leanprover-community / leanprover-community/lean
`ts_vm_obj` segfaults on large objects
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 433
- Forks
- 79
- PR merge metrics
- No merged PRs in 30d
Description
The function ts_vm_obj::to_ts_vm_obj_fn requires stack space that is linear in the depth of the input VM object. There is also no checking for stack overflow. Hence this function just segfaults in this case.
Easy reproduction:
#eval -- segfaults
let ls := list.range 50000 in
(task.delay (λ _, ls.length)).get
This doesn't only happen with tasks, the function tactic.save_info_thunk uses the same code.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with ts_vm_obj::to_ts_vm_obj_fn and inspect the shared code used by tactic.save_info_thunk. Run the provided Lean reproduction with list.range 50000, then check how the conversion handles deeply nested VM objects. Done means the reproduction no longer segfaults and stack exhaustion is handled safely.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100