Steel Bank Common Lisp

copy-structure broken with dx structs

Reported by James Y Knight on 2012-01-02
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
SBCL
Undecided
Unassigned

Bug Description

copy-structure (and thus the default copied from defstruct) uses %instance-length to determine the length of the structure to copy.

But %instance-length is rounded up to a multiple of 2-minus-1 by dd-instance-length so that alignment works right, so some structs have an extra word of padding on the end.

DX-allocated structs don't pre-initialize the memory used, and so the padding word is filled with garbage. Garbage on the stack is okay (at least on x86/x86-64), so no problem.

But then, copy-structure copies the word of garbage to the heap. And next time there's a GC...BOOM.

I've attached the obvious patch to copy-structure.

James Y Knight (foom) wrote :
Stas Boukarev (stassats) on 2012-03-24
Changed in sbcl:
status: New → Fix Committed
Stas Boukarev (stassats) wrote :

commit 55577e881cb26ef6001ff3ac3b2fdc90f656c6ca
Author: Martin Cracauer <email address hidden>
Date: Fri Mar 23 13:39:54 2012 -0400

    Closes https://bugs.launchpad.net/sbcl/+bug/911027

    Fix copy-structure. When copying from stack to heap, garbage could
    end up in the heap making GC unhappy. Thanks to James Knight.

Changed in sbcl:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers