View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0000633 | LDMud 3.3 | LPC Compiler/Preprocessor | public | 2009-05-04 03:46 | 2009-05-04 05:23 |
Reporter | invisible | Assigned To | Gnomi | ||
Priority | normal | Severity | crash | Reproducibility | sometimes |
Status | resolved | Resolution | fixed | ||
Fixed in Version | 3.3.719 | ||||
Summary | 0000633: Access of undefined/undeclared variable crashes 3.3.718 on amd64 | ||||
Description | A call to a function, using an undeclared variable as argument *sometimes* (don't ask me why) crashes ldmud-3.3.718 compiled on amd64. foo() - works (produces an "Undefined function 'foo' near ';'.", execution continues) foo(bar) - crash after message "Variable bar not declared ! before ';'." The segfault happens at line 10865 in prolang.y: $$.type = V_VARIABLE(i)->type; It seems, that V_VARIABLE(i) is NULL or another improper value when the variable is undefined. Strange thing: I'd expect this to crash *always* not only occasionally and not only on amd64. The really annoing things about this bug are: a) it happens only occasionally (some calls to "foo(bar)" just produce the error message compaining about the undefined variable 'bar' but the driver continues to work - as expected) - I really can't imagine why b) it does *not* happen on our 'production'-server, running the very same version just compiled for i386 - again: shouldn't this always crash? Is there another path in the driver where V_VARIABLE(i) gets checked more thoroughly? c) it is so simple to crash the driver; undeclared variables appear all the time while programming... | ||||
Additional Information | gdb output: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7f377f65a6e0 (LWP 5864)] 0x000000000048de3c in yyparse () at prolang.y:10865 10865 $$.type = V_VARIABLE(i)->type; (gdb) bt #0 0x000000000048de3c in yyparse () at prolang.y:10865 0000001 0x00000000004965fa in compile_file (fd=11, fname=0x7f377ce87767 "home/invisible/ccall.c", isMasterObj=<value optimized out>) at prolang.y:16823 0000002 0x00000000004a7c99 in load_object (lname=<value optimized out>, create_super=false, depth=0, isMasterObj=false, chain=0x0) at simulate.c:1981 0000003 0x00000000004a8494 in lookfor_object (str=<value optimized out>, bLoad=true) at simulate.c:2426 0000004 0x0000000000454229 in eval_instruction ( first_instruction=<value optimized out>, initial_sp=<value optimized out>) at interpret.c:16276 0000005 0x00000000004ab532 in catch_instruction (flags=0, offset=<value optimized out>, i_sp=0x7ad048, i_pc=0x7f377cfe2a2f "a\036\003\n »b´b{\004(j\v\n\212\036\004*¥\t", i_fp=<value optimized out>, reserve_cost=10000, i_context=0x0) at simulate.c:449 0000006 0x000000000044c52c in eval_instruction ( first_instruction=<value optimized out>, initial_sp=<value optimized out>) at interpret.c:9506 0000007 0x000000000045a113 in int_call_lambda (lsvp=<value optimized out>, num_arg=1, allowRefs=false) at interpret.c:17913 0000008 0x000000000045a7fe in v_funcall (sp=0x736370, num_arg=2) at interpret.c:20451 0000009 0x00000000004507aa in eval_instruction ( first_instruction=<value optimized out>, initial_sp=<value optimized out>) at interpret.c:8297 0000010 0x0000000000459418 in apply_low (fun=<value optimized out>, ob=0x7f377ce2b0e8, num_arg=1, b_ign_prot=false, allowRefs=false) at interpret.c:16836 0000011 0x000000000044a58d in int_apply (fun=0x34, ob=0x7fff87675cce, num_arg=2094053465, b_ign_prot=<value optimized out>, b_use_default=true) at interpret.c:17027 0000012 0x000000000044b195 in sapply_int (fun=0x7f377d102ef0, ob=0x7f377ce2b0e8, num_arg=1, b_find_static=122, b_use_default=true) at interpret.c:17188 0000013 0x0000000000405dcd in parse_command ( buff=0x7fff87679020 "xcall #foo(barbaz)", from_efun=false) at actions.c:1102 #14 0x000000000040773a in execute_command ( str=0x7fff87679020 "xcall #foo(barbaz)", ob=0x7f377ce2b0e8) #15 0x000000000040e96d in backend () at backend.c:673 #16 0x000000000046849d in main (argc=<value optimized out>, argv=<value optimized out>) at main.c:625 (gdb) You can download the coredump at http://xover.mud.at/~invisible/temp/ldmud-3.3.718-core (25MB) (program compiled via 'sh settings/beutelland', original from 3.3.718 + "enable_use_mccp=yes", plus "-ggdb3" added to $DEBUG in the Makefile) | ||||
Tags | No tags attached. | ||||
Attached Files | r2499.diff (4,944 bytes)
Index: trunk/CHANGELOG =================================================================== --- trunk/CHANGELOG (Revision 2498) +++ trunk/CHANGELOG (Revision 2499) @@ -1,6 +1,10 @@ This file lists all changes made to the game driver in all glory detail. See the file HISTORY for a user-oriented summary of all the changes. +17-Jan-2008 (Fuchur) + - (prolang.y) + check return value of verify_declared() - fixes a crash in t-language + 17-Jan-2009 (Gnomi) - (object.c) Save_object without a filename removed one too many elements Index: trunk/src/prolang.y =================================================================== --- trunk/src/prolang.y (Revision 2498) +++ trunk/src/prolang.y (Revision 2499) @@ -3472,6 +3472,11 @@ define_variable(name, actual_type); i = verify_declared(name); /* Is the var declared? */ +#ifdef DEBUG + if (i == -1) + fatal("Variable not declared after defining it.\n"); +#endif + /* Initialize float values with 0.0. */ if (with_init || (!(actual_type.typeflags & TYPE_MOD_POINTER) @@ -9604,54 +9609,44 @@ %line $$.start = $1.start; i = verify_declared($2); + if (i == -1) + /* Variable not declared. */ + YYACCEPT; - if (i != -1) + if (i & VIRTUAL_VAR_TAG) { - - if (i & VIRTUAL_VAR_TAG) + add_f_code(F_PUSH_VIRTUAL_VARIABLE_LVALUE); + add_byte(i); + lvtype = V_VARIABLE(i)->type; + lvtype.typeflags &= TYPE_MOD_MASK; + } + else + { + if ((i + num_virtual_variables) & ~0xff) { - add_f_code(F_PUSH_VIRTUAL_VARIABLE_LVALUE); - add_byte(i); - lvtype = V_VARIABLE(i)->type; - lvtype.typeflags &= TYPE_MOD_MASK; + add_f_code(F_PUSH_IDENTIFIER16_LVALUE); + add_short(i + num_virtual_variables); + CURRENT_PROGRAM_SIZE += 1; } else { - if ((i + num_virtual_variables) & ~0xff) - { - add_f_code(F_PUSH_IDENTIFIER16_LVALUE); - add_short(i + num_virtual_variables); - CURRENT_PROGRAM_SIZE += 1; - } - else - { - add_f_code(F_PUSH_IDENTIFIER_LVALUE); - add_byte(i + num_virtual_variables); - } - lvtype = NV_VARIABLE(i)->type; - lvtype.typeflags &= TYPE_MOD_MASK; + add_f_code(F_PUSH_IDENTIFIER_LVALUE); + add_byte(i + num_virtual_variables); } + lvtype = NV_VARIABLE(i)->type; + lvtype.typeflags &= TYPE_MOD_MASK; + } - if (exact_types.typeflags - && !BASIC_TYPE(lvtype, Type_Number) - && !BASIC_TYPE(lvtype, Type_Float)) - { - argument_type_error($1.code, lvtype); - } - - CURRENT_PROGRAM_SIZE += 2; - } - else + if (exact_types.typeflags + && !BASIC_TYPE(lvtype, Type_Number) + && !BASIC_TYPE(lvtype, Type_Float)) { - /* Variable not declared - try to recover */ - YYACCEPT; - - lvtype = Type_Any; + argument_type_error($1.code, lvtype); } - last_expression = CURRENT_PROGRAM_SIZE; + last_expression = CURRENT_PROGRAM_SIZE + 2; - CURRENT_PROGRAM_SIZE += 1; + CURRENT_PROGRAM_SIZE += 3; add_f_code($1.code); $$.end = CURRENT_PROGRAM_SIZE; @@ -10591,6 +10586,9 @@ bytecode_p p; %line i = verify_declared($2); + if (i == -1) + /* variable not declared */ + YYACCEPT; $$.start = current = CURRENT_PROGRAM_SIZE; $$.code = -1; @@ -10844,6 +10842,9 @@ bytecode_p p; %line i = verify_declared($1); + if (i == -1) + /* variable not declared */ + YYACCEPT; $$.start = current = CURRENT_PROGRAM_SIZE; $$.end = 0; @@ -11474,6 +11475,10 @@ %line $$.length = 0; i = verify_declared($1); + if (i == -1) + /* variable not declared */ + YYACCEPT; + if (i & VIRTUAL_VAR_TAG) { $$.u.simple[0] = F_PUSH_VIRTUAL_VARIABLE_LVALUE; @@ -13557,7 +13562,12 @@ int i; %line $$ = 1 + $1; + i = verify_declared($3); + if (i == -1) + /* variable not declared */ + YYACCEPT; + if (i & VIRTUAL_VAR_TAG) { ins_f_code(F_PUSH_VIRTUAL_VARIABLE_LVALUE); | ||||
|
Could you make the exact binary which wrote the core also available for download? (Otherwise the core dump is not very useful.) |
|
I believe this bug is already fixed in r2499. I attached the patch, could you give it a try. |
|
Binary can be found at http://xover.mud.at/~invisible/temp/ldmud-3.3.718-debug. But I'll try the patch this week someday. |
|
Ok, found time right away... this patch does indeed fix the issue. Thanks a lot! |
Date Modified | Username | Field | Change |
---|---|---|---|
2009-05-04 03:46 | invisible | New Issue | |
2009-05-04 03:58 | zesstra | Note Added: 0001070 | |
2009-05-04 04:10 | Gnomi | File Added: r2499.diff | |
2009-05-04 04:12 | Gnomi | Note Added: 0001071 | |
2009-05-04 04:20 | invisible | Note Added: 0001073 | |
2009-05-04 04:30 | invisible | Note Added: 0001074 | |
2009-05-04 05:22 | Gnomi | Project | LDMud 3.2 => LDMud 3.3 |
2009-05-04 05:23 | Gnomi | Status | new => resolved |
2009-05-04 05:23 | Gnomi | Fixed in Version | => 3.3.719 |
2009-05-04 05:23 | Gnomi | Resolution | open => fixed |
2009-05-04 05:23 | Gnomi | Assigned To | => Gnomi |