Commit Graph

10 Commits

Author SHA1 Message Date
Mark Thom
4fc4152eac Merge pull request #2817 from adri326/fix-2815-run_module_predicate-backtrack
Fix backtracking on the topmost predicate triggering UB in run_module_predicate
2025-02-16 22:47:49 -08:00
bakaq
28926486e0 More stream tests 2025-02-16 04:04:48 -03:00
Emilie Burgun
22538a05be Fix backtracking on the topmost predicate triggering UB in run_module_predicate
Fixes #2815, see that issue for my investigation.

This is a one-line fix that I'm quite proud of :)

If the topmost query for `run_module_predicate` needs to backtrack,
then before this commit, one of the following two things may happen:
- A dangling OrFrame is read at stack offset 0
- An AndFrame was at stack offset 0 would be read as an OrFrame

This can be seen by either calling `run_module_predicate` with a
throwing predicate (encountering the second scenario) or a failing
predicate (encountering the first scenario), or by running the following
in the REPL, which triggers a `throw/1` within the error handler, propagating
it all the way up (and encountering the second scenario):

```prolog
?- current_output(S), open(stream(S), write, S0, [type(binary)]).
```

Currently, `Stack` is not equipped with tools to detect this incorrect
behavior, so it would instead try to read an OrFrame at offset 0, which
triggers UB, since transmuting between AndFramePrelude and OrFramePrelude
isn't legal.

In practice, since `AndFramePrelude` is smaller, the later fields of
`OrFramePrelude` would read from the cells following the `AndFramePrelude`,
and would contain nonsensical data, triggering the panic that led to
my investigation in #2815 and that is fairly reliable to witness.

Surprisingly, this wouldn't happen with `run_query`, which led me to
look at how they operate differently. It turns out that `run_query`
inserts an OrFrame at offset 0, which covers both problematic scenarios.

The fix is thus to simply add a call to `Machine::allocate_stub_choice_point`
in `run_module_predicate` :)
2025-02-06 00:43:01 +01:00
bakaq
2e910de485 cargo fmt 2024-12-12 06:03:43 -03:00
bakaq
500a6cdaf1 FIXME in Drop for QueryState 2024-12-12 05:49:52 -03:00
bakaq
17293a5753 Leave residual goals for later 2024-12-12 05:47:01 -03:00
bakaq
a92eac919f Rename lib_machine_tests.rs to tests.rs 2024-12-12 05:46:54 -03:00
bakaq
9265d66f58 Handle errors in QueryState 2024-12-08 20:18:06 -03:00
bakaq
e21c772181 Migrate tests to new API 2024-12-08 20:18:06 -03:00
bakaq
2f82c78bc0 Separate lib_machine tests into separate file 2024-12-08 20:18:06 -03:00