Segmentation fault in dot function

[yuzl00]

Code :

using LinearAlgebra

function main()
    len = 100000
    a = rand(Float64, len)
    b = rand(Float64, len)
    for i in 1:len
        u = @view a[1:i]
        b = b .- b[1]
        v = @view b[i:-1:1]
        b[i] = dot(u, v)
    end
end

main()

When running this code, I got a segmentation fault.

signal (11): Segmentation fault
in expression starting at /home/nebula/test.jl:15
dot_compute at /home/nebula/julia/bin/../lib/julia/libopenblas64_.so (unknown line)
dot_thread_function at /home/nebula/julia/bin/../lib/julia/libopenblas64_.so (unknown line)
legacy_exec at /home/nebula/julia/bin/../lib/julia/libopenblas64_.so (unknown line)
exec_blas at /home/nebula/julia/bin/../lib/julia/libopenblas64_.so (unknown line)
blas_level1_thread_with_return_value at /home/nebula/julia/bin/../lib/julia/libopenblas64_.so (unknown line)
ddot_k_HASWELL at /home/nebula/julia/bin/../lib/julia/libopenblas64_.so (unknown line)
dot at /buildworker/worker/package_linux64/build/usr/share/julia/stdlib/v1.5/LinearAlgebra/src/blas.jl:320
dot at /buildworker/worker/package_linux64/build/usr/share/julia/stdlib/v1.5/LinearAlgebra/src/blas.jl:369
dot at /buildworker/worker/package_linux64/build/usr/share/julia/stdlib/v1.5/LinearAlgebra/src/matmul.jl:9 [inlined]
main at /home/nebula/test.jl:11
unknown function (ip: 0x7fb5c5a236bc)
_jl_invoke at /buildworker/worker/package_linux64/build/src/gf.c:2231 [inlined]
jl_apply_generic at /buildworker/worker/package_linux64/build/src/gf.c:2398
jl_apply at /buildworker/worker/package_linux64/build/src/julia.h:1690 [inlined]
do_call at /buildworker/worker/package_linux64/build/src/interpreter.c:117
eval_value at /buildworker/worker/package_linux64/build/src/interpreter.c:206
eval_stmt_value at /buildworker/worker/package_linux64/build/src/interpreter.c:157 [inlined]
eval_body at /buildworker/worker/package_linux64/build/src/interpreter.c:566
jl_interpret_toplevel_thunk at /buildworker/worker/package_linux64/build/src/interpreter.c:660
jl_toplevel_eval_flex at /buildworker/worker/package_linux64/build/src/toplevel.c:840
jl_parse_eval_all at /buildworker/worker/package_linux64/build/src/ast.c:913
jl_load_rewrite at /buildworker/worker/package_linux64/build/src/toplevel.c:914
include at ./Base.jl:380
include at ./Base.jl:368
_jl_invoke at /buildworker/worker/package_linux64/build/src/gf.c:2214 [inlined]
jl_apply_generic at /buildworker/worker/package_linux64/build/src/gf.c:2398
exec_options at ./client.jl:296
_start at ./client.jl:506
jfptr__start_60376.clone_1 at /home/nebula/julia/lib/julia/sys.so (unknown line)
_jl_invoke at /buildworker/worker/package_linux64/build/src/gf.c:2214 [inlined]
jl_apply_generic at /buildworker/worker/package_linux64/build/src/gf.c:2398
unknown function (ip: 0x401931)
unknown function (ip: 0x401533)
__libc_start_main at /lib/x86_64-linux-gnu/libc.so.6 (unknown line)
unknown function (ip: 0x4015d4)
Allocations: 805278 (Pool: 805145; Big: 133); GC: 1004
Segmentation fault

Other situations:

julia> dot(ones(10), view(ones(10), 1:10))
10.0

julia> dot(ones(10), view(ones(10), 10:-1:1))
1.0

julia> [dot(ones(10), view(ones(10), 10:-1:1)) for _ in 1:5, _ in 1:10]
5×10 Array{Float64,2}:
 1.0  1.0  1.0  1.0  1.0          1.0  1.0          1.0          1.0  1.0
 1.0  1.0  1.0  1.0  1.0          1.0  1.16189e165  1.0          1.0  1.0
 1.0  1.0  1.0  1.0  1.0          1.0  1.0          2.52324e180  1.0  1.0
 1.0  1.0  1.0  1.0  1.0          1.0  1.0          1.0          1.0  1.0
 1.0  1.0  1.0  1.0  2.52324e180  1.0  1.0          1.0          1.0  1.0

julia> view(ones(10), 10:-1:1) isa StridedArray
true

Original link: https://discourse.julialang.org/t/segmentation-fault-in-dot-function/47308

[JeffBezanson]

Thanks for filing this. I can reproduce it on linux on icelake (openblas is calling ddot_k_SKYLAKEX in my case).

[p-zubieta]

Here is the rr trace: https://s3.amazonaws.com/julialang-dumps/reports/2020-10-08T21-49-29-pabloferz.tar.zst in case no one has uploaded it yet (ddot_k_HASWELL).

[Moelf]

https://s3.amazonaws.com/julialang-dumps/reports/2020-10-09T19-16-28-Moelf.tar.zst
on an AMD Zen2 CPU (ddot_k_ZEN)

Added explanation of what I think is going on at the PR JuliaLang/julia#39751.

Here is an example with a similar miscalculation (didn't try to produce a segfault) involving matrix multiplication and views with negative step size, which is not fixed by the PR.

using LinearAlgebra, Test
M = [2. 3.; 0. 0.] 
a = [1.,2.,3.]

v = view(a,3:-1:2)
@test M * v ≈ M * Vector(v)

fails

   Evaluated: [9.0, 0.0] ≈ [12.0, 0.0]

[dkarrasch]

@dagbr Thanks for working on this. IIUC, then this issue is fixed by JuliaLang/julia#39751? If that's the case, could you please open a new issue, and let JuliaLang/julia#39751 close this one?

@dkarrasch yes, could you merge it?

[dkarrasch]

Will do when tests pass.