bugGNU Octave - Bugs: bug #60101, symbfact crashes for dense matrices

 
 

bug #60101: symbfact crashes for dense matrices

Submitter:  None
Submitted:  Tue 23 Feb 2021 12:03:10 AM UTC
   
 
Category:  Octave Function Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  Fixed Assigned to:  None
Originator Name:  Marcel Jacobse Originator Email:  -email is unavailable-
Open/Closed:  * Closed Release:  * 6.2.0
Operating System:  * Any Fixed Release:  None
Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Wed 24 Feb 2021 05:11:46 PM UTC, comment #13: 

I extended etree to work with dense matrices on the development branch here: http://hg.savannah.gnu.org/hgweb/octave/rev/7797e2f3c69b.

Marking bug as fixed and closing report.

Rik <rik5>
Group administrator
Tue 23 Feb 2021 04:58:43 PM UTC, comment #12: 

I reviewed the code in some of the other sparse functions, such as ccolamd.cc, and the solution of declaring two local variables was already in use.  In fact, there is already a naming convention of sm for SparseMatrix and scm for SparseComplexMatrix.  With that encouragement, I went ahead and coded the two local variable solution on the stable branch here: http://hg.savannah.gnu.org/hgweb/octave/rev/1f9e755bd91e.

A light review of the rest of the places in libinterp where sparse_array_value() is used shows that etree() is also coded with local block scope variables.  It doesn't exhibit this problem because it requires a sparse matrix as input, and the interpreter therefore already has a reference count above 1 for the variable.  But this isn't good practice and I will check in another fix for that.

Rik <rik5>
Group administrator
Tue 23 Feb 2021 03:00:55 PM UTC, comment #11: 

Rik: Maybe add a comment explaining that the AC and AR variables need to exist until the end of the outer scope, but otherwise I think your change is fine.  Thanks for tracking it down.  Now I wonder whether something like this bug is the cause of the crashes we've seen when the buildbots run make check and a crash happens in sparse matrix functions.

John W. Eaton <jwe>
Group administrator
Tue 23 Feb 2021 05:24:19 AM UTC, comment #10: 

Attached is a diff (60101.diff) against the stable branch that prevents the segfault.  I declared both a SparseMatrix and a SparseComplexMatrix and then use whichever one is required.  This does mean unnecessary storage on the stack of a variable that is never used.  Perhaps there is a more clever way with a union construct to get around that.

(file #50911)

Rik <rik5>
Group administrator
Tue 23 Feb 2021 05:20:35 AM UTC, comment #9: 

I've found the problem.  The code in symbfact.cc at the start of the function is


      const SparseMatrix a = args(0).sparse_matrix_value ();
  if (args(0).isreal ())
    {
      //const SparseMatrix a = args(0).sparse_matrix_value ();
      A->nrow = a.rows ();
      A->ncol = a.cols ();
      A->p = a.cidx ();
      A->i = a.ridx ();
      A->nzmax = a.nnz ();
      A->xtype = CHOLMOD_REAL;

      if (a.rows () > 0 && a.cols () > 0)
        A->x = a.data ();
    }
  else if (args(0).iscomplex ())
    {
      const SparseComplexMatrix a = args(0).sparse_complex_matrix_value ();
      A->nrow = a.rows ();
      A->ncol = a.cols ();
      A->p = a.cidx ();
      A->i = a.ridx ();
      A->nzmax = a.nnz ();
      A->xtype = CHOLMOD_COMPLEX;

      if (a.rows () > 0 && a.cols () > 0)
        A->x = a.data ();
    }


A temporary variable 'a' is declared inside a block and then used to initialize the cholmod_sparse matrix A.  But when execution proceeds out of the block the variable goes out of scope and can be reclaimed by a runtime garbage collector.

I made the simple change above of declaring the variable 'a' outside of a block so it is available and that stops the segfaults.

Rik <rik5>
Group administrator
Tue 23 Feb 2021 04:14:35 AM UTC, comment #8: 

If I look in symbfact.cc for the DEFUN I find that after some initial input set up, this line is called


      const SparseMatrix a = args(0).sparse_matrix_value ();


If I look at the SparseMatrix that is created I see


rep = {d = 0x7f0b482bf620, r = 0x7f0b484fa1b0, c = 0x7f0b48433f70, nzmx = 16,
  nrows = 4, ncols = 4, count = {m_count = {<std::__atomic_base<long>> = {
        static _S_alignment = 8, _M_i = 2}, <No data fields>}}}


When I call the function with the full version of matrix A the only difference is the member variable _M_i = 1 within std::__atomic_base<long>.

Rik <rik5>
Group administrator
Tue 23 Feb 2021 04:02:01 AM UTC, comment #7: 

Here is another partial backtrace for a version compiled with "-g -O0" in which I set a breakpoint in Fsymbfact and then continued after the breakpoint was hit.


#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007f6b32c05921 in __GI_abort () at abort.c:79
#2  0x00007f6b32c4e967 in __libc_message (action=action@entry=do_abort,
    fmt=fmt@entry=0x7f6b32d7bb0d "%s\n") at ../sysdeps/posix/libc_fatal.c:181
#3  0x00007f6b32c559da in malloc_printerr (str=str@entry=0x7f6b32d7d720 "munmap_chunk(): invalid pointer")
    at malloc.c:5342
#4  0x00007f6b32c5cfbc in munmap_chunk (p=0x7f6afc52ac10) at malloc.c:2846
#5  __GI___libc_free (mem=0x7f6afc52ac20) at malloc.c:3127
#6  0x00007f6b35573e7a in __gnu_cxx::new_allocator<std::_List_node<octave::symbol_record> >::deallocate (
    this=0x7f6b0b321cb0, __p=0x7f6afc52ac20) at /usr/include/c++/7/ext/new_allocator.h:125
#7  0x00007f6b35573334 in std::allocator_traits<std::allocator<std::_List_node<octave::symbol_record> > >::deallocate (__a=..., __p=0x7f6afc52ac20, __n=1) at /usr/include/c++/7/bits/alloc_traits.h:462
#8  0x00007f6b35571bf8 in std::__cxx11::_List_base<octave::symbol_record, std::allocator<octave::symbol_record> >::_M_put_node (this=0x7f6b0b321cb0, __p=0x7f6afc52ac20) at /usr/include/c++/7/bits/stl_list.h:387
#9  0x00007f6b3556fb4d in std::__cxx11::_List_base<octave::symbol_record, std::allocator<octave::symbol_record> >::_M_clear (this=0x7f6b0b321cb0) at /usr/include/c++/7/bits/list.tcc:80
#10 0x00007f6b35570da9 in std::__cxx11::list<octave::symbol_record, std::allocator<octave::symbol_record> >::_M_move_assign (this=0x7f6b0b321cb0, __x=...) at /usr/include/c++/7/bits/stl_list.h:1840
#11 0x00007f6b3556f1b9 in std::__cxx11::list<octave::symbol_record, std::allocator<octave::symbol_record> >::operator= (this=0x7f6b0b321cb0, __x=...) at /usr/include/c++/7/bits/stl_list.h:765
#12 0x00007f6b3556e37d in octave::symbol_info_accumulator::append_list (this=0x7f6b0b321e00, frame=...)
    at libinterp/corefcn/stack-frame.cc:1016
#13 0x00007f6b3556d9b9 in octave::symbol_info_accumulator::visit_scope_stack_frame (this=0x7f6b0b321e00,
    frame=...) at libinterp/corefcn/stack-frame.cc:912
#14 0x00007f6b3556a21a in octave::scope_stack_frame::accept (this=0x7f6afc006a90, sfw=...)
    at libinterp/corefcn/stack-frame.cc:2465
#15 0x00007f6b3556503b in octave::stack_frame::all_variables (this=0x7f6afc006a90)
    at libinterp/corefcn/stack-frame.cc:1153
#16 0x00007f6b350ca9ce in octave::stack_frame::get_symbol_info (this=0x7f6afc006a90)
    at libinterp/corefcn/stack-frame.h:273
#17 0x00007f6b350c7e32 in octave::call_stack::get_symbol_info (this=0x7f6afc005960)
    at libinterp/corefcn/call-stack.cc:856
#18 0x00007f6b3500d087 in octave::tree_evaluator::get_symbol_info (this=0x7f6afc005838)
    at libinterp/parse-tree/pt-eval.cc:4244
#19 0x00007f6b351838ce in octave::event_manager::set_workspace (this=0x7f6afc005de0)
    at libinterp/corefcn/event-manager.cc:167
#20 0x00007f6b353d602f in octave::base_reader::octave_gets (this=0x7f6afc43c6d0, prompt="octave:5> ",
    eof=@0x7f6afc43c6e0: false) at libinterp/corefcn/input.cc:818
#21 0x00007f6b353d6624 in octave::terminal_reader::get_input (this=0x7f6afc43c6d0, prompt="octave:5> ",
    eof=@0x7f6b0b3221c3: false) at libinterp/corefcn/input.cc:991
#22 0x00007f6b34fbaf6f in octave::input_reader::get_input (this=0x7f6afc228560, prompt="octave:5> ",
    eof=@0x7f6b0b3221c3: false) at libinterp/corefcn/input.h:282
#23 0x00007f6b34fd3c51 in octave::push_parser::run (this=0x7f6afc22f1c0)
    at libinterp/parse-tree/oct-parse.yy:4958


If I try repeatedly I find the backtrace points to different places.  I think this just means that the original call does overrun memory and it is random chance which parts get affected.

Rik <rik5>
Group administrator
Tue 23 Feb 2021 03:31:14 AM UTC, comment #6: 

Somehow ASAN prevented the crash. Here is a bachtrace on debug binary w/o ASAN:


octave:4> exit

Thread 7 "QThread" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffb37fe700 (LWP 3286195)]
0x00007ffff6b5035d in octave::tree_breakpoint::visit_statement_list (this=0x7fffb37ed8d0, lst=...) at ../libinterp/parse-tree/pt-bp.cc:297
297            for (tree_statement *elt : lst)
Missing separate debuginfos, use: yum debuginfo-install GConf2-3.2.6-22.el8.x86_64 GraphicsMagick-1.3.36-2.el8.x86_64 GraphicsMagick-c++-1.3.36-2.el8.x86_64 PackageKit-gtk3-module-1.1.12-6.el8.x86_64 adwaita-qt-1.0-5.el8.x86_64 arpack-3.7.0-1.el8.x86_64 at-spi2-atk-2.26.2-1.el8.x86_64 at-spi2-core-2.28.0-1.el8.x86_64 atk-2.28.1-1.el8.x86_64 blas-3.8.0-8.el8.x86_64 brotli-1.0.6-2.el8.x86_64 bzip2-libs-1.0.6-26.el8.x86_64 cairo-1.15.12-3.el8.x86_64 cairo-gobject-1.15.12-3.el8.x86_64 cyrus-sasl-lib-2.1.27-5.el8.x86_64 dbus-glib-0.110-2.el8.x86_64 dbus-libs-1.12.8-11.el8.x86_64 dconf-0.28.0-3.el8.x86_64 expat-2.2.5-4.el8.x86_64 fftw-libs-double-3.3.5-11.el8.x86_64 fftw-libs-single-3.3.5-11.el8.x86_64 fontconfig-2.13.1-3.el8.x86_64 freetype-2.9.1-4.el8_3.1.x86_64 gdk-pixbuf2-2.36.12-5.el8.x86_64 gl2ps-1.4.2-2.el8.x86_64 glib2-2.56.4-8.el8.x86_64 glibc-2.28-127.el8.x86_64 gmp-6.1.2-10.el8.x86_64 gnutls-3.6.14-7.el8_3.x86_64 graphite2-1.3.10-10.el8.x86_64 harfbuzz-1.7.5-3.el8.x86_64 hdf5-1.10.5-4.el8.x86_64 keyutils-libs-1.5.10-6.el8.x86_64 krb5-libs-1.18.2-5.el8.x86_64 lapack-3.8.0-8.el8.x86_64 lcms2-2.9-2.el8.x86_64 libICE-1.0.9-15.el8.x86_64 libSM-1.2.3-1.el8.x86_64 libX11-1.6.8-3.el8.x86_64 libX11-xcb-1.6.8-3.el8.x86_64 libXcursor-1.1.15-3.el8.x86_64 libXext-1.3.4-1.el8.x86_64 libXfixes-5.0.3-7.el8.x86_64 libXi-1.7.10-1.el8.x86_64 libXinerama-1.1.4-1.el8.x86_64 libXrender-0.9.10-7.el8.x86_64 libaec-1.0.2-3.el8.x86_64 libcanberra-0.30-16.el8.x86_64 libcap-2.26-4.el8.x86_64 libcom_err-1.45.6-1.el8.x86_64 libcurl-7.61.1-14.el8_3.1.x86_64 libepoxy-1.5.3-1.el8.x86_64 libffi-3.1-22.el8.x86_64 libgcc-8.3.1-5.1.el8.x86_64 libgcrypt-1.8.5-4.el8.x86_64 libgfortran-8.3.1-5.1.el8.x86_64 libglvnd-glx-1.2.0-6.el8.x86_64 libgomp-8.3.1-5.1.el8.x86_64 libgpg-error-1.31-1.el8.x86_64 libicu-60.3-2.el8_1.x86_64 libidn2-2.2.0-1.el8.x86_64 libmount-2.32.1-24.el8.x86_64 libnghttp2-1.33.0-3.el8_2.1.x86_64 libogg-1.3.2-10.el8.x86_64 libpng-1.6.34-5.el8.x86_64 libpsl-0.20.2-6.el8.x86_64 libquadmath-8.3.1-5.1.el8.x86_64 libselinux-2.9-4.el8_3.x86_64 libssh-0.9.4-2.el8.x86_64 libtasn1-4.13-3.el8.x86_64 libtdb-1.4.3-1.el8.x86_64 libthai-0.1.27-2.el8.x86_64 libtool-ltdl-2.4.6-25.el8.x86_64 libunistring-0.9.9-3.el8.x86_64 libuuid-2.32.1-24.el8.x86_64 libvorbis-1.3.6-2.el8.x86_64 libwayland-client-1.17.0-1.el8.x86_64 libwayland-cursor-1.17.0-1.el8.x86_64 libxcrypt-4.1.1-4.el8.x86_64 lz4-libs-1.8.3-2.el8.x86_64 mesa-libGLU-9.0.0-15.el8.x86_64 ncurses-libs-6.1-7.20180224.el8.x86_64 nettle-3.4.1-2.el8.x86_64 openldap-2.4.46-15.el8.x86_64 openssl-libs-1.1.1g-12.el8_3.x86_64 p11-kit-0.23.14-5.el8_0.x86_64 pango-1.42.4-6.el8.x86_64 pcre2-utf16-10.32-2.el8.x86_64 pixman-0.38.4-1.el8.x86_64 qgnomeplatform-0.4-3.el8.x86_64 qrupdate-1.1.2-18.el8.x86_64 qscintilla-qt5-2.11.2-6.el8.x86_64 qt5-qtbase-5.12.5-6.el8.x86_64 qt5-qtbase-gui-5.12.5-6.el8.x86_64 qt5-qttools-libs-help-5.12.5-2.el8.x86_64 readline-7.0-10.el8.x86_64 suitesparse-5.4.0-3.el8.x86_64 systemd-libs-239-41.el8_3.1.x86_64 xcb-util-0.4.0-10.el8.x86_64 xz-libs-5.2.4-3.el8.x86_64 zlib-1.2.11-16.el8_2.x86_64
(gdb) thread apply all bt

Thread 8 (Thread 0x7fffb2efb700 (LWP 3286196)):
#0  0x00007fffec33a5cc in sigtimedwait () at /lib64/libc.so.6
#1  0x00007fffec6d76ac in sigwait () at /lib64/libpthread.so.0
#2  0x00007ffff4178721 in signal_watcher (arg=0x7ffff70426a9 <octave::generic_sig_handler(int)>) at ../liboctave/wrappers/signal-wrappers.c:697
#3  0x00007fffec6cd14a in start_thread () at /lib64/libpthread.so.0
#4  0x00007fffec3fef23 in clone () at /lib64/libc.so.6

Thread 7 (Thread 0x7fffb37fe700 (LWP 3286195)):
#0  0x00007ffff6b5035d in octave::tree_breakpoint::visit_statement_list(octave::tree_statement_list&) (this=0x7fffb37ed8d0, lst=...) at ../libinterp/parse-tree/pt-bp.cc:297
#1  0x00007ffff69675ee in octave::tree_statement_list::accept(octave::tree_walker&) (this=0x7fffa43f4400, tw=...) at ../libinterp/parse-tree/pt-stmt.h:201
#2  0x00007ffff6b4ff81 in octave::tree_breakpoint::visit_if_command_list(octave::tree_if_command_list&) (this=0x7fffb37ed8d0, lst=...) at ../libinterp/parse-tree/pt-bp.cc:187
#3  0x00007ffff6b6a95c in octave::tree_if_command_list::accept(octave::tree_walker&) (this=0x7fffa43f5800, tw=...) at ../libinterp/parse-tree/pt-select.h:118
#4  0x00007ffff6b9cfbe in octave::tree_walker::visit_if_command(octave::tree_if_command&) (this=0x7fffb37ed8d0, cmd=...) at ../libinterp/parse-tree/pt-walk.cc:226
#5  0x00007ffff6b898e0 in octave::tree_if_command::accept(octave::tree_walker&) (this=0x7fffa43f5a80, tw=...) at ../libinterp/parse-tree/pt-select.h:151
#6  0x00007ffff6b502b8 in octave::tree_breakpoint::visit_statement(octave::tree_statement&) (this=0x7fffb37ed8d0, stmt=...) at ../libinterp/parse-tree/pt-bp.cc:282
#7  0x00007ffff6b8ac60 in octave::tree_statement::accept(octave::tree_walker&) (this=0x7fffa43f5ac0, tw=...) at ../libinterp/parse-tree/pt-stmt.h:124
#8  0x00007ffff6b50389 in octave::tree_breakpoint::visit_statement_list(octave::tree_statement_list&) (this=0x7fffb37ed8d0, lst=...) at ../libinterp/parse-tree/pt-bp.cc:301
#9  0x00007ffff69675ee in octave::tree_statement_list::accept(octave::tree_walker&) (this=0x7fffa43f5b00, tw=...) at ../libinterp/parse-tree/pt-stmt.h:201
#10 0x00007ffff6b4ff81 in octave::tree_breakpoint::visit_if_command_list(octave::tree_if_command_list&) (this=0x7fffb37ed8d0, lst=...) at ../libinterp/parse-tree/pt-bp.cc:187
#11 0x00007ffff6b6a95c in octave::tree_if_command_list::accept(octave::tree_walker&) (this=0x7fffa44007a0, tw=...) at ../libinterp/parse-tree/pt-select.h:118
#12 0x00007ffff6b9cfbe in octave::tree_walker::visit_if_command(octave::tree_if_command&) (this=0x7fffb37ed8d0, cmd=...) at ../libinterp/parse-tree/pt-walk.cc:226
#13 0x00007ffff6b898e0 in octave::tree_if_command::accept(octave::tree_walker&) (this=0x7fffa4401090, tw=...) at ../libinterp/parse-tree/pt-select.h:151
#14 0x00007ffff6b502b8 in octave::tree_breakpoint::visit_statement(octave::tree_statement&) (this=0x7fffb37ed8d0, stmt=...) at ../libinterp/parse-tree/pt-bp.cc:282
#15 0x00007ffff6b8ac60 in octave::tree_statement::accept(octave::tree_walker&) (this=0x7fffa44010d0, tw=...) at ../libinterp/parse-tree/pt-stmt.h:124
#16 0x00007ffff6b50389 in octave::tree_breakpoint::visit_statement_list(octave::tree_statement_list&) (this=0x7fffb37ed8d0, lst=...) at ../libinterp/parse-tree/pt-bp.cc:301
#17 0x00007ffff69675ee in octave::tree_statement_list::accept(octave::tree_walker&) (this=0x7fffa43f2820, tw=...) at ../libinterp/parse-tree/pt-stmt.h:201
#18 0x00007ffff6b4ff81 in octave::tree_breakpoint::visit_if_command_list(octave::tree_if_command_list&) (this=0x7fffb37ed8d0, lst=...) at ../libinterp/parse-tree/pt-bp.cc:187
#19 0x00007ffff6b6a95c in octave::tree_if_command_list::accept(octave::tree_walker&) (this=0x7fffa4401210, tw=...) at ../libinterp/parse-tree/pt-select.h:118
#20 0x00007ffff6b9cfbe in octave::tree_walker::visit_if_command(octave::tree_if_command&) (this=0x7fffb37ed8d0, cmd=...) at ../libinterp/parse-tree/pt-walk.cc:226
#21 0x00007ffff6b898e0 in octave::tree_if_command::accept(octave::tree_walker&) (this=0x7fffa4401730, tw=...) at ../libinterp/parse-tree/pt-select.h:151
#22 0x00007ffff6b502b8 in octave::tree_breakpoint::visit_statement(octave::tree_statement&) (this=0x7fffb37ed8d0, stmt=...) at ../libinterp/parse-tree/pt-bp.cc:282
#23 0x00007ffff6b8ac60 in octave::tree_statement::accept(octave::tree_walker&) (this=0x7fffa4401770, tw=...) at ../libinterp/parse-tree/pt-stmt.h:124
--Type <RET> for more, q to quit, c to continue without paging--
#24 0x00007ffff6b50389 in octave::tree_breakpoint::visit_statement_list(octave::tree_statement_list&) (this=0x7fffb37ed8d0, lst=...) at ../libinterp/parse-tree/pt-bp.cc:301
#25 0x00007ffff69675ee in octave::tree_statement_list::accept(octave::tree_walker&) (this=0x7fffa43f2270, tw=...) at ../libinterp/parse-tree/pt-stmt.h:201
#26 0x00007ffff6b4ff81 in octave::tree_breakpoint::visit_if_command_list(octave::tree_if_command_list&) (this=0x7fffb37ed8d0, lst=...) at ../libinterp/parse-tree/pt-bp.cc:187
#27 0x00007ffff6b6a95c in octave::tree_if_command_list::accept(octave::tree_walker&) (this=0x7fffa44018b0, tw=...) at ../libinterp/parse-tree/pt-select.h:118
#28 0x00007ffff6b9cfbe in octave::tree_walker::visit_if_command(octave::tree_if_command&) (this=0x7fffb37ed8d0, cmd=...) at ../libinterp/parse-tree/pt-walk.cc:226
#29 0x00007ffff6b898e0 in octave::tree_if_command::accept(octave::tree_walker&) (this=0x7fffa4401900, tw=...) at ../libinterp/parse-tree/pt-select.h:151
#30 0x00007ffff6b502b8 in octave::tree_breakpoint::visit_statement(octave::tree_statement&) (this=0x7fffb37ed8d0, stmt=...) at ../libinterp/parse-tree/pt-bp.cc:282
#31 0x00007ffff6b8ac60 in octave::tree_statement::accept(octave::tree_walker&) (this=0x7fffa4401940, tw=...) at ../libinterp/parse-tree/pt-stmt.h:124
#32 0x00007ffff6b50389 in octave::tree_breakpoint::visit_statement_list(octave::tree_statement_list&) (this=0x7fffb37ed8d0, lst=...) at ../libinterp/parse-tree/pt-bp.cc:301
#33 0x00007ffff69675ee in octave::tree_statement_list::accept(octave::tree_walker&) (this=0x7fffa42d29e0, tw=...) at ../libinterp/parse-tree/pt-stmt.h:201
#34 0x00007ffff6b8a37c in octave::tree_statement_list::list_breakpoints() (this=0x7fffa42d29e0) at ../libinterp/parse-tree/pt-stmt.cc:222
#35 0x00007ffff6b8a861 in octave::tree_statement_list::remove_all_breakpoints(octave::event_manager&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (this=0x7fffa42d29e0, evmgr=..., file="/home/dima/src/octave/scripts/optimization/qp.m") at ../libinterp/parse-tree/pt-stmt.cc:286
#36 0x00007ffff6a7d840 in octave_user_code::~octave_user_code() (this=0x7fffa43649f0, __in_chrg=<optimized out>) at ../libinterp/octave-value/ov-usr-fcn.cc:81
#37 0x00007ffff6a7ea18 in octave_user_function::~octave_user_function() (this=0x7fffa43649f0, __in_chrg=<optimized out>) at ../libinterp/octave-value/ov-usr-fcn.cc:234
#38 0x00007ffff6a7ea34 in octave_user_function::~octave_user_function() (this=0x7fffa43649f0, __in_chrg=<optimized out>) at ../libinterp/octave-value/ov-usr-fcn.cc:244
#39 0x00007ffff78b6bfb in octave_value::operator=(octave_value&&) (this=0x7fffa423f9f0, a=...) at ../libinterp/octave-value/ov.h:390
#40 0x00007ffff707abb0 in octave::fcn_info::fcn_info_rep::clear_user_function(bool) (this=0x7fffa423f8e0, force=false) at ../libinterp/corefcn/fcn-info.h:168
#41 0x00007ffff707ada5 in octave::fcn_info::fcn_info_rep::clear(bool) (this=0x7fffa423f8e0, force=false) at ../libinterp/corefcn/fcn-info.h:193
#42 0x00007ffff707b174 in octave::fcn_info::clear(bool) (this=0x7fffa43ade30, force=false) at ../libinterp/corefcn/fcn-info.h:338
#43 0x00007ffff707867f in octave::symbol_table::clear_functions(bool) (this=0x7fffa4003ec8, force=false) at ../libinterp/corefcn/symtab.cc:431
#44 0x00007ffff6b5e0af in octave::tree_evaluator::clear_all(bool) (this=0x7fffa4003f60, force=false) at ../libinterp/parse-tree/pt-eval.cc:2197
#45 0x00007ffff6efdd8a in octave::interpreter::clear_all(bool) (this=0x7fffa40031c0, force=false) at ../libinterp/corefcn/interpreter.cc:1700
#46 0x00007ffff6ef7e11 in octave::interpreter::shutdown() (this=0x7fffa40031c0) at ../libinterp/corefcn/interpreter.cc:870
#47 0x00007ffff78fc64e in octave::interpreter_qobject::shutdown(int) (this=0x954390, exit_status=0) at ../libgui/src/interpreter-qobject.cc:115
#48 0x00007ffff7a0b0a0 in octave::interpreter_qobject::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (_o=0x954390, _c=QMetaObject::InvokeMetaMethod, _id=4, _a=0x91b4f0)
    at libgui/src/moc-interpreter-qobject.cc:96
#49 0x00007ffff4880276 in QObject::event(QEvent*) () at /lib64/libQt5Core.so.5
#50 0x00007ffff51a05f5 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /lib64/libQt5Widgets.so.5
#51 0x00007ffff51a7b10 in QApplication::notify(QObject*, QEvent*) () at /lib64/libQt5Widgets.so.5
#52 0x00007ffff796f4d3 in octave::octave_qapplication::notify(QObject*, QEvent*) (this=0x6ece90, receiver=0x954390, ev=0xa055a0) at ../libgui/src/octave-qobject.cc:136
#53 0x00007ffff4856326 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /lib64/libQt5Core.so.5
#54 0x00007ffff4859597 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () at /lib64/libQt5Core.so.5
--Type <RET> for more, q to quit, c to continue without paging--c
#55 0x00007ffff48a9407 in postEventSourceDispatch(_GSource*, int (*)(void*), void*) () at /lib64/libQt5Core.so.5
#56 0x00007fffe87f267d in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#57 0x00007fffe87f2a48 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#58 0x00007fffe87f2ae0 in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#59 0x00007ffff48a918b in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#60 0x00007ffff485518b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#61 0x00007ffff46b3d42 in QThread::exec() () at /lib64/libQt5Core.so.5
#62 0x00007ffff46b5076 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#63 0x00007fffec6cd14a in start_thread () at /lib64/libpthread.so.0
#64 0x00007fffec3fef23 in clone () at /lib64/libc.so.6

Thread 6 (Thread 0x7fffb3fff700 (LWP 3286193)):
#0  0x00007fffec3f3ca1 in poll () at /lib64/libc.so.6
#1  0x00007fffe87f29b6 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007fffe87f2ae0 in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#3  0x00007ffff48a918b in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#4  0x00007ffff485518b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#5  0x00007ffff46b3d42 in QThread::exec() () at /lib64/libQt5Core.so.5
#6  0x00007fffce9e0ee9 in QDBusConnectionManager::run() () at /lib64/libQt5DBus.so.5
#7  0x00007ffff46b5076 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#8  0x00007fffec6cd14a in start_thread () at /lib64/libpthread.so.0
#9  0x00007fffec3fef23 in clone () at /lib64/libc.so.6

Thread 5 (Thread 0x7fffc20e4700 (LWP 3286192)):
#0  0x00007fffec3f3ca1 in poll () at /lib64/libc.so.6
#1  0x00007fffe87f29b6 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007fffe87f2d72 in g_main_loop_run () at /lib64/libglib-2.0.so.0
#3  0x00007fffc9b8755a in gdbus_shared_thread_func () at /lib64/libgio-2.0.so.0
#4  0x00007fffe881ad4a in g_thread_proxy () at /lib64/libglib-2.0.so.0
#5  0x00007fffec6cd14a in start_thread () at /lib64/libpthread.so.0
#6  0x00007fffec3fef23 in clone () at /lib64/libc.so.6

Thread 4 (Thread 0x7fffc28e5700 (LWP 3286191)):
#0  0x00007fffec3f3ca1 in poll () at /lib64/libc.so.6
#1  0x00007fffe87f29b6 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007fffe87f2ae0 in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#3  0x00007fffe87f2b31 in glib_worker_main () at /lib64/libglib-2.0.so.0
#4  0x00007fffe881ad4a in g_thread_proxy () at /lib64/libglib-2.0.so.0
#5  0x00007fffec6cd14a in start_thread () at /lib64/libpthread.so.0
#6  0x00007fffec3fef23 in clone () at /lib64/libc.so.6

Thread 3 (Thread 0x7fffc30e6700 (LWP 3286190)):
#0  0x00007fffec3f3ca1 in poll () at /lib64/libc.so.6
#1  0x00007fffe87f29b6 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007fffe87f2ae0 in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#3  0x00007fffc30efe6d in dconf_gdbus_worker_thread () at /usr/lib64/gio/modules/libdconfsettings.so
#4  0x00007fffe881ad4a in g_thread_proxy () at /lib64/libglib-2.0.so.0
#5  0x00007fffec6cd14a in start_thread () at /lib64/libpthread.so.0
#6  0x00007fffec3fef23 in clone () at /lib64/libc.so.6

Thread 2 (Thread 0x7fffcc6b5700 (LWP 3286189)):
#0  0x00007fffec3f3ca1 in poll () at /lib64/libc.so.6
#1  0x00007fffe6b786cf in _xcb_conn_wait () at /lib64/libxcb.so.1
#2  0x00007fffe6b7a34a in xcb_wait_for_event () at /lib64/libxcb.so.1
#3  0x00007fffcead43d8 in QXcbEventQueue::run() () at /lib64/libQt5XcbQpa.so.5
#4  0x00007ffff46b5076 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#5  0x00007fffec6cd14a in start_thread () at /lib64/libpthread.so.0
#6  0x00007fffec3fef23 in clone () at /lib64/libc.so.6

Thread 1 (Thread 0x7fffdc6cac40 (LWP 3286161)):
#0  0x00007fffec3f3ca1 in poll () at /lib64/libc.so.6
#1  0x00007fffe87f29b6 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007fffe87f2ae0 in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#3  0x00007ffff48a918b in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#4  0x00007ffff485518b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#5  0x00007ffff485d1a6 in QCoreApplication::exec() () at /lib64/libQt5Core.so.5
#6  0x00007ffff796ff6f in octave::base_qobject::exec() (this=0x7fffffffc2f0) at ../libgui/src/octave-qobject.cc:284
#7  0x00007ffff797d362 in octave::qt_application::execute() (this=0x7fffffffc460) at ../libgui/src/qt-application.cc:73
#8  0x0000000000401a5d in main(int, char**) (argc=8, argv=0x7fffffffc788) at ../src/main-gui.cc:106
(gdb)


Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Tue 23 Feb 2021 02:40:03 AM UTC, comment #5: 

I got the crash on optimized binary:



octave:1> load badA.var
octave:2> symbfact (full (A))
ans =

   1
   2
   2
   1

octave:3> symbfact ((A))
ans =

   4
   3
   2
   1

octave:4> exit
munmap_chunk(): invalid pointer
fatal: caught signal Aborted -- stopping myself...
Aborted (core dumped)


But everything looks fine on debug binary (-OO) with ASAN:



octave:1> load badA.var
octave:2> symbfact (full (A))
ans =

   4
   3
   2
   1

octave:3> symbfact ((A))
ans =

   4
   3
   2
   1

octave:4> exit


Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Tue 23 Feb 2021 02:17:37 AM UTC, comment #4: 

Confirmed.

Changing the OS to Any as this is happening on Linux as well.

This is quite the problem.  I changed the while loop to a for loop so that I could see what the loop counter is at the time the assert fails.  It is always less than 10 and often just 2 or 3.

Worse, when I exit from Octave I get a segfault.


octave:4> exit
fatal: caught signal Segmentation fault -- stopping myself...
Segmentation fault (core dumped)


I captured one of the "bad" matrices and am uploading it as badA.var.  To re-create the difference, and then crash, run


load badA.var
symbfact (full (A))
symbfact (A)
exit



(file #50910)

Rik <rik5>
Group administrator
Tue 23 Feb 2021 12:46:02 AM UTC, comment #3: 

comment #1:

> How often does it fail on Windows?  Do you need to put the call to symbfact in a loop and execute it a few times to guarantee getting at least one failure?


On Windows it happens very frequently, just running it a few times with the "arrow up" key in the CLI is how I noticed it. On Linux it seems a bit more stable, but ultimately shows the same issues if tested more extensively in a loop (see previous comment)

Marcel

Anonymous
Tue 23 Feb 2021 12:41:40 AM UTC, comment #2: 

Correction: Testing a bit more extensively with a simple script

while true
  n = randi([1,5]);
  A = sprand(n, n, max(0, min(1, randn)));
  A = A + A';
  col_counts_dense = symbfact(full(A));
  col_counts_sparse = symbfact(A);
  assert(all(col_counts_dense == col_counts_sparse));
end

shows the same issues on Linux. Sometimes the assertion fails, sometimes Octave crashes.

Marcel

Anonymous
Tue 23 Feb 2021 12:21:38 AM UTC, comment #1: 

How often does it fail on Windows?  Do you need to put the call to symbfact in a loop and execute it a few times to guarantee getting at least one failure?

Rik <rik5>
Group administrator
Tue 23 Feb 2021 12:03:10 AM UTC, original submission:  

Example:

>> symbfact([1])


Expected result:

ans = 1


Observed result: Varies on each call. Sometimes the expected result. Sometimes a wrong result. Sometimes a warning and error like

>> symbfact([1])
warning: warning -3, at line 89 in file ../Core/cholmod_sparse.c: problem too large
warning: warning -4, at line 219 in file ../Cholesky/cholmod_rowcolcounts.c: argument missing
error: symbfact: matrix corrupted

And other times Octave just crashes.

This happens for me on Octave versions 5.2.0, 6.1.0 and 6.2.0, but only on Windows. On Linux everything works as expected. Also on both Windows and Linux everything works as expected when using a sparse matrix, e.g.

symbfact(sparse([1]))


Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #50911:  60101.diff added by rik5 (2KiB - text/x-patch)
file #50910:  badA.var added by rik5 (513B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jwe (Posted a comment)
  • -email is unavailable- added by dasergatskov (Posted a comment)
  • -email is unavailable- added by rik5 (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-02-24 rik5 StatusConfirmed Fixed
        Open/ClosedOpen Closed
    2021-02-23 rik5 Attached File- Added 60101.diff, #50911
    2021-02-23 rik5 Summarysymbfact crashes for dense matrices on Windows symbfact crashes for dense matrices
    2021-02-23 rik5 Attached File- Added badA.var, #50910
        StatusNeed Info Confirmed
        Operating SystemMicrosoft Windows Any
    2021-02-23 rik5 StatusNone Need Info

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code