Fix integer overflow in getCrossProductUnionSize causing hang on large template literal types#3929
Open
Copilot wants to merge 3 commits into
Open
Fix integer overflow in getCrossProductUnionSize causing hang on large template literal types#3929Copilot wants to merge 3 commits into
Copilot wants to merge 3 commits into
Conversation
…e template literal types Add overflow protection to prevent int64 wraparound when computing cross product union sizes. When the size would exceed 100,000, return 100,000 immediately instead of continuing to multiply, which could overflow and produce a value that bypasses the limit check. Add test case for template literal type with combinatorial explosion. Agent-Logs-Url: https://github.com/microsoft/typescript-go/sessions/5fcc3e3e-691e-43a4-b71c-72ae84389f8b Co-authored-by: jakebailey <5341706+jakebailey@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix tsgo hang on large template literal types
Fix integer overflow in getCrossProductUnionSize causing hang on large template literal types
May 16, 2026
jakebailey
reviewed
May 16, 2026
| case t.flags&TypeFlagsUnion != 0: | ||
| size *= len(t.Types()) | ||
| n := len(t.Types()) | ||
| if n > 0 && size > 100_000/n { |
Member
There was a problem hiding this comment.
@copilot 100_000 seems like a magic number, and this definitely requires a comment. Probably also best to return MaxInt?
Contributor
Author
There was a problem hiding this comment.
Updated in a446575 — now returns math.MaxInt and added a comment explaining the overflow guard and why it's needed (Go int wraps vs JS Infinity).
…UnionSize Agent-Logs-Url: https://github.com/microsoft/typescript-go/sessions/4f78a0b2-27bb-4eac-98cd-adc2beb086c3 Co-authored-by: jakebailey <5341706+jakebailey@users.noreply.github.com>
jakebailey
approved these changes
May 16, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes a hang in the type checker when expanding extremely large template literal types by preventing int overflow in getCrossProductUnionSize, ensuring the existing “too complex” guard (TS2590) reliably triggers.
Changes:
- Add overflow-capping logic to
Checker.getCrossProductUnionSizeso cross-product size never wraps to 0/negative on large unions. - Add a new compiler test that previously caused a combinatorial explosion hang, now expected to produce TS2590.
- Add reference baselines for the new test.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
internal/checker/checker.go |
Caps cross-product union size computation before int overflow to preserve complexity-limit behavior. |
testdata/tests/cases/compiler/templateLiteralTypeTooComplex.ts |
New regression test for large template literal type expansion. |
testdata/baselines/reference/compiler/templateLiteralTypeTooComplex.errors.txt |
Baseline asserting TS2590 is produced. |
testdata/baselines/reference/compiler/templateLiteralTypeTooComplex.types |
Baseline for type output under the new test. |
testdata/baselines/reference/compiler/templateLiteralTypeTooComplex.symbols |
Baseline for symbol output under the new test. |
testdata/baselines/reference/compiler/templateLiteralTypeTooComplex.js |
Baseline for JS emit output under the new test. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1346
Analysis
When
getCrossProductUnionSizecomputes the cross product of many union types (e.g., 49 unions of 4 members each = 4^49), the result overflows Go'sint(signed 64-bit integer). Specifically, 4^32 = 2^64 wraps to 0 in signed 64-bit arithmetic, causing all subsequent multiplications to produce 0. This meansgetCrossProductUnionSizereturns 0, which is less than the 100,000 limit, socheckCrossProductUnionincorrectly allows the expansion to proceed. The recursivemapTypecalls then attempt to expand 4^49 combinations, effectively hanging.In TypeScript (the reference implementation), numbers are 64-bit floats, so 4^49 evaluates to
Infinity, which correctly triggers the "too complex" error.Fix
Added overflow protection in
getCrossProductUnionSize: before each multiplication, check whethersize > math.MaxInt / n. If so, returnmath.MaxIntimmediately instead of continuing to multiply and risking overflow. This ensures the limit check incheckCrossProductUnioncorrectly detects and rejects excessively large cross products.Copilot Checklist
I successfully ran these commands at the end of my session, and they completed without error: