bugGNU Octave - Bugs: bug #64914, Bytecode VM crash with Symbolic...

 
 

bug #64914: Bytecode VM crash with Symbolic package operation

Submitter:  Arun Giridhar <arungiridhar>
Submitted:  Mon 20 Nov 2023 11:00:14 PM UTC
   
 
Category:  Interpreter Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  Ready For Test Assigned to:  None
Originator Name:  Open/Closed:  * Open
Release:  * dev Operating System:  * Any
Fixed Release:  None Planned Release:  9.1.0
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 25 Nov 2023 03:27:37 PM UTC, comment #4: 

This change caused issues for platforms on which `long` is not 64-bit wide.
Should be fixed with this change hopefully:
https://hg.savannah.gnu.org/hgweb/octave/rev/a4b9c5b2d85e

Leaving status as ready for test.

Markus Mützel <mmuetzel>
Group administrator
Fri 24 Nov 2023 10:11:41 PM UTC, comment #3: 

I tested and can confirm that the patch stops the crash from happening.

Since this patch is fixing a repeatable crash in Octave 9, I pushed it to stable here: https://hg.savannah.gnu.org/hgweb/octave/rev/907ee6f8d6dd

Marking as ready for test.

Arun Giridhar <arungiridhar>
Group Member
Wed 22 Nov 2023 11:00:59 PM UTC, comment #2: 

I can recreate the issue and made a patch addressing it.

Essentially the problem is that the vm pushed cell elements by row to
the stack before inserting them into a cell row, which didn't work
very well for big cells, leading to stack overflow.

There are some:

a = {a{:} b{:}};

in the python_copy_vars_to.m in the package, which led to the failure,
since the resulting cs-lists were pushed to the stack element by element.

The patch reworks how cells are created so that the row element
arguments are put straight into the cell after being evaluated.


pkg load symbolic
__vm_enable__ (1);
tic
val = sym (ones(89));
toc
whos
tic
val = sym (ones(89));
toc
whos


Runs fine with the patch.

(file #55349)

Petter <petter>
Mon 20 Nov 2023 11:26:03 PM UTC, comment #1: 

If the input matrix has more nonzeros, then the crash happens for smaller matrices as well:


tic
pkg load symbolic
val = sym (ones(89));
toc
whos


Was able to rule out charpoly().

Arun Giridhar <arungiridhar>
Group Member
Mon 20 Nov 2023 11:00:14 PM UTC, original submission:  

This crash doesn't happen for all inputs, but for this case and all larger ones tested, it is consistent.

Test code:

load testadj.mat
whos

tic
pkg load symbolic
val = charpoly (sym (adj+0));
toc
whos


(The file testadj.mat is attached in text format so you can examine its contents before downloading.)

Output without bytecode interpreter:

Variables visible from the current scope:

variables in scope: top scope

  Attr   Name        Size                     Bytes  Class
  ====   ====        ====                     =====  =====
         adj       120x120                    14400  logical

Total is 14400 elements using 14400 bytes

Symbolic pkg v3.1.1: Python communication link active, SymPy v1.12.
Elapsed time is 77.8366 seconds.
Variables visible from the current scope:

variables in scope: top scope

  Attr   Name        Size                     Bytes  Class
  ====   ====        ====                     =====  =====
         adj       120x120                    14400  logical
         val         1x121                    15735  sym

Total is 14401 elements using 30135 bytes


Output with the bytecode VM:

Variables visible from the current scope:

variables in scope: top scope

  Attr   Name        Size                     Bytes  Class
  ====   ====        ====                     =====  =====
         adj       120x120                    14400  logical

Total is 14400 elements using 14400 bytes

Symbolic pkg v3.1.1: Python communication link active, SymPy v1.12.
VM error 4688: Internal VM conistency check failed, m_stack0[i + stack_size].u == stack_magic_int
VM error 8139: Exception in numeric_array_to_sym escaped the VM
double free or corruption (!prev)
fatal: caught signal Aborted -- stopping myself...

Aborted (core dumped)


Arun Giridhar <arungiridhar>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #55349:  32725.patch added by petter (19KiB - text/x-patch)
file #55344:  testadj.mat added by arungiridhar (28KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mmuetzel (Posted a comment)
  • -email is unavailable- added by petter (Updated the item)
  • -email is unavailable- added by arungiridhar (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-11-25 mmuetzel Operating SystemGNU/Linux Any
    2023-11-24 arungiridhar StatusNone Ready For Test
        Planned ReleaseNone 9.1.0
    2023-11-22 petter Attached File- Added 32725.patch, #55349
    2023-11-20 arungiridhar Attached File- Added testadj.mat, #55344

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code