| Issue |
208290
|
| Summary |
clang 23 crashes with template friends
|
| Labels |
clang:frontend,
crash
|
| Assignees |
|
| Reporter |
avikivity
|
# Clang crashes (heap corruption) when a class template befriends a member-class-template specialization that then accesses a private member
## Summary
When a class template `data<K>` befriends a *specialization of a member class
template* of another class template — `friend struct tree<K>::template ib<true>;`
— and that specialization is instantiated and actually exercises the friendship
(accesses a private member of `data`), clang corrupts the heap and aborts.
## Reproducer
```cpp
template <typename K> class data;
template <typename K>
struct tree {
template <bool Const>
struct ib {
int get(data<K>* d) { return d->value; } // uses friendship
};
};
template <typename K>
class data {
friend struct tree<K>::template ib<true>; // befriend member-class-template specialization
int value;
};
template struct tree<int>::ib<true>; // instantiate -> crash
```
## Command
```
clang++ -std=c++23 -fsyntax-only friend-member-template-crash.cpp
```
## Actual behavior
The compiler aborts (SIGABRT, exit 134) with a "PLEASE submit a bug report"
message. It is 100% reproducible. In a larger TU it manifests instead as
SIGSEGV mid-compilation — the signature of heap corruption, so the exact fault
address is allocation-dependent. This is a release build (no assertions); an
assertions/ASan build would pinpoint the faulting code.
## Expected behavior
Compiles cleanly. The friend declaration is well-formed and grants `ib<true>`
access to `data::value`.
## What narrows it down
- Removing the `friend` line → compiles fine.
- Making `value` **public** (so friendship is never checked) → compiles fine.
- Never instantiating `tree<int>::ib<true>` → compiles fine.
So the crash is specifically in the friendship access-granting path for a
**member-class-template specialization** named as a friend of a class template.
## Version
```
clang version 23.0.0git (https://github.com/llvm/llvm-project.git 290f3bc2d12e5875a0be386fad8f6a5dfce9d6a3)
Target: x86_64-unknown-linux-gnu
```
Also reproduces with `-std=c++17` and `-std=c++20`.
![]()
_______________________________________________
llvm-bugs mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
