Crash in small matrix products when compiling with -mavx
@rmlarsen1
Submitted by Rasmus Munk LarsenAssigned to Nobody
Link to original bugzilla bug (#1622)
Version: 3.4 (development)
Platform: x86 - AVX
Description
We observe a heap overflow crash caused by
when compiling with -mavx.
Stack trace: from ASAN (Addrees sanitizer):
==6684==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000029bef at pc 0x55dd70850d92 bp 0x7ffed8739070 sp 0x7ffed8739068
READ of size 32 at 0x606000029bef thread T0
#0 0x55dd70850d91 in ploadu<__attribute__((vector_size(4 * sizeof(double)))) double> third_party/eigen3/Eigen/src/Core/arch/AVX/PacketMath.h:228:114
#1 (closed) 0x55dd70850d91 in ploadt<__attribute__((vector_size(4 * sizeof(double)))) double, 16> third_party/eigen3/Eigen/src/Core/GenericPacketMath.h:476
#2 (closed) 0x55dd70850d91 in packet<16, attribute((vector_size(4 * sizeof(double)))) double> third_party/eigen3/Eigen/src/Core/CoreEvaluators.h:231
#3 (closed) 0x55dd70850d91 in run third_party/eigen3/Eigen/src/Core/ProductEvaluators.h:715
#4 0x55dd70850d91 in packet<16, attribute((vector_size(4 * sizeof(double)))) double> third_party/eigen3/Eigen/src/Core/ProductEvaluators.h:599
#5 (closed) 0x55dd70850d91 in assignPacket<32, 16, attribute((vector_size(4 * sizeof(double)))) double> third_party/eigen3/Eigen/src/Core/AssignEvaluator.h:654
#6 (closed) 0x55dd70850d91 in assignPacketByOuterInner<32, 16, attribute((vector_size(4 * sizeof(double)))) double> third_party/eigen3/Eigen/src/Core/AssignEvaluator.h:668
#7 (closed) 0x55dd70850d91 in Eigen::internal::dense_assignment_loop<Eigen::internal::restricted_packet_dense_assignment_kernel<Eigen::internal::evaluator<Eigen::Matrix<double, 2, -1, 0, 2, -1> >, Eigen::internal::evaluator<Eigen::Product<Eigen::Matrix<double, 2, -1, 0, 2, -1>, Eigen::Inverse<Eigen::Matrix<double, -1, -1, 0, -1, -1> >, 1> >, Eigen::internal::assign_op<double, double> >, 2, 0>::run(Eigen::internal::restricted_packet_dense_assignment_kernel<Eigen::internal::evaluator<Eigen::Matrix<double, 2, -1, 0, 2, -1> >, Eigen::internal::evaluator<Eigen::Product<Eigen::Matrix<double, 2, -1, 0, 2, -1>, Eigen::Inverse<Eigen::Matrix<double, -1, -1, 0, -1, -1> >, 1> >, Eigen::internal::assign_op<double, double> >&) third_party/eigen3/Eigen/src/Core/AssignEvaluator.h:460
#8 (closed) 0x55dd708508c6 in void Eigen::internal::call_restricted_packet_assignment_no_alias<Eigen::Matrix<double, 2, -1, 0, 2, -1>, Eigen::Product<Eigen::Matrix<double, 2, -1, 0, 2, -1>, Eigen::Inverse<Eigen::Matrix<double, -1, -1, 0, -1, -1> >, 1>, Eigen::internal::assign_op<double, double> >(Eigen::Matrix<double, 2, -1, 0, 2, -1>&, Eigen::Product<Eigen::Matrix<double, 2, -1, 0, 2, -1>, Eigen::Inverse<Eigen::Matrix<double, -1, -1, 0, -1, -1> >, 1> const&, Eigen::internal::assign_op<double, double> const&) third_party/eigen3/Eigen/src/Core/AssignEvaluator.h:878:5
#9 (closed) 0x55dd7084fb92 in eval_dynamic<Eigen::Matrix<double, 2, -1, 0, 2, -1>, Eigen::Matrix<double, 2, -1, 0, 2, -1>, Eigen::internal::assign_op<double, double> > third_party/eigen3/Eigen/src/Core/ProductEvaluators.h:436:5
#10 (closed) 0x55dd7084fb92 in void Eigen::internal::generic_product_impl<Eigen::Matrix<double, 2, -1, 0, 2, -1>, Eigen::Inverse<Eigen::Matrix<double, -1, -1, 0, -1, -1> >, Eigen::DenseShape, Eigen::DenseShape, 8>::evalTo<Eigen::Matrix<double, 2, -1, 0, 2, -1> >(Eigen::Matrix<double, 2, -1, 0, 2, -1>&, Eigen::Matrix<double, 2, -1, 0, 2, -1> const&, Eigen::Inverse<Eigen::Matrix<double, -1, -1, 0, -1, -1> > const&) third_party/eigen3/Eigen/src/Core/products/GeneralMatrixMatrix.h:439
#11 (closed) 0x55dd7084f5cd in run third_party/eigen3/Eigen/src/Core/ProductEvaluators.h:148:5
#12 (closed) 0x55dd7084f5cd in call_assignment_no_alias<Eigen::Matrix<double, 2, -1, 0, 2, -1>, Eigen::Product<Eigen::Matrix<double, 2, -1, 0, 2, -1>, Eigen::Inverse<Eigen::Matrix<double, -1, -1, 0, -1, -1> >, 0>, Eigen::internal::assign_op<double, double> > third_party/eigen3/Eigen/src/Core/AssignEvaluator.h:858
#13 (closed) 0x55dd7084f5cd in _set_noalias<Eigen::Product<Eigen::Matrix<double, 2, -1, 0, 2, -1>, Eigen::Inverse<Eigen::Matrix<double, -1, -1, 0, -1, -1> >, 0> > third_party/eigen3/Eigen/src/Core/PlainObjectBase.h:732
#14 (closed) 0x55dd7084f5cd in PlainObjectBase<Eigen::Product<Eigen::Matrix<double, 2, -1, 0, 2, -1>, Eigen::Inverse<Eigen::Matrix<double, -1, -1, 0, -1, -1> >, 0> > third_party/eigen3/Eigen/src/Core/PlainObjectBase.h:537
#15 (closed) 0x55dd7084f5cd in Matrix<Eigen::Product<Eigen::Matrix<double, 2, -1, 0, 2, -1>, Eigen::Inverse<Eigen::Matrix<double, -1, -1, 0, -1, -1> >, 0> > third_party/eigen3/Eigen/src/Core/Matrix.h:379
#16 (closed) 0x55dd7084f5cd in (anonymous namespace)::ETest_crashes_Test::TestBody() experimental/users/ckershaw/eigen/test.cc:45
#17 0x7f650b9f5343 in testing::Test::Run() third_party/googletest/googletest/src/gtest.cc:2522:5
Repro code:
#include "testing/base/public/gunit.h"
#include "third_party/absl/memory/memory.h"
#include "third_party/eigen3/Eigen/Core" // IWYU pragma: export
#include "third_party/eigen3/Eigen/Geometry" // IWYU pragma: export
#include "third_party/eigen3/Eigen/StdVector" // IWYU pragma: export
namespace {
class ETest : public ::testing::Test {
protected:
void SetUp() override {
x_.resize(2, 2);
x_(0, 0) = 1.0;
x_(1, 0) = 2.0;
x_(1, 1) = 3.0;
x_(0, 1) = 4.0;
y_.resize(2, 2);
y_(0, 0) = 1.23;
y_(1, 1) = 2.34;
}
Eigen::Matrix<double, 2, -1, 0, 2, -1> x_;
Eigen::Matrix<double, -1, -1, 0, -1, -1> y_;
};
TEST_F(ETest, passes) {
const Eigen::Matrix<double, -1, -1, 0, -1, -1> K = x_ * y_.inverse();
// Added to appease unused-variable
EXPECT_EQ(K.rows(), 2);
}
TEST_F(ETest, passes2) {
const auto K = x_ * y_.inverse();
EXPECT_EQ(K.rows(), 2);
EXPECT_EQ(K.cols(), 2);
EXPECT_EQ(decltype(K)::RowsAtCompileTime, 2);
EXPECT_EQ(decltype(K)::ColsAtCompileTime, -1);
}
TEST_F(ETest, crashes) {
// This matches EMatrixD<2,-1> from:
// http://google3/third_party/car/onboard/math/ukf_template.h?l=283&rcl=221129961
const Eigen::Matrix<double, 2, -1, 0, 2, -1> K = x_ * y_.inverse();
// Added to appease unused-variable
EXPECT_EQ(K.rows(), 2);
}
TEST_F(ETest, crashes2) {
const Eigen::Matrix<double, 2, 2, 0, 2, 2> K = x_ * y_.inverse();
// Added to appease unused-variable
EXPECT_EQ(K.rows(), 2);
}
} // namespace