Take inline trampoline into account when optimizing fall-through jumps

The IR2-level optimisation bug manifests itself as randomly bogus
code in the presence of tail and local calls to the same function.

Reported by Eric Marsden on sbcl-devel.

Test case by Anton Kovalenko.

Fixes lp#883500

diff --git a/NEWS b/NEWS
index 64fdd90..d9a4ff9 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,9 @@ changes relative to sbcl-1.0.52:
     when built with certain compilers.
   * bug fix: SB-ROTATE-BYTE misrotated to the right when using constant
     rotation arguments on x86-64. (lp#882151)
+  * bug fix: low-level control flow optimisations could result in bogus
+    code in functions with tail and non-tail calls to local functions on
+    x86oids. (lp#883500)
 
 changes in sbcl-1.0.52 relative to sbcl-1.0.51:
   * enhancement: ASDF has been updated to version 2.017.

diff --git a/src/compiler/ir2opt.lisp b/src/compiler/ir2opt.lisp
index 6c0e764..b664980 100644 (file)
--- a/src/compiler/ir2opt.lisp
+++ b/src/compiler/ir2opt.lisp
@@ -211,7 +211,9 @@
              (do ((2block (ir2-block-next 2block)
                     (ir2-block-next 2block)))
                  ((null 2block) nil)
-               (cond ((eq target (ir2-block-%label 2block))
+               (cond ((ir2-block-%trampoline-label 2block)
+                      (return nil))
+                     ((eq target (ir2-block-%label 2block))
                       (return t))
                      ((ir2-block-start-vop 2block)
                       (return nil)))))))

diff --git a/tests/compiler.pure.lisp b/tests/compiler.pure.lisp
index 3bc80da..f13a4a1 100644 (file)
--- a/tests/compiler.pure.lisp
+++ b/tests/compiler.pure.lisp
@@ -4011,3 +4011,13 @@
                                  (the (eql #c(1.0 1.0)) p3))))))
     (assert (eql (funcall fun 1 #c(1.2d0 1d0) #c(1.0 1.0))
                  #c(1.2d0 1.0d0)))))
+
+;; Fall-through jump elimination made control flow fall through to trampolines.
+;; Reported by Eric Marsden on sbcl-devel@ 2011.10.26, with a test case
+;; reproduced below (triggered a corruption warning and a memory fault).
+(with-test (:name :bug-883500)
+  (funcall (compile nil `(lambda (a)
+                           (declare (type (integer -50 50) a))
+                           (declare (optimize (speed 0)))
+                           (mod (mod a (min -5 a)) 5)))
+           1))