fix: resolve UB in batch_invert and logderivative OOB in debug builds#22312
Draft
fix: resolve UB in batch_invert and logderivative OOB in debug builds#22312
Conversation
AztecBot
added
ci-draft
AztecBot
force-pushed
the
claudebox/fix-bb-debug-build
branch
from
f47dc94 to
46d1d71
Compare
AztecBot
changed the title
AztecBot
force-pushed
the
claudebox/fix-bb-debug-build
branch
from
46d1d71 to
3da2230
Compare
AztecBot
changed the title
Two bugs causing nightly debug build SIGABRT (exit code 134): 1. batch_invert: reserve() + operator[] is UB — use resize() to properly allocate elements before indexing. 2. compute_logderivative_inverse: multithreaded path splits work by circuit_size but inverse_polynomial can be smaller, causing OOB span access. Clamp range to polynomial's actual data size.
AztecBot
force-pushed
the
claudebox/fix-bb-debug-build
branch
from
3da2230 to
e2886cd
Compare
AztecBot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes nightly barretenberg debug build which crashes with SIGABRT (exit code 134).
Two bugs causing UB that is caught by
_GLIBCXX_DEBUGbounds checking in debug builds:batch_invert:reserve()+operator[]is UB —reserveonly allocates capacity without changingsize(), so all indexed accesses are out-of-bounds. Fixed by constructing vectors with the correct size.compute_logderivative_inverse: multithreaded path partitions work bycircuit_sizebutinverse_polynomial.coeffs()can be smaller, causing OOB span access. Fixed by clamping the range to the polynomial's actual data size.Detailed analysis: https://gist.github.com/AztecBot/fd346519e4fcb034b402be854dc26980
Verification
AvmVerifierTests.GoodPublicInputs: PASS (was SIGABRT)AvmRecursiveTests.TwoLayerAvmRecursionFailsWithWrongPIs: PASS (was SIGABRT)ultra_honk_tests(263),commitment_schemes_tests(88): no regressionNote: PRs #22313 and #22314 from parallel automated sessions address the same issues and can be closed.