segfault or abort with IT in small programs

[jasonhemann]

The program

HAI 1.3
    SUM OF 1 AN 2 
    VISIBLE IT 
KTHXBYE

executes fine. I'm using IT as described in the 1.2 spec on expression syntax.

However, when I try to do something more complicated involving IT, e.g.,

HAI 1.3
    SUM OF 1 AN 2 
    VISIBLE SUM OF IT AN 3 
KTHXBYE

I variously get abort traps or segfaults.

bash-3.2$ lci test.lol 
6
Segmentation fault: 11
bash-3.2$ lci test.lol 
6
lci(39953,0x7fff73c4a300) malloc: *** error for object 0x7feffae05470: incorrect checksum for freed object - object was probably modified after being freed.
*** set a breakpoint in malloc_error_break to debug
Abort trap: 6

However, this is an intermittent failure. I can't always seem to produce it. I've been able to reproduce it by modifying this test file and building up to it.

[initbar]

Huh.. this looks fun ! I'll also investigate this bug ~

[initbar]

@jasonhemann After ~50,000 of runs, I'm still unable to reproduce the segfault:

ubuntu@server ~> i=0; while :; do echo "[$i] $(./lci bug.lol)" ; i=$(( i+1 )) ; done 2> bug.log
...
[50000] 6
[50001] 6

I'm just wondering how you have compiled the lci binary. Did you use any optimization flags?

[jasonhemann]

Hi,

I am compiling future branch, on which I'm up to date. I'm running the Makefile as usual, but I do see two warnings when I compile.

bash-3.2$ sudo make 
Password:
Scanning dependencies of target lci
[ 10%] Building C object CMakeFiles/lci.dir/interpreter.c.o
[ 20%] Building C object CMakeFiles/lci.dir/lexer.c.o
[ 30%] Building C object CMakeFiles/lci.dir/main.c.o
[ 40%] Building C object CMakeFiles/lci.dir/parser.c.o
/Users/jhemann/Documents/lci/parser.c:2914:55: warning: use of logical '||' with constant operand [-Wconstant-logical-operand]
        if (!status) status = acceptToken(&tokens, TT_HASAN) || -1;
                                                             ^  ~~
/Users/jhemann/Documents/lci/parser.c:2914:55: note: use '|' for a bitwise operation
        if (!status) status = acceptToken(&tokens, TT_HASAN) || -1;
                                                             ^~
                                                             |
1 warning generated.
[ 50%] Building C object CMakeFiles/lci.dir/tokenizer.c.o
[ 60%] Building C object CMakeFiles/lci.dir/unicode.c.o
[ 70%] Building C object CMakeFiles/lci.dir/error.c.o
[ 80%] Building C object CMakeFiles/lci.dir/binding.c.o
/Users/jhemann/Documents/lci/binding.c:12:11: warning: using the result of an assignment as a condition without parentheses [-Wparentheses]
        while (c = input[pos]) {
               ~~^~~~~~~~~~~~
/Users/jhemann/Documents/lci/binding.c:12:11: note: place parentheses around the assignment to silence this warning
        while (c = input[pos]) {
                 ^
               (             )
/Users/jhemann/Documents/lci/binding.c:12:11: note: use '==' to turn this assignment into an equality comparison
        while (c = input[pos]) {
                 ^
                 ==
1 warning generated.
[ 90%] Building C object CMakeFiles/lci.dir/inet.c.o
[100%] Linking C executable lci
[100%] Built target lci

[initbar]

@jasonhemann Hmm.. when I compiled it on Docker ubuntu:17.10 image, I also saw the same make log. However, I am still unable to reproduce the issue..

[jasonhemann]

What other information can I supply that would help narrow this down?

[jasonhemann]

@initbar I'm compiling on OSX 10.10.5, with what I assume is the standard OSX build environment.

[initbar]

@jasonhemann Hmm, then I'm not sure if I can be helpful 😅 (I don't have any Macs)

[leyarotheconquerer]

I've duplicated this error on OSX using the following script:

HAI 1.3
    I HAS A counter ITZ 0
    I HAS A number ITZ 0
    IM IN YR loop
        counter R SUM OF counter AN 1
        SUM OF 1 AN 2 
        number R SUM OF IT AN 3
        VISIBLE ":{counter}:>:{number}"
    IM OUTTA YR loop
KTHXBYE

This code segfaults in the first 200 iterations or so. When run on Linux, it runs perfectly fine, so this appears to be an OSX issue. I used XCode to build this, so it may also be a clang issue.

Cursory debugging indicates that the segfault occurs on various calls to free() in the statement evaluation logic.

EDIT: Looks like the error was a double free of the implicit IT variable. I'll create a pull request to fix this.