bugGNU Octave - Bugs: bug #54527, Crash when concatenating empty...

 
 

bug #54527: Crash when concatenating empty elements with sparse matrices.

Submitter:  Kai Torben Ohlhus <siko1056>
Submitted:  Fri 17 Aug 2018 09:15:49 AM UTC
   
 
Category:  Interpreter Severity:  4 - Important
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  Fixed Assigned to:  None
Originator Name:  Open/Closed:  * Closed
Release:  * 4.4.1 Operating System:  * GNU/Linux
Fixed Release:  None Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sat 18 Aug 2018 11:29:55 AM UTC, comment #6: 

Thank you for taking care of this Rik and Mike!  I can confirm, that none of my (admittedly) two-liners works no more =)

Even more surprising, that the fix was that short.  I stopped yesterday in Sparse<T>::cat and thought of a bigger issue.

Kai Torben Ohlhus <siko1056>
Group Member
Fri 17 Aug 2018 09:15:11 PM UTC, comment #5: 

I checked in a change to the isempty definition which stops the segfault (https://hg.savannah.gnu.org/hgweb/octave/rev/7233dae64579).  Marking as fixed and closing report.

Rik <rik5>
Group administrator
Fri 17 Aug 2018 07:58:52 PM UTC, comment #4: 

The problem seems to be in Sparse.cc with the cat function.

There is this bit of code which is designed to handle concatenating empty matrices


const Sparse<T>& spi = sparse_list[i];
// Skipping empty matrices.  See the comment in Array.cc.
if (spi.isempty ())
  continue;


Using gdb, I get


(gdb) display-sparse-array spi
sparse object: (const Sparse<double> &) @0x1fe7f10: {
  _vptr.Sparse = 0x7f33ae18d5b0 <vtable for SparseMatrix+16>, rep = 0x2277af0,
  dimensions = {rep = 0x1fcff50}}
dimensions.rep[0] = ndims: 2
dims: {1, 0}

dimensions.rep[1] = 0
rep = {d = 0x0, r = 0x0, c = 0x1ff4770, nzmx = 0, nrows = 1, ncols = 0, count = {
    count = 1}}
rep.d = Invalid number 0 of repetitions.
(gdb) p spi.isempty ()
$3 = false
(gdb) p spi.numel ()
$4 = 0


The killer is that isempty () is returning false for this very empty matrix.

Looking at isempty in Sparse.h I find


  bool isempty (void) const { return (rows () < 1 && cols () < 1); }


That looks very suspect.  I think '&&' should be '||' in this case.  Or maybe we should just do things the way we do in Array.h


Array.h:  bool isempty (void) const { return numel () == 0; }



Rik <rik5>
Group administrator
Fri 17 Aug 2018 07:32:48 PM UTC, comment #3: 

Here is the interesting portion of a backtrace for


[sparse(1); zeros(1,0)]



#0  0x00007f33ad1947fb in Sparse<double>::SparseRep::cridx (this=0x2277af0, i=0)
    at ./liboctave/array/Sparse.h:114
#1  0x00007f33ad1944d5 in Sparse<double>::ridx (this=0x1fe7f10, i=0)
    at ./liboctave/array/Sparse.h:504
#2  0x00007f33ac18bb79 in Sparse<double>::cat (dim=0, n=2, sparse_list=0x1fe7ef8)
    at liboctave/array/Sparse.cc:2635
#3  0x00007f33ad76d501 in octave::tm_const::sparse_array_concat<SparseMatrix> (
    this=0x7fffe4374650) at libinterp/parse-tree/pt-tm-const.cc:669
#4  0x00007f33ad76a113 in octave::tm_const::concat (this=0x7fffe4374650,
    string_fill_char=32 ' ') at libinterp/parse-tree/pt-tm-const.cc:230
#5  0x00007f33ad745f2a in octave::tree_evaluator::visit_matrix (this=0x1e6bad0, expr=...)
    at libinterp/parse-tree/pt-eval.cc:2096



Rik <rik5>
Group administrator
Fri 17 Aug 2018 06:18:25 PM UTC, comment #2: 

It's both about the dimensions and about the vertcat operation.

With horzcat, there is no crash


>> [sparse(1), (1:0)']
error: =: nonconformant arguments (op1 is 1x1, op2 is 0x1)
>> horzcat (sparse(1), (1:0)')
error: horzcat: =: nonconformant arguments (op1 is 1x1, op2 is 0x1)


Mike Miller <mtmiller>
Group Member
Fri 17 Aug 2018 05:33:59 PM UTC, comment #1: 

Confirmed.  A one-liner test is


[sparse(1); zeros(1,0)]


Dimensions are obviously an issue because the other way works.


[sparse(1); zeros(0,1)]



Rik <rik5>
Group administrator
Fri 17 Aug 2018 09:15:49 AM UTC, original submission:  

I found a new one-liner to crash Octave:


e = 1;
E = [1 1 1]';

[e     ; sparse(1)];   ## works
[e(1:1); sparse(1)];   ## works
[e(1:0); 1        ];   ## works
[[]    ; sparse(1)];   ## works
[E(1:0); sparse(1)];   ## works
[sparse(1); E(1:0)];   ## works

[sparse(1); e(1:0,1)]; ## works, when explicitly reshaping the empty matrix
[e(1:0,1); sparse(1)]; ## works, see above

##[sparse(1); e(1:0)]; ## CRASH!!!
##[e(1:0); sparse(1)]; ## CRASH!!!

##vertcat (sparse(1), e(1:0)) ## CRASH!!!
##vertcat (e(1:0), sparse(1)) ## CRASH!!!

## works, because dimension of empty matrix is 1x0
horzcat (sparse(1), e(1:0));
horzcat (e(1:0), sparse(1));


The problem seems to be, when the matrix dimensions of the empty element are wrong, something bad happens.

Kai Torben Ohlhus <siko1056>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mtmiller (Posted a comment)
  • -email is unavailable- added by rik5 (Posted a comment)
  • -email is unavailable- added by siko1056 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-08-17 rik5 StatusConfirmed Fixed
        Open/ClosedOpen Closed
    2018-08-17 rik5 StatusNone Confirmed

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code