Segfault in jl_typemap_level_assoc_exact (?)

[tkoolen]

The following code reliably produces a segfault in jl_typemap_level_assoc_exact:

module Segfault
using StaticArrays

# typealias for typeof(view(rand(SMatrix{S1, S2, T, L}), :, 1:0)):
typealias ViewType{S1, S2, T, L} SubArray{T,2,SMatrix{S1,S2,T,L},Tuple{Colon,UnitRange{Int64}},true} # for 0.5
# typealias ViewType{S1, S2, T, L} SubArray{T,2,SMatrix{S1,S2,T,L},Tuple{Base.Slice{Base.OneTo{Int64}},UnitRange{Int64}},true} # for latest master

immutable ArrayHolder{A<:AbstractMatrix}
    a::A
end

typealias SpecificArrayHolder{T} ArrayHolder{ViewType{3, 6, T, 18}}

immutable Foo{T} end

type FooHolder{T<:Real}
    foo::Foo{T}
end

function smatrix3x6view(mat::SMatrix{3, 1}) # mat's type must not be concrete
    T = eltype(mat)
    data = fill(NaN, SMatrix{3, 6, T})
    ret = view(data, :, 1 : 0)
end

function _bar{T}(::Foo{T})
    a = zeros(SMatrix{3, 1, T})
    ArrayHolder(smatrix3x6view(a))
end

function bar{M}(fooHolder::FooHolder{M})::SpecificArrayHolder{M} # return type annotation required
    _bar(fooHolder.foo)
end

end # module

fooHolders = (Segfault.FooHolder(Segfault.Foo{Float64}()),)
for fooHolder in fooHolders
    arrayHolder = Segfault.bar(fooHolder) # call to bar must occur in for loop
    println(length(arrayHolder.a))
end

on (at least) the following platforms:

Julia Version 0.5.0
Commit 3c9d753 (2016-09-19 18:14 UTC)
Platform Info:
  System: Darwin (x86_64-apple-darwin13.4.0)
  CPU: Intel(R) Core(TM) i7-3820QM CPU @ 2.70GHz
  WORD_SIZE: 64
  BLAS: libopenblas (USE64BITINT DYNAMIC_ARCH NO_AFFINITY Sandybridge)
  LAPACK: libopenblas64_
  LIBM: libopenlibm
  LLVM: libLLVM-3.7.1 (ORCJIT, ivybridge)

Julia Version 0.6.0-dev.2069
Commit ff9a949 (2017-01-13 02:17 UTC)
Platform Info:
  OS: macOS (x86_64-apple-darwin13.4.0)
  CPU: Intel(R) Core(TM) i7-3820QM CPU @ 2.70GHz
  WORD_SIZE: 64
  BLAS: libopenblas (USE64BITINT DYNAMIC_ARCH NO_AFFINITY Sandybridge)
  LAPACK: libopenblas64_
  LIBM: libopenlibm
  LLVM: libLLVM-3.9.1 (ORCJIT, ivybridge)

Julia Version 0.5.0
Commit 3c9d753 (2016-09-19 18:14 UTC)
Platform Info:
  System: Linux (x86_64-pc-linux-gnu)
  CPU: Intel(R) Core(TM) i7-6950X CPU @ 3.00GHz
  WORD_SIZE: 64
  BLAS: libopenblas (USE64BITINT DYNAMIC_ARCH NO_AFFINITY Haswell)
  LAPACK: libopenblas64_
  LIBM: libopenlibm
  LLVM: libLLVM-3.7.1 (ORCJIT, broadwell)

On OSX, the output of julia segfault.jl (with segfault.jl containing the code above) is Segmentation fault: 11. On Linux, it is:

signal (11): Segmentation fault
while loading /home/twan/code/RigidBodyDynamics/v0.5/RigidBodyDynamics/segfault.jl, in expression starting on line 37
jl_typemap_level_assoc_exact at /home/centos/buildbot/slave/package_tarball64/build/src/typemap.c:850
jl_typemap_assoc_exact at /home/centos/buildbot/slave/package_tarball64/build/src/julia_internal.h:726 [inlined]
jl_apply_generic at /home/centos/buildbot/slave/package_tarball64/build/src/gf.c:1901
macro expansion; at /home/twan/code/RigidBodyDynamics/v0.5/RigidBodyDynamics/segfault.jl:39 [inlined]
anonymous at ./<missing> (unknown line)
unknown function (ip: 0x7f97b5c0e55f)
jl_call_method_internal at /home/centos/buildbot/slave/package_tarball64/build/src/julia_internal.h:189 [inlined]
jl_toplevel_eval_flex at /home/centos/buildbot/slave/package_tarball64/build/src/toplevel.c:569
jl_parse_eval_all at /home/centos/buildbot/slave/package_tarball64/build/src/ast.c:717
jl_load at /home/centos/buildbot/slave/package_tarball64/build/src/toplevel.c:596
jl_load_ at /home/centos/buildbot/slave/package_tarball64/build/src/toplevel.c:605
include_from_node1 at ./loading.jl:488
unknown function (ip: 0x7f99e410a57b)
jl_call_method_internal at /home/centos/buildbot/slave/package_tarball64/build/src/julia_internal.h:189 [inlined]
jl_apply_generic at /home/centos/buildbot/slave/package_tarball64/build/src/gf.c:1942
process_options at ./client.jl:262
_start at ./client.jl:318
unknown function (ip: 0x7f99e412fc68)
jl_call_method_internal at /home/centos/buildbot/slave/package_tarball64/build/src/julia_internal.h:189 [inlined]
jl_apply_generic at /home/centos/buildbot/slave/package_tarball64/build/src/gf.c:1942
unknown function (ip: 0x4018ed)
unknown function (ip: 0x4013b6)
__libc_start_main at /build/glibc-Qz8a69/glibc-2.23/csu/../csu/libc-start.c:291
unknown function (ip: 0x4013fc)
Allocations: 1539708 (Pool: 1538820; Big: 888); GC: 0
Segmentation fault (core dumped)

Running Julia in lldb on OSX also points to jl_typemap_level_assoc_exact:

<redacted>:RigidBodyDynamics twan$ lldb julia segfault.jl 
(lldb) target create "julia"
Current executable set to 'julia' (x86_64).
(lldb) settings set -- target.run-args  "segfault.jl"
(lldb) run
Process 6082 launched: '/Applications/Julia-0.5.app/Contents/Resources/julia/bin/julia' (x86_64)
libjulia.dylib was compiled with optimization - stepping may behave oddly; variables may not be available.
Process 6082 stopped
* thread #1: tid = 0x59353, 0x000000010001ced5 libjulia.dylib`jl_typemap_level_assoc_exact(cache=0x0000000108c8a290, args=<unavailable>, n=2, offs='\x01') + 69 at typemap.c:848, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
    frame #0: 0x000000010001ced5 libjulia.dylib`jl_typemap_level_assoc_exact(cache=0x0000000108c8a290, args=<unavailable>, n=2, offs='\x01') + 69 at typemap.c:848 [opt]

Perhaps related to #17288?

[tkoolen]

Simplified further:

module Segfault
using StaticArrays

# typealias for typeof(view(rand(SMatrix{S1, S2, T, L}), :, 1:0)):
typealias ViewType{S1, S2, T, L} SubArray{T,2,SMatrix{S1, S2, T, L},Tuple{Colon,UnitRange{Int64}},true} # for 0.5
# typealias ViewType{S1, S2, T, L} SubArray{T,2,SMatrix{S1,S2,T,L},Tuple{Base.Slice{Base.OneTo{Int64}},UnitRange{Int64}},true} # for latest master

immutable MatrixHolder{A<:AbstractMatrix}
    a::A
end

typealias SpecificMatrixHolder{T} MatrixHolder{ViewType{3, 6, T, 18}}

type Foo{T} end

function bar{T}(foo::Foo{T})::SpecificMatrixHolder{T} # return type annotation required
    data = zeros(SMatrix{3, 6, T})
    SpecificMatrixHolder{T}(view(data, :, 1 : 1))
end

end # module

foos = (Segfault.Foo{Float64}(),)
for foo in foos
    arrayHolder = Segfault.bar(foo) # call to bar must occur in for loop
    println(length(arrayHolder.a))
end

[vtjnash]

probably will be fixed by #18457, should retest after that is merged.

[tkoolen]

I just tried again with the latest nightly (00b1c77) and I first got a method ambiguity error:

ERROR: LoadError: MethodError: convert(::Type{StaticArrays.SMatrix{3,6,Float64,18}}, ::StaticArrays.SMatrix{3,6,Float64,18}) is ambiguous. Candidates:
  convert{SA<:StaticArrays.StaticArray}(::Type{SA}, sa::StaticArrays.StaticArray) in StaticArrays at /Users/twan/code/julia/RigidBodyDynamics/v0.6/StaticArrays/src/core.jl:69
  convert{SA<:StaticArrays.StaticArray}(::Type{SA}, a::AbstractArray) in StaticArrays at /Users/twan/code/julia/RigidBodyDynamics/v0.6/StaticArrays/src/core.jl:72
  convert{SA<:StaticArrays.StaticArray}(::Type{SA}, x1) in StaticArrays at /Users/twan/code/julia/RigidBodyDynamics/v0.6/StaticArrays/src/core.jl:66
  convert{T}(::Type{T}, x::T) in Base at essentials.jl:29
Stacktrace:
 [1] bar(::Segfault.Foo{Float64}) at /Users/twan/code/julia/RigidBodyDynamics/v0.5/RigidBodyDynamics/segfault.jl:18
 [2] macro expansion; at /Users/twan/code/julia/RigidBodyDynamics/v0.5/RigidBodyDynamics/segfault.jl:25 [inlined]
 [3] anonymous at ./<missing>:?
 [4] include_from_node1(::String) at ./loading.jl:532
 [5] include_from_node1(::String) at /Applications/Julia-0.6.app/Contents/Resources/julia/lib/julia/sys.dylib:?
 [6] include(::String) at ./sysimg.jl:14
 [7] include(::String) at /Applications/Julia-0.6.app/Contents/Resources/julia/lib/julia/sys.dylib:?
 [8] process_options(::Base.JLOptions) at ./client.jl:308
 [9] _start() at ./client.jl:374
 [10] _start() at /Applications/Julia-0.6.app/Contents/Resources/julia/lib/julia/sys.dylib:?
while loading /Users/twan/code/julia/RigidBodyDynamics/v0.5/RigidBodyDynamics/segfault.jl, in expression starting on line 24

but after adding the following method to Base.convert:

Base.convert{SA<:StaticArrays.StaticArray}(::Type{SA}, sa::SA) = sa

it worked without segfaulting. I tried running in 0.5 again after adding that method, but unfortunately it doesn't fix the segfault on 0.5.

I'm very happy that it's fixed on master though, so I'll close the issue.