scm_num2dbl with #f -> segfault

scm_num2dbl with #f -> segfault

[Bill Schottstaedt]

On the Sun (Solaris 2.9), guile 1.6.0, scm_num2dbl segfaults if
accidentally passed #f instead of a number.

Program received signal SIGSEGV, Segmentation fault.
0x3ba15c in scm_num2dbl (a=0x2174, why=0x404a40 "list2vct") at numbers.c:3641
3641      } else if (SCM_BIGP (a)) {
(gdb) where
#0  0x3ba15c in scm_num2dbl (a=0x2174, why=0x404a40 "list2vct") at numbers.c:3641
...

(gdb) gp 0x2174
$1 = 0x4fcf90 "#f"


_______________________________________________
Bug-guile mailing list
Bug-guile@gnu.org
http://mail.gnu.org/mailman/listinfo/bug-guile

Re: scm_num2dbl with #f -> segfault

[Marius Vollmer]

Bill Schottstaedt <bil@ccrma.Stanford.EDU> writes:

> On the Sun (Solaris 2.9), guile 1.6.0, scm_num2dbl segfaults if
> accidentally passed #f instead of a number.

I can't reproduce this on GNU/Linux i386.  Could you try to figure out
why it crashes exactly?

I tried this:

    #include <libguile.h>
    #include <stdio.h>

    SCM
    xxx (SCM x)
    {
      printf ("%g\n", scm_num2dbl (x, "xxx"));
      return SCM_UNSPECIFIED;
    }

    int main ()
    {
      scm_init_guile ();
      scm_c_define_gsubr ("xxx", 1, 0, 0, xxx);
      scm_shell (0, NULL);
    }

    $ gcc -o x x.c -lguile
    $ ./x
    guile> (xxx #f)
    <unnamed port>:3:1: In procedure xxx in expression (xxx #f):
    <unnamed port>:3:1: Wrong type argument: #f
    ABORT: (wrong-type-arg)

-- 
GPG: D5D4E405 - 2F9B BCCC 8527 692A 04E3  331E FAF8 226A D5D4 E405


_______________________________________________
Bug-guile mailing list
Bug-guile@gnu.org
http://mail.gnu.org/mailman/listinfo/bug-guile

Re: scm_num2dbl with #f -> segfault

[Bill Schottstaedt]

>> On the Sun (Solaris 2.9), guile 1.6.0, scm_num2dbl segfaults if
>> accidentally passed #f instead of a number.
>
> I can't reproduce this on GNU/Linux i386.  Could you try to figure out
> why it crashes exactly?

It appears to be a compiler bug.  I was using gcc 2.95 (which comes
with Solaris 2.9), and for the SCM_BIGP macro (which is essentially
(!(6 & val)) && ((val[0] & 0xffff) == scm_tc16_big) or some variation
thereof), the compiler produced:

	andcc	%o2, 6, %o0
	ld	[%o2], %o3
	bne	.LL2472

whereas it should have been more along the lines of:

	andcc	%o2, 6, %o3
	bne	.LL2487
	ld	[%o2], %o1

That is, it was in a big hurry to treat #f as a pointer.
I built gcc 3.2 on that machine and it produces correct-looking
code.


_______________________________________________
Bug-guile mailing list
Bug-guile@gnu.org
http://mail.gnu.org/mailman/listinfo/bug-guile

Re: scm_num2dbl with #f -> segfault

[Marius Vollmer]

Bill Schottstaedt <bil@ccrma.Stanford.EDU> writes:

> It appears to be a compiler bug.

Ok.  We have seen this already, in a different place.  It's good to
know that it is a compiler bug and not some property of ANSI C that we
would need to take into account.

-- 
GPG: D5D4E405 - 2F9B BCCC 8527 692A 04E3  331E FAF8 226A D5D4 E405


_______________________________________________
Bug-guile mailing list
Bug-guile@gnu.org
http://mail.gnu.org/mailman/listinfo/bug-guile