Skip to content

fix: avoid span OOB in compute_logderivative_inverse for debug builds#22313

Draft
AztecBot wants to merge 1 commit intomerge-train/barretenbergfrom
claudebox/fix-bb-debug-build-logderiv
Draft

fix: avoid span OOB in compute_logderivative_inverse for debug builds#22313
AztecBot wants to merge 1 commit intomerge-train/barretenbergfrom
claudebox/fix-bb-debug-build-logderiv

Conversation

@AztecBot
Copy link
Copy Markdown
Collaborator

@AztecBot AztecBot commented Apr 4, 2026

Summary

Fixes std::span::operator[] out-of-bounds assertion in compute_logderivative_inverse() that crashes the nightly debug build (_GLIBCXX_DEBUG).

Two issues in logderivative_library.hpp:

  1. Empty polynomial access: When a lookup has no active rows, the inverse polynomial has size() = 0. The batch_invert path unconditionally indexes coeffs()[start] even when the range is empty.
  2. Multithreaded range too large: The parallel work was partitioned over circuit_size (2^21 for AVM) but the inverse polynomial can be much smaller, causing OOB span access in worker threads.

Fix

  • Guard coeffs()[start] / batch_invert with if (start < end) to skip empty ranges
  • Use inverse_polynomial.size() instead of circuit_size to bound the parallel work range

Test plan

  • AvmVerifierTests.GoodPublicInputs — passes (was crashing)
  • AvmVerifierTests.NegativeBadPublicInputs — passes
  • AvmVerifierTests.ProofSizeMatchesComputedConstant — passes

Detailed analysis: https://gist.github.com/AztecBot/7fd0fb327d2f1c0bae2fbd53d886b0f6

ClaudeBox log: https://claudebox.work/s/49b5d18ab43b5277?run=1

ClaudeBox log: https://claudebox.work/s/49b5d18ab43b5277?run=1

@AztecBot AztecBot added ci-draft Run CI on draft PRs. claudebox Owned by claudebox. it can push to this PR. labels Apr 4, 2026
…ive computation

In compute_logderivative_inverse, the multi-threaded path splits work by
circuit_size, but the inverse polynomial may have fewer actual elements due to
virtual zero padding. The batch_invert call accessed coeffs()[start] where start
could exceed the polynomial's actual size, triggering a _GLIBCXX_DEBUG span
bounds assertion in the nightly debug build.

Fix: clamp start/end to the polynomial's actual data range before batch_invert.
Virtual zero elements need no inversion.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci-draft Run CI on draft PRs. claudebox Owned by claudebox. it can push to this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant