GNU bug report logs - #16060
Attempt to mutate a literal pair results in segfault (master)

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: guile; Reported by: Pieter Slabbert <blob626@HIDDEN>; merged with #79483; dated Thu, 5 Dec 2013 19:41:02 UTC; Maintainer for guile is bug-guile@HIDDEN.
Merged 16060 79483. Request was from Olivier Dion <olivier.dion@HIDDEN> to control <at> debbugs.gnu.org. Full text available.
Severity set to 'normal' from 'wishlist' Request was from Olivier Dion <olivier.dion@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at 16060 <at> debbugs.gnu.org:


Received: (at 16060) by debbugs.gnu.org; 19 Jul 2023 22:14:02 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Jul 19 18:14:02 2023
Received: from localhost ([127.0.0.1]:57223 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1qMFQn-0005em-Kx
	for submit <at> debbugs.gnu.org; Wed, 19 Jul 2023 18:14:02 -0400
Received: from mout.kundenserver.de ([212.227.17.24]:53589)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <jean@HIDDEN>) id 1qMFQh-0005e9-Kq
 for 16060 <at> debbugs.gnu.org; Wed, 19 Jul 2023 18:14:00 -0400
Received: from [172.20.10.5] ([37.169.36.180]) by mrelayeu.kundenserver.de
 (mreue106 [212.227.15.184]) with ESMTPSA (Nemesis) id
 1M7KG2-1qGmJ63Ua4-007kdl for <16060 <at> debbugs.gnu.org>; Thu, 20 Jul 2023
 00:13:49 +0200
Message-ID: <e7ef2be10cd781d7bbf8c8fe93c2f6ed20af1956.camel@HIDDEN>
Subject: Re: bug#16060: Attempt to mutate a literal pair results in segfault
 (master)
From: Jean Abou Samra <jean@HIDDEN>
To: 16060 <at> debbugs.gnu.org
Date: Thu, 20 Jul 2023 00:13:47 +0200
Content-Type: multipart/signed; micalg="pgp-sha512";
 protocol="application/pgp-signature"; boundary="=-ZPkmMmYbvtOx0Di8lo7I"
User-Agent: Evolution 3.48.4 (3.48.4-1.fc38) 
MIME-Version: 1.0
X-Provags-ID: V03:K1:GdjCQdmIgo85/BmgvDeABo9e9NzA81HsDAwA7QWCUXfVqcFcyPB
 9HEJVbdCfl074By27l4NMnY/G9fLDgiW59EcgzRmUIUww8yLuQUK0Wrz1QdfoT132uWtGig
 yMqiGAZEvF/8kfl79X6Wf1DOd96QeUcQ2JduJznoe2iBRe8K3XhEXZp+adgCmSW2UMv5UKM
 jJjpG4Ivq8WyTEBENESNg==
X-Spam-Flag: NO
UI-OutboundReport: notjunk:1;M01:P0:Xk0epy1kaa8=;nDS5J50Jth7RE464zsxiYEqV25R
 ZgvOxLEe7QHVHt5ptD9qnnpoGy2rlcj9umwm1jNOpAyprkbZ66pTd3c9mRn/FMVU9G31ZApPo
 HGsKxFnNsmKqBLwt2QWeKTu87BfpfQNU2Wgt05D9T7pDOlbrrrpnAVzdbCC9PGxDFh7oZOZL2
 4d42remeiRjOn+8KsMOp7kSh71Aw6Sv59dudWIU9wLo68XHwq7BaINpAjlUBU/or6CnLrvrn3
 RHRqGv0UKczSQlzoGGnedIr6KaceQic9kYC1k3+UeOppCfeR0IrzB1OD75zfFtNBmWVocLoVT
 HutuOTKU0OI/QwOr6byKOrRWLMDEnkv4pJdnul+6m7Vf6mJUWoraLzXywM22qCifIZnsthXSY
 R8TDsFcFbRL0MWWlWwRHzbmqEwQrz+5ctzaqvPaYYVZfsv08iMbSfsKOdOVvKRdvJy8NjAr74
 i3CuI8YPIaTziYFDdoUoLcGPvckp12DaK5XHYJApC3jYBY9puG/NiI2i2MyqEVRrcqSWep3CG
 AnO4yHRUVpGVwO0qFgXaAQaop6wTtP//d+QIr3j5jOFT+GZtFcQXg95zHt1QMrEjel9extfLl
 tG/AbMCF01GCjcde2a05C8mELH0I2vsR5i6v9pasRejjFwt3E4oK1DnyhbUZLzwUIOfVam/Sg
 y4FilcVSB9x647oOTiemgIzx9z8PAgB/XNhLqK0PCg==
X-Spam-Score: -0.0 (/)
X-Debbugs-Envelope-To: 16060
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)


--=-ZPkmMmYbvtOx0Di8lo7I
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

This is still happening with Guile 3.0, but only at -O2, not at -O1.



$ cat x.scm=20
(set-car! '(1 . 2) 3)

$ guild3.0 compile -O1 x.scm
wrote `/home/jean/.cache/guile/ccache/3.0-LE-8-4.5/home/jean/tmp/x.scm.go'

$ guile3.0 x.scm
Backtrace:
In ice-9/boot-9.scm:
  1752:10  6 (with-exception-handler _ _ #:unwind? _ # _)
In unknown file:
           5 (apply-smob/0 #<thunk 7f72df6e0f60>)
In ice-9/boot-9.scm:
    724:2  4 (call-with-prompt ("prompt") #<procedure 7f72df6e7ee0 =E2=80=
=A6> =E2=80=A6)
In ice-9/eval.scm:
    619:8  3 (_ #(#(#<directory (guile-user) 7f72df6d9c80>)))
In ice-9/boot-9.scm:
   2835:4  2 (save-module-excursion #<procedure 7f72df6c7150 at ice-=E2=80=
=A6>)
  4380:12  1 (_)
In x.scm:
      1:0  0 (_)

x.scm:1:0: In procedure set-car!: Wrong type argument in position 1 (expect=
ing
mutable pair): (1 . 2)

$ guild3.0 compile -O2 x.scm
wrote `/home/jean/.cache/guile/ccache/3.0-LE-8-4.5/home/jean/tmp/x.scm.go'

$ guile3.0 x.scm
Segmentation fault (core dumped)



I found that module/language/cps/lower-primcalls.scm contains:

;; precondition: pair is mutable pair
(define-primcall-lowerer (set-car! cps k src #f (pair val))
  (with-cps cps
    (build-term
      ($continue k src
        ($primcall 'scm-set!/immediate '(pair . 0) (pair val))))))


which bypasses the check that the scm_set_car_x and scm_set_cdr_x
functions do.

I wonder if instead of checking the pair beforehand, Guile could just
do the set-c(a|d)r! anyway. Could the problem with mmapped bytecode
just be solved by adding PROT_WRITE to the mmap flags? (Or are there
maybe thread-safety problems?)





--=-ZPkmMmYbvtOx0Di8lo7I
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQSZ7TKxnKGyBvBjzBmj8PYLiTOX/gUCZLhgGwAKCRCj8PYLiTOX
/suIAP0X/4OBa3Yf0SyUdIg6kfZoAQ6SJR1tICxHJFYr/iSVGgEAojmVy0c3QPZw
ETqo587SzzPYe9kFeOWU3Bt1UYzfRgA=
=Yos1
-----END PGP SIGNATURE-----

--=-ZPkmMmYbvtOx0Di8lo7I--




Information forwarded to bug-guile@HIDDEN:
bug#16060; Package guile. Full text available.
Severity set to 'wishlist' from 'normal' Request was from Mark H Weaver <mhw@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at 16060 <at> debbugs.gnu.org:


Received: (at 16060) by debbugs.gnu.org; 5 Dec 2013 23:05:36 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Dec 05 18:05:36 2013
Received: from localhost ([127.0.0.1]:60677 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1VohzC-0002ve-Cg
	for submit <at> debbugs.gnu.org; Thu, 05 Dec 2013 18:05:34 -0500
Received: from world.peace.net ([96.39.62.75]:38826)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <mhw@HIDDEN>) id 1Vohz9-0002vT-8h
 for 16060 <at> debbugs.gnu.org; Thu, 05 Dec 2013 18:05:32 -0500
Received: from 209-6-91-212.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com
 ([209.6.91.212] helo=yeeloong)
 by world.peace.net with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)
 (Exim 4.72) (envelope-from <mhw@HIDDEN>)
 id 1Vohz2-00064o-Om; Thu, 05 Dec 2013 18:05:24 -0500
From: Mark H Weaver <mhw@HIDDEN>
To: Pieter Slabbert <blob626@HIDDEN>
Subject: Re: bug#16060: Attempt to mutate a literal pair results in segfault
 (master)
References: <52A0D66A.2070708@HIDDEN>
Date: Thu, 05 Dec 2013 18:04:25 -0500
In-Reply-To: <52A0D66A.2070708@HIDDEN> (Pieter Slabbert's message of "Thu, 
 05 Dec 2013 21:39:22 +0200")
Message-ID: <87siu6kih2.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 16060
Cc: 16060 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <http://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <http://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <http://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

Hi,

Pieter Slabbert <blob626@HIDDEN> writes:
> When I try to load a file which contains
>  (set-car! '(0 . ()) 1)
>
> Guile segfaults .
> if I enter the same thing into the interpreter it works fine.

According to the R5RS, it is "an error" to mutate literals, and
implementations are not required to detect this error.  In other words,
the behavior is unspecified, like signed integer overflow in C.

Currently, what happens is this: on the stable-2.0 branch, and in the
interpreter on master, you are effectively modifying the code itself.

In compiled code on master, literals are in read-only memory, which is
why attempting to mutate it leads to a segfault.  It is similar to what
happens in C if you attempt to mutate a character in a string literal.

Perhaps in 2.2.x we can support a debugging mode where compiled code
adds extra checks, but this is a wishlist item.

> I tried the same thing in chibi and it complained about try to mutate
> an immutable pair. Fixed it in my code but the segfault made it a lot
> harder to find
>
> I installed guile from git. Version gives me 2.1.0.526-7f710

The master branch of guile is very much a work-in-progress, with a major
new implementation of the VM, compiler, and loader recently pushed.  The
ABI is not yet stabilized, which means that occasionally you may need to
"make clean" and rebuild everything, including any external libraries
that use libguile.

For now, you might be happier with the 'stable-2.0' branch in git.

     Regards,
       Mark




Information forwarded to bug-guile@HIDDEN:
bug#16060; Package guile. Full text available.
Changed bug title to 'Attempt to mutate a literal pair results in segfault (master)' from 'segfault when loading file' Request was from Mark H Weaver <mhw@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 5 Dec 2013 19:40:15 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Dec 05 14:40:15 2013
Received: from localhost ([127.0.0.1]:60376 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1VoemU-00058c-74
	for submit <at> debbugs.gnu.org; Thu, 05 Dec 2013 14:40:14 -0500
Received: from eggs.gnu.org ([208.118.235.92]:34810)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <blob626@HIDDEN>) id 1VoemP-00058S-Qf
 for submit <at> debbugs.gnu.org; Thu, 05 Dec 2013 14:40:10 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <blob626@HIDDEN>) id 1VoemG-0002PO-T6
 for submit <at> debbugs.gnu.org; Thu, 05 Dec 2013 14:40:09 -0500
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: *
X-Spam-Status: No, score=1.1 required=5.0 tests=BAYES_50,
 FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,T_DKIM_INVALID autolearn=disabled
 version=3.3.2
Received: from lists.gnu.org ([2001:4830:134:3::11]:42974)
 by eggs.gnu.org with esmtp (Exim 4.71)
 (envelope-from <blob626@HIDDEN>) id 1VoemG-0002PK-P4
 for submit <at> debbugs.gnu.org; Thu, 05 Dec 2013 14:40:00 -0500
Received: from eggs.gnu.org ([2001:4830:134:3::10]:36488)
 by lists.gnu.org with esmtp (Exim 4.71)
 (envelope-from <blob626@HIDDEN>) id 1Voem8-0004MV-8N
 for bug-guile@HIDDEN; Thu, 05 Dec 2013 14:40:00 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <blob626@HIDDEN>) id 1Voelw-0002NM-LS
 for bug-guile@HIDDEN; Thu, 05 Dec 2013 14:39:52 -0500
Received: from mail-we0-x22c.google.com ([2a00:1450:400c:c03::22c]:62043)
 by eggs.gnu.org with esmtp (Exim 4.71)
 (envelope-from <blob626@HIDDEN>) id 1Voelw-0002N3-E9
 for bug-guile@HIDDEN; Thu, 05 Dec 2013 14:39:40 -0500
Received: by mail-we0-f172.google.com with SMTP id w62so11581123wes.3
 for <bug-guile@HIDDEN>; Thu, 05 Dec 2013 11:39:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=message-id:date:from:user-agent:mime-version:to:subject
 :content-type:content-transfer-encoding;
 bh=Gu+fqkq2NtBWR1Dl8Hw/qEJRZ5SVA0cEPPGuvkyMa58=;
 b=TLXGUNNlN+a0Q8E5UPHYeDuo7yWp3VEkCMHq+eAh1xTClHmKjf5OhZ2SDl6V+EdwJP
 x93L1vnafKzRFXEJfVmsNWpEYal6XZPDVqV3e21WEbOTPiMr4JaFLjSYEpNVy3nwMHJc
 iaF7dRL2QnWbqvkzuQz9d216gLIG9XTkrcFeYnLplYyOB8lh5nbrhFBlvMpCdcLlR/0X
 /qvusOocITqmvLI0qlhmwJzrZUVXfpCgAy/ET7cCTMDfOi+/+FmayC5t8bfjVYHz3owf
 Hnp73sf/pem1VmqvO9K2NJhS2tAsk3ezQw2WlO/Jc3So7F2JN4PTFKYReQn8D6bjr6hT
 u1Qg==
X-Received: by 10.194.122.99 with SMTP id lr3mr68634871wjb.21.1386272378166;
 Thu, 05 Dec 2013 11:39:38 -0800 (PST)
Received: from [192.168.10.104] (105-237-90-181.access.mtnbusiness.co.za.
 [105.237.90.181])
 by mx.google.com with ESMTPSA id w20sm9212500wia.5.2013.12.05.11.39.36
 for <bug-guile@HIDDEN>
 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
 Thu, 05 Dec 2013 11:39:37 -0800 (PST)
Message-ID: <52A0D66A.2070708@HIDDEN>
Date: Thu, 05 Dec 2013 21:39:22 +0200
From: Pieter Slabbert <blob626@HIDDEN>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:24.0) Gecko/20100101 Thunderbird/24.1.1
MIME-Version: 1.0
To: bug-guile@HIDDEN
Subject: segfault when loading file
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address
 (bad octet value).
X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address
 (bad octet value).
X-Received-From: 2001:4830:134:3::11
X-Spam-Score: -3.8 (---)
X-Debbugs-Envelope-To: submit
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <http://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <http://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <http://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -3.8 (---)

HI

When I try to load a file which contains
  (set-car! '(0 . ()) 1)

Guile segfaults .
if I enter the same thing into the interpreter it works fine.

I tried the same thing in chibi and it complained about try to mutate
an immutable pair. Fixed it in my code but the segfault made it a lot 
harder to find

I installed guile from git. Version gives me 2.1.0.526-7f710
Running Ubuntu 13.10
Processor: Intel Atom N450

Steps to reproduce:

$ echo "(set-car! '(0 . ()) 1)" > test.scm
$ guile
 > (load "test.scm")
segfault

Thanks
Pieter




Acknowledgement sent to Pieter Slabbert <blob626@HIDDEN>:
New bug report received and forwarded. Copy sent to bug-guile@HIDDEN. Full text available.
Report forwarded to bug-guile@HIDDEN:
bug#16060; Package guile. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Thu, 19 Feb 2026 18:00:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.