tiger-speech 0.7.8 — a crash Tiger never had, and a report that names itself

Both fixes in this release were found on Leopard, and measurement says Tiger has neither of the faults. It is still worth installing, and the honest summary is below.

The crash Tiger does not have

"x" * 20 + "the" killed the Leopard host ten times out of ten — issue #4, found by a fuzzer and reported by Brandon (@serrebi).

SLPrefixMorph::AddAffix keeps a saved word's length in a signed byte and adds each affix to it unchecked. A run of the same letter is what makes it reachable — every position in the run offers the morphology the same prefix match — and past 127 the length reads back negative and memmove receives it unsigned. Brandon measured a single call asking for 4,294,956,106 bytes.

Brandon assumed Tiger reached it too, and said so, having no Tiger tree to check with. It does not. Rebuilt with the repair compiled out so it could not mask anything, all eight of the inputs that crash Vicki on Leopard render cleanly here. Same voice, same text, same host — only the SpeechDictionary differs.

The fix ships anyway: it is harmless (ordinary text renders byte-identically), and one behaviour to reason about beats two.

The part Tiger users actually gain

Brandon's PR #3 — three separate things that had to be wrong at once for a crash to arrive as pure silence:

• A fault in the host's own code named nothing. The report could only resolve addresses inside Apple's images, so a fault in any CRT function the shim table hands the engine — strlen, memcpy — pointed nowhere. It now names the module and offset.
• Everything identifying the caller was at debug level. The registers, the frame walk, the stack walk with C++ symbol names — all printed, all filed where nobody looks. A crash happens once and costs an utterance; it goes to warning now.
• A reporter that faulted hung the host for ever. on_fault is a vectored handler, so it saw its own fault, found the flag already set, and slept forever — on the thread writing the report. The process never exited and the driver blocked on a pipe that would never answer.

That last one is strictly worse than the crash it was describing, and it was reproduced rather than reasoned about.

This is the machinery that made issue #4 findable at all. It is worth having before the next unexplained silence rather than after it.

Also since 0.7.7

Nothing else — 0.7.7's Tiger-image guidance (Intel only, and the earliest Intel Tiger, because 10.4.5 onward ships MacinTalk 3.4 with Apple's copy-protection call) still stands.

Testing

63 automated tests pass. Fred, Cellos and Vicki render byte-identically to the previous build.