move-return-stuff into deleted lambda

[Stas Boukarev]

The bug reported by Eric Marsden reduces into

(defun foo ()
  (declare (optimize (debug 1)))
  (block nil
    (lambda () (return)))
  (labels ((l () (l))
           (%f (a &key)
             (l)
             (return-from foo a)))
    (%f (return-from foo))
    (%f 1)))

=> failed AVER: (SINGLETON-P SB-C::SUCC)

This is caused by move-return-stuff deleting and unlinking the return node, it only does so if the return block is deleted. And normally delete-block would handle that, but move-return-stuff points the callee return node to the caller lambda. Now the caller has two returns pointing to it, and delete-return can't handle being called twice on the same lambda.

Now unlink-node fails because the return is the only node in the deleted block, and the block has no successors, unlink-node can't handle that.

Why is move-return-stuff called on deleted stuff? It's coming from MAYBE-CONVERT-TO-ASSIGNMENT, which comes from IR1-OPTIMIZE-RETURN. And it's the tail self recursive L function that is being converted. Its parent caller is %F, but it's already let converted into an &optional-processor, and that optional processor is deleted. It's deleted, but none of the blocks that contain %F or the call to L are being marked as deleted.

[Stas Boukarev (stassats)]

In 561fda243be8967968640bf67cc553237d83fbb0

[Stas Boukarev (stassats)]

Wrong thread.

[Stas Boukarev (stassats)]

This test case stopped failing after 39122eaee21ac78bbfe33b3e933dd23cbdaf9a93, but
(progn
  (declaim (special *s*))
  (defun f1 (a b)
    (progn
      (tagbody
         (ash (catch 'ct7 0)
              (flet ((%f8 (f8-2 f8-3 &key (key1 (progv '(*s*) (list 0) (go tag5))))
                       f8-2))
                (logand (%f8 0 (go tag5)) (%f8 b 0))))
       tag5)
      0)))
from https://bugs.launchpad.net/sbcl/+bug/1722840 still fails

[Stas Boukarev (stassats)]

In 1316bd2d42bdaf93e73b9832a812605caa179b83.