{"record":{"id":"2442aaeff995abdd","repo":"xai-org/x-algorithm","slug":"async-emb-arena-offset-overflow","errorCode":null,"errorMessage":"async_emb arena offset overflow","messagePattern":"async_emb arena offset overflow","errorType":"exception","errorClass":"std::overflow_error","httpStatus":null,"severity":"critical","filePath":"phoenix/xrex/cuda/async_emb/src/async_emb_comm.cc","lineNumber":95,"sourceCode":"  auto* f32 = reinterpret_cast<float*>(scratch);\n  auto* i32 = reinterpret_cast<int32_t*>(scratch);\n  const SliceLayout slices{0, 8, 1};\n  launch_lookup_dispatch(i32, bf16, bf16, slices, 1, stream);\n  launch_grad_dispatch(bf16, bf16, slices, stream);\n  launch_grad_segment_sum(bf16, i32, f32, f32, slices, 0, stream);\n  launch_lookup_combine(bf16, bf16, slices, stream);\n  XAI_CUDA_CHECK(cudaStreamSynchronize(stream));\n}\n\n}\n\nArenaLayout ArenaLayout::build(const PipelineSpec& spec, int world_size) {\n  ArenaLayout layout;\n  size_t offset = 0;\n  auto take = [&offset](size_t bytes) {\n    size_t result = offset;\n    if (offset > std::numeric_limits<size_t>::max() - bytes) {\n      throw std::overflow_error(\"async_emb arena offset overflow\");\n    }\n    offset = alignUp(offset + bytes);\n    return result;\n  };\n\n  const size_t slice_bytes = checkedProduct(\n      {size_t(spec.tokens_per_rank), size_t(spec.shard_width), sizeof(__nv_bfloat16)}\n  );\n  layout.token_ids_all =\n      take(checkedProduct({size_t(world_size), size_t(spec.tokens_per_rank), sizeof(int32_t)}));\n  layout.lookup_send = take(checkedProduct({size_t(world_size), slice_bytes}));\n  layout.lookup_recv = take(checkedProduct({size_t(world_size), slice_bytes}));\n  layout.segment_ids_all =\n      take(checkedProduct({size_t(world_size), size_t(spec.tokens_per_rank), sizeof(int32_t)}));\n  layout.update_send = take(checkedProduct({size_t(world_size), slice_bytes}));\n  layout.update_recv = take(checkedProduct({size_t(world_size), slice_bytes}));\n  layout.grad_accum =\n      take(checkedProduct({size_t(spec.num_unique), size_t(spec.shard_width), sizeof(float)}));","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/xai-org/x-algorithm/blob/24c60942c5c5fdad3a6addffb4c6e6d2f228f04f/phoenix/xrex/cuda/async_emb/src/async_emb_comm.cc#L77-L113","documentation":"While laying out the communication arena, ArenaLayout::build computes running byte offsets for each pipeline slice; if adding a slice's size would overflow size_t, an overflow_error is thrown instead of silently wrapping. This is a defensive arithmetic check on offset+bytes and alignUp.","triggerScenarios":"Calling ArenaLayout::build(spec, world_size) with a PipelineSpec whose per-slice sizes (hidden dim, vocab/row counts, dtypes, world_size) multiply to a total arena approaching SIZE_MAX on 64-bit — practically only reachable via checkedProduct returning astronomically large values from garbage spec numbers.","commonSituations":"Passing an uninitialized or misparsed spec (e.g. hidden size read as a negative int then cast to size_t), or unit tests feeding absurd dimensions; not something realistic model configs hit on 64-bit builds.","solutions":["Inspect the PipelineSpec values (hidden, rows, dtype size, world_size) for garbage such as -1 cast to huge unsigned.","Add upstream bounds checks / clamps on spec fields before building the layout.","Catch std::overflow_error at config-validation time and fail fast with a readable config dump."],"exampleFix":"// before\nPipelineSpec spec{.hidden = static_cast<size_t>(hidden_int)};  // hidden_int == -1\nauto layout = ArenaLayout::build(spec, world_size);\n\n// after\nif (hidden_int <= 0 || hidden_int > kMaxHidden) throw std::invalid_argument(\"bad hidden\");\nPipelineSpec spec{.hidden = static_cast<size_t>(hidden_int)};\nauto layout = ArenaLayout::build(spec, world_size);","handlingStrategy":"validation","validationCode":"auto sane = [](long long v, long long max) { return v > 0 && v <= max; };\nif (!sane(spec.rows, 1LL<<40) || !sane(spec.hidden, 1<<20) || world_size <= 0 || world_size > 4096)\n    throw std::invalid_argument(\"pipeline spec out of sane range\");","typeGuard":null,"tryCatchPattern":"catch (const std::overflow_error& e) { /* dump spec, fail config validation */ }","preventionTips":["Validate config values at load time before constructing the context.","Clamp dimensions to realistic maxima."],"tags":["overflow","arena","layout","bounds-check","async-emb"],"backgroundTag":"integer-overflow","analyzedSha":"24c60942c5c5fdad3a6addffb4c6e6d2f228f04f","analyzedAt":"2026-08-28T11:40:14.686Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}