any(A,2) on sparse A causes segfault

[Kim Hansen]

This code makes 2.9.19 crash:
  A = sprand(42,1856,0.56);
  a = any(A,2);

The problem has been observed in the Debian package octave2.9 version
1:2.9.19-1, and in cvs builds from December the 5th, 11th and 12th.
The Debian package version 1:2.9.18-1 does not have the problem.

It looks like a problem where octave writes to some memory it
shouldn't touch, in some cases octave didn't crash on these two lines,
but crashed on the next line no matter what it was. I have tried to
debug it by running it through valgrind, but I had no luck. I will add
the valgrind log below.

Regards,


octave:2> a = any(A,2);
==7495==
==7495== Invalid write of size 1
==7495==    at 0x4EB7A52: SparseMatrix::any(int) const (dSparse.cc:7695)
==7495==    by 0x44BB600: octave_base_sparse<SparseMatrix>::any(int)
const (ov-base-sparse.h:117)
==7495==    by 0x41C2A9A: Fany(octave_value_list const&, int) (ov.h:463)
==7495==    by 0x44D4961: octave_builtin::do_multi_index_op(int,
octave_value_list const&) (ov-builtin.cc:104)
==7495==    by 0x44D3F45: octave_builtin::subsref(std::string const&,
std::list<octave_value_list, std::allocator<octave_value_list> >
const&, int) (ov-builtin.cc:54)
==7495==    by 0x449E8A3: octave_value::subsref(std::string const&,
std::list<octave_value_list, std::allocator<octave_value_list> >
const&, int) (ov.cc:783)
==7495==    by 0x45EBE31: tree_index_expression::rvalue(int) (pt-idx.cc:352)
==7495==    by 0x45E822E: tree_index_expression::rvalue() (pt-idx.cc:363)
==7495==    by 0x45D3E40: tree_simple_assignment::rvalue() (pt-assign.cc:202)
==7495==    by 0x45D1BBC: tree_simple_assignment::rvalue(int) (pt-assign.cc:184)
==7495==    by 0x460EE0D: tree_statement::eval(bool, int, bool) (pt-stmt.cc:133)
==7495==    by 0x460F385: tree_statement_list::eval(bool, int) (pt-stmt.cc:190)
==7495==  Address 0x923edc2 is not stack'd, malloc'd or (recently) free'd
--7495-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11
(SIGSEGV) - exiting
--7495-- si_code=1;  Faulting address: 0xCA23ECFD;  sp: 0x62994E34

valgrind: the 'impossible' happened:
   Killed by fatal signal
==7495==    at 0x3802103C: unlinkBlock (m_mallocfree.c:206)
==7495==    by 0x38021DD4: vgPlain_arena_malloc (m_mallocfree.c:1202)
==7495==    by 0x38002AFD: vgMemCheck_new_block (mc_malloc_wrappers.c:195)
==7495==    by 0x38002F2C: vgMemCheck___builtin_new (mc_malloc_wrappers.c:237)
==7495==    by 0x38035B6F: vgPlain_scheduler (scheduler.c:1269)
==7495==    by 0x38048B18: run_a_thread_NORETURN (syswrap-linux.c:89)

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable
==7495==    at 0x4025294: operator new(unsigned) (vg_replace_malloc.c:224)
==7495==    by 0x4EB7633: SparseMatrix::any(int) const (Sparse.h:193)
==7495==    by 0x44BB600: octave_base_sparse<SparseMatrix>::any(int)
const (ov-base-sparse.h:117)
==7495==    by 0x41C2A9A: Fany(octave_value_list const&, int) (ov.h:463)
==7495==    by 0x44D4961: octave_builtin::do_multi_index_op(int,
octave_value_list const&) (ov-builtin.cc:104)
==7495==    by 0x44D3F45: octave_builtin::subsref(std::string const&,
std::list<octave_value_list, std::allocator<octave_value_list> >
const&, int) (ov-builtin.cc:54)
==7495==    by 0x449E8A3: octave_value::subsref(std::string const&,
std::list<octave_value_list, std::allocator<octave_value_list> >
const&, int) (ov.cc:783)
==7495==    by 0x45EBE31: tree_index_expression::rvalue(int) (pt-idx.cc:352)
==7495==    by 0x45E822E: tree_index_expression::rvalue() (pt-idx.cc:363)
==7495==    by 0x45D3E40: tree_simple_assignment::rvalue() (pt-assign.cc:202)
==7495==    by 0x45D1BBC: tree_simple_assignment::rvalue(int) (pt-assign.cc:184)
==7495==    by 0x460EE0D: tree_statement::eval(bool, int, bool) (pt-stmt.cc:133)
==7495==    by 0x460F385: tree_statement_list::eval(bool, int) (pt-stmt.cc:190)
==7495==    by 0x43EE65C: main_loop() (toplev.cc:225)
==7495==    by 0x4373DF6: octave_main (octave.cc:835)
==7495==    by 0x8048749: main (main.c:35)


-- 
Kim Hansen
Vadgårdsvej 3, 2.tv
2860 Søborg
Fastnet: 3956 2437  --  Mobil: 3091 2437