bugGNU Octave - Bugs: bug #51552, AddressSanitizer:...


bug #51552: AddressSanitizer: stack-use-after-scope error in Array.h

Submitted by:  Dmitri A. Sergatskov <dasergatskov>
Submitted on:  Mon 24 Jul 2017 01:53:56 AM UTC  
Category:  Interpreter Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  Need Info Assigned to:  None
Originator Name:  Dmitri A. Sergatskov Open/Closed:  Closed
Release:  dev Operating System:  GNU/Linux

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


( Jump to the original submission)

Mon 24 Jul 2017 08:43:52 PM UTC, comment #7: 

For the moment, I'm going to close this report.  There is enough other stuff going on that needs attention.  I've got another project that I could use your help on.  I'll file a different bug report about that.

Rik <rik5>
Project Administrator
Mon 24 Jul 2017 07:01:53 PM UTC, comment #6: 

To get a "second opinion" I recompiled with clang-4.0.0

0fb64e83f8b3 tip @

The only problem I see is

SUMMARY: AddressSanitizer: 204896 byte(s) leaked in 3198 allocation(s).

So perhaps we should declare those errors false positives, at least for now.


Dmitri A. Sergatskov <dasergatskov>
Mon 24 Jul 2017 05:32:14 AM UTC, comment #5: 

Looks the same.


Dmitri A. Sergatskov <dasergatskov>
Mon 24 Jul 2017 05:05:06 AM UTC, comment #4: 

This may be undoing an optimization, but try the attached 51552.diff and see if it helps.

patch -p1 < 51552.diff
make check

(file #41311)

Rik <rik5>
Project Administrator
Mon 24 Jul 2017 04:33:47 AM UTC, comment #3: 

Here is some other tests resultin in the same error:

octave:1> test libinterp/corefcn/bsxfun.cc-tst verbose
>>>>> /home/dima/src/octave/gcc_asan/libinterp/corefcn/bsxfun.cc-tst
***** shared a, b, c, f
a = randn (4, 4);
b = mean (a, 1);
c = mean (a, 2);
f = @minus;
***** error (bsxfun (f))
==14242==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffe82c926a0 at pc 0x7f26727f8e67 bp 0x7ffe82c923a0 sp 0x7ffe82c92390
WRITE of size 8 at 0x7ffe82c926a0 thread T0
    #0 0x7f26727f8e66 in Array<octave_value>::Array() ../liboctave/array/Array.h:257
    #1 0x7f26727f8e66 in octave_value_list::octave_value_list() ../libinterp/octave-value/ovl.h:46

octave:1> test libinterp/corefcn/conv2.cc-tst verbose
>>>>> /home/dima/src/octave/gcc_asan/libinterp/corefcn/conv2.cc-tst
***** test
rand ("seed", 42);
x = rand (100);
y = ones (5);
A = conv2 (x, y)(5:end-4,5:end-4);
B = conv2 (x, y, "valid");
assert (B, A);   # Yes, this test is for *exact* equivalence.
***** error conv2 ()
==14696==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffd975fa9d0 at pc 0x7f1fc8d8fe67 bp 0x7ffd975fa6d0 sp 0x7ffd975fa6c0
WRITE of size 8 at 0x7ffd975fa9d0 thread T0
    #0 0x7f1fc8d8fe66 in Array<octave_value>::Array() ../liboctave/array/Array.h:257
    #1 0x7f1fc8d8fe66 in octave_value_list::octave_value_list() ../libinterp/octave-value/ovl.h:46

octave:1> test libinterp/corefcn/dassl.cc-tst verbose
>>>>> /home/dima/src/octave/gcc_asan/libinterp/corefcn/dassl.cc-tst
***** test

x0 = [1; 0];
xdot0 = [-10; 10];
t = (0:0.2:1)';

tol = 500 * dassl_options ("relative tolerance");

[x, xdot] = dassl ("__f", x0, xdot0, t);

y = [exp(-10*t), 1-exp(-10*t)];

assert (x, y, tol);
***** test
old_tol = dassl_options ("absolute tolerance");
dassl_options ("absolute tolerance", eps);
assert (dassl_options ("absolute tolerance") == eps);
## Restore old value of tolerance
dassl_options ("absolute tolerance", old_tol);
***** error dassl_options ("foo", 1, 2)
==15006==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fff47b4b610 at pc 0x7fd60967ee67 bp 0x7fff47b4b310 sp 0x7fff47b4b300
WRITE of size 8 at 0x7fff47b4b610 thread T0
    #0 0x7fd60967ee66 in Array<octave_value>::Array() ../liboctave/array/Array.h:257
    #1 0x7fd60967ee66 in octave_value_list::octave_value_list() ../libinterp/octave-value/ovl.h:46

Dmitri A. Sergatskov <dasergatskov>
Mon 24 Jul 2017 04:21:27 AM UTC, comment #2: 

octave:1> nnz({0, 1, 2})
error: nnz: wrong type argument 'cell array'
octave:1> nnz (C)
error: 'C' undefined near line 1 column 6
octave:1> C = {0, 1, 2};
octave:2> nnz (C)
error: nnz: wrong type argument 'cell array'
octave:2> test libinterp/corefcn/Cell.cc-tst verbose
>>>>> /home/dima/src/octave/gcc_asan/libinterp/corefcn/Cell.cc-tst
***** test
a = {"foo", "bar"};
assert (a(), a);
***** error <wrong type argument 'cell array'> nnz ({0, 1, 2})
==13766==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffc505c01a0 at pc 0x7f3641fa2e67 bp 0x7ffc505bfea0 sp 0x7ffc505bfe90
WRITE of size 8 at 0x7ffc505c01a0 thread T0
    #0 0x7f3641fa2e66 in Array<octave_value>::Array() ../liboctave/array/Array.h:257
    #1 0x7f3641fa2e66 in octave_value_list::octave_value_list() ../libinterp/octave-value/ovl.h:46
    #2 0x7f3643302e59 in octave::tree_evaluator::visit_identifier(octave::tree_identifier&) ../libinterp/parse-tree/pt-eval.cc:1035
    #3 0x7f36432beccd in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:270

Dmitri A. Sergatskov <dasergatskov>
Mon 24 Jul 2017 04:16:43 AM UTC, comment #1: 

Can you try starting Octave and just execute this one command?

nnz ({0, 1, 2})

I'm trying to figure out whether it is something to do with exception processing.

If that segfaults (I hope it will) then does the following work?

C = {0, 1, 2};
nnz (C)

Rik <rik5>
Project Administrator
Mon 24 Jul 2017 01:53:56 AM UTC, original submission:  

When built with "enable-address-sanitizer-flags" octave crashed
in multiple tests with

SUMMARY: AddressSanitizer: stack-use-after-scope ../liboctave/array/Array.h:257 in Array<octave_value>::Array()

error. (Array.h is attached)

E.g. running

octave:1> test libinterp/corefcn/Cell.cc-tst verbose
>>>>> /home/dima/src/octave/gcc_asan/libinterp/corefcn/Cell.cc-tst
***** test
a = {"foo", "bar"};
assert (a(), a);
***** error <wrong type argument 'cell array'> nnz ({0, 1, 2})
==31489==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffd91b06350 at pc 0x7f7d98957e67 bp 0x7ffd91b06050 sp 0x7ffd91b06040
WRITE of size 8 at 0x7ffd91b06350 thread T0
    #0 0x7f7d98957e66 in Array<octave_value>::Array() ../liboctave/array/Array.h:257
    #1 0x7f7d98957e66 in octave_value_list::octave_value_list() ../libinterp/octave-value/ovl.h:46
    #2 0x7f7d99cb7e59 in octave::tree_evaluator::visit_identifier(octave::tree_identifier&) ../libinterp/parse-tree/pt-eval.cc:1035

(full log is attached).

One needs to have at least gcc 7 to get stack-use-after-scope diagnostic. See



Dmitri A. Sergatskov <dasergatskov>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #41311:  51552.diff added by rik5 (446B - text/x-patch)
file #41309:  Array.h added by dasergatskov (27KiB - text/x-chdr)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by rik5 (Posted a comment)
  • -email is unavailable- added by dasergatskov (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only project members can vote.




    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-07-24 rik5 Open/ClosedOpen => Closed
    2017-07-24 rik5 Attached File- => Added 51552.diff, #41311
    2017-07-24 rik5 StatusNone => Need Info
    2017-07-24 dasergatskov Attached File- => Added Array.h, #41309
        Attached File- => Added octave_stack-use-after-scope_log.txt, #41310

    Back to the top

    Powered by Savane 3.5