Skip to content

Segfault in MBDirectAccess::get_coords with fragmented MOAB storage #55

Description

@meltawila

MBDirectAccess::get_coords/get_mb_coords index the vertex coordinate arrays (tx_/ty_/tz_) with the element sequence index, and compute vertex offsets as handle - 1 (assuming one contiguous vertex block starting at handle 1). Both assumptions hold only for file-loaded meshes with a single vertex and single triangle sequence. On a MOAB instance modified in-memory (e.g. Cardinal's MoabSkinner regenerating DAGMC geometry on-the-fly), storage fragments and this reads out of bounds — segfault, or silently wrong coordinates fed to the BVH.

Observed during DagMC::setup_obbsRayTracingInterface::createBVH: instance had 43 element sequences but only 23 vertex coordinate arrays; crash at tx_[idx][i0] with idx = 23 (one past the end). The element-side lookup was correct — the triangle handle was verified to lie in first_elements_[23], the failure is purely the vertex-side indexing. ~694k tris / ~370k verts, skinning into 10 temperature × 252 block bins.

backtace:

openmc0:
openmc0: Time Step 1, time = 1, dt = 1
openmc0: Skinning geometry into 10 temperature bins, 1 density bins, and 252 block bins...

Thread 52 "salamander-dbg" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x1553757f5640 (LWP 4099791)]
0x0000155528f9eaab in MBDirectAccess::get_coords (this=0xc75c0490, tri=@0x1553757dd228: 2305843009214071943)
    at /ibmstor/scratch/eltamm/projects/teton/aug_salamander/salamander/cardinal/install/include/double_down/MOABDirectAccess.h:88
88          Vec3da v0(tx_[idx][i0], ty_[idx][i0], tz_[idx][i0]);
Missing separate debuginfos, use: dnf debuginfo-install bzip2-libs-1.0.8-10.el9_5.x86_64 cyrus-sasl-lib-2.1.27-21.el9.x86_64 glibc-2.34-168.el9_6.25.x86_64 hwloc-libs-2.4.1-5.el9_6.1.x86_64 json-c-0.14-11.el9.x86_64 krb5-libs-1.21.1-8.el9_6.2.x86_64 libX11-1.7.0-11.el9.x86_64 libXau-1.0.9-8.el9.x86_64 libbrotli-1.0.9-7.el9_6.1.x86_64 libcom_err-1.46.5-7.el9.x86_64 libcurl-7.76.1-31.el9_6.3.x86_64 libevent-2.1.12-8.el9_4.x86_64 libfabric-2.3.1-SHS13.1.0_20260127184330_93e17abd472e.x86_64 libidn2-2.3.0-7.el9.x86_64 libnghttp2-1.43.0-6.el9_6.1.x86_64 libnl3-3.11.0-1.el9.x86_64 libpng-1.6.37-12.el9_6.4.x86_64 libpsl-0.21.1-5.el9.x86_64 libselinux-3.6-3.el9.x86_64 libssh-0.10.4-15.el9_6.1.x86_64 libunistring-0.9.10-15.el9.x86_64 libxcb-1.13.1-9.el9.x86_64 libxcrypt-4.4.18-3.el9.x86_64 openldap-2.6.8-4.el9.x86_64 openssl-libs-3.2.2-7.el9_6.2.x86_64 xz-libs-5.2.5-8.el9_0.x86_64 zlib-1.2.11-40.el9.x86_64
(gdb) bt
#0  0x0000155528f9eaab in MBDirectAccess::get_coords (this=0xc75c0490, tri=@0x1553757dd228: 2305843009214071943)
    at /ibmstor/scratch/eltamm/projects/teton/aug_salamander/salamander/cardinal/install/include/double_down/MOABDirectAccess.h:88
#1  0x0000155528f9ed49 in double_down::DblTriBounds (mdam=0xc75c0490, tri_handle=2305843009214071943, bump_val=0.00017453326627448913)
    at /ibmstor/scratch/eltamm/projects/teton/aug_salamander/salamander/cardinal/install/include/double_down/primitives.hpp:40
#2  0x0000155528f9dbfc in double_down::DblTriBounds (args=0x1553757dd3c0) at /ibmstor/scratch/eltamm/projects/teton/aug_salamander/salamander/cardinal/contrib/double-down/src/primitives.cpp:42
#3  0x000015552b0fb2a1 in embree::avx512::UserGeometryISA::createPrimRefArray(embree::PrimRef*, embree::range<unsigned long> const&, unsigned long, unsigned int) const ()
   from /ibmstor/scratch/eltamm/projects/teton/aug_salamander/salamander/cardinal/install/lib/libembree4.so.4
#4  0x000015552a116d07 in _ZN6embree13TaskScheduler19ClosureTaskFunctionIZNS0_5spawnImZNS_12parallel_forImZNS_29parallel_for_for_prefix_sum0_IZNS_28parallel_for_for_prefix_sum0INS_5Scene9Iterator2EmNS_9PrimInfoTINS_4BBoxINS_6Vec3faEEEEEZNS_3avx18createPrimRefArrayEPS6_NS_8Geometry9GTypeMaskEbmRNS_8vector_tINS_7PrimRefENS_27aligned_monitored_allocatorISI_Lm32EEEEERNS_20BuildProgressMonitorEEUlPSF_RKNS_5rangeImEEmmE_ZNSD_18createPrimRefArrayESE_SG_bmSM_SO_EUlRKSC_SW_E_EET1_RNS_28ParallelForForPrefixSumStateISY_EERT_T0_RKSY_RKT2_RKT3_EUlmE_mSC_ZNS5_IS7_mSC_SU_SX_EESY_S11_S13_S14_S16_S19_S1C_EUlmST_mE_SX_EESY_S11_S14_RKS12_S16_S19_S1C_EUlmE_EEvS12_RKS14_EUlST_E_EEvS12_S12_S12_S1J_PNS0_16TaskGroupContextEEUlvE_E7executeEv ()
   from /ibmstor/scratch/eltamm/projects/teton/aug_salamander/salamander/cardinal/install/lib/libembree4.so.4
#5  0x000015552b4b96a0 in embree::TaskScheduler::Task::run_internal(embree::TaskScheduler::Thread&) ()
   from /ibmstor/scratch/eltamm/projects/teton/aug_salamander/salamander/cardinal/install/lib/libembree4.so.4
#6  0x000015552b4b9712 in embree::TaskScheduler::TaskQueue::execute_local_internal(embree::TaskScheduler::Thread&, embree::TaskScheduler::Task*) ()
   from /ibmstor/scratch/eltamm/projects/teton/aug_salamander/salamander/cardinal/install/lib/libembree4.so.4
#7  0x000015552b4b9fef in embree::TaskScheduler::thread_loop(unsigned long) () from /ibmstor/scratch/eltamm/projects/teton/aug_salamander/salamander/cardinal/install/lib/libembree4.so.4
#8  0x000015552b4ba1e3 in embree::TaskScheduler::ThreadPool::thread_loop(unsigned long) () from /ibmstor/scratch/eltamm/projects/teton/aug_salamander/salamander/cardinal/install/lib/libembree4.so.4
#9  0x000015552b4af6d0 in embree::threadStartup(embree::ThreadStartupData*) () from /ibmstor/scratch/eltamm/projects/teton/aug_salamander/salamander/cardinal/install/lib/libembree4.so.4
#10 0x0000155528cae33a in start_thread () from /lib64/libc.so.6
#11 0x0000155528d332c0 in clone3 () from /lib64/libc.so.6

[12:30 AM](gdb) frame 0
#0  0x0000155528f9eaab in MBDirectAccess::get_coords (this=0xc75c0490, tri=@0x1553757dd228: 2305843009214071943)
    at /ibmstor/scratch/eltamm/projects/teton/aug_salamander/salamander/cardinal/install/include/double_down/MOABDirectAccess.h:88
88          Vec3da v0(tx_[idx][i0], ty_[idx][i0], tz_[idx][i0]);
(gdb) print *this
$1 = {mbi = 0xec16a7f0, num_elements_ = 694396, num_vertices_ = 369579, element_stride_ = 3,
  first_elements_ = {<std::_Vector_base<std::pair<unsigned long, unsigned long>, std::allocator<std::pair<unsigned long, unsigned long> > >> = {
      _M_impl = {<std::allocator<std::pair<unsigned long, unsigned long> >> = {<std::__new_allocator<std::pair<unsigned long, unsigned long> >> = {<No data fields>}, <No data fields>}, <std::_Vector_base<std::pair<unsigned long, unsigned long>, std::allocator<std::pair<unsigned long, unsigned long> > >::_Vector_impl_data> = {_M_start = 0x53aed0a0, _M_finish = 0x53aed350,
          _M_end_of_storage = 0x53aed4a0}, <No data fields>}}, <No data fields>}, vconn_ = {<std::_Vector_base<unsigned long const*, std::allocator<unsigned long const*> >> = {
      _M_impl = {<std::allocator<unsigned long const*>> = {<std::__new_allocator<unsigned long const*>> = {<No data fields>}, <No data fields>}, <std::_Vector_base<unsigned long const*, std::allocator<unsigned long const*> >::_Vector_impl_data> = {_M_start = 0x54620680, _M_finish = 0x546207d8, _M_end_of_storage = 0x54620880}, <No data fields>}}, <No data fields>},
  tx_ = {<std::_Vector_base<double*, std::allocator<double*> >> = {
      _M_impl = {<std::allocator<double*>> = {<std::__new_allocator<double*>> = {<No data fields>}, <No data fields>}, <std::_Vector_base<double*, std::allocator<double*> >::_Vector_impl_data> = {
          _M_start = 0x5461e550, _M_finish = 0x5461e608, _M_end_of_storage = 0x5461e650}, <No data fields>}}, <No data fields>}, ty_ = {<std::_Vector_base<double*, std::allocator<double*> >> = {
      _M_impl = {<std::allocator<double*>> = {<std::__new_allocator<double*>> = {<No data fields>}, <No data fields>}, <std::_Vector_base<double*, std::allocator<double*> >::_Vector_impl_data> = {
          _M_start = 0x5461e440, _M_finish = 0x5461e4f8, _M_end_of_storage = 0x5461e540}, <No data fields>}}, <No data fields>}, tz_ = {<std::_Vector_base<double*, std::allocator<double*> >> = {
      _M_impl = {<std::allocator<double*>> = {<std::__new_allocator<double*>> = {<No data fields>}, <No data fields>}, <std::_Vector_base<double*, std::allocator<double*> >::_Vector_impl_data> = {
          _M_start = 0x5461b110, _M_finish = 0x5461b1c8, _M_end_of_storage = 0x5461b210}, <No data fields>}}, <No data fields>}}
(gdb) print idx
$2 = 23
(gdb) print i0
$3 = 204942
(gdb) print first_elements_._M_impl._M_start[23]
$4 = {<std::__pair_base<unsigned long, unsigned long>> = {<No data fields>}, first = 2305843009214070785, second = 16384}
(gdb) print num_elements_
$5 = 694396

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions