google / szl

A compiler and runtime for the Sawzall language
Other
69 stars 16 forks source link

Memory corruption in nativecodegen with -O1 or higher #33

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
The regression tests sort/sort_0{1,2,3,4}.szl all fail in -N (native) mode on 
x86_64 Ubuntu 13.04 when compiled with -O1 or higher. Compiling 
nativecodegen.cc with -O0 is a workaround.

The root cause appears to be that FunctionCall (a class defined in 
nativecodegen.cc) copies a reference-typed constructor argument to a 
reference-typed member variable, and then accesses it in ~FunctionCall after 
the original constructor argument has been deallocated by the caller. To put it 
another way, each FunctionCall retains a pointer to a stack object and 
dereferences it after its lifetime has expired. The decision to use '&' instead 
of '*' rendered the bug difficult to see on code review.

One-byte code patch attached, representing two days of debugging work. Two 
days. One byte. This is why I hate C++.

Original issue reported on code.google.com by aecolley on 20 Oct 2013 at 4:05

Attachments: