Memory fault in code w. notinlined FUNCALL on DX labels

[Paul F. Dietz]

(defun f077 (a b c)
  (declare (notinline funcall max))
  (labels ((%f14
               (f14-1 f14-2
                &optional (f14-3 (setq a (min 13 (max 1 0))))
                  (f14-4 (setq c 0)))
             0))
    (declare (dynamic-extent (function %f14)))
    (funcall #'%f14
             (%f14
              (min 11 (max 0 c))
              (funcall #'%f14 a b 1)
              1
              b)
             0)))

(defun bug077 ()
  (f077 1 2 3))

(bug077) ==> memory fault

[Paul F. Dietz (paul-f-dietz)]

Perhaps also related:

(defun bug078 (b)
  (declare (notinline funcall))
  (declare (optimize (speed 3)))
  (labels ((%f1 (&optional f1-1) (shiftf b 0)))
    (declare (dynamic-extent (function %f1)))
    (funcall #'%f1 :bad)))

(bug078 10) ==> :BAD

[Stas Boukarev (stassats)]

Bisects to
commit 20987650aaae1005b9d81e27c0499eede5510dcb
Author: Charles Zhang <email address hidden>
Date: Wed Dec 1 11:36:13 2021 -0800

    Clean up and document representation of dynamic extent closures.

    * Since dynamic extent closures do not participate in the
    back-propagation of dynamic extent, we don't need to create ENTRY DXs
    to facilitate that.
    * Document IR1-CONVERT-FBINDINGS, which looks much cleaner now.

    I'd like to make the CLEANUP-INFO slot even more sane, since its still
    used for several different overlapping purposes at different times in
    the compilation process.

[Stas Boukarev (stassats)]

And reduced to
(defun foo (a c)
  (declare (notinline funcall))
  (flet ((f (o
             &optional (p (setq a (min 13 c))))
           (setq c 0)
           0))
    (declare (dynamic-extent (function f)))
    (funcall #'f
             (f c (funcall #'f a 2)))))