forward-mode jacobian aborts for mappings R^n -> R^m with m != n - #3386
Merged
Conversation
Regression tests for #3385. Both fail against develop, aborting inside jacobian() before reaching any assertion: Assertion failed: (rows == this->rows() && cols == this->cols() && "DenseBase::resize() does not actually allow to resize.") The fwd jacobian sizes J as n x n and fx as n from the input before evaluating f, so J.col(0) = fx_fvar.d() assigns an m-vector into an n-row column whenever m != n. Existing coverage in test/unit/math/mix/functor/autodiff_test.cpp only uses an R^2 -> R^2 functor, where m == n masks the mis-sizing entirely. These cover both directions: R^2 -> R^3 (more outputs than inputs, the case forward mode is actually cheaper for) and R^3 -> R^2, each checked against a hand-computed Jacobian. The tests live in fwd/ and include only stan/math/fwd.hpp, which is also the realistic reproduction path: with rev in scope the rev overload wins partial ordering and handles these functors correctly.
The fwd jacobian sized both outputs from the domain before f was ever
applied, so the range dimension m was simply assumed equal to n:
J.resize(x_fvar.size(), x.size());
fx.resize(x_fvar.size());
...
Matrix<fvar<T>, Dynamic, 1> fx_fvar = f(x_fvar);
J.col(0) = fx_fvar.d();
For m != n that assigns an m-vector into an n-row column. Move the
J.resize below the call to f and take its rows from fx_fvar.size(),
which mirrors what the rev implementation already does.
The fx.resize is dropped rather than moved: fx = fx_fvar.val() is a
full-matrix assignment that resizes on its own, which is why fx.size()
came out correct even in the aborting runs. Moving it would only have
restated that.
Failure modes before the fix, both directions, with a functor that is
not square:
assertions on (math's own build never defines NDEBUG) - abort.
-DNDEBUG, m > n - Eigen's assignment loop bounds on the destination
block, so the copy truncates: J stays n x n and holds a partial
Jacobian. Silent wrong answer, no out-of-bounds access.
-DNDEBUG, m < n - the same destination bound reads past the source
temporary. ASan reports a heap-buffer-overflow READ at jacobian.hpp:25,
8 bytes past fx_fvar.
Note that this narrows the issue's description: there is no write past
J's storage in either direction, so no heap corruption.
No signature change, so overload resolution is untouched and the eight
in-tree callers (all in rev/functor, all resolving to the rev overload,
and all square) are unaffected. Verified with ASan clean in both
directions, agreement with the rev overload on the same functor, the
higher-order T = fvar<double> instantiation, the fwd/functor suite,
mix/functor/autodiff_test, and rev/functor/algebra_solver_fp_test.
Closes #3385
WardBrian
approved these changes
Sep 3, 2026
WardBrian
left a comment
WardBrian
left a comment
Member
There was a problem hiding this comment.
Fix seems simple enough! Hilarious that the LLM thinks it's worth writing ~400 words worth of commit messages for.
Contributor
Jenkins Console Log Machine informationDistributor ID: Ubuntu Description: Ubuntu 20.04.3 LTS Release: 20.04 Codename: focal CPU: Architecture: x86_64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian Address sizes: 46 bits physical, 48 bits virtual CPU(s): 80 On-line CPU(s) list: 0-79 Thread(s) per core: 2 Core(s) per socket: 20 Socket(s): 2 NUMA node(s): 2 Vendor ID: GenuineIntel CPU family: 6 Model: 85 Model name: Intel(R) Xeon(R) Gold 6248 CPU @ 2.50GHz Stepping: 7 CPU MHz: 1000.033 CPU max MHz: 3900.0000 CPU min MHz: 1000.0000 BogoMIPS: 5000.00 Virtualization: VT-x L1d cache: 1.3 MiB L1i cache: 1.3 MiB L2 cache: 40 MiB L3 cache: 55 MiB NUMA node0 CPU(s): 0,2,4,6,8,10,12,14,16,18,20,22,24,26,28,30,32,34,36,38,40,42,44,46,48,50,52,54,56,58,60,62,64,66,68,70,72,74,76,78 NUMA node1 CPU(s): 1,3,5,7,9,11,13,15,17,19,21,23,25,27,29,31,33,35,37,39,41,43,45,47,49,51,53,55,57,59,61,63,65,67,69,71,73,75,77,79 Vulnerability Gather data sampling: Mitigation; Microcode Vulnerability Indirect target selection: Mitigation; Aligned branch/return thunks Vulnerability Itlb multihit: KVM: Mitigation: Split huge pages Vulnerability L1tf: Not affected Vulnerability Mds: Not affected Vulnerability Meltdown: Not affected Vulnerability Mmio stale data: Mitigation; Clear CPU buffers; SMT vulnerable Vulnerability Reg file data sampling: Not affected Vulnerability Retbleed: Mitigation; Enhanced IBRS Vulnerability Spec rstack overflow: Not affected Vulnerability Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization Vulnerability Spectre v2: Mitigation; Enhanced / Automatic IBRS; IBPB conditional; PBRSB-eIBRS SW sequence; BHI SW loop, KVM SW loop Vulnerability Srbds: Not affected Vulnerability Tsa: Not affected Vulnerability Tsx async abort: Mitigation; TSX disabled Vulnerability Vmscape: Mitigation; IBPB before exit to userspace Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l3 cdp_l3 intel_ppin ssbd mba ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid cqm mpx rdt_a avx512f avx512dq rdseed adx smap clflushopt clwb intel_pt avx512cd avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts hwp hwp_act_window hwp_epp hwp_pkg_req vnmi pku ospke avx512_vnni md_clear flush_l1d arch_capabilities G++: g++ (Ubuntu 9.4.0-1ubuntu1~20.04) 9.4.0 Copyright (C) 2019 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Clang: clang version 10.0.0-4ubuntu1 Target: x86_64-pc-linux-gnu Thread model: posix InstalledDir: /usr/bin |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #3385
Tests
red/green test for showing the issue and then resolving it.
Checklist
Copyright holder: Steve Bronder
The copyright holder is typically you or your assignee, such as a university or company. By submitting this pull request, the copyright holder is agreeing to the license the submitted work under the following licenses:
- Code: BSD 3-clause (https://opensource.org/licenses/BSD-3-Clause)
- Documentation: CC-BY 4.0 (https://creativecommons.org/licenses/by/4.0/)
the basic tests are passing
./runTests.py test/unit)make test-headers)make test-math-dependencies)make doxygen)make cpplint)the code is written in idiomatic C++ and changes are documented in the doxygen
the new changes are tested