move-return-stuff into deleted lambda

Bug #1661911 reported by Stas Boukarev on 2017-02-05
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
SBCL
High
Unassigned

Bug Description

The bug reported by Eric Marsden reduces into

(defun foo ()
  (declare (optimize (debug 1)))
  (block nil
    (lambda () (return)))
  (labels ((l () (l))
           (%f (a &key)
             (l)
             (return-from foo a)))
    (%f (return-from foo))
    (%f 1)))

=> failed AVER: (SINGLETON-P SB-C::SUCC)

This is caused by move-return-stuff deleting and unlinking the return node, it only does so if the return block is deleted. And normally delete-block would handle that, but move-return-stuff points the callee return node to the caller lambda. Now the caller has two returns pointing to it, and delete-return can't handle being called twice on the same lambda.

Now unlink-node fails because the return is the only node in the deleted block, and the block has no successors, unlink-node can't handle that.

Why is move-return-stuff called on deleted stuff? It's coming from MAYBE-CONVERT-TO-ASSIGNMENT, which comes from IR1-OPTIMIZE-RETURN. And it's the tail self recursive L function that is being converted. Its parent caller is %F, but it's already let converted into an &optional-processor, and that optional processor is deleted. It's deleted, but none of the blocks that contain %F or the call to L are being marked as deleted.

Stas Boukarev (stassats) on 2017-02-05
description: updated
Stas Boukarev (stassats) wrote :

In 561fda243be8967968640bf67cc553237d83fbb0

Stas Boukarev (stassats) wrote :

Wrong thread.

Stas Boukarev (stassats) wrote :

This test case stopped failing after 39122eaee21ac78bbfe33b3e933dd23cbdaf9a93, but
(progn
  (declaim (special *s*))
  (defun f1 (a b)
    (progn
      (tagbody
         (ash (catch 'ct7 0)
              (flet ((%f8 (f8-2 f8-3 &key (key1 (progv '(*s*) (list 0) (go tag5))))
                       f8-2))
                (logand (%f8 0 (go tag5)) (%f8 b 0))))
       tag5)
      0)))
from https://bugs.launchpad.net/sbcl/+bug/1722840 still fails

Stas Boukarev (stassats) wrote :

In 1316bd2d42bdaf93e73b9832a812605caa179b83.

Changed in sbcl:
status: Triaged → Fix Committed
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers