RE: [Gcl-devel] memory damaged at (system:STRING-MATCH :anykey :verbose)

[Mike Thomas]

Hi Michael.

Thanks for the test file, Michael - it saves a lot of effort.

I realised why I couldn't break in the C debugger - I had thought that
"aset-by-cursor" was the one in GCL's "o/array.c", but not so - it is
defined in "src/clmacs.lsp".

| > The first is a crash in Maxima's src/specfn.o which crashes
| while loading
| > when compiled with gcc version 3.3.3 and 3.4.0.  From the Lisp side that
| > occurs during the initialisation phase when the very first
| array of values
| > is set up. (fillarray *li2* .....)
|
|   ok - i think it does'nt crash here - but I've attached the first step
|   of my method (extract a source to cover the problem) so you might be
|   able to circle it a bit more down.
|
|   Tests would be:
|   - cut'n'paste the script

OK.

|   - load the script from one file

OK.

|   - compile that file

OK.

|   - load the script from the compiled file

Failed.

============================================================================
=====
>(load "specfntest.o")

Loading specfntest.o
Error in FILLARRAY [or a callee]: Caught fatal error [memory may be damaged]

Fast links are on: do (use-fast-links nil) for debugging
Broken at FILLARRAY.  Type :H for Help.
 1 (Continue) Retry loading file "specfntest.o".
 2 Return to top level.
dbl:>>:bt

#0   FILLARRAY {ar=#(0.0 0.0 0.0 ...),x=(14.0 1.9350643000000001
0.1660730330000
0001 ...),loc2=...} [ihs=8]
#1   CLCS-LOAD {file=#<compiled-function fillarray>} [ihs=7]
#2   EVAL {loc0=nil,loc1=nil,loc2=nil,loc3=#<compiled-function
conditions::clcs-
load>,loc4...} [ihs=6]
#3   TOP-LEVEL
{loc0=nil,loc1=0,loc2=0,loc3=nil,loc4=nil,loc5=nil,loc6=nil,loc7=
"c:/cvs/head/gc...} [ihs=5]
#4   FUNCALL {loc0=#<compiled-function system:top-level>} [ihs=4]
NIL
dbl:>>
============================================================================
=====


|   - split the script into 2 parts
|   - load both

OK when loaded but not compiled:

|   - compile and load both

Failed:

============================================================================
=====
>(load "specfntest-2.o")

Loading specfntest-2.o
Error in FILLARRAY [or a callee]: Caught fatal error [memory may be damaged]

Fast links are on: do (use-fast-links nil) for debugging
Broken at FILLARRAY.  Type :H for Help.
 1 (Continue) Retry loading file "specfntest-2.o".
 2 Return to top level.
dbl:>>:bt

#0   FILLARRAY {ar=#(0.0 0.0 0.0 ...),x=(14.0 1.9350643000000001
0.1660730330000
0001 ...),loc2=...} [ihs=8]
#1   CLCS-LOAD {file=("specfntest-2.o"),args=nil,g2560=(nil
"specfntest-2.o"),lo
c3=(#<@1A49BFB8...} [ihs=7]
#2   EVAL {loc0=nil,loc1=nil,loc2=nil,loc3=#<compiled-function
conditions::clcs-
load>} [ihs=6]
#3   TOP-LEVEL
{loc0=nil,loc1=0,loc2=0,loc3=nil,loc4=nil,loc5=nil,loc6=nil,loc7=
"c:/cvs/head/gc...} [ihs=5]
#4   FUNCALL {loc0=#<compiled-function system:top-level>} [ihs=4]
NIL
dbl:>>
============================================================================
=====

The odd thing about this is that if I do this via your test file (modified
with some tracing format statements) the failure occurs when the first (f- v
1) is executed in "set-up-cursor".

I had already format traced in the maxima specfn (just copied the same ones
across) and found the error occurred when the first "aset" in
"aset-by-cursor" occurred.

So I decided to remove the f- in your test file, replacing it with -; that
gave me the same results as with "specfn.o".

So I replaced f+ with + in your test, and the test passed OK.  Did the same
in Maxima's clmacs.lsp (removed f- and f+) and still got the failure.

I'm thinking that the f+/f- thing might be a red herring.  The two test
files are attached.

A gdb backtrace with f+, f- included in the test is attached.  Also one with
just the f+ instances - same crash location as with Maxima in specfn.o
although from memory the stack backtrace is substantially different.

Cheers

Mike Thomas.

=====================F+,
F-===================================================
Loading specfntest-2.o
set-up-cursor: lis (15)
set-up-cursor: 1 *acursor* #(1 0 0 0 0 0 0 0 0 0 0)
set-up-cursor:  (aref *acursor* 0) 1
set-up-cursor:  (aref *acursor* 1) 0
set-up-cursor:  (aref *acursor* 2) 0
set-up-cursor:  (aref *acursor* 3) 0
set-up-cursor:  (aref *acursor* 4) 0
set-up-cursor:  (aref *acursor* 5) 0
set-up-cursor:  (aref *acursor* 6) 0
set-up-cursor:  (aref *acursor* 7) 0
set-up-cursor:  (aref *acursor* 8) 0
set-up-cursor:  (aref *acursor* 9) 0
set-up-cursor:  (aref *acursor* 10) 0

Program received signal SIGSEGV, Segmentation fault.
0x1a6f7be9 in ?? ()
(gdb) :bt
Undefined command: "".  Try "help".
(gdb) bt
#0  0x1a6f7be9 in ?? ()
#1  0x1a4c36c8 in ?? ()
#2  0x00000002 in ?? ()
#3  0x1a598234 in ?? ()
#4  0x006d6ab0 in sKoverwrite ()
#5  0x0000000f in ?? ()
#6  0x1a6f7fe4 in ?? ()
#7  0x007465f4 in value_stack ()
#8  0x007465e8 in value_stack ()
#9  0x1a4c36c8 in ?? ()
#10 0x00000002 in ?? ()
#11 0x006d6ab0 in sKoverwrite ()
#12 0x006d6ab0 in sKoverwrite ()
#13 0x0073b048 in small_fixnum_table ()
#14 0x0073b0b8 in small_fixnum_table ()
#15 0x0022e4d8 in ?? ()
#16 0x0041d18e in funcall (fun=0x7465dc) at eval.c:213
Previous frame identical to this frame (corrupt stack?)
(gdb)
(gdb) p  (0x1a6f7be9->d.t)
Attempt to extract a component of a value that is not a structure pointer.
(gdb) p  ((*0x1a6f7be9)->d.t)
Attempt to extract a component of a value that is not a structure pointer.
(gdb) whatis 0x1a6f7be9
type = int
(gdb) whatis *0x1a6f7be9
type = int
(gdb)

========F+ only same crash location as Maxima specfn.o load==============
>
Loading specfntest-2.o
set-up-cursor: lis (15)
set-up-cursor: 1 *acursor* #(1 0 0 0 0 0 0 0 0 0 0)
set-up-cursor:  (aref *acursor* 0) 1
set-up-cursor:  (aref *acursor* 1) 0
set-up-cursor:  (aref *acursor* 2) 0
set-up-cursor:  (aref *acursor* 3) 0
set-up-cursor:  (aref *acursor* 4) 0
set-up-cursor:  (aref *acursor* 5) 0
set-up-cursor:  (aref *acursor* 6) 0
set-up-cursor:  (aref *acursor* 7) 0
set-up-cursor:  (aref *acursor* 8) 0
set-up-cursor:  (aref *acursor* 9) 0
set-up-cursor:  (aref *acursor* 10) 0
set-up-cursor: v 15, i 6, (- v 1) 14
set-up-cursor: 2 *acursor* #(1 0 0 0 0 0 14 0 0 0 0)
set-up-cursor: 3 *acursor* #(1 0 0 0 0 0 14 0 0 0 0)
aset-by-cursor: curs #(1 0 0 0 0 0 14 0 0 0 0)
val 14.0
ar #(0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0)
aset-by-cursor: (aref curs 0) 1
aset-by-cursor: (aref curs 1) 0
aset-by-cursor: (aref ar 0) 0.0
aset-by-cursor: (aref ar 1) 0.0
aset-by-cursor: ar #(1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
                     0.0 0.0 0.0)
aset-by-cursor: ar #(14.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
                     0.0 0.0 0.0)

Program received signal SIGSEGV, Segmentation fault.
0x1a6f7c5a in ?? ()
(gdb) bt
#0  0x1a6f7c5a in ?? ()
#1  0x006d6ab0 in sKoverwrite ()
#2  0x006d6ab0 in sKoverwrite ()
#3  0x006d6ab0 in sKoverwrite ()
#4  0x006d6ab0 in sKoverwrite ()
#5  0x00000005 in ?? ()
#6  0x77c3da2a in msvcrt!getc () from C:\WINDOWS\system32\msvcrt.dll
#7  0x007465e4 in value_stack ()
#8  0x007465d8 in value_stack ()
#9  0x007e7244 in current_fasd ()
#10 0x1a4c36c8 in ?? ()
#11 0x006d6ab0 in sKoverwrite ()
#12 0x006d6ab0 in sKoverwrite ()
#13 0x0073b048 in small_fixnum_table ()
#14 0x0073b068 in small_fixnum_table ()
#15 0x0022e4a8 in ?? ()
#16 0x0041d18e in funcall (fun=0x7465cc) at eval.c:213
Previous frame identical to this frame (corrupt stack?)
(gdb)

(gdb) whatis 0x1a6f7c5a
type = int
(gdb) whatis 0x1a4c36c8
type = int
(gdb) whatis 0x7465cc
type = int
(gdb) up 16
#16 0x0041d18e in funcall (fun=0x7465cc) at eval.c:213
213                     MMccall(fun, top);
(gdb) :help
Undefined command: "".  Try "help".
(gdb) info frame
Stack level 16, frame at 0x22e460:
 eip = 0x41d18e in funcall (eval.c:213); saved eip 0x41d18e
 caller of frame at 0x22e460
 source language c.
 Arglist at 0x22e458, args: fun=0x7465cc
 Locals at 0x22e458, Previous frame's sp is 0x22e460
 Saved registers:
  ebp at 0x22e458, eip at 0x22e45c
(gdb) frame
#16 0x0041d18e in funcall (fun=0x7465cc) at eval.c:213
213                     MMccall(fun, top);

(gdb) info locals
temporary = 0x73b068
x = 0x73b048
top = (object * volatile) 0x6d6ab0
lex = (object *) 0x6d6ab0
old_bds_top = 0x1a4c36c8
b = 8286788
c = 7628248
res = 0x7465e4
b = (object *) 0x77c3da2a
n = 5
top = (object *) 0x5
base = (object *) 0x77c3da2a
l = 0x7465e4
x = 0x6d6ab0
not_pushed = 7170736
(gdb) info threads
* 1 thread 1356.0x50c  0x0041d18e in funcall (fun=0x7465cc) at eval.c:213
warning: Couldn't restore frame in current thread, at frame 0
0x0041d18e in funcall (fun=0x7465cc) at eval.c:213
(gdb)

specfntest-1.lsp
Description: Binary data

specfntest-2.lsp
Description: Binary data