Incubator-mxnet: Memory corruption issue with unravel_index

[ChaiBapchya]

Description

MXNet unravel_index function seems to run into memory corruption issue with the following inputs

Command

>>> a=mx.nd.random.randn(2,20)
>>> mx.nd.unravel_index(a, shape=(-1,10))

Error Log

*** Error in `python3': double free or corruption (out): 0x00007f0cf4011d30 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7f0e76cb97e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x8037a)[0x7f0e76cc237a]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7f0e76cc653c]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZN9__gnu_cxx13new_allocatorIN5mxnet5TBlobEE10deallocateEPS2_m+0x20)[0x7f0e45141c18]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZNSt16allocator_traitsISaIN5mxnet5TBlobEEE10deallocateERS2_PS1_m+0x2b)[0x7f0e4513f982]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZNSt12_Vector_baseIN5mxnet5TBlobESaIS1_EE13_M_deallocateEPS1_m+0x32)[0x7f0e4513d4d4]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZNSt12_Vector_baseIN5mxnet5TBlobESaIS1_EED1Ev+0x52)[0x7f0e4513a68a]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZNSt6vectorIN5mxnet5TBlobESaIS1_EED1Ev+0x41)[0x7f0e451366e5]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZZN5mxnet10imperative12PushFComputeERKSt8functionIFvRKN4nnvm9NodeAttrsERKNS_9OpContextERKSt6vectorINS_5TBlobESaISA_EERKS9_INS_9OpReqTypeESaISF_EESE_EEPKNS2_2OpES5_RKNS_7ContextERKS9_IPNS_6engine3VarESaISW_EES10_RKS9_INS_8ResourceESaIS11_EERKS9_IPNS_7NDArrayESaIS17_EES1B_RKS9_IjSaIjEESJ_ENKUlNS_10RunContextEE_clES1G_+0x305)[0x7f0e451fbe4b]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZNSt17_Function_handlerIFvN5mxnet10RunContextEEZNS0_10imperative12PushFComputeERKSt8functionIFvRKN4nnvm9NodeAttrsERKNS0_9OpContextERKSt6vectorINS0_5TBlobESaISD_EERKSC_INS0_9OpReqTypeESaISI_EESH_EEPKNS5_2OpES8_RKNS0_7ContextERKSC_IPNS0_6engine3VarESaISZ_EES13_RKSC_INS0_8ResourceESaIS14_EERKSC_IPNS0_7NDArrayESaIS1A_EES1E_RKSC_IjSaIjEESM_EUlS1_E_E9_M_invokeERKSt9_Any_dataOS1_+0x3f)[0x7f0e4520206a]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZNKSt8functionIFvN5mxnet10RunContextEEEclES1_+0x42)[0x7f0e4510ab7e]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(+0x231a86f)[0x7f0e4511086f]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(+0x231bdee)[0x7f0e45111dee]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZNKSt8functionIFvN5mxnet10RunContextENS0_6engine18CallbackOnCompleteEEEclES1_S3_+0x56)[0x7f0e4510bbf0]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZN5mxnet6engine14ThreadedEngine15ExecuteOprBlockENS_10RunContextEPNS0_8OprBlockE+0x3b1)[0x7f0e45120093]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZN5mxnet6engine23ThreadedEnginePerDevice9CPUWorkerILN4dmlc19ConcurrentQueueTypeE0EEEvNS_7ContextEPNS1_17ThreadWorkerBlockIXT_EEERKSt10shared_ptrINS3_11ManualEventEE+0xc6)[0x7f0e45123f04]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZZZN5mxnet6engine23ThreadedEnginePerDevice13PushToExecuteEPNS0_8OprBlockEbENKUlvE_clEvENKUlSt10shared_ptrIN4dmlc11ManualEventEEE_clES8_+0x42)[0x7f0e45121638]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZNSt17_Function_handlerIFvSt10shared_ptrIN4dmlc11ManualEventEEEZZN5mxnet6engine23ThreadedEnginePerDevice13PushToExecuteEPNS6_8OprBlockEbENKUlvE_clEvEUlS3_E_E9_M_invokeERKSt9_Any_dataOS3_+0x5c)[0x7f0e45127b3a]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZNKSt8functionIFvSt10shared_ptrIN4dmlc11ManualEventEEEEclES3_+0x49)[0x7f0e4512f615]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZNSt12_Bind_simpleIFSt8functionIFvSt10shared_ptrIN4dmlc11ManualEventEEEES4_EE9_M_invokeIILm0EEEEvSt12_Index_tupleIIXspT_EEE+0x68)[0x7f0e4512f588]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZNSt12_Bind_simpleIFSt8functionIFvSt10shared_ptrIN4dmlc11ManualEventEEEES4_EEclEv+0x2c)[0x7f0e4512f41c]
/home/ubuntu/incubator-mxnet/python/mxnet/../../build/libmxnet.so(_ZNSt6thread5_ImplISt12_Bind_simpleIFSt8functionIFvSt10shared_ptrIN4dmlc11ManualEventEEEES6_EEE6_M_runEv+0x1c)[0x7f0e4512f36c]
/usr/lib/x86_64-linux-gnu/libstdc++.so.6(+0xb8c80)[0x7f0e69b6ac80]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7f0e770136ba]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x6d)[0x7f0e76d4941d]
======= Memory map: ========
559906a44000-559906d03000 r-xp 00000000 ca:01 9987032                    /home/ubuntu/incubator-mxnet/py3_venv/bin/python3
559906f02000-559906f05000 r--p 002be000 ca:01 9987032                    /home/ubuntu/incubator-mxnet/py3_venv/bin/python3
559906f05000-559906f68000 rw-p 002c1000 ca:01 9987032                    /home/ubuntu/incubator-mxnet/py3_venv/bin/python3
559906f68000-559906f99000 rw-p 00000000 00:00 0
5599077b3000-55990901c000 rw-p 00000000 00:00 0                          [heap]
7f0c5c000000-7f0c5c021000 rw-p 00000000 00:00 0

At the very least, error handling should be improved (even if the inputs were incorrect, graceful exit is desired)

[ChaiBapchya]

It seg-faults for other inputs

>>> a=mx.nd.random.randn(2,1024)
>>> mx.nd.unravel_index(a,shape=(1024,1024))

Segmentation fault: 11

[oleg-trott]

I can confirm it here too (mxnet 1.5.1 on Linux)

free(): invalid pointer
Aborted (core dumped)

[wkcn]

I can reproduce the bug.
I check the code of unravel_index, which only support 1D input.

[wkcn]

I have fixed the bug, and I will submit the PR.

[ChaiBapchya]

@mxnet-bot test if you comment on an issue

[mxnet-bot]

Undefined action detected.
Permissible actions are : run ci [all], run ci [job1, job2]
Example : @mxnet-bot run ci [all]
Example : @mxnet-bot run ci [centos-cpu, clang]

[ChaiBapchya]

@mxnet-bot test if it detects that this is an issue and not a PR

[mxnet-bot]

Hey @ChaiBapchya
@mxnet-bot can only be invoked on a PR.

[ChaiBapchya]

Please ignore previous comments. I just used them for testing out a bot functionality.