Unhandled memory fault in code from random tester

[Paul F. Dietz]

(defun f367 (a b c)
    (declare (notinline funcall))
    (labels ((%f7 (f7-1 &optional (f7-2 0) (f7-3 0))
               (let ((*s1*
                      (labels ((%f10
                                   (f10-1
                                    &optional
                                    (f10-3 (setf b 0))
                                    (f10-4 (decf f7-1 b))
                                    &key)
                                 0))
                        (declare (dynamic-extent (function %f10)))
                        (funcall #'%f10 0))))
                 (declare (special *s1*))
                 (eval 0))))
      (%f7 a 0 (%f7 c 0))))

(f367 0 0 0) ==>

CORRUPTION WARNING in SBCL pid 6224(tid 0x7f21ba708b80):
Memory fault at 0xffffffffffffffe0 (pc=0x41cee7, sp=0x7f21b8c7fac0)
The integrity of this image is possibly compromised.
Continuing with fingers crossed.

[Paul F. Dietz (paul-f-dietz)]

Simplified:

(defun f367 (a b c)
    (declare (notinline funcall))
    (labels ((%f7 (f7-1 &optional (f7-2 0) (f7-3 0))
               (labels ((%f10
                            (f10-1
                             &optional
                             (f10-3 (setf b 0))
                                    (f10-4 (decf f7-1 b))
                                    &key)
                          0))
                 (declare (dynamic-extent (function %f10)))
                 (funcall #'%f10 0))))
      (%f7 a 0 (%f7 c 0))))

[Stas Boukarev (stassats)]

(defun f367 (b)
  (flet ((%f7 ()
           (flet ((%f10 ()
                    (decf b b)))
             (declare (dynamic-extent #'%f10))
             (funcall (eval #'%f10)))))
    (declare (notinline %f7))
    (%f7)))

[Stas Boukarev (stassats)]

4dc269c9fce3ec3b74535ef3266b7aa5c4afa005