Boost C++ Libraries: Ticket #5050: Crash inside 'accumulators::median' for p_square_cumulative_distribution https://svn.boost.org/trac10/ticket/5050 <p> Code to reproduce is below. Also I looked at the code in median.hpp and commented on the relevant lines below. </p> <p> accumulator_set&lt;double, stats&lt;tag::p_square_cumulative_distribution, tag::median(with_p_square_cumulative_distribution)&gt;&gt; m_HistogramAccumulator( tag::p_square_cumulative_distribution::num_cells = 5 ); </p> <p> m_HistogramAccumulator( 1566 ); </p> <p> m_HistogramAccumulator( 1345 ); </p> <p> cout &lt;&lt; accumulators::median( m_HistogramAccumulator ) &lt;&lt; endl; </p> <hr /> <p> median.hpp line 151 – 158 (boost 1_45_0): </p> <p> range_type histogram = p_square_cumulative_distribution(args); </p> <p> typename range_type::iterator it = histogram.begin(); </p> <p> while (it-&gt;second &lt; 0.5) </p> <p> { </p> <blockquote> <p> ++it; </p> </blockquote> <p> } </p> <p> float_type over = numeric::average(it-&gt;second - 0.5, it-&gt;second - (it - 1)-&gt;second); </p> <p> this-&gt;median = it-&gt;first * over + (it + 1)-&gt;first * ( 1. - over ); </p> <p> 1) If the very first bin in the histogram has a density of 0.5 or more then the ‘while’ loop does not get executed at all and ‘it’ is still pointing to the ‘begin()’ when the code try to compute the local variable ‘over’. However this computation involves ‘(it – 1)’ and in this specific scenario it will try to decrement the iterator beyond ‘begin’ and access an element. This causes a crash. </p> <p> 2) Also I suspect that there is a small computation bug unrelated to the crash in the last line. It is using ‘(it+1)’ instead of ‘(it-1)’ in the last line. It seems like it should interpolate between the current element and the previous one, but it is interpolating between the current element and the next one. </p> en-us Boost C++ Libraries /htdocs/site/boost.png https://svn.boost.org/trac10/ticket/5050 Trac 1.4.3 Eric Niebler Sat, 15 Jan 2011 10:44:28 GMT owner changed https://svn.boost.org/trac10/ticket/5050#comment:1 https://svn.boost.org/trac10/ticket/5050#comment:1 <ul> <li><strong>owner</strong> changed from <span class="trac-author">Eric Niebler</span> to <span class="trac-author">Matthias Troyer</span> </li> </ul> <p> Matthias, is (1) a case where asking for the result too soon violates this accumulator's precondition, or is this a legitimate use? Also, can you check out (2)? I don't have the expertise here to say. </p> Ticket ojford@… Wed, 07 Feb 2018 10:02:59 GMT <link>https://svn.boost.org/trac10/ticket/5050#comment:2 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/5050#comment:2</guid> <description> <p> Tested with the latest develop checkout and this is no longer an issue. Code now produces "1345". Ticket can be closed. </p> </description> <category>Ticket</category> </item> <item> <dc:creator>Eric Niebler</dc:creator> <pubDate>Wed, 07 Feb 2018 18:42:43 GMT</pubDate> <title>status changed; resolution set https://svn.boost.org/trac10/ticket/5050#comment:3 https://svn.boost.org/trac10/ticket/5050#comment:3 <ul> <li><strong>status</strong> <span class="trac-field-old">new</span> → <span class="trac-field-new">closed</span> </li> <li><strong>resolution</strong> → <span class="trac-field-new">fixed</span> </li> </ul> Ticket