bugGNU Octave - Bugs: bug #47246, segfault in findobj.m when...

 
 

bug #47246: segfault in findobj.m when compiling with llvm clang

Submitted by:  Mike Miller <mtmiller>
Submitted on:  Wed 24 Feb 2016 03:31:21 PM UTC  
 
Category: Octave FunctionSeverity: 3 - Normal
Priority: 5 - NormalItem Group: Segfault, Bus Error, etc.
Status: FixedAssigned to: None
Originator Name: Open/Closed: Closed
Release: devOperating System: GNU/Linux

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Tue 29 Mar 2016 05:15:25 PM UTC, comment #7:

I haven't seen it lately so let's call it resolved. Can be reopened if it comes up again.

Mike Miller <mtmiller>
Project Administrator
Mon 28 Mar 2016 05:02:00 AM UTC, comment #6:

Can we close this as a gremlin that disappeared on its own?

Rik <rik5>
Project Administrator
Tue 15 Mar 2016 12:44:18 AM UTC, comment #5:

I don't see this error anymore with the current default branch and with clang 3.7 (Debian version 3.7.1-2) and llvm libc++ 3.7 (Debian version 3.7.0-1). Does this still crash for you with clang 3.6 or has it been fixed?

Mike Miller <mtmiller>
Project Administrator
Wed 24 Feb 2016 09:05:50 PM UTC, comment #4:

Hmm, this is an odd one. The attached patch avoids the crash for me. But if I move this code into the idx_vector::idx_vector_rep::as_array class (instead of setting the aowner pointer and just generating the output Array on the fly at each call) then I still see a crash. And gdb is saying that the crash is in idx_vector::copy_data but I don't see how that function is being called. The stack trace is strange:

If I set a breakpoint in idx_vector::copy_data execution doesn't stop there before the crash.

So possibly some kind of data overrun is trashing the stack? I don't know.

Running with valgrind shows

That doesn't really give me much of a clue because the data read error doesn't happen until after copy_data is called, and as far as I can tell, it is not supposed to be called at any point from idx_vector::idx_vector_rep::as_array.

(file #36452)

John W. Eaton <jwe>
Project Administrator
Wed 24 Feb 2016 06:18:57 PM UTC, comment #3:

I see the same crash but I'm using

Debian clang version 3.6.2-3 (tags/RELEASE_362/final) (based on LLVM 3.6.2)

I'll see if I can find out what is happening there. No guarantees though, it looks like we are off in the world of tricky Jaroslavisms.

John W. Eaton <jwe>
Project Administrator
Wed 24 Feb 2016 03:54:33 PM UTC, comment #2:

An even simpler example, no need to plot anything:

It seems to always crash on the 3rd argument pair for me, regardless of the order or types of the queries.

Mike Miller <mtmiller>
Project Administrator
Wed 24 Feb 2016 03:41:20 PM UTC, comment #1:

The segfault in this example is occuring on line 261 of findobj.m:

where pairs is simply [1, 2]. I'm sensing some kind of prior memory corruption.

Mike Miller <mtmiller>
Project Administrator
Wed 24 Feb 2016 03:31:21 PM UTC, original submission:

When Octave is built with clang (version 3.7) on Debian, I see a segfault from the following simple example (the findobj command is a simplified form of one in print.m that causes the crash):

This is the minimum set of arguments that I've come up with through trial and error that still cause a crash. I don't know if it has to do with the number of args or the specific combination.

Stack trace:

Mike Miller <mtmiller>
Project Administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #36452:  diffs.txt added by jwe (725B - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rik5 (Posted a comment)
  • -unavailable- added by jwe (Posted a comment)
  • -unavailable- added by mtmiller (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only project members can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 29 Mar 2016 05:15:25 PM UTCmtmillerStatusNeed Info=>Fixed
      Open/ClosedOpen=>Closed
      Summarysegfault in findobj.m when compiling with clang=>segfault in findobj.m when compiling with llvm clang
    Mon 28 Mar 2016 05:02:00 AM UTCrik5StatusNone=>Need Info
    Wed 24 Feb 2016 09:05:50 PM UTCjweAttached File-=>Added diffs.txt, #36452

    Back to the top


    Powered by Savane 3.1-cleanup1