of lsp_cross pass on repositories with 200+ files #340/SIGSEGV in lsp_cross pass when all_defs exceeds ~1189 entries (scale-dependent, not file-specific) #344/82d5c84)
• Crash on Large Java Project: Memory Corruption Causes Database Corruption #189 — SIGTRAP/pointer-auth on 1.42M-line Java (v0.5.7), dump phase — retest asked
• Stuck when indexing project and laptop's fan is spinning at full speed #195 — stuck/hang on 2nd project (fan spinning) — retest asked (lsp_cross deadlock fix 82d5c84)
• segmentation fault (core dumped) #245 — segfault, no repro detail — need-info + retest asked
• Dump-phase crash on large TS monorepo (v0.6.1, darwin-arm64) — pipeline completes through semantic_edges then terminates abnormally before gbuf.dump #317 — dump-phase crash on large TS monorepo (v0.6.1) — retest asked (lsp_cross scale + 82d5c84)
• cbm_pipeline_pass_lsp_cross deadlocks on a specific .ts file (no progress, ~3 CPU-s, indefinite) #370 — lsp_cross deadlock on a specific .ts (SvelteKit/Turborepo) — retest asked (82d5c84 ordering fix)

Status (2026-05-31)

The crash classes are addressed in v0.7.0 by an extensive hardening pass: C-LSP template-call guards (#322/#323/#360), lsp_cross scale fixes (#340/#344), a deadlock/ordering fix (82d5c84), and fixed-size-stack → dynamic conversion (#339). ~11 children fixed/closed. The 6 remaining opens are crashes reported on v0.5.7–v0.6.1 against massive or proprietary repos (AOSP, 1.42M-line Java, private monorepos) that can't be cloned for CI repro — each has a targeted v0.7.0 retest request asking for the specific crashing file/path or log so a direct regression test can be added.

Acceptance

1. No crash on the regression corpus (icinga2, kicad, xxhash, scale-synthesized def sets). ✅
2. lsp_cross handles large def sets without SIGSEGV. ✅ (Segmentation fault at start of lsp_cross pass on repositories with 200+ files #340/SIGSEGV in lsp_cross pass when all_defs exceeds ~1189 entries (scale-dependent, not file-specific) #344)
3. Remaining large-repo crashes confirmed fixed or reproduced via reporter-supplied minimal cases — pending v0.7.0 retests.

Why one task

These share memory-safety / scale infrastructure in the extraction + lsp_cross + dump pipeline.

Added 2026-06-29 (triage)

• fix(extract): indexing large SQL files crashes native parser (tree-sitter SQL assertion / stack overflow) #691 — SQL parser crash implementation tracker (relates Indexing large SQL file crashes native parser (Tree-sitter SQL assertion / stack overflow) #668)
• Indexing large SQL file crashes native parser (Tree-sitter SQL assertion / stack overflow) #668 — large SQL file crashes native parser / tree-sitter SQL assertion
• lsp_all.o not rebuilt when cbm.h changes → stale-object ODR mismatch (ASan stack-buffer-underflow in cbm_calls_push) #661 — stale lsp_all.o rebuild dependency causes ASan stack-buffer-underflow
• [Bug] v0.8.1 darwin-arm64 binary aborts with dyld: unknown imports format on macOS 26.5.1 #630 — darwin-arm64 release binary aborts with dyld: unknown imports format on macOS 26 beta
• v0.8.1 darwin-arm64 binary aborts with dyld: unknown imports format on macOS 26.5.1 #629 — duplicate darwin-arm64 dyld: unknown imports format report (see [Bug] v0.8.1 darwin-arm64 binary aborts with dyld: unknown imports format on macOS 26.5.1 #630)
• Crash when calling query_graph #627 — query_graph crash on Windows
• [ui] Graph canvas is black on high-DPI/large displays: EffectComposer MSAA render target exceeds GPU allocation (glRenderbufferStorageMultisample too large) due to uncapped setPixelRatio(dpr) #648 — graph UI black canvas from oversized high-DPI MSAA render target

Added 2026-06-30 (triage)

• Python parser hangs on deeply chained method calls during definitions pass #710 — Python definitions pass hangs on deep chained method calls (LangGraph StateGraph pattern)

Added 2026-07-09 (triage)

• SIGABRT (invalid free in ts_stack_delete via cbm_destroy_thread_parser) on second index_repository in one server process — server dies silently #773 — SIGABRT (invalid free in ts_stack_delete via cbm_destroy_thread_parser) on second index_repository in one server process
• ts_runtime: bound GLR stack-merge recursion to prevent stack overflow on pathological input #913 — ts_runtime: bound GLR stack-merge recursion to prevent stack overflow on pathological input
• PHP: trait whose name collides with an aliased use … as import it composes → unbounded recursion in definitions pass, OOM (SIGKILL) #765 — PHP: trait name colliding with aliased use … as import → unbounded recursion in definitions pass, OOM (verify against the fix(lsp/php): prevent OOM when a PHP trait uses itself #920 loop-bound fix)
• Indexer OOM-killed (exit 137): infinite loop in PHP trait flattening when a class shares its short name with an aliased trait import #951 — PHP: infinite trait flattening when a class shares its short name with an aliased trait import, OOM exit 137 (verify against the fix(lsp/php): prevent OOM when a PHP trait uses itself #920 loop-bound fix)
• Indexer hangs (deadlock) and blows up RAM on a mid-size MQL5 codebase #775 — indexer deadlock + unbounded RAM on a mid-size MQL5 codebase (Windows)

Added 2026-08-03 (triage)

• index_repository crashes at dump phase — all modes affected #1379 — index_repository crashes in the dump phase across all modes
• index_repository crashes with SIGILL (EXC_BAD_INSTRUCTION) at cbm_pipeline_new entry — reproducible on trivial 1-file repo, macOS 26.5.2 / Apple M3 Pro #1343 — macOS Apple Silicon release binary traps with SIGILL at cbm_pipeline_new