module system segfaulting at O3

[Idiomdrottning]

(module main ()
  (import
   scheme
   (only chicken.base print)
   (only matchable match-lambda*))

  (define mdplus
    (match-lambda*
     (( (? list? x) (? list? y)) (append x y))
     (( (? string? x) (? string? y)) (string-append x y))
     (( (? number? x) (? number? y)) (+ x y))))

  (mdplus 1 2)
  (mdplus 3 4))

So for me this segfaults when compiled at -O3.

Any two mdplus calls in the actual text. You can wrap it in dotimes ten gazillion and that's fine, that doesn't crash. It only crashes when there are actually two mdplus calls in the actual text.

To cause the crash, the two calls can have the same arguments or they can have different arguments, that doesn't seem to make a difference.

It doesn't crash when mdplus is imported, it only crashes when it's defined directly in the module.

It also doesn't crash when there isn't a module, i.e. removing the first line and the last paren from the above file also removes the crash.

Importing full matchable as opposed to just only match-lambda* does not remove the crash.

It does not crash in the interpreter, only when compiled O3.

Expanding and reexpanding and rereexpanding the match-lambda* stuff we end up with some macros that aren't exported from matchable, such as match-next. Idk but that's what leads me to suspect that there is a module system issue.

[megane]

Smaller repro:

(let ()
  (define mdplus
    (lambda args
      (let ((args args))
        (if (pair? args)
            (let ((aa (car args))
                  (bb (cdr args)))
              (if (pair? bb)
                  3))))))
  (mdplus '1 '2)
  (mdplus '3 '4))

;; specializations:
;;   1 (scheme#cdr pair)
;;   2 (scheme#car pair)
;; safe calls: 9
;;
;; Error: segmentation violation
;;
;;         Call history:
;;
;;         issue-1756.scm:25: mdplus               <--

Maybe related:

(let ()
  (define mdplus
    (lambda args
      (let ((args args))
        (if (pair? args)
            (car args)))))
  (mdplus '1 '2)
  (mdplus '3 '4))

;; specializations:
;;   1 (scheme#car pair)
;; safe calls: 5
;;
;; Error: attempted rest argument access at index 0 but rest list length is 0: #<procedure>

[sjamaan]

This is an important enough regression to get a fix into 5.3

[Idiomdrottning]

Apparently it doesn't segfault with -d3

[sjamaan]

At least for the related case, it seems that explicitly consed rest args are interfering with the argvector-based rest operations. We need to prohibit argvector-based rest ops when rest args are explicitly consed, or prohibit explicit consing if there are argvector-based rest ops.

[sjamaan]

Patch posted

[Idiomdrottning]

Patch works

[megane]

Fixed in 5a4df9c22e8e6463fa44d9bd19802080118c1989