Poly/ML

polyml@lists.polyml.org

1 participants
715 discussions

Bug report: four confirmed faults in Poly/ML (ARM64, commit dfb7e03b)
by Aravinth Kaneshalingam 15 Apr '26

15 Apr '26

Hi, I am a final-year Computer Science student at King's College London. As part of my dissertation, I ran coverage-guided fuzzing against Poly/ML on ARM64 using AFL++ with AddressSanitizer and UndefinedBehaviorSanitizer. I found four confirmed faults against commit dfb7e03b, all of which remain present in current upstream master. I am reporting them here with full reproducer inputs. Finding 1 - UBSan unsigned offset overflow in arm64.cpp (CopyStackFrame) Triggered by two completely valid SML programs. UBSan reports pointer arithmetic overflow at libpolyml/arm64.cpp (line 246 on dfb7e03b, line 440 in current master) in CopyStackFrame. The unsigned offset is divided by sizeof(PolyWord) (a size_t), causing implicit conversion to unsigned and wrapping on negative values. ARM64-specific - does not occur on x86-64. Reproducer: seed_fun.sml (attached) - triggers in libpolyml/arm64.cpp:440 (CopyStackFrame) Proposed fix: cast sizeof(PolyWord) to POLYSIGNED before the division. I have validated this locally and would be happy to submit a pull request if that is welcome. Finding 2 - Unbounded memory allocation on pathological floating-point exponents (LEX_.ML) readChars in LEX_.ML reads exponent digits after e/E in a float literal with no length bound. Since there is no upper bound, an exponent of sufficient length will exhaust available memory on any system. Reproduces without sanitisers - memory growth is linear with exponent length. Note: upstream commit fc874893 ("Fix greedy lexing of reals with fractions") sounds related but is not - it addresses dot consumption, not the exponent path. Lines 323–331 of LEX_.ML are unchanged. Reproducer: crash_float_9584.bin and crash_float_3136.bin (attached) - feed via poly < crash_float_9584.bin Proposed fix: cap exponent accumulation at 20 digits and emit a lex error on overflow. I have validated this locally and would be happy to submit a pull request if that is welcome. Finding 3 - Three faults in module elaboration (TYPE_TREE.ML, TYPECHECK_PARSETREE.sml) Fuzzing with a module-heavy corpus found three faults in the elaborator, all reproducible without sanitisers. Crashes 1 and 2: Nested structure seed with AFL++-corrupted identifiers. Input passes the parser and faults in the elaborator. On current upstream master these now produce an infinite hang rather than SIGSEGV, indicating the code path changed but the root cause is unresolved. Crash 3: 80-byte reproducer: structure Mat0=struct val 0=0 fun s0uare x=x+x fun e 0=()end;val a=Mat0.s0uare 0.0 val 0 = 0 inside a structure body is accepted by the parser without error. The elaborator then assumes the left-hand side of a val binding is always an identifier and dereferences accordingly into invalid memory. SIGSEGV confirmed on current upstream master. Reproducers: crash_nested_1.bin, crash_nested_2.bin (crashes 1 and 2), crash_val00.bin (crash 3) - feed via poly < crash_val00.bin I do not have a proposed fix for Finding 3 - it requires deeper understanding of the elaborator's type safety assumptions. I am happy to provide any additional details or the full AFL++ campaign logs. Kind regards, Aravinth Kaneshalingam

1 0

Interrupting the read-eval-print loop
by Rob Arthan 28 Mar '26

28 Mar '26

I am seeing non-deterministic behaviour in the way keyboard interrupts are handled in the REPL. Some unknown factor seems to be causing some instances of poly to ignore them while other instances do what I would expect: Here in one terminal window, no matter how long I wait, there is no response to a Ctrl-C: rda]- poly Poly/ML 5.9.2 Release > ([ # ^C In another terminal window, I see what I would expect: rda]- poly Poly/ML 5.9.2 Release > ([ # ^CCompilation interrupted > I see exactly the same behaviour if I send the signal from another terminal window using kill -INT. This is all on Mac OS Sequoia 15.3.2. I don’t recall having any problems like this on older releases of Poly/ML say prior to 15.9, though I can’\t say exactly when it started. The behaviour I would expect is very useful as, if you’ve mistakenly copied in some badly formed input, it can be quite fiddly to work out how to continue the input to get back to the top-level prompt of the REPL without accidentally executing something you don’t want to be executed. Any suggestions? Rob.

2 2

Issue with vector header file during Poly/ML build
by Rob Arthan 24 Mar '26

24 Mar '26

I am trying to build Poly/ML from the 5.9.2 tarball on Mac OS Sequoia 15.3.2 and it is failing as follows on my Mac Mini: rda]- make /Library/Developer/CommandLineTools/usr/bin/make all-recursive Making all in libpolyml /bin/sh ../libtool --tag=CXX --mode=compile g++ -DHAVE_CONFIG_H -I. -I.. -O3 -DMACOSX -Wall -DMODULEDIR=\"/usr/local/poly/5.9.2-fixed/lib/polyml/modules\" -O3 -MT arb.lo -MD -MP -MF .deps/arb.Tpo -c -o arb.lo arb.cpp libtool: compile: g++ -DHAVE_CONFIG_H -I. -I.. -O3 -DMACOSX -Wall -DMODULEDIR=\"/usr/local/poly/5.9.2-fixed/lib/polyml/modules\" -O3 -MT arb.lo -MD -MP -MF .deps/arb.Tpo -c arb.cpp -fno-common -DPIC -o .libs/arb.o In file included from arb.cpp:93: ./memmgr.h:27:10: fatal error: 'vector' file not found 27 | #include <vector> | ^~~~~~~~ 1 error generated. make[2]: *** [arb.lo] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 It builds fine on my MacBook which is running the same OS and the same version of the Xcode tools. There are suggested fixes to similar problems (but not with Poly/ML) on the Web but the proposed solutions don’t work for me. Any suggestions gratefully received. Regards, Rob.

1 1

Symbolic identifiers for module names
by David Matthews 21 Mar '26

21 Mar '26

A student at KCL, Enzo Bestetti, has been doing a systematic analysis of Poly/ML's lexer. There weren't any serious problems but he did mention something that made me look more closely. It turns out that Poly/ML has been accepting symbolic identifiers, those made up of the symbols +, - etc, for structure, signature and functor names. It looks as though this changed between SML90 and SML97 and I hadn't realised. The SML90 definition explicitly includes symbolic identifiers for signature and functors and doesn't appear to rule them out for structures. The SML97 restricts them to alphanumeric only but I can't see this included in the list of changes in Appendix G which is why it slipped through. I'm proposing to restrict module names to alphanumeric to bring Poly/ML into line with the SML97 Definition. I can't imagine that this will affect anyone but I thought I'd mention it. David

2 1

Type Constraints and Overloading
by Duke Normandin 03 Mar '26

03 Mar '26

Taken from Paulson's book: Chap2.4 A) fun square x = x * x; > Error- Unable to resolve overloading for * I understand the above! B) fun square(x : real) = x * x; I understand: x is declared as a real C) fun square x = x * x : real; I see this as declaring a function w/o parentheses AND that the r_result_ is a 'real' I have a problem with this declaration: D) fun square x : real = x * x; I see this as declaring a function w/o parentheses, AND declaring x to be a 'real' I do NOT see/understand that this syntax indicates that the type of the _result_ is a 'real' I suppose that I'm free to ignore D) and use the more IMHO intuitive C) declaration. I thought that I'd ask to make sure that I wasn't missing something in the D) one. TIA .... -- Duke

6 13

Quick Question About polyml.org and Its Current Status
by Kimmy Trango 24 Feb '26

24 Feb '26

Hello, Kimmy here. I lead Community Outreach at Dotcom Monitor, and I have been exploring long standing programming language implementations and research driven projects. Poly ML really stood out to me. It is impressive to see a mature and high performance implementation of Standard ML that has supported both academic research and real world development for many years. Projects like Poly ML play an important role in advancing language design and functional programming. It clearly reflects deep technical expertise and sustained community effort. I wanted to ask, is polyml.org and the Poly ML project still actively maintained? At Dotcom Monitor and LoadView, we work closely with long running technical and open source projects. We aim to support the community in ways that are practical and genuinely helpful. For context: https://www.dotcom-monitor.com/sponsoring-open-source-projects/ https://www.loadview-testing.com/scholarship/ If the project is still active, we would be glad to explore the possibility of offering a small corporate contribution to help support its continued development. I would love to hear your thoughts. -- Cheers, *Kimmy Trango*Community Outreach Assistant Dotcom-Monitor <https://www.dotcom-monitor.com/> | Monitor > Repair > Optimize LoadView <https://www.loadview-testing.com/> | Flexible Load Testing from the Cloud

1 0

variable shadowing
by Duke Normandin 25 Jan '26

25 Jan '26

I think that I almost understand "shadowing", maybe ... val pi = 3.14159; fun area (r) = pi*r*r; area 2.0; => 12.56636 So far so good ... re-declare pi ... val p1 = 0.0; Here is where things get blurry for me. When/how is the *new* pi available? Is it only available if re-declared in a *block* of code, making it local to that block and therefore usable there and only there? After re-declaring pi above, executing the "area" function uses the original pi. I get that! What I'm not sure of is how to use the re-declared pi. TIA ... -- Duke

2 2

"symbolic" identifier names
by Duke Normandin 21 Jan '26

21 Jan '26

Reading Paulson!! Right ON!! lol [quote] ML also permits symbolic names. These consist of the characters ! % & $ # + - * / : < = > ? @ \ ˜ ‘ ˆ | Names made up of these characters can be as long as you like: ----> $ˆ$ˆ$ˆ$ !!?@**??!! :-|==>-># Certain strings of special characters are reserved for ML’s syntax and should not be used as symbolic names: : | = => -> # :> A symbolic name is allowed wherever an alphabetic name is: val +-+-+ = 1415; > val +-+-+ = 1415 : int [/quote] What purpose would this cryptic-tude serve? Obfuscation? Seeding brain cancer? What? Or do most of you simply ignore this allowance? Enjoying Paulson!! And so far, Poly&Paulson are a team!! :) -- Duke

2 2

Type error in function application
by Duke Normandin 21 Jan '26

21 Jan '26

This function: fun divide (x: real, y: real) = if y = 0.0 then raise DivByZero 5 else x / y; is taken from: "Beginner's Guide to Standard ML" It's part of a "calculator" program included in the document. I'm using: $ poly --use ./calc.sml Poly/ML 5.9.2 Release and it chokes and quits at line 4 on the above function. I made no typo! So! What now? Why doesn't Poly/ML not like that code? TIA ... -- Duke

5 8

First step woes
by Duke Normandin 18 Jan '26

18 Jan '26

From: INTRODUCTION TO POLY D.C.J. Matthews,May 1982 Computer Laboratory, University of Cambridge [quote] > begin # print("Hello"); # print(" again") # end; Hello again [/quote] but I get: [quote] > begin # print("hello"); poly: : error: Value or constructor (begin) has not been declared Found near begin print ("hello") Static Errors > [/quote] if I remove the semi-colon, it lets me enter the rest of the code, but chokes after I enter `end;'. Has the syntax changed since the book was written, or am I doing something wrong? TIA ... -- Duke

3 3

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Poly/ML