bugGNU Octave - Bugs: bug #51552, AddressSanitizer:...

 
 

bug #51552: AddressSanitizer: stack-use-after-scope error in Array.h

Submitter:  Dmitri A. Sergatskov <dasergatskov>
Submitted:  Mon 24 Jul 2017 01:53:56 AM UTC
   
 
Category:  Interpreter Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  Need Info Assigned to:  None
Originator Name:  Dmitri A. Sergatskov Open/Closed:  * Closed
Release:  * dev Operating System:  * GNU/Linux
Fixed Release:  None Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Mon 24 Jul 2017 08:43:52 PM UTC, comment #7: 

For the moment, I'm going to close this report.  There is enough other stuff going on that needs attention.  I've got another project that I could use your help on.  I'll file a different bug report about that.

Rik <rik5>
Group administrator
Mon 24 Jul 2017 07:01:53 PM UTC, comment #6: 

To get a "second opinion" I recompiled with clang-4.0.0

0fb64e83f8b3 tip @

The only problem I see is


SUMMARY: AddressSanitizer: 204896 byte(s) leaked in 3198 allocation(s).


So perhaps we should declare those errors false positives, at least for now.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Mon 24 Jul 2017 05:32:14 AM UTC, comment #5: 

Looks the same.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Mon 24 Jul 2017 05:05:06 AM UTC, comment #4: 

This may be undoing an optimization, but try the attached 51552.diff and see if it helps.


patch -p1 < 51552.diff
make
make check




(file #41311)

Rik <rik5>
Group administrator
Mon 24 Jul 2017 04:33:47 AM UTC, comment #3: 

Here is some other tests resultin in the same error:

octave:1> test libinterp/corefcn/bsxfun.cc-tst verbose
>>>>> /home/dima/src/octave/gcc_asan/libinterp/corefcn/bsxfun.cc-tst
***** shared a, b, c, f
 a = randn (4, 4);
 b = mean (a, 1);
 c = mean (a, 2);
 f = @minus;
***** error (bsxfun (f))
=================================================================
==14242==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffe82c926a0 at pc 0x7f26727f8e67 bp 0x7ffe82c923a0 sp 0x7ffe82c92390
WRITE of size 8 at 0x7ffe82c926a0 thread T0
    #0 0x7f26727f8e66 in Array<octave_value>::Array() ../liboctave/array/Array.h:257
    #1 0x7f26727f8e66 in octave_value_list::octave_value_list() ../libinterp/octave-value/ovl.h:46



octave:1> test libinterp/corefcn/conv2.cc-tst verbose
>>>>> /home/dima/src/octave/gcc_asan/libinterp/corefcn/conv2.cc-tst
***** test
 (...deleted...)
rand ("seed", 42);
 x = rand (100);
 y = ones (5);
 A = conv2 (x, y)(5:end-4,5:end-4);
 B = conv2 (x, y, "valid");
 assert (B, A);   # Yes, this test is for *exact* equivalence.
***** error conv2 ()
=================================================================
==14696==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffd975fa9d0 at pc 0x7f1fc8d8fe67 bp 0x7ffd975fa6d0 sp 0x7ffd975fa6c0
WRITE of size 8 at 0x7ffd975fa9d0 thread T0
    #0 0x7f1fc8d8fe66 in Array<octave_value>::Array() ../liboctave/array/Array.h:257
    #1 0x7f1fc8d8fe66 in octave_value_list::octave_value_list() ../libinterp/octave-value/ovl.h:46



octave:1> test libinterp/corefcn/dassl.cc-tst verbose
>>>>> /home/dima/src/octave/gcc_asan/libinterp/corefcn/dassl.cc-tst
(...deleted...)
***** test

 x0 = [1; 0];
 xdot0 = [-10; 10];
 t = (0:0.2:1)';

 tol = 500 * dassl_options ("relative tolerance");

 [x, xdot] = dassl ("__f", x0, xdot0, t);

 y = [exp(-10*t), 1-exp(-10*t)];

 assert (x, y, tol);
***** test
 old_tol = dassl_options ("absolute tolerance");
 dassl_options ("absolute tolerance", eps);
 assert (dassl_options ("absolute tolerance") == eps);
 ## Restore old value of tolerance
 dassl_options ("absolute tolerance", old_tol);
***** error dassl_options ("foo", 1, 2)
=================================================================
==15006==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fff47b4b610 at pc 0x7fd60967ee67 bp 0x7fff47b4b310 sp 0x7fff47b4b300
WRITE of size 8 at 0x7fff47b4b610 thread T0
    #0 0x7fd60967ee66 in Array<octave_value>::Array() ../liboctave/array/Array.h:257
    #1 0x7fd60967ee66 in octave_value_list::octave_value_list() ../libinterp/octave-value/ovl.h:46



Dmitri A. Sergatskov <dasergatskov>
Mon 24 Jul 2017 04:21:27 AM UTC, comment #2: 


octave:1> nnz({0, 1, 2})
error: nnz: wrong type argument 'cell array'
octave:1> nnz (C)
error: 'C' undefined near line 1 column 6
octave:1> C = {0, 1, 2};
octave:2> nnz (C)
error: nnz: wrong type argument 'cell array'
octave:2> test libinterp/corefcn/Cell.cc-tst verbose
>>>>> /home/dima/src/octave/gcc_asan/libinterp/corefcn/Cell.cc-tst
***** test
 a = {"foo", "bar"};
 assert (a(), a);
***** error <wrong type argument 'cell array'> nnz ({0, 1, 2})
=================================================================
==13766==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffc505c01a0 at pc 0x7f3641fa2e67 bp 0x7ffc505bfea0 sp 0x7ffc505bfe90
WRITE of size 8 at 0x7ffc505c01a0 thread T0
    #0 0x7f3641fa2e66 in Array<octave_value>::Array() ../liboctave/array/Array.h:257
    #1 0x7f3641fa2e66 in octave_value_list::octave_value_list() ../libinterp/octave-value/ovl.h:46
    #2 0x7f3643302e59 in octave::tree_evaluator::visit_identifier(octave::tree_identifier&) ../libinterp/parse-tree/pt-eval.cc:1035
    #3 0x7f36432beccd in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:270


Dmitri A. Sergatskov <dasergatskov>
Mon 24 Jul 2017 04:16:43 AM UTC, comment #1: 

Can you try starting Octave and just execute this one command?


nnz ({0, 1, 2})


I'm trying to figure out whether it is something to do with exception processing.

If that segfaults (I hope it will) then does the following work?


C = {0, 1, 2};
nnz (C)



Rik <rik5>
Group administrator
Mon 24 Jul 2017 01:53:56 AM UTC, original submission:  

When built with "enable-address-sanitizer-flags" octave crashed
in multiple tests with

SUMMARY: AddressSanitizer: stack-use-after-scope ../liboctave/array/Array.h:257 in Array<octave_value>::Array()


error. (Array.h is attached)

E.g. running

octave:1> test libinterp/corefcn/Cell.cc-tst verbose
>>>>> /home/dima/src/octave/gcc_asan/libinterp/corefcn/Cell.cc-tst
***** test
 a = {"foo", "bar"};
 assert (a(), a);
***** error <wrong type argument 'cell array'> nnz ({0, 1, 2})
=================================================================
==31489==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffd91b06350 at pc 0x7f7d98957e67 bp 0x7ffd91b06050 sp 0x7ffd91b06040
WRITE of size 8 at 0x7ffd91b06350 thread T0
    #0 0x7f7d98957e66 in Array<octave_value>::Array() ../liboctave/array/Array.h:257
    #1 0x7f7d98957e66 in octave_value_list::octave_value_list() ../libinterp/octave-value/ovl.h:46
    #2 0x7f7d99cb7e59 in octave::tree_evaluator::visit_identifier(octave::tree_identifier&) ../libinterp/parse-tree/pt-eval.cc:1035

(full log is attached).

One needs to have at least gcc 7 to get stack-use-after-scope diagnostic. See


https://gcc.gnu.org/gcc-7/changes.html


Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #41311:  51552.diff added by rik5 (446B - text/x-patch)
file #41309:  Array.h added by dasergatskov (27KiB - text/x-chdr)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rik5 (Posted a comment)
  • -email is unavailable- added by dasergatskov (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-07-24 rik5 Open/ClosedOpen Closed
    2017-07-24 rik5 Attached File- Added 51552.diff, #41311
    2017-07-24 rik5 StatusNone Need Info
    2017-07-24 dasergatskov Attached File- Added Array.h, #41309
        Attached File- Added octave_stack-use-after-scope_log.txt, #41310

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code