SSE Kernel causes "pointer being freed was not allocated" error

[Eugene Zatepyakin]

Hello,

I was trying to do some matrix multiplication tests and faced "pointer being freed was not allocated" error

* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT

    frame #0: 0x00007fff8e52cdd6 libsystem_kernel.dylib`__pthread_kill + 10

libsystem_kernel.dylib`__pthread_kill:

->  0x7fff8e52cdd6 <+10>: jae    0x7fff8e52cde0            ; <+20>

    0x7fff8e52cdd8 <+12>: movq   %rax, %rdi

    0x7fff8e52cddb <+15>: jmp    0x7fff8e525cdf            ; cerror_nocancel

    0x7fff8e52cde0 <+20>: retq

(lldb) bt

* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT

  * frame #0: 0x00007fff8e52cdd6 libsystem_kernel.dylib`__pthread_kill + 10

    frame #1: 0x00007fff8e618787 libsystem_pthread.dylib`pthread_kill + 90

    frame #2: 0x00007fff8e492420 libsystem_c.dylib`abort + 129

    frame #3: 0x00007fff8e58203f libsystem_malloc.dylib`free + 530

    frame #4: 0x00000001000545b2 test_thinnet2`gemmlowp::DefaultKernel<(gemmlowp::KernelFamily)1, gemmlowp::BitDepthParams<gemmlowp::OperandRange<0, 255>, gemmlowp::OperandRange<0, 255> > >::~DefaultKernel(this=0x000000000003c27c) at kernel_default.h:49

it happens inside SSE4_64_Kernel12x4Depth2::Run

when i disable all pts and it uses Default Scalar kernel everything works as expected.

i'm running on macOS 10.12.3 with clang version:

Apple LLVM version 8.1.0 (clang-802.0.38)

Target: x86_64-apple-darwin16.4.0

Thread model: posix

Is it known issue? What details you might need to try to reproduce and solve it?

thank you.

[Benoit Jacob]

Hello,

Can you please share a stand-alone C++ program that reproduces the issue, and the command line used to build it?

--
You received this message because you are subscribed to the Google Groups "gemmlowp" group.
To unsubscribe from this group and stop receiving emails from it, send an email to gemmlowp+unsubscribe@googlegroups.com.
To post to this group, send email to gemm...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/gemmlowp/86bc4e20-40c3-403b-abaa-e1aee9ad9d8c%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Eugene Zatepyakin]

Hi, 

sure thing:

FLAGS = -fPIC -funwind-tables -msse -msse2 -msse4 -mavx -march=native -mpopcnt -std=c++11 -stdlib=libc++ -std=c++11 -stdlib=libc++ -O3 -DNDEBUG -fvisibility=hidden -fvisibility-inlines-hidden

Program code:

#include <tuple>

#include <iostream>

#include <string>

#include <vector>

#include <random>

#include "gemmlowp/public/gemmlowp.h"

template <bool TransposeA, bool TransposeB, bool TransposeC>

void GemmlowpMultiply(const uint8_t* a_data, const uint8_t* b_data, 

                      int32_t* c_data, int m, int n, int k,

                      int offset_a, int offset_b, int lda, int ldb, int ldc) {

  static const gemmlowp::MapOrder ResultOrder =

      !TransposeC ? gemmlowp::MapOrder::RowMajor : gemmlowp::MapOrder::ColMajor;

  static const gemmlowp::MapOrder LhsOrder =

      !TransposeA ? gemmlowp::MapOrder::RowMajor : gemmlowp::MapOrder::ColMajor;

  static const gemmlowp::MapOrder RhsOrder =

      !TransposeB ? gemmlowp::MapOrder::RowMajor : gemmlowp::MapOrder::ColMajor;

  gemmlowp::MatrixMap<const std::uint8_t, LhsOrder> lhs(a_data, m, k,

                                                        lda);

  gemmlowp::MatrixMap<const std::uint8_t, RhsOrder> rhs(b_data, k, n,

                                                        ldb);

  gemmlowp::MatrixMap<std::int32_t, ResultOrder> result(c_data, m, n,

                                                        ldc);

  const std::tuple<> empty_pipeline = {};

  gemmlowp::GemmContext context;

  gemmlowp::GemmWithOutputPipeline<std::uint8_t, std::int32_t,

                                   gemmlowp::DefaultL8R8BitDepthParams>(

      &context, lhs, rhs, &result, -offset_a, -offset_b, empty_pipeline);

}

std::mt19937& RandomEngine() {

  static std::mt19937 engine;

  return engine;

}

int Random_u8() {

  std::uniform_int_distribution<int> dist(0, 255);

  return dist(RandomEngine());

}

int main(int argc, char** argv) {

std::vector<uint8_t> A(2217546, 0);

std::vector<uint8_t> B(72, 0);

std::vector<int32_t> C(1971152, 0);

for(auto& v : A) {

v = Random_u8();

}

for(auto& v : B) {

v = Random_u8();

}

const int offset_input = 0;

const int offset_filter = 131;

// const bool transpose_a = false;

// const bool transpose_b = true;

// const bool transpose_c = false;

const int m = 246394;

const int n = 8;

const int k = 9;

const int lda = 9;

const int ldb = 9;

const int ldc = 8;

GemmlowpMultiply<false, true, false>(A.data(),

B.data(), C.data(), m, n, k,

offset_input, offset_filter, lda, ldb, ldc);

return 0;

}

[Eugene Zatepyakin]

Hi Benoit,

were you able to reproduce the crash?

[Benoit Jacob]

Hi Eugene,

I have tried reproducing in several different configurations, but can't -- your program runs fine here.

Apple LLVM version 8.0.0 (clang-800.0.42.1)

Target: x86_64-apple-darwin16.4.0

Thread model: posix

I also tried with assertions enabled, and with -fsanitize=address, no issue.

It also runs fine on Linux, including a no-optimization build in Valgrid, so I am really quite confident that there is no memory error (such as an incorrect or double free, as suggested by your error message).

I tried the current gemmlowp master branch (ef9b6cb575f7574b44235bd2bd0a4f7db1f484e3). Which changeset are you at?

If you can still reproduce, can you reproduce

 - without -DNDEBUG?

 - with -O0 instead of -O3?

 - with -O0 -g3 ?

 - the latter, running in a debugger (such as LLDB), obtaining a full backtrace there?

 - with -fsanitize=address ?

Cheers,

Benoit

To view this discussion on the web visit https://groups.google.com/d/msgid/gemmlowp/ec0fb9ba-785f-4826-88f7-502621c9883f%40googlegroups.com.

[Eugene Zatepyakin]

After you told me that you were not able to reproduce I went through my build system and noticed

that i did not report one flag: "-dead_strip" it is used during find executable output and this one

results in error i reported. when i remove dead_strip everything runs as expected.

any thoughts why compiler mess the programs code with dead_strip?

[Benoit Jacob]

I didn't know about -dead_strip. Seems like an Apple extension? Anyway, if it is what that name sounds like (stripping dead code) then presumably it is part of the contract that it has no side effects, so having it cause the program to crash sounds like a bug in the toolchain's implementation of -dead_strip.

To view this discussion on the web visit https://groups.google.com/d/msgid/gemmlowp/3b74af45-81be-4161-a33c-9d78ddeb35fa%40googlegroups.com.

[Benoit Jacob]

Note though that all compilers do automatically strip code that is statically dead, so this -dead_strip option must be doing something fancier than just that. Does it require some runtime profile data to be recorded first?

[Eugene Zatepyakin]

Hmm, nope i did not provide any additional info except using this flag
during Linking stage.
strange indeed...

Eugene

>>>>>>>> send an email to gemmlowp+u...@googlegroups.com.

>>>>>>>> To post to this group, send email to gemm...@googlegroups.com.
>>>>>>>> To view this discussion on the web visit
>>>>>>>> https://groups.google.com/d/msgid/gemmlowp/86bc4e20-40c3-403b-abaa-e1aee9ad9d8c%40googlegroups.com.
>>>>>>>> For more options, visit https://groups.google.com/d/optout.
>>>>>>>
>>>>>>>
>>>>> --
>>>>> You received this message because you are subscribed to the Google
>>>>> Groups "gemmlowp" group.
>>>>> To unsubscribe from this group and stop receiving emails from it, send

>>>>> an email to gemmlowp+u...@googlegroups.com.

>>>>> To post to this group, send email to gemm...@googlegroups.com.
>>>>> To view this discussion on the web visit
>>>>> https://groups.google.com/d/msgid/gemmlowp/ec0fb9ba-785f-4826-88f7-502621c9883f%40googlegroups.com.
>>>>>
>>>>> For more options, visit https://groups.google.com/d/optout.
>>>>
>>>>
>>> --
>>> You received this message because you are subscribed to the Google Groups
>>> "gemmlowp" group.
>>> To unsubscribe from this group and stop receiving emails from it, send an

>>> email to gemmlowp+u...@googlegroups.com.