Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent word duplication when appending to an object #105

Closed
wants to merge 3 commits into from
Closed

Prevent word duplication when appending to an object #105

wants to merge 3 commits into from

Conversation

0branch
Copy link
Contributor

@0branch 0branch commented Mar 14, 2013

(Addresses Cure Code #1979.)

Ensure that duplicate words in block! arguments are flagged as temporary, favouring the final value.

The linear search isn't ideal, though it means that existing structures can be re-used without further allocation.

In Brian Hawley's proposal, appending to an `object!` employs three
passes:

1. Verify the `block!` argument
2. Add any absent words to the target `object!` with `bind/new`
3. Update values for each word, favouring the latest, using `set/any`

In this commit, (2) and (3) are merged.
@BrianHawley
Copy link
Contributor

So this is only happening in the case where the word isn't already in the object?

>> append context [b: 1] [b: 2 b: 3]
== make object! [
    b: 3
]

The make object! case uses code that is exported as the collect-words native. Might there be some better code in that native that you can use, like what it does to do collect-words/set? Perhaps not, it's just worth looking into.

@0branch
Copy link
Contributor Author

0branch commented Mar 14, 2013

Right: only when the word isn't already present.

Thanks for the suggestion, will take a look.

@0branch
Copy link
Contributor Author

0branch commented Mar 15, 2013

As indicated in the original message, the nested linear search is far from ideal and should be avoidable if we allocate a map! or similar structure.

Here is the performance degradation in the worst case (quadratic, O(n2)) where all words in the block are unique:

$ r3-1979 append-profile.r
Preparing input...words: 1000
Elapsed: 0:00:00.022868
~~
Preparing input...words: 10000
Elapsed: 0:00:01.915341
~~
Preparing input...words: 20000
Elapsed: 0:00:08.370466

vs.

$ r3-master append-profile.r
Preparing input...words: 1000
Elapsed: 0:00:00.000076
~~
Preparing input...words: 10000
Elapsed: 0:00:00.000636
~~
Preparing input...words: 20000
Elapsed: 0:00:00.000637

I don't find this acceptable; suggest we close this pull request (apologies for filing a naive patch) and treat as a demonstration of the duplication problem.

@BrianHawley
Copy link
Contributor

Well, from a naive outside position (I haven't examined the code), let me suggest a possible solution expressed in Rebol code for append object block where block is presumed to possibly contain words :

foreach [w v] block [bind/new w object]
append object block

Basically, this is a block of pairs of any-word and value, no evaluation necessary, so we just need to add new words to the object; the bind/new function does that. So, use the method bind/new uses to add the words in the block itself (not deep into nested blocks) to the object first, before you do the append. That method is already hashed. Then, after that, do the existing append object block code, but now it will be the words-exist-in-object-already operation that we know already works, and that word lookup is hashed already too.

Then optimize a little, maybe doing things like just expanding the object once in the bind/new phase rather than n times. Does that make sense?

@0branch
Copy link
Contributor Author

0branch commented Mar 15, 2013

I think I follow. One issue though: the current code proceeds with append in two steps,

  1. Verify the block structure (this is where duplicates are currently detected);
  2. Append once verified.

The original patch aimed to preserve this logic.

If I'm reading your proposal correctly, you're mutating the block (by binding member words) iteratively. So: What happens when you arrive at a bad key?

@BrianHawley
Copy link
Contributor

"If I'm reading your proposal correctly, you're mutating the block (by binding member words) iteratively. So: What happens when you arrive at a bad key?"

The bind/new function when binding a word rather than a block doesn't mutate the word, it just generates a new word value with references to the old symbol and the new context. You were missing the important bit, which is the /new part, which adds any new words found to the object (with unset values at first) - that is the only mutating part. It was just a hint of where to go to find code that collects a set of words and adds them to an object.

"The alternative solution I had in mind was..."

You don't need to allocate a new object, you already have an object that you are going to be adding the values to anyway, so you might as well use it. It would mean 3 fast passes, the native equivalent of this Rebol code:

forskip block 2 [unless any-word? first block [trap]]  ; Use whatever Trap function it uses in native
forskip block 2 [bind/new first block object]  ; This modifies object, copies the word
forskip block 2 [set/any in object first block second block]  ; value will be none if block ends early

Now you might want to optimize the second step by looking at what the /new option of bind does when it has a block of words that it is adding to the object all at once, and maybe do something like that. Or you can do it one-at-a-time. You don't actually need to do any of the actual binding in the second step, unless what you are doing is generating a new block with bound words and unaltered value references, which might be faster because it would let you skip the in object part in the third pass - test to be sure.

You might also consider looking at what reduce and compose do in this situation. Instead of allocating a new series, they just push their temporary values on the stack, then copy them into the results and just let the function return get rid of the temporaries (the stack is basically a block, FYI). If you think that the block appended is going to be relatively small (100 items or less maybe) you can push your bound words to the stack in step 2, then just set them in step 3. It is trading heap pressure until the next GC, for stack pressure until the function returns, but that is likely a good tradeoff when you consider that it doesn't recursively call other functions.

@0branch
Copy link
Contributor Author

0branch commented Mar 16, 2013

Thanks for the clarification.

I tested your bind/new proposal this morning (the naive version where binding is performed a word at a time).

Here're some rough worst-case results (all words are unique, the target object! is empty):

  • Using bind/new (frame appending when a word isn't bound in the target object),

    Preparing input of 100 unique words ... done.
    Append duration: 0:00:00.000049
    ~~
    Preparing input of 1000 unique words ... done.
    Append duration: 0:00:00.00089
    ~~
    Preparing input of 10000 unique words ... done.
    Append duration: 0:00:00.085974
    ~~
    Preparing input of 100000 unique words ... done.
    Append duration: 0:00:08.816506
    ~~
    Preparing input of 200000 unique words ... done.
    Append duration: 0:00:41.362606
    
  • Current HEAD of master,

    Preparing input of 100 unique words ... done.
    Append duration: 0:00:00.000023
    ~~
    Preparing input of 1000 unique words ... done.
    Append duration: 0:00:00.000034
    ~~
    Preparing input of 10000 unique words ... done.
    Append duration: 0:00:00.001611
    ~~
    Preparing input of 100000 unique words ... done.
    Append duration: 0:00:00.010069
    ~~
    Preparing input of 200000 unique words ... done.
    Append duration: 0:00:00.014229
    

Another suggestion: how about leveraging resolve for this purpose? In particular, resolve/extend/all? Consider,

>> append context [a: 1] [a: 2 b: 3 b: 4]
== make object! [
    a: 2
    b: 4
]
>> resolve/extend/all context [a: 1] context [a: 2 b: 3 b: 4]
== make object! [
    a: 2
    b: 4
]

By converting the block! at the outset, we end up with a blazing fast "append",

Preparing input of 100 unique words ... done.
Employing resolve...
Duration: 0:00:00.000047
~~
Preparing input of 1000 unique words ... done.
Employing resolve...
Duration: 0:00:00.000222
~~
Preparing input of 10000 unique words ... done.
Employing resolve...
Duration: 0:00:00.003199
~~
Preparing input of 100000 unique words ... done.
Employing resolve...
Duration: 0:00:00.019207
~~
Preparing input of 200000 unique words ... done.
Employing resolve...
Duration: 0:00:00.047758
~~
Preparing input of 1000000 unique words ... done.
Employing resolve...
Duration: 0:00:00.225966
~~
Preparing input of 5000000 unique words ... done.
Employing resolve...
Duration: 0:00:01.232638

The current implementation fails to check for hidden words in the target
object before appending additional frames.

Replace the `Bind_Word` logic with a single `Find_Word_Index` call to
correct this behaviour.
@0branch
Copy link
Contributor Author

0branch commented Mar 16, 2013

Unfortunately, the above implementation introduces inconsistent state when attempting to set protected words during an append,

>> protect in x: context [a: 1] 'a
== a
>> append x [b: 2 c: 3 a: 4]
** Script error: protected variable - cannot modify: a:
** Where: append
** Near: append x [b: 2 c: 3 a: 4]
>> x
== make object! [
    a: 1
    b: 2
    c: 3
]    

Note that while master fares slightly better, backout is still problematic:

>> protect in x: context [a: 1] 'a
== a
>> append x [b: 2 c: 3 a: 4]
** Script error: protected variable - cannot modify: a:
** Where: append
** Near: append x [b: 2 c: 3 a: 4]
>> x
== make object! [
    a: 1
]
>> append x [b: 2]
== make object! [
    a: 1
    b: 2
]
>> append x [b: "whoops" c: 3 a: 4]
** Script error: protected variable - cannot modify: a:
** Where: append
** Near: append x [b: "whoops" c: 3 a: 4]
>> x
== make object! [
    a: 1
    b: "whoops"
]

Since new frames are appended once mutation of existing words has occurred, the problem only becomes apparent under certain ordering conditions (b is set before the trap on a).

@earl
Copy link
Contributor

earl commented Mar 17, 2013

Well, you'd "just" have to move the protected check back to the verification loop to get rid of the inconsistent state problem. (Which would be another fix over r3-master, as you already noted.)

Unfortunately, Find_Word_Index is just another linear search in disguise (over the target object's frame) ... So we have O(n_m) in the protected checking, and another O(n_m) in the final mutation (in the worst case, of course). That is a slight improvement over the initial O(n²), as we'd now need both huge target objects and huge to-be-appended blocks to make this bite; but it still strikes me as problematic. (Note, however, that the original code is also O(n*m).)

@0branch
Copy link
Contributor Author

0branch commented Mar 17, 2013

Agreed on both points. I'll push a verification fix shortly for completeness, though I don't find these solutions particularly satisfactory.

Incidentally, since I suggested it above, note that resolve/extend/all doesn't perform any verification:

>> protect in x: context [a: 1] 'a
== a
>> resolve/extend/all x context [a: "ignored" b: 2]
== make object! [
    a: 1
    b: 2
]
>> resolve/extend/all x context [b: "replaced" c: 3]
== make object! [
    a: 1
    b: "replaced"
    c: 3
]

—protected fields are simply left unchanged.

@0branch
Copy link
Contributor Author

0branch commented Mar 17, 2013

Some profiling data for the latest commit (46e3d14),

Here the target object consists of 500000 words, disjoint from the input.

Preparing input of 100 unique words ... done.
Append duration: 0:00:00.225658
~~
Preparing input of 1000 unique words ... done.
Append duration: 0:00:02.371522
~~
Preparing input of 10000 unique words ... done.
Append duration: 0:00:22.006266
~~
Preparing input of 100000 unique words ... done.
Append duration: 0:03:49.309265

As indicated in the output, the target object is created with a fixed size (500,000 words) and is completely disjoint from the source block. This means that the entirety of the target needs to be walked per candidate arg during verification.

@ladislav
Copy link
Contributor

#153 is meant to replace this

@carls
Copy link
Contributor

carls commented Feb 16, 2014

Pull request #153 accepted - closing this one.

@carls carls closed this Feb 16, 2014
zsx added a commit to zsx/r3 that referenced this pull request May 13, 2014
It will confuse Expand_Series expects "tail" to be the actual size, and
cause a read beyond the allocated memory, or heap buffer overflow found
by address sanitizer of GCC:
=================================================================
==10856==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a00000b201 at pc 0x47df61 bp 0x7fffffff2ca0 sp 0x7fffffff2c98
READ of size 1 at 0x62a00000b201 thread T0
    #0 0x47df60 in Expand_Series ../src/core/m-series.c:145
    #1 0x47e5a7 in Extend_Series ../src/core/m-series.c:187
    #2 0x466e0c in Scan_Quote ../src/core/l-scan.c:462
    #3 0x46a797 in Scan_Token ../src/core/l-scan.c:918
    #4 0x46e263 in Scan_Block ../src/core/l-scan.c:1188
    #5 0x46e722 in Scan_Code ../src/core/l-scan.c:1548
    #6 0x46e886 in Scan_Source ../src/core/l-scan.c:1568
    #7 0x4cb85c in Make_Block_Type ../src/core/t-block.c:306
    #8 0x4cd1b8 in T_Block ../src/core/t-block.c:608
    #9 0x4d042e in T_Datatype ../src/core/t-datatype.c:92
    #10 0x42e080 in Do_Act ../src/core/c-function.c:338
    #11 0x42e7e5 in Do_Action ../src/core/c-function.c:396
    #12 0x413628 in Do_Next ../src/core/c-do.c:884
    #13 0x41309b in Do_Next ../src/core/c-do.c:858
    #14 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #15 0x482dd2 in N_case ../src/core/n-control.c:349
    #16 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #17 0x413628 in Do_Next ../src/core/c-do.c:884
    #18 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #19 0x42e869 in Do_Function ../src/core/c-function.c:415
    #20 0x413628 in Do_Next ../src/core/c-do.c:884
    #21 0x41309b in Do_Next ../src/core/c-do.c:858
    #22 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #23 0x42e869 in Do_Function ../src/core/c-function.c:415
    #24 0x413628 in Do_Next ../src/core/c-do.c:884
    #25 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #26 0x414152 in Do_Next ../src/core/c-do.c:939
    #27 0x48201c in N_all ../src/core/n-control.c:261
    #28 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #29 0x413628 in Do_Next ../src/core/c-do.c:884
    #30 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #31 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #32 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #33 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #34 0x413628 in Do_Next ../src/core/c-do.c:884
    #35 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #36 0x42e869 in Do_Function ../src/core/c-function.c:415
    #37 0x413628 in Do_Next ../src/core/c-do.c:884
    #38 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #39 0x414152 in Do_Next ../src/core/c-do.c:939
    #40 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #41 0x48459c in N_if ../src/core/n-control.c:619
    #42 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #43 0x413628 in Do_Next ../src/core/c-do.c:884
    #44 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #45 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #46 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #47 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #48 0x413628 in Do_Next ../src/core/c-do.c:884
    #49 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #50 0x42e869 in Do_Function ../src/core/c-function.c:415
    #51 0x418fb4 in Apply_Block ../src/core/c-do.c:1474
    #52 0x4824fb in N_apply ../src/core/n-control.c:295
    rebol#53 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#54 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#55 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#56 0x414152 in Do_Next ../src/core/c-do.c:939
    rebol#57 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#58 0x485388 in N_unless ../src/core/n-control.c:763
    rebol#59 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#60 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#61 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#62 0x483eff in N_do ../src/core/n-control.c:523
    rebol#63 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#64 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#65 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#66 0x414152 in Do_Next ../src/core/c-do.c:939
    rebol#67 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#68 0x48459c in N_if ../src/core/n-control.c:619
    rebol#69 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#70 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#71 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#72 0x48f8cc in Loop_Integer ../src/core/n-loop.c:130
    rebol#73 0x49314d in N_repeat ../src/core/n-loop.c:631
    rebol#74 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#75 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#76 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#77 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    rebol#78 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#79 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#80 0x485388 in N_unless ../src/core/n-control.c:763
    rebol#81 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#82 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#83 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#84 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#85 0x418fb4 in Apply_Block ../src/core/c-do.c:1474
    rebol#86 0x4824fb in N_apply ../src/core/n-control.c:295
    rebol#87 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#88 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#89 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#90 0x414152 in Do_Next ../src/core/c-do.c:939
    rebol#91 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#92 0x485388 in N_unless ../src/core/n-control.c:763
    rebol#93 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#94 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#95 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#96 0x483eff in N_do ../src/core/n-control.c:523
    rebol#97 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#98 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#99 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#100 0x414152 in Do_Next ../src/core/c-do.c:939
    rebol#101 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#102 0x48459c in N_if ../src/core/n-control.c:619
    rebol#103 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#104 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#105 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#106 0x48f8cc in Loop_Integer ../src/core/n-loop.c:130
    rebol#107 0x49314d in N_repeat ../src/core/n-loop.c:631
    rebol#108 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#109 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#110 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#111 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    rebol#112 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#113 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#114 0x485388 in N_unless ../src/core/n-control.c:763
    rebol#115 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#116 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#117 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#118 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#119 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#120 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#121 0x484cf1 in N_switch ../src/core/n-control.c:716
    rebol#122 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#123 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#124 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#125 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#126 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#127 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#128 0x48459c in N_if ../src/core/n-control.c:619
    rebol#129 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#130 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#131 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#132 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#133 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#134 0x41309b in Do_Next ../src/core/c-do.c:858
    rebol#135 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#136 0x484280 in N_either ../src/core/n-control.c:595
    rebol#137 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#138 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#139 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#140 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#141 0x419631 in Apply_Function ../src/core/c-do.c:1518
    rebol#142 0x419918 in Apply_Func ../src/core/c-do.c:1545
    rebol#143 0x48d102 in N_wake_up ../src/core/n-io.c:415
    rebol#144 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#145 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#146 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#147 0x4133c9 in Do_Next ../src/core/c-do.c:877
    rebol#148 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#149 0x492b66 in N_loop ../src/core/n-loop.c:590
    rebol#150 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#151 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#152 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#153 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#154 0x419631 in Apply_Function ../src/core/c-do.c:1518
    rebol#155 0x419918 in Apply_Func ../src/core/c-do.c:1545
    rebol#156 0x42fef7 in Awake_System ../src/core/c-port.c:198
    rebol#157 0x43012a in Wait_Ports ../src/core/c-port.c:231
    rebol#158 0x48cd62 in N_wait ../src/core/n-io.c:374
    rebol#159 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#160 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#161 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#162 0x4133c9 in Do_Next ../src/core/c-do.c:877
    rebol#163 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#164 0x4133c9 in Do_Next ../src/core/c-do.c:877
    rebol#165 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#166 0x4929a7 in N_forever ../src/core/n-loop.c:527
    rebol#167 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#168 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#169 0x4152ff in Try_Block ../src/core/c-do.c:1077
    rebol#170 0x48507e in N_try ../src/core/n-control.c:740
    rebol#171 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#172 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#173 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#174 0x414152 in Do_Next ../src/core/c-do.c:939
    rebol#175 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#176 0x4133c9 in Do_Next ../src/core/c-do.c:877
    rebol#177 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#178 0x4133c9 in Do_Next ../src/core/c-do.c:877
    rebol#179 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#180 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#181 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#182 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#183 0x48459c in N_if ../src/core/n-control.c:619
    rebol#184 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#185 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#186 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#187 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#188 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#189 0x41309b in Do_Next ../src/core/c-do.c:858
    rebol#190 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#191 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#192 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#193 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#194 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#195 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#196 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#197 0x414152 in Do_Next ../src/core/c-do.c:939
    rebol#198 0x48201c in N_all ../src/core/n-control.c:261
    rebol#199 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#200 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#201 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#202 0x491abc in Loop_Each ../src/core/n-loop.c:410
    rebol#203 0x492a6c in N_foreach ../src/core/n-loop.c:546
    rebol#204 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#205 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#206 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#207 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#208 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#209 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#210 0x485388 in N_unless ../src/core/n-control.c:763
    rebol#211 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#212 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#213 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#214 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#215 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#216 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#217 0x48459c in N_if ../src/core/n-control.c:619
    rebol#218 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#219 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#220 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#221 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    rebol#222 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#223 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#224 0x414152 in Do_Next ../src/core/c-do.c:939
    rebol#225 0x48201c in N_all ../src/core/n-control.c:261
    rebol#226 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#227 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#228 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#229 0x491abc in Loop_Each ../src/core/n-loop.c:410
    rebol#230 0x492a6c in N_foreach ../src/core/n-loop.c:546
    rebol#231 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#232 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#233 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#234 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#235 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#236 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#237 0x48459c in N_if ../src/core/n-control.c:619
    rebol#238 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#239 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#240 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#241 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#242 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#243 0x41309b in Do_Next ../src/core/c-do.c:858
    rebol#244 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#245 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#246 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#247 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#248 0x48459c in N_if ../src/core/n-control.c:619
    rebol#249 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#250 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#251 0x414825 in Do_Blk ../src/core/c-do.c:1010

0x62a00000b201 is located 1 bytes to the right of 20480-byte region [0x62a000006200,0x62a00000b200)
allocated by thread T0 here:
    #0 0x7ffff6f58b1f in malloc (/usr/lib/libasan.so.1+0x54b1f)
    #1 0x47924a in Make_Mem ../src/core/m-pools.c:121
    #2 0x47a9ff in Make_Series ../src/core/m-pools.c:406
    #3 0x4aee84 in Make_Unicode ../src/core/s-make.c:59
    #4 0x4bb797 in Init_Mold ../src/core/s-mold.c:1425
    #5 0x40da64 in Init_Core ../src/core/b-init.c:940
    #6 0x4055e0 in RL_Init ../src/core/a-lib.c:124
    #7 0x580aa2 in main ../src/os/host-main.c:154
    #8 0x7ffff5719fff in __libc_start_main (/usr/lib/libc.so.6+0x1ffff)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../src/core/m-series.c:145 Expand_Series
Shadow bytes around the buggy address:
  0x0c547fff95f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c547fff9640:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:
zsx referenced this pull request in metaeducation/ren-c Jun 21, 2015
It will confuse Expand_Series expects "tail" to be the actual size, and
cause a read beyond the allocated memory, or heap buffer overflow found
by address sanitizer of GCC:
=================================================================
==10856==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a00000b201 at pc 0x47df61 bp 0x7fffffff2ca0 sp 0x7fffffff2c98
READ of size 1 at 0x62a00000b201 thread T0
    #0 0x47df60 in Expand_Series ../src/core/m-series.c:145
    #1 0x47e5a7 in Extend_Series ../src/core/m-series.c:187
    rebolsource#2 0x466e0c in Scan_Quote ../src/core/l-scan.c:462
    rebolsource#3 0x46a797 in Scan_Token ../src/core/l-scan.c:918
    #4 0x46e263 in Scan_Block ../src/core/l-scan.c:1188
    #5 0x46e722 in Scan_Code ../src/core/l-scan.c:1548
    rebolsource#6 0x46e886 in Scan_Source ../src/core/l-scan.c:1568
    rebol#7 0x4cb85c in Make_Block_Type ../src/core/t-block.c:306
    #8 0x4cd1b8 in T_Block ../src/core/t-block.c:608
    #9 0x4d042e in T_Datatype ../src/core/t-datatype.c:92
    #10 0x42e080 in Do_Act ../src/core/c-function.c:338
    #11 0x42e7e5 in Do_Action ../src/core/c-function.c:396
    #12 0x413628 in Do_Next ../src/core/c-do.c:884
    #13 0x41309b in Do_Next ../src/core/c-do.c:858
    #14 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #15 0x482dd2 in N_case ../src/core/n-control.c:349
    #16 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#17 0x413628 in Do_Next ../src/core/c-do.c:884
    #18 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#19 0x42e869 in Do_Function ../src/core/c-function.c:415
    #20 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#21 0x41309b in Do_Next ../src/core/c-do.c:858
    rebol#22 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#23 0x42e869 in Do_Function ../src/core/c-function.c:415
    #24 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#25 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#26 0x414152 in Do_Next ../src/core/c-do.c:939
    #27 0x48201c in N_all ../src/core/n-control.c:261
    #28 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #29 0x413628 in Do_Next ../src/core/c-do.c:884
    #30 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #31 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #32 0x492a6c in N_foreach ../src/core/n-loop.c:546
    rebol#33 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #34 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#35 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #36 0x42e869 in Do_Function ../src/core/c-function.c:415
    #37 0x413628 in Do_Next ../src/core/c-do.c:884
    #38 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #39 0x414152 in Do_Next ../src/core/c-do.c:939
    rebol#40 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#41 0x48459c in N_if ../src/core/n-control.c:619
    #42 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #43 0x413628 in Do_Next ../src/core/c-do.c:884
    #44 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #45 0x491abc in Loop_Each ../src/core/n-loop.c:410
    rebol#46 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #47 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#48 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#49 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #50 0x42e869 in Do_Function ../src/core/c-function.c:415
    #51 0x418fb4 in Apply_Block ../src/core/c-do.c:1474
    #52 0x4824fb in N_apply ../src/core/n-control.c:295
    rebol#53 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #54 0x413628 in Do_Next ../src/core/c-do.c:884
    #55 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #56 0x414152 in Do_Next ../src/core/c-do.c:939
    #57 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #58 0x485388 in N_unless ../src/core/n-control.c:763
    #59 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#60 0x413628 in Do_Next ../src/core/c-do.c:884
    #61 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #62 0x483eff in N_do ../src/core/n-control.c:523
    #63 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #64 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#65 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#66 0x414152 in Do_Next ../src/core/c-do.c:939
    #67 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#68 0x48459c in N_if ../src/core/n-control.c:619
    #69 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #70 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#71 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #72 0x48f8cc in Loop_Integer ../src/core/n-loop.c:130
    #73 0x49314d in N_repeat ../src/core/n-loop.c:631
    #74 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#75 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#76 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #77 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    #78 0x413628 in Do_Next ../src/core/c-do.c:884
    #79 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #80 0x485388 in N_unless ../src/core/n-control.c:763
    #81 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #82 0x413628 in Do_Next ../src/core/c-do.c:884
    #83 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#84 0x42e869 in Do_Function ../src/core/c-function.c:415
    #85 0x418fb4 in Apply_Block ../src/core/c-do.c:1474
    #86 0x4824fb in N_apply ../src/core/n-control.c:295
    #87 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #88 0x413628 in Do_Next ../src/core/c-do.c:884
    #89 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #90 0x414152 in Do_Next ../src/core/c-do.c:939
    #91 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #92 0x485388 in N_unless ../src/core/n-control.c:763
    rebol#93 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #94 0x413628 in Do_Next ../src/core/c-do.c:884
    #95 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #96 0x483eff in N_do ../src/core/n-control.c:523
    #97 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #98 0x413628 in Do_Next ../src/core/c-do.c:884
    #99 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #100 0x414152 in Do_Next ../src/core/c-do.c:939
    #101 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #102 0x48459c in N_if ../src/core/n-control.c:619
    rebol#103 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #104 0x413628 in Do_Next ../src/core/c-do.c:884
    #105 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #106 0x48f8cc in Loop_Integer ../src/core/n-loop.c:130
    #107 0x49314d in N_repeat ../src/core/n-loop.c:631
    #108 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #109 0x413628 in Do_Next ../src/core/c-do.c:884
    #110 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #111 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    #112 0x413628 in Do_Next ../src/core/c-do.c:884
    #113 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #114 0x485388 in N_unless ../src/core/n-control.c:763
    #115 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #116 0x413628 in Do_Next ../src/core/c-do.c:884
    #117 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#118 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#119 0x413628 in Do_Next ../src/core/c-do.c:884
    #120 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #121 0x484cf1 in N_switch ../src/core/n-control.c:716
    #122 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #123 0x413628 in Do_Next ../src/core/c-do.c:884
    #124 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #125 0x42e869 in Do_Function ../src/core/c-function.c:415
    #126 0x413628 in Do_Next ../src/core/c-do.c:884
    #127 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #128 0x48459c in N_if ../src/core/n-control.c:619
    #129 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #130 0x413628 in Do_Next ../src/core/c-do.c:884
    #131 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #132 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#133 0x413628 in Do_Next ../src/core/c-do.c:884
    #134 0x41309b in Do_Next ../src/core/c-do.c:858
    #135 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #136 0x484280 in N_either ../src/core/n-control.c:595
    #137 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #138 0x413628 in Do_Next ../src/core/c-do.c:884
    #139 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #140 0x42e869 in Do_Function ../src/core/c-function.c:415
    #141 0x419631 in Apply_Function ../src/core/c-do.c:1518
    #142 0x419918 in Apply_Func ../src/core/c-do.c:1545
    #143 0x48d102 in N_wake_up ../src/core/n-io.c:415
    #144 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #145 0x413628 in Do_Next ../src/core/c-do.c:884
    #146 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #147 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #148 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #149 0x492b66 in N_loop ../src/core/n-loop.c:590
    #150 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #151 0x413628 in Do_Next ../src/core/c-do.c:884
    #152 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #153 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#154 0x419631 in Apply_Function ../src/core/c-do.c:1518
    rebol#155 0x419918 in Apply_Func ../src/core/c-do.c:1545
    rebol#156 0x42fef7 in Awake_System ../src/core/c-port.c:198
    rebol#157 0x43012a in Wait_Ports ../src/core/c-port.c:231
    #158 0x48cd62 in N_wait ../src/core/n-io.c:374
    rebol#159 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #160 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#161 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#162 0x4133c9 in Do_Next ../src/core/c-do.c:877
    rebol#163 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #164 0x4133c9 in Do_Next ../src/core/c-do.c:877
    rebol#165 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#166 0x4929a7 in N_forever ../src/core/n-loop.c:527
    #167 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #168 0x413628 in Do_Next ../src/core/c-do.c:884
    #169 0x4152ff in Try_Block ../src/core/c-do.c:1077
    #170 0x48507e in N_try ../src/core/n-control.c:740
    rebol#171 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #172 0x413628 in Do_Next ../src/core/c-do.c:884
    #173 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #174 0x414152 in Do_Next ../src/core/c-do.c:939
    #175 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #176 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #177 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #178 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #179 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #180 0x42e869 in Do_Function ../src/core/c-function.c:415
    #181 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#182 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#183 0x48459c in N_if ../src/core/n-control.c:619
    #184 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #185 0x413628 in Do_Next ../src/core/c-do.c:884
    #186 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #187 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#188 0x413628 in Do_Next ../src/core/c-do.c:884
    #189 0x41309b in Do_Next ../src/core/c-do.c:858
    rebol#190 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#191 0x42e869 in Do_Function ../src/core/c-function.c:415
    #192 0x413628 in Do_Next ../src/core/c-do.c:884
    #193 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #194 0x42e869 in Do_Function ../src/core/c-function.c:415
    #195 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#196 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #197 0x414152 in Do_Next ../src/core/c-do.c:939
    #198 0x48201c in N_all ../src/core/n-control.c:261
    rebol#199 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#200 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#201 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #202 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #203 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #204 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #205 0x413628 in Do_Next ../src/core/c-do.c:884
    #206 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #207 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#208 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#209 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #210 0x485388 in N_unless ../src/core/n-control.c:763
    rebol#211 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#212 0x413628 in Do_Next ../src/core/c-do.c:884
    #213 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #214 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#215 0x413628 in Do_Next ../src/core/c-do.c:884
    #216 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#217 0x48459c in N_if ../src/core/n-control.c:619
    rebol#218 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #219 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#220 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#221 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    rebol#222 0x413628 in Do_Next ../src/core/c-do.c:884
    #223 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #224 0x414152 in Do_Next ../src/core/c-do.c:939
    rebol#225 0x48201c in N_all ../src/core/n-control.c:261
    #226 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #227 0x413628 in Do_Next ../src/core/c-do.c:884
    #228 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #229 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #230 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #231 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #232 0x413628 in Do_Next ../src/core/c-do.c:884
    #233 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #234 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#235 0x413628 in Do_Next ../src/core/c-do.c:884
    #236 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #237 0x48459c in N_if ../src/core/n-control.c:619
    #238 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #239 0x413628 in Do_Next ../src/core/c-do.c:884
    #240 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #241 0x42e869 in Do_Function ../src/core/c-function.c:415
    #242 0x413628 in Do_Next ../src/core/c-do.c:884
    #243 0x41309b in Do_Next ../src/core/c-do.c:858
    rebol#244 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#245 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#246 0x413628 in Do_Next ../src/core/c-do.c:884
    #247 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #248 0x48459c in N_if ../src/core/n-control.c:619
    rebol#249 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #250 0x413628 in Do_Next ../src/core/c-do.c:884
    #251 0x414825 in Do_Blk ../src/core/c-do.c:1010

0x62a00000b201 is located 1 bytes to the right of 20480-byte region [0x62a000006200,0x62a00000b200)
allocated by thread T0 here:
    #0 0x7ffff6f58b1f in malloc (/usr/lib/libasan.so.1+0x54b1f)
    #1 0x47924a in Make_Mem ../src/core/m-pools.c:121
    rebolsource#2 0x47a9ff in Make_Series ../src/core/m-pools.c:406
    rebolsource#3 0x4aee84 in Make_Unicode ../src/core/s-make.c:59
    #4 0x4bb797 in Init_Mold ../src/core/s-mold.c:1425
    #5 0x40da64 in Init_Core ../src/core/b-init.c:940
    rebolsource#6 0x4055e0 in RL_Init ../src/core/a-lib.c:124
    rebol#7 0x580aa2 in main ../src/os/host-main.c:154
    #8 0x7ffff5719fff in __libc_start_main (/usr/lib/libc.so.6+0x1ffff)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../src/core/m-series.c:145 Expand_Series
Shadow bytes around the buggy address:
  0x0c547fff95f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c547fff9640:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:
zsx referenced this pull request in metaeducation/ren-c Jun 21, 2015
It will confuse Expand_Series expects "tail" to be the actual size, and
cause a read beyond the allocated memory, or heap buffer overflow found
by address sanitizer of GCC:
=================================================================
==10856==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a00000b201 at pc 0x47df61 bp 0x7fffffff2ca0 sp 0x7fffffff2c98
READ of size 1 at 0x62a00000b201 thread T0
    #0 0x47df60 in Expand_Series ../src/core/m-series.c:145
    #1 0x47e5a7 in Extend_Series ../src/core/m-series.c:187
    rebolsource#2 0x466e0c in Scan_Quote ../src/core/l-scan.c:462
    rebolsource#3 0x46a797 in Scan_Token ../src/core/l-scan.c:918
    #4 0x46e263 in Scan_Block ../src/core/l-scan.c:1188
    #5 0x46e722 in Scan_Code ../src/core/l-scan.c:1548
    rebolsource#6 0x46e886 in Scan_Source ../src/core/l-scan.c:1568
    rebol#7 0x4cb85c in Make_Block_Type ../src/core/t-block.c:306
    #8 0x4cd1b8 in T_Block ../src/core/t-block.c:608
    #9 0x4d042e in T_Datatype ../src/core/t-datatype.c:92
    #10 0x42e080 in Do_Act ../src/core/c-function.c:338
    #11 0x42e7e5 in Do_Action ../src/core/c-function.c:396
    #12 0x413628 in Do_Next ../src/core/c-do.c:884
    #13 0x41309b in Do_Next ../src/core/c-do.c:858
    #14 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #15 0x482dd2 in N_case ../src/core/n-control.c:349
    #16 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#17 0x413628 in Do_Next ../src/core/c-do.c:884
    #18 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#19 0x42e869 in Do_Function ../src/core/c-function.c:415
    #20 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#21 0x41309b in Do_Next ../src/core/c-do.c:858
    rebol#22 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#23 0x42e869 in Do_Function ../src/core/c-function.c:415
    #24 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#25 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#26 0x414152 in Do_Next ../src/core/c-do.c:939
    #27 0x48201c in N_all ../src/core/n-control.c:261
    #28 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #29 0x413628 in Do_Next ../src/core/c-do.c:884
    #30 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #31 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #32 0x492a6c in N_foreach ../src/core/n-loop.c:546
    rebol#33 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #34 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#35 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #36 0x42e869 in Do_Function ../src/core/c-function.c:415
    #37 0x413628 in Do_Next ../src/core/c-do.c:884
    #38 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #39 0x414152 in Do_Next ../src/core/c-do.c:939
    rebol#40 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#41 0x48459c in N_if ../src/core/n-control.c:619
    #42 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #43 0x413628 in Do_Next ../src/core/c-do.c:884
    #44 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #45 0x491abc in Loop_Each ../src/core/n-loop.c:410
    rebol#46 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #47 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#48 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#49 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #50 0x42e869 in Do_Function ../src/core/c-function.c:415
    #51 0x418fb4 in Apply_Block ../src/core/c-do.c:1474
    #52 0x4824fb in N_apply ../src/core/n-control.c:295
    rebol#53 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #54 0x413628 in Do_Next ../src/core/c-do.c:884
    #55 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #56 0x414152 in Do_Next ../src/core/c-do.c:939
    #57 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #58 0x485388 in N_unless ../src/core/n-control.c:763
    #59 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#60 0x413628 in Do_Next ../src/core/c-do.c:884
    #61 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #62 0x483eff in N_do ../src/core/n-control.c:523
    #63 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #64 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#65 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#66 0x414152 in Do_Next ../src/core/c-do.c:939
    #67 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#68 0x48459c in N_if ../src/core/n-control.c:619
    #69 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #70 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#71 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #72 0x48f8cc in Loop_Integer ../src/core/n-loop.c:130
    #73 0x49314d in N_repeat ../src/core/n-loop.c:631
    #74 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#75 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#76 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #77 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    #78 0x413628 in Do_Next ../src/core/c-do.c:884
    #79 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #80 0x485388 in N_unless ../src/core/n-control.c:763
    #81 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #82 0x413628 in Do_Next ../src/core/c-do.c:884
    #83 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#84 0x42e869 in Do_Function ../src/core/c-function.c:415
    #85 0x418fb4 in Apply_Block ../src/core/c-do.c:1474
    #86 0x4824fb in N_apply ../src/core/n-control.c:295
    #87 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #88 0x413628 in Do_Next ../src/core/c-do.c:884
    #89 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #90 0x414152 in Do_Next ../src/core/c-do.c:939
    #91 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #92 0x485388 in N_unless ../src/core/n-control.c:763
    rebol#93 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #94 0x413628 in Do_Next ../src/core/c-do.c:884
    #95 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #96 0x483eff in N_do ../src/core/n-control.c:523
    #97 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #98 0x413628 in Do_Next ../src/core/c-do.c:884
    #99 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #100 0x414152 in Do_Next ../src/core/c-do.c:939
    #101 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #102 0x48459c in N_if ../src/core/n-control.c:619
    rebol#103 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #104 0x413628 in Do_Next ../src/core/c-do.c:884
    #105 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #106 0x48f8cc in Loop_Integer ../src/core/n-loop.c:130
    #107 0x49314d in N_repeat ../src/core/n-loop.c:631
    #108 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #109 0x413628 in Do_Next ../src/core/c-do.c:884
    #110 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #111 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    #112 0x413628 in Do_Next ../src/core/c-do.c:884
    #113 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #114 0x485388 in N_unless ../src/core/n-control.c:763
    #115 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #116 0x413628 in Do_Next ../src/core/c-do.c:884
    #117 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#118 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#119 0x413628 in Do_Next ../src/core/c-do.c:884
    #120 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #121 0x484cf1 in N_switch ../src/core/n-control.c:716
    #122 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #123 0x413628 in Do_Next ../src/core/c-do.c:884
    #124 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #125 0x42e869 in Do_Function ../src/core/c-function.c:415
    #126 0x413628 in Do_Next ../src/core/c-do.c:884
    #127 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #128 0x48459c in N_if ../src/core/n-control.c:619
    #129 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #130 0x413628 in Do_Next ../src/core/c-do.c:884
    #131 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #132 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#133 0x413628 in Do_Next ../src/core/c-do.c:884
    #134 0x41309b in Do_Next ../src/core/c-do.c:858
    #135 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #136 0x484280 in N_either ../src/core/n-control.c:595
    #137 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #138 0x413628 in Do_Next ../src/core/c-do.c:884
    #139 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #140 0x42e869 in Do_Function ../src/core/c-function.c:415
    #141 0x419631 in Apply_Function ../src/core/c-do.c:1518
    #142 0x419918 in Apply_Func ../src/core/c-do.c:1545
    #143 0x48d102 in N_wake_up ../src/core/n-io.c:415
    #144 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #145 0x413628 in Do_Next ../src/core/c-do.c:884
    #146 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #147 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #148 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #149 0x492b66 in N_loop ../src/core/n-loop.c:590
    #150 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #151 0x413628 in Do_Next ../src/core/c-do.c:884
    #152 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #153 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#154 0x419631 in Apply_Function ../src/core/c-do.c:1518
    rebol#155 0x419918 in Apply_Func ../src/core/c-do.c:1545
    rebol#156 0x42fef7 in Awake_System ../src/core/c-port.c:198
    rebol#157 0x43012a in Wait_Ports ../src/core/c-port.c:231
    #158 0x48cd62 in N_wait ../src/core/n-io.c:374
    rebol#159 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #160 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#161 0x4115f2 in Do_Args ../src/core/c-do.c:669
    rebol#162 0x4133c9 in Do_Next ../src/core/c-do.c:877
    rebol#163 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #164 0x4133c9 in Do_Next ../src/core/c-do.c:877
    rebol#165 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#166 0x4929a7 in N_forever ../src/core/n-loop.c:527
    #167 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #168 0x413628 in Do_Next ../src/core/c-do.c:884
    #169 0x4152ff in Try_Block ../src/core/c-do.c:1077
    #170 0x48507e in N_try ../src/core/n-control.c:740
    rebol#171 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #172 0x413628 in Do_Next ../src/core/c-do.c:884
    #173 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #174 0x414152 in Do_Next ../src/core/c-do.c:939
    #175 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #176 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #177 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #178 0x4133c9 in Do_Next ../src/core/c-do.c:877
    #179 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #180 0x42e869 in Do_Function ../src/core/c-function.c:415
    #181 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#182 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#183 0x48459c in N_if ../src/core/n-control.c:619
    #184 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #185 0x413628 in Do_Next ../src/core/c-do.c:884
    #186 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #187 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#188 0x413628 in Do_Next ../src/core/c-do.c:884
    #189 0x41309b in Do_Next ../src/core/c-do.c:858
    rebol#190 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#191 0x42e869 in Do_Function ../src/core/c-function.c:415
    #192 0x413628 in Do_Next ../src/core/c-do.c:884
    #193 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #194 0x42e869 in Do_Function ../src/core/c-function.c:415
    #195 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#196 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #197 0x414152 in Do_Next ../src/core/c-do.c:939
    #198 0x48201c in N_all ../src/core/n-control.c:261
    rebol#199 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#200 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#201 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #202 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #203 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #204 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #205 0x413628 in Do_Next ../src/core/c-do.c:884
    #206 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #207 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#208 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#209 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #210 0x485388 in N_unless ../src/core/n-control.c:763
    rebol#211 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    rebol#212 0x413628 in Do_Next ../src/core/c-do.c:884
    #213 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #214 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#215 0x413628 in Do_Next ../src/core/c-do.c:884
    #216 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#217 0x48459c in N_if ../src/core/n-control.c:619
    rebol#218 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #219 0x413628 in Do_Next ../src/core/c-do.c:884
    rebol#220 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#221 0x42ee10 in Do_Closure ../src/core/c-function.c:459
    rebol#222 0x413628 in Do_Next ../src/core/c-do.c:884
    #223 0x4115f2 in Do_Args ../src/core/c-do.c:669
    #224 0x414152 in Do_Next ../src/core/c-do.c:939
    rebol#225 0x48201c in N_all ../src/core/n-control.c:261
    #226 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #227 0x413628 in Do_Next ../src/core/c-do.c:884
    #228 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #229 0x491abc in Loop_Each ../src/core/n-loop.c:410
    #230 0x492a6c in N_foreach ../src/core/n-loop.c:546
    #231 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #232 0x413628 in Do_Next ../src/core/c-do.c:884
    #233 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #234 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#235 0x413628 in Do_Next ../src/core/c-do.c:884
    #236 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #237 0x48459c in N_if ../src/core/n-control.c:619
    #238 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #239 0x413628 in Do_Next ../src/core/c-do.c:884
    #240 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #241 0x42e869 in Do_Function ../src/core/c-function.c:415
    #242 0x413628 in Do_Next ../src/core/c-do.c:884
    #243 0x41309b in Do_Next ../src/core/c-do.c:858
    rebol#244 0x414825 in Do_Blk ../src/core/c-do.c:1010
    rebol#245 0x42e869 in Do_Function ../src/core/c-function.c:415
    rebol#246 0x413628 in Do_Next ../src/core/c-do.c:884
    #247 0x414825 in Do_Blk ../src/core/c-do.c:1010
    #248 0x48459c in N_if ../src/core/n-control.c:619
    rebol#249 0x42dbb7 in Do_Native ../src/core/c-function.c:289
    #250 0x413628 in Do_Next ../src/core/c-do.c:884
    #251 0x414825 in Do_Blk ../src/core/c-do.c:1010

0x62a00000b201 is located 1 bytes to the right of 20480-byte region [0x62a000006200,0x62a00000b200)
allocated by thread T0 here:
    #0 0x7ffff6f58b1f in malloc (/usr/lib/libasan.so.1+0x54b1f)
    #1 0x47924a in Make_Mem ../src/core/m-pools.c:121
    rebolsource#2 0x47a9ff in Make_Series ../src/core/m-pools.c:406
    rebolsource#3 0x4aee84 in Make_Unicode ../src/core/s-make.c:59
    #4 0x4bb797 in Init_Mold ../src/core/s-mold.c:1425
    #5 0x40da64 in Init_Core ../src/core/b-init.c:940
    rebolsource#6 0x4055e0 in RL_Init ../src/core/a-lib.c:124
    rebol#7 0x580aa2 in main ../src/os/host-main.c:154
    #8 0x7ffff5719fff in __libc_start_main (/usr/lib/libc.so.6+0x1ffff)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../src/core/m-series.c:145 Expand_Series
Shadow bytes around the buggy address:
  0x0c547fff95f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c547fff9630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c547fff9640:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fff9690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants