cmssw: [UBSAN] Undefined behavior in Reco* and TrackingTools reco packages

The UBSAN IB reports undefined behavior in reco with example relval and step they appear in:


23434.9921 step4
TrackingTools/TrajectoryParametrization/interface/PerigeeTrajectoryError.h:14:7: runtime error: load of value 253, which is not a valid value for type 'bool'

134.706 step3 
TrackingTools/TrajectoryState/interface/BasicTrajectoryState.h:66:7: runtime error: load of value 131071, which is not a valid value for type 'SurfaceSide'

136.811 step3
TrackingTools/TrajectoryState/interface/TrajectoryStateClosestToPoint.h:18:7: runtime error: load of value 164, which is not a valid value for type 'bool'

136.751 step3
RecoCaloTools/Navigation/interface/CaloRectangle.h:80:87: runtime error: reference binding to null pointer of type 'const struct CaloSubdetectorTopology'

138.1 step2
RecoEgamma/EgammaPhotonAlgos/src/EnergyUncertaintyPhotonSpecific.cc:229:99: runtime error: index -1 out of bounds for type 'float [6]'

159.3 step3
RecoHI/HiJetAlgos/plugins/HiPuRhoProducer.cc:357:11: runtime error: load of value 16, which is not a valid value for type 'bool'

134.706 step3
RecoLocalTracker/SiPixelClusterizer/plugins/PixelThresholdClusterizer.cc:225:27: runtime error: variable length array bound evaluates to non-positive value 0

11603.0 step3
RecoLocalTracker/SiPixelRecHits/interface/PixelCPEBase.h:45:10: runtime error: load of value 138369145, which is not a valid value for type 'SubDetector'

34634.21 step3
RecoMTD/TrackExtender/plugins/TrackExtenderWithMTD.cc:889:29: runtime error: downcast of address 0x2af64df85f40 which does not point to an object of type 'MTDRingForwardDoubleLayer'

11603.0 step2
RecoMuon/MuonIdentification/plugins/MuonIdProducer.cc:894:40: runtime error: member call on null pointer of type 'struct MuonShowerDigiFiller'

11650.0 step2
RecoMuon/TrackerSeedGenerator/plugins/TSGFromL2Muon.cc:106:28: runtime error: reference binding to null pointer of type 'const struct RectangularEtaPhiTrackingRegion'

11834.24 step2
RecoTracker/DeDx/plugins/HLTDeDxFilter.cc:119:92: runtime error: variable length array bound evaluates to non-positive value 0

11603.0 step3
RecoTracker/FinalTrackSelectors/plugins/TrackListMerger.cc:441:20: runtime error: variable length array bound evaluates to non-positive value 0

11723.17 step3
RecoTracker/TkSeedGenerator/plugins/DeepCoreSeedGenerator.cc:340:97: runtime error: left shift of negative value -956

check the relval logs in here for the examples: https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/ubsan_logs/relvals/

About this issue

  • Original URL
  • State: open
  • Created 3 years ago
  • Comments: 39 (37 by maintainers)

Most upvoted comments

type trk

type tracking

@smuzaffar

This is generated when trackColls.size() is zero at https://github.com/cms-sw/cmssw/blob/master/RecoTracker/FinalTrackSelectors/plugins/TrackListMerger.cc#L339 . Is someone looking in to this?

I’ll open a PR with your suggestion at https://github.com/cms-sw/cmssw/issues/35036#issuecomment-926489632