Menu

#290 factorial broken on 64bit cpu

segfault
closed-fixed
clisp (524)
5
2005-12-21
2005-12-08
No

http://article.gmane.org/gmane.lisp.clisp.general:10578

(let ((ht (make-hash-table :test 'eq)))
(defstruct ht-test-struct a b c)
(setq x (make-ht-test-struct :a 1 :b 2 :c ht))
(setf (gethash ht ht) ht
(gethash x ht) 12)
(setq x (read-from-string (with-standard-io-syntax
(write-to-string x)))
ht (ht-test-struct-c x))
(setf (ht-test-struct-a x) (ext:! 123)
(gethash (ext:! 20) ht) (ext:! 21)
(gethash (ext:! 21) ht) (ext:! 22)
(gethash (ext:! 22) ht) (ext:! 23))
(ext:gc)
(setf (ht-test-struct-b x) (ext:! 124)
(gethash (ext:! 30) ht) (ext:! 61)
(gethash (ext:! 41) ht) (ext:! 72)
(gethash (ext:! 52) ht) (ext:! 83))
(ext:gc)
(list (eq (gethash ht ht) ht)
(gethash x ht)))

#0 0x00000034f512e4dd in raise () from
/lib64/tls/libc.so.6
#1 0x00000034f512fc8e in abort () from
/lib64/tls/libc.so.6
#2 0x000000000042427e in gc_mark ()
#3 0x00000000004243fe in gc_mark_stack ()
#4 0x00000000004244f3 in gc_markphase ()
#5 0x000000000042856a in gar_col_normal ()
#6 0x0000000000429906 in do_gar_col ()
#7 0x00000000004f7846 in with_gc_statistics ()
#8 0x0000000000429928 in gar_col ()
#9 0x00000000004e8cae in C_gc ()
#10 0x000000000043cace in eval_subr ()
#11 0x000000000043b25f in eval1 ()
#12 0x000000000043ae2a in eval ()
#13 0x000000000044da0c in C_let ()
#14 0x000000000043b908 in eval_fsubr ()
#15 0x000000000043b30d in eval1 ()
#16 0x000000000043ae2a in eval ()
#17 0x00000000004e634d in C_read_eval_print ()
#18 0x0000000000441340 in funcall_subr ()
#19 0x000000000044084e in funcall ()
#20 0x0000000000444bca in interpret_bytecode_ ()
#21 0x000000000044204b in funcall_closure ()
#22 0x0000000000440818 in funcall ()
#23 0x0000000000451b89 in C_driver ()
#24 0x0000000000444d49 in interpret_bytecode_ ()
#25 0x000000000044204b in funcall_closure ()
#26 0x0000000000440818 in funcall ()
#27 0x00000000004457cc in interpret_bytecode_ ()
#28 0x000000000044204b in funcall_closure ()
#29 0x0000000000440818 in funcall ()
#30 0x00000000004e664d in driver ()
#31 0x00000000004318ae in main_actions ()
#32 0x00000000004309cb in main ()

works: CVS 2005-05-14 (no 48bit fixnums)
crash: CVS 2005-05-15 (with 48b fixnums)

Discussion

  • Sam Steingold

    Sam Steingold - 2005-12-08

    Logged In: YES
    user_id=5735

    alternative backtrace:
    #0 0x0000000000413b1e in get_circ_mark (obj=0x40000ccce51bf0,
    env=0x7fbfff9ae0) at spvw_circ.d:767
    #1 0x0000000000414290 in get_circ_mark (obj=0xa000333c0dfc8,
    env=0x7fbfff9ae0) at spvw_circ.d:978
    #2 0x000000000041393d in get_circularities
    (obj=0xa000333c0dfc8,
    pr_array=true, pr_closure=true) at spvw_circ.d:717
    #3 0x00000000004ae5f5 in pr_enter_2 (stream_=0x2a9558b428,
    obj=0xa000333c0dfc8, pr_xxx=0x4afcb9 <prin_object>) at
    io.d:6699
    #4 0x00000000004aeead in pr_enter (stream_=0x2a9558b428,
    obj=0xa000333c0dfc8, pr_xxx=0x4afcb9 <prin_object>) at
    io.d:6756
    #5 0x00000000004b9193 in prin1 (stream_=0x2a9558b428,
    obj=0xa000333c0dfc8)
    at io.d:10049
    #6 0x00000000004ba6d6 in write_up () at io.d:10354
    #7 0x00000000004badc5 in C_write_to_string () at io.d:10494
    #8 0x000000000042f9a1 in eval_subr (fun=0x10000007437c8) at
    eval.d:3557
    #9 0x000000000042d8a2 in eval1 (form=0x40000cccd80320) at
    eval.d:3033
    #10 0x000000000042d3ba in eval (form=0x40000cccd80320) at
    eval.d:2907
    #11 0x000000000044562b in C_let () at control.d:686
    #12 0x000000000042e104 in eval_fsubr (fun=0xc000333a02488,
    args=0x40000cccd80300) at eval.d:3194
    #13 0x000000000042d960 in eval1 (form=0x40000cccd78470) at
    eval.d:3050
    #14 0x000000000042d3ba in eval (form=0x40000cccd78470) at
    eval.d:2907
    #15 0x000000000042d7d8 in eval1 (form=0x40000cccd78470) at
    eval.d:3008
    #16 0x000000000042d3ba in eval (form=0x40000cccd80330) at
    eval.d:2907
    #17 0x000000000042f641 in eval_subr (fun=0x10000007434f0) at
    eval.d:3445
    #18 0x000000000042d8a2 in eval1 (form=0x40000cccd80340) at
    eval.d:3033
    #19 0x000000000042d3ba in eval (form=0x40000cccd80340) at
    eval.d:2907
    #20 0x0000000000443e5f in C_setq () at control.d:220
    #21 0x000000000042e104 in eval_fsubr (fun=0xc000333a023c0,
    args=0x40000cccd80350) at eval.d:3194
    #22 0x000000000042d960 in eval1 (form=0x40000cccd80360) at
    eval.d:3050
    #23 0x000000000042d3ba in eval (form=0x40000cccd80360) at
    eval.d:2907
    #24 0x000000000044562b in C_let () at control.d:686
    #25 0x000000000042e104 in eval_fsubr (fun=0xc000333a02488,
    args=0x40000cccd804e0) at eval.d:3194
    #26 0x000000000042d960 in eval1 (form=0x40000cccd805d0) at
    eval.d:3050
    #27 0x000000000042d3ba in eval (form=0x40000cccd805d0) at
    eval.d:2907
    #28 0x000000000050f8a5 in C_read_eval_print () at debug.d:408
    #29 0x0000000000435b9a in funcall_subr (fun=0x1000000741b20,
    args_on_stack=2)
    at eval.d:5338
    #30 0x0000000000434e44 in funcall (fun=0x400000074fc78,
    args_on_stack=2)
    at eval.d:4945
    #31 0x000000000043a31d in interpret_bytecode_
    (closure=0x9000333bd0a90,
    codeptr=0x333b86c58,
    byteptr=0x333b86c9d
    "\037\ak\016\211\017\t.\020\021M\026\001Q\031\001Ö\017\0
    22") at eval.d:7029
    #32 0x0000000000436ba0 in funcall_closure
    (closure=0x9000333bd0a90,
    args_on_stack=0) at eval.d:5779
    #33 0x0000000000434dfd in funcall (fun=0x9000333bd0a90,
    args_on_stack=0)
    at eval.d:4940
    #34 0x000000000044ad3e in C_driver () at control.d:1976
    #35 0x000000000043a4ea in interpret_bytecode_
    (closure=0x9000333b86e40,
    codeptr=0x333b86be0, byteptr=0x333b86c02 "\031\001") at
    eval.d:7035
    #36 0x0000000000436ba0 in funcall_closure
    (closure=0x9000333b86e40,
    args_on_stack=0) at eval.d:5779
    #37 0x0000000000434dfd in funcall (fun=0x9000333b86e40,
    args_on_stack=0)
    at eval.d:4940
    #38 0x000000000043b266 in interpret_bytecode_
    (closure=0x9000333bcea38,
    codeptr=0x333a84708, byteptr=0x333a8474e "\031\001PG"3\003")
    at eval.d:7085
    #39 0x0000000000436ba0 in funcall_closure
    (closure=0x9000333bcea38,
    args_on_stack=0) at eval.d:5779
    #40 0x0000000000434dfd in funcall (fun=0x9000333bcea38,
    args_on_stack=0)
    at eval.d:4940
    #41 0x000000000050fd4e in driver () at debug.d:477
    #42 0x000000000041f26a in main_actions (p=0x768040) at
    spvw.d:3187
    #43 0x000000000041dea6 in main (argc=11, argv=0x7fbffff658)
    at spvw.d:3319

     
  • Sam Steingold

    Sam Steingold - 2005-12-08

    Logged In: YES
    user_id=5735

    with -DNO_GENERATIONAL_GC:

    Program received signal SIGSEGV, Segmentation fault.
    0x0000000000406692 in gc_mark (obj=0x40000cccda3df0) at
    spvw_gcmark.d:207
    207 down_varobject(TheSymbol,symbol_objects_offset,
    (gdb) where
    #0 0x0000000000406692 in gc_mark (obj=0x40000cccda3df0) at
    spvw_gcmark.d:207
    #1 0x0000000000406f64 in gc_mark_stack (objptr=0x2a9558a190)
    at spvw_garcol.d:105
    #2 0x0000000000406f90 in gc_markphase () at spvw_garcol.d:116
    #3 0x000000000040c602 in gar_col_normal () at
    spvw_garcol.d:1563
    #4 0x000000000040ed0e in do_gar_col () at spvw_garcol.d:2419
    #5 0x000000000052485c in with_gc_statistics (fun=0x40ecf7
    <do_gar_col>)
    at predtype.d:3137
    #6 0x000000000040ed30 in gar_col () at spvw_garcol.d:2431
    #7 0x000000000050fc65 in C_gc () at debug.d:1572
    #8 0x000000000042c49d in eval_subr (fun=0x100000073dd08) at
    eval.d:3557
    #9 0x000000000042a39e in eval1 (form=0x40000cccda3df0) at
    eval.d:3033
    #10 0x0000000000429eb6 in eval (form=0x40000cccda3df0) at
    eval.d:2907
    #11 0x0000000000442127 in C_let () at control.d:686
    #12 0x000000000042ac00 in eval_fsubr (fun=0xc0003339ff488,
    args=0x40000cccda4290) at eval.d:3194
    #13 0x000000000042a45c in eval1 (form=0x40000cccda4380) at
    eval.d:3050
    #14 0x0000000000429eb6 in eval (form=0x40000cccda4380) at
    eval.d:2907
    #15 0x000000000050c259 in C_read_eval_print () at debug.d:408
    #16 0x0000000000432696 in funcall_subr (fun=0x100000073d8e0,
    args_on_stack=2)
    at eval.d:5338
    #17 0x0000000000431940 in funcall (fun=0x400000074ba38,
    args_on_stack=2)
    at eval.d:4945
    #18 0x0000000000436e19 in interpret_bytecode_
    (closure=0x9000333bdaec8,
    codeptr=0x333b83290,
    byteptr=0x333b832d5
    "\037\ak\016\211\017\t.\020\021M\026\001Q\031\001Ö\017\0
    22") at eval.d:7029
    #19 0x000000000043369c in funcall_closure
    (closure=0x9000333bdaec8,
    args_on_stack=0) at eval.d:5779
    #20 0x00000000004318f9 in funcall (fun=0x9000333bdaec8,
    args_on_stack=0)
    at eval.d:4940
    #21 0x000000000044783a in C_driver () at control.d:1976
    #22 0x0000000000436fe6 in interpret_bytecode_
    (closure=0x9000333b83478,
    codeptr=0x333b83218, byteptr=0x333b8323a "\031\001") at
    eval.d:7035
    #23 0x000000000043369c in funcall_closure
    (closure=0x9000333b83478,
    args_on_stack=0) at eval.d:5779
    #24 0x00000000004318f9 in funcall (fun=0x9000333b83478,
    args_on_stack=0)
    at eval.d:4940
    #25 0x000000000050c702 in driver () at debug.d:477
    #26 0x000000000041bfdb in main_actions (p=0x763ca0) at
    spvw.d:3187
    #27 0x000000000041ac17 in main (argc=3, argv=0x7fbffff6b8)
    at spvw.d:3319
    (gdb) up
    #1 0x0000000000406f64 in gc_mark_stack (objptr=0x2a9558a190)
    at spvw_garcol.d:105
    105 gc_mark(obj);
    (gdb) xout obj
    (#<NULLOBJ> . #<frame IBLOCK 0x84000000748c80>)(void *)
    0x40000cccda3df0
    (gdb)

     
  • Sam Steingold

    Sam Steingold - 2005-12-08
    • assigned_to: sds --> haible
     
  • Sam Steingold

    Sam Steingold - 2005-12-12

    Logged In: YES
    user_id=5735

    the same 48bit patch broke g++ amd64 build:
    segfault in with_gc_statistics() on access to
    Symbol_value(S(gc_statistics_stern));
    (first line):
    Program received signal SIGSEGV, Segmentation fault.
    0x00000000004884ad in gcv_object_t::operator object
    (this=0x4000000919ed0)
    at lispbibl.d:3821
    3821 nonimmprobe(one_o);
    Warning: the current language does not match this frame.
    (gdb) where
    #0 0x00000000004884ad in gcv_object_t::operator object
    (this=0x4000000919ed0)
    at lispbibl.d:3821
    #1 0x000000000067d176 in with_gc_statistics (
    fun=0x4183b0 <do_gar_col_simple>) at predtype.d:3134
    #2 0x00000000004183f1 in gar_col_simple () at
    spvw_garcol.d:2405
    #3 0x0000000000418833 in make_space_gc_true (need=72,
    heapptr=0x8f6228)
    at spvw_allocate.d:219
    #4 0x0000000000418f7b in allocate_vector (len=7) at
    spvw_typealloc.d:89
    #5 0x0000000000473316 in init_subr_tab_2 () at subrkw.d:7
    #6 0x000000000047e540 in initmem () at spvw.d:1491
    #7 0x00000000004834db in init_memory (p=0x8f63d0) at
    spvw.d:2896
    #8 0x0000000000480820 in main (argc=1, argv=0x7fbffff6d8)
    at spvw.d:3238
    (gdb) up
    #1 0x000000000067d176 in with_gc_statistics (
    fun=0x4183b0 <do_gar_col_simple>) at predtype.d:3134
    3134 var object flag =
    Symbol_value(S(gc_statistics_stern));
    (gdb)

     
  • Sam Steingold

    Sam Steingold - 2005-12-14

    Logged In: YES
    user_id=5735

    http://article.gmane.org/gmane.lisp.clisp.general:10615
    > > Q: Is it known that --with-debug leads to an error
    within the
    > > gc_unmarkcheck() function of spvw_garcol.d forced by
    -DDEBUG_SPVW.
    ./lisp.run -B . -N locale -Efile UTF-8 -Eterminal UTF-8
    -Emisc 1:1 -norc -m 1400KW -x "(and (load \"init.lisp\")
    (sys::%saveinitmem) (ext::exit)) (ext::exit t)"
    STACK depth: 22389

    Object 0x333a78000 marked!!

    Object 0x333a78000 marked!!

    Object 0x333a78000 marked!!

    [... 1269 times repeated ...]

    Object 0x333a78000 marked!!
    make: *** [interpreted.mem] Segmentation fault

     
  • Sam Steingold

    Sam Steingold - 2005-12-15

    Logged In: YES
    user_id=5735

    http://article.gmane.org/gmane.lisp.clisp.general:10628

    down: vorg = 0x17000333b9d728, dies = 0x486273950000000c

    Program received signal SIGABRT, Aborted.
    0x00002aaaaaf91a25 in raise () from /lib64/libc.so.6
    (gdb) up
    #1 0x00002aaaaaf92d0e in abort () from /lib64/libc.so.6
    (gdb) up
    #2 0x0000000000419d73 in gc_mark (obj=<value optimized
    out>) at spvw_gcmark.d:251
    251 /*NOTREACHED*/ abort();
    (gdb)
    ---------------------------------------------------------------------------

    The message `down: vorg = 0x17000333b9d728, dies =
    0x486273950000000c'
    is from the copied fprintf at line 200 with PRIoint choosen
    to `l'
    in file spvw_gcmark.d.

     
  • Sam Steingold

    Sam Steingold - 2005-12-21

    Logged In: YES
    user_id=5735

    for x in $(seq 1 200) ; do
    echo "! $x";
    ./clisp -q -norc -x "(ext::! $x)" || echo crash;
    done

    ! is broken from 17 to 33 inclusively.
    this corresponds to the integer-length
    of the result from 49 to 123.
    16! (45 bits) and 34! (128 bits) are fine.

    full results are attached

     
  • Sam Steingold

    Sam Steingold - 2005-12-21

    factorial output

     
  • Sam Steingold

    Sam Steingold - 2005-12-21

    Logged In: YES
    user_id=5735

    thank you for your bug report.
    the bug has been fixed in the CVS tree.
    you can either wait for the next release (recommended)
    or check out the current CVS tree (see http://clisp.cons.org\)
    and build CLISP from the sources (be advised that between
    releases the CVS tree is very unstable and may not even build
    on your platform).

     
  • Sam Steingold

    Sam Steingold - 2005-12-21

    Logged In: YES
    user_id=5735

    from "Dr. Werner Fink" <werner@suse.de>

    --- src/intmal.d
    +++ src/intmal.d 2005-12-21 15:09:43.000000000 +0100
    @@ -921,7 +921,7 @@
    #endif
    };
    var uintV n_ = posfixnum_to_V(n);
    - if (n_ < sizeof(fakul_table)/sizeof(uintL)) {
    + if (n_ < sizeof(fakul_table)/sizeof(uintV)) {
    return fixnum(fakul_table[n_]);
    } else {
    pushSTACK(Fixnum_1); # bisheriges Produkt := 1

     
  • Sam Steingold

    Sam Steingold - 2005-12-21
    • assigned_to: haible --> sds
    • summary: hash-table crash on amd64 --> factorial broken on 64bit cpu
    • status: open --> closed-fixed
     

Log in to post a comment.