Matrix move constructor - access object after it's moved

Submitted by Haoyue

Assigned to Nobody

Link to original bugzilla bug (#1634)
Version: 3.3 (current stable)
Operating system: Other UNIX-like

Description

Created attachment 903
The test code

Summary: In Matrix move constructor it's accessing moved object and leads to segfault.

Test Code: Attached

Added Log: In Matrix.h Matrix move constructor, before line Base::_set_noalias(other); I added one line log print Before Matrix move constructor accessing moved object, and after this line I added After Matrix move constructor accessing moved object

Command:
$g++ -g -fno-omit-frame-pointer --std=c++14 -Wall -mavx -mfma -O3 -DNDEBUG -I /usr/local/include/eigen3/ eigen_test.cc -o eigen_test

$./eigen_test

Running Environment:
g++ (Ubuntu 5.4.0-6ubuntu1~16.04.10) 5.4.0 20160609

Running Result:
push 0
Before Matrix move constructor accessing moved object
Segmentation fault

Explain:
It proved segment fault is caused by accessing moved object other, as the log only prints Before ... but failed before printing After ...

Details:
Inside Matrix move constructor ( line 273 Core/Matrix.h ), it tries to access object other by Base::_set_noalias(other); after the object other being moved in initialisation Base(std::move(other)).

My test program gives segment fault move MyStruct.

struct MyStruct {
Eigen::Matrix<double, 3, 4> m;
};

The crash sometimes happens but sometimes not, (if changed to Eigen::Matrix<double, 3, 3> it doesn't happen, and under some running env (changed the g++ parameters or changed hardware) it doesn't happen.

Conclusion:

Although the code sometimes crash sometimes not. We shouldn't access moved object in any case, this is definitely a bug needs to be fixed.

Attachment 903, "The test code":
eigen_test.cc