[Sbcl-devel] Re: WARNING: MIPS heap corruption bug

[Christophe R. <cs...@ca...>]

Christophe Rhodes <cs...@ca...> writes:

> (foo *foo*) -> #\Nul
> *foo* -> "fo"

Hmp.  Lest anyone become confused, this is actually the right answer,
not the wrong answer.  (the wrong answer, which it is certainly
possible to get, is "").

Nonetheless, the bug exists; it's obscured in the above example
because the cost for each variants of DEFINE-PARTIAL-SETTER is the
same, at 5, so other criteria come into play in VOP selection, such as
the phase of the moon. 

In sbcl-0.8.1, on a big-endian MIPS machine:

* (defun foo (x) 
    (declare (type simple-string x) (optimize speed (safety 0))) 
    (setf (aref x 1) #\Null) 
    (setf (aref x 2) #\Null))

FOO
* (disassemble 'foo)

; 08033158:       OR  $NL3, $ZERO, 0          ; no-arg-parsing entry point
;       5C:       SB  $NL3, $A0               ; $A0 = X
;       60:       OR  $NL3, $ZERO, 0
;       64:       SB  $NL3, $A0[-1]
; [...]

you can clearly see that the indexing into the array is going the
wrong way, and here overwrites the length word of the simple-string.

Cheers,

Christophe
-- 
http://www-jcsu.jesus.cam.ac.uk/~csr21/       +44 1223 510 299/+44 7729 383 757
(set-pprint-dispatch 'number (lambda (s o) (declare (special b)) (format s b)))
(defvar b "~&Just another Lisp hacker~%")    (pprint #36rJesusCollegeCambridge)