SubbyteReference breaks its offset invariant for negative offsets (constructor and operator+=)
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 10.5k
- Forks
- 2.1k
- Avg merge
- 3d 11h
- Merged PRs (30d)
- 7
Description
Description
SubbyteReference (both the primary template and the StorageVec partial specialization in include/cutlass/subbyte_reference.h) mishandles negative offsets: the constructor and operator+= with a negative argument use truncating division without normalizing, leaving the object in a state that violates its own invariant.
Verified by execution on a minimal host build (Storage = uint8_t, Element = int4b_t):
control -= (+3) : storage_delta=-2 off=1 get=-3 correct
case B += (-3) : storage_delta=-1 off=-1 (invariant requires off in [0, 1])
FAIL: += negative breaks offset_ invariant
case C ctor(ptr, -3): storage_delta=-1 off=-1 same broken state
Correct state for element -3 is one storage unit further back (storage_delta == -2, offset_ == 1). Instead offset_ < 0, and any subsequent get()/set() shifts by a negative bit count (undefined behavior) or reads the wrong nibble. The mirrored operator-= with a positive argument is correct - its borrow logic compensates - which is why only the negative-input paths were affected.
Reachability: TensorRef::operator-(coord) and negative add_pointer_offset feed this constructor through ReferenceFactory for sub-byte tensors. Nothing in-tree navigates sub-byte tensors backward across vector boundaries today, so this is latent public-API breakage.
Suggested fix
Normalize negative deltas exactly like the positive path does: fold the current offset_ in first, then use floor-style division/borrow so that the postcondition 0 <= offset_ < kElementsPerVector always holds.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in include/cutlass/subbyte_reference.h and inspect the primary template and StorageVec partial specialization, focusing on the constructor and operator+= paths for negative offsets. Verify the negative cases with a minimal host build like the one described; done means storage movement and offset normalization preserve 0 <= offset_ < kElementsPerVector without invalid shifts or incorrect nibble access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- backend-api-design
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 76/100