task: Stability — crashes, segfaults, and memory safety during indexing (14 issues)

[DeusData]

Scope

Umbrella tracker for crashes, segfaults, and memory-safety failures during indexing. Clusters: C/C++ LSP template-call resolution, lsp_cross scale limits, parallel-extract on very large repos, and dump-phase crashes.

Sub-issues

Fixed in v0.7.0:

• SEGV in c_resolve_pending_template_calls: OOB read on NULL-terminated param_types array #215 — SEGV in c_resolve_pending_template_calls (OOB read) — fixed (fix(c-lsp): guard pending template call resolution #322)
• Binary crash (buffer overflow) when passing unrecognised project name to MCP tools #235 — buffer overflow on unrecognised project name — fixed
• Crash on simple C++ code snippet #312 — crash on simple C++ snippet — fixed (Fix C++ template call segfault #360)
• Segmentation fault (core dumped) #336 — segfault (core dumped) — fixed/verified (icinga2 indexes clean)
• fix(extraction): convert remaining fixed-size stacks in extract_channels.c to growable TSNodeStack #339 — fixed-size stacks in extract_channel → dynamic — fixed
• Segmentation fault at start of lsp_cross pass on repositories with 200+ files #340 — segfault at lsp_cross start on 200+-file repos — fixed
• SIGSEGV in lsp_cross pass when all_defs exceeds ~1189 entries (scale-dependent, not file-specific) #344 — SIGSEGV when all_defs > ~1189 (scale) — fixed
• Segmentation fault when running codebase-memory-mcp cli index_repository on dhw/xx_hash.h #355 — segfault on macro-dense xxhash header — fixed (fix(c-lsp): guard pending template call resolution #322/fix(c-lsp): cap expression type evaluation steps #323/Fix C++ template call segfault #360; proxy regression test clsp_nocrash_issue355_xxhash_header)
• Fix C++ template call segfault #360 / fix(c-lsp): guard pending template call resolution #322 / fix(c-lsp): cap expression type evaluation steps #323 — C-LSP template-call + expr-eval-step guards — merged
• Crash on large codebase #385 — crash on large codebase (kicad) — verified clean (88k nodes)

Awaiting v0.7.0 retest (old-version crashes; not reproducible without reporter's exact repo):

• Full-repo indexing crashes in parallel.extract on large AOSP-scale repository #141 — parallel.extract segfault on AOSP-scale repo — retest asked (extract/scale hardening fix(extraction): convert remaining fixed-size stacks in extract_channels.c to growable TSNodeStack #339/Segmentation fault at start of lsp_cross pass on repositories with 200+ files #340/SIGSEGV in lsp_cross pass when all_defs exceeds ~1189 entries (scale-dependent, not file-specific) #344/82d5c84)
• Crash on Large Java Project: Memory Corruption Causes Database Corruption #189 — SIGTRAP/pointer-auth on 1.42M-line Java (v0.5.7), dump phase — retest asked
• Stuck when indexing project and laptop's fan is spinning at full speed #195 — stuck/hang on 2nd project (fan spinning) — retest asked (lsp_cross deadlock fix 82d5c84)
• segmentation fault (core dumped) #245 — segfault, no repro detail — need-info + retest asked
• Dump-phase crash on large TS monorepo (v0.6.1, darwin-arm64) — pipeline completes through semantic_edges then terminates abnormally before gbuf.dump #317 — dump-phase crash on large TS monorepo (v0.6.1) — retest asked (lsp_cross scale + 82d5c84)
• cbm_pipeline_pass_lsp_cross deadlocks on a specific .ts file (no progress, ~3 CPU-s, indefinite) #370 — lsp_cross deadlock on a specific .ts (SvelteKit/Turborepo) — retest asked (82d5c84 ordering fix)

Status (2026-05-31)

The crash classes are addressed in v0.7.0 by an extensive hardening pass: C-LSP template-call guards (#322/#323/#360), lsp_cross scale fixes (#340/#344), a deadlock/ordering fix (82d5c84), and fixed-size-stack → dynamic conversion (#339). ~11 children fixed/closed. The 6 remaining opens are crashes reported on v0.5.7–v0.6.1 against massive or proprietary repos (AOSP, 1.42M-line Java, private monorepos) that can't be cloned for CI repro — each has a targeted v0.7.0 retest request asking for the specific crashing file/path or log so a direct regression test can be added.

Acceptance

1. No crash on the regression corpus (icinga2, kicad, xxhash, scale-synthesized def sets). ✅
2. lsp_cross handles large def sets without SIGSEGV. ✅ (Segmentation fault at start of lsp_cross pass on repositories with 200+ files #340/SIGSEGV in lsp_cross pass when all_defs exceeds ~1189 entries (scale-dependent, not file-specific) #344)
3. Remaining large-repo crashes confirmed fixed or reproduced via reporter-supplied minimal cases — pending v0.7.0 retests.

Why one task

These share memory-safety / scale infrastructure in the extraction + lsp_cross + dump pipeline.

[DeusData]

Stability triage pass complete (14/14 children)

Worked each child by reproducing first (test or real-repo index), then confirming the fix:

✅ Resolved with regression tests (5):

• SEGV in c_resolve_pending_template_calls: OOB read on NULL-terminated param_types array #215 — C++ template-call OOB (clsp_nocrash_template_extra_call_args)
• Crash on simple C++ code snippet #312 — defaulted template param + auto (clsp_nocrash_issue312…)
• Binary crash (buffer overflow) when passing unrecognised project name to MCP tools #235 — bad-project-name buffer overflow (ASan test tool_bad_project_name_no_overflow_issue235)
• Segmentation fault at start of lsp_cross pass on repositories with 200+ files #340 / SIGSEGV in lsp_cross pass when all_defs exceeds ~1189 entries (scale-dependent, not file-specific) #344 — lsp_cross SIGSEGV at scale (4,000-def ASan test tslsp_scale_many_defs_no_crash_issue344)

✅ Resolved by real-repo reproduction in CI (2):

• Segmentation fault (core dumped) #336 — Icinga2 indexed clean on Linux+macOS (fast mode)
• Crash on large codebase #385 — KiCad indexed clean on Windows (moderate mode, 88k nodes)

💬 Could not reproduce on v0.7.0 — asked reporters to retest / provide data, left open (7):

• Segmentation fault when running codebase-memory-mcp cli index_repository on dhw/xx_hash.h #355 (xxhash header — added a vendored-xxhash extraction guard), cbm_pipeline_pass_lsp_cross deadlocks on a specific .ts file (no progress, ~3 CPU-s, indefinite) #370 (lsp_cross deadlock — pass rewritten + CBM_DISABLE_LSP_CROSS now built in), Dump-phase crash on large TS monorepo (v0.6.1, darwin-arm64) — pipeline completes through semantic_edges then terminates abnormally before gbuf.dump #317, Crash on Large Java Project: Memory Corruption Causes Database Corruption #189, Full-repo indexing crashes in parallel.extract on large AOSP-scale repository #141, segmentation fault (core dumped) #245, Stuck when indexing project and laptop's fan is spinning at full speed #195

All fixes verified under -fsanitize=address,undefined. The bulk of this group was resolved by the v0.7.0 C/C++ extraction hardening (#215/#312/#360), growable AST stacks (#339), the cross-LSP rewrite (#340/#344), and WAL/cgroup fixes (#277/#363).