Hi Henrik,

> You're trying to access unassigned memory in your examples, C would crash if
> you went out of bounds on an array too. The only viable options you have in

Thanks for the comment.

Let me add an explanation why this access to unassigned memory happens
in the first place.

In the call

   : (cadr (1 . 2))

the function 'cadr' finds the following structure:

         |  |  |  |  |
            |     |
            |     +-----------+
            |                 |
            V                 V
         +-----+-----+     +-----+-----+
         |  1  |  /  |     |  2  |  /  |
         +-----+-----+     +-----+-----+

i.e. a cell with two numbers.

As shown in another answer to this thread, 'cadr' only checks its direct
argument. As it is a cell, it proceeds to

   1. Take the CDR of its argument (an offset of 4 bytes on a 32bit
      machine), resulting in the pointer to the number '2'.

   2. It assumes this pointer to be referring to another cell. So it
      takes the CAR (an offset of zero). This is fatal, though, for two

      - The '2' in the CAR part of that number cell is not the pointer
        to a Lisp object, but a binary pattern representing that number.

      - Numbers are pointed to with an offset of 2 bytes, so this
        dereference effectively accesses half of the CAR part and half
        of the CDR part of that cell. Even if the CPU allows a long word
        access at an address not aligned to 4, the resulting pointer is
        guaranteed to be useless :-)

As soon as the interpreter uses the resulting "pointer" (typically to
print the result), it crashes.

- Alex

Reply via email to