[GH-ISSUE #6868] [Bug] Partly joined PTX pointer qualifiers erase the parameter name and layout #4205

New issue

Closed

opened 2026-10-31 00:47:42 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:47:42 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6868

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

The built source CLI preserves output, its eight-byte layout, and the following parameter's offset for .ptr .global .align 16 and .ptr.global.align 16. Changing only the spacing to .ptr .global.align 16 makes output unnamed, makes its size and offset unknown, and makes the following parameter's offset and total parameter bytes unknown. The result is explicitly partial, and the original PTX text survives.

Reproduction

Use a source checkout at the tested commit, with its locked dependencies and runtime build. $REPO denotes that checkout and $TMP a disposable directory. Node.js 24.22.1 was on PATH for the executed commands. Save this fixture as $TMP/partly-joined.ptx:

.version 8.0
.target sm_80
.address_size 64
.visible .entry k(.param .u64 .ptr .global.align 16 output, .param .u32 count) { ret; }

Executed public command:

node "$REPO/scripts/rea.mjs" inspect-gpu-code-objects "$TMP/partly-joined.ptx" --analysis kernels --detail complete --json

Two executed controls use the same command and fixture, changing the first parameter's qualifiers to .ptr .global .align 16 (spaced.ptx) or .ptr.global.align 16 (joined.ptx). Each of these three public CLI inspections ran once before this draft. An earlier focused source-parser probe also observed the partly joined failure. Every CLI invocation exited 0 with empty stderr. No GPU code was executed.

Expected behavior

All three spellings should preserve name: "output", the eight-byte .u64 parameter, the following parameter's offset of 8, and total parameter bytes of 12. The pointee alignment is unrelated to the parameter's own alignment.

NVIDIA's PTX pointer-attribute specification permits removing spaces between .ptr, the address-space qualifier, and .align. REA's PTX contract supports pointer qualifiers and preserves known parameter names when layout decoding is unsupported. At minimum, an unknown layout must not erase the explicit identifier.

Impact and scope

A valid pointer declaration loses its known parameter name and layout facts solely because of permitted qualifier spacing. The uncertainty also removes the next parameter's offset and total argument byte count. Observed scope is a two-parameter standalone PTX input through the public source CLI. Three spacing variants were inspected; producer prevalence, other pointer address spaces, embedded fatbins, and MCP transport were not tested. The result honestly reports partial coverage, and reading the retained PTX provides a practical workaround.

REA version

Source commit 8d8d85ba22463b80715a1af1fdb51acc9b5d760b; source-built CLI --version: 6.7.0. No installed REA or published package was used. This report does not establish behavior in a published release.

Runtime and platform

Node.js v24.22.1; Linux 7.2.8-9-omarchy x86_64. No CUDA assembler, GPU runtime, Hopper, or Ghidra was used. Syntax validity is grounded in NVIDIA's specification; these exact fixtures were not independently assembled.

Target and artifact context

Three self-authored ASCII PTX 8.0 files targeting sm_80, address size 64, one entry, two parameters, and a ret instruction. They differ only in whitespace between the first parameter's pointer qualifiers. They contain no private sample data.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Selected fields from the three observed CLI results:

qualifiers                 name      first size  first offset  next offset  parameter_bytes  inspection
.ptr .global .align 16      "output"  8           0             8            12               complete
.ptr.global.align 16        "output"  8           0             8            12               complete
.ptr .global.align 16       null      null        null          null         null             partial

All results retained parameter_count=2, the second parameter's name count and size 4, and the exact input PTX text. The partly joined result included the generic unsupported-parameter-layout limitation. Object inspection and report payload coverage were partial for that input and complete for both controls.

Evidence provenance: observed public source CLI results, with source-derived cause and specification-grounded syntax expectation.
Local verification: reproduced before drafting.
Reproduction completeness: complete for the reduced source CLI case; no published-package, independent-assembler, real-producer, or MCP execution is claimed.

Analysis or suspected cause

Source-derived: qualifier normalization splits a combined token only when it starts with .ptr.. It therefore normalizes .ptr.global.align, but leaves .global.align intact when .ptr is a separate token. The qualifier loop treats .global.align as unknown and leaves 16 at the name position, producing null instead of the explicit following identifier.

Related open report #6861 concerns post-type .align on a non-pointer declaration. This trigger has a recognized pointer and a joined address-space/alignment token; normalizing only tokens beginning .ptr. is the distinct failed boundary. The spaced pointer control here already succeeds; the remaining failure occurs while normalizing the joined .global.align token. NOT_ENOUGH_INFO: first affected source revision and producer prevalence were not established. Prepared with AI assistance; no project source was changed.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: Three public CLI observations establish that permitted qualifier spacing removes a known parameter name and layout facts, including the following offset, while preserving source text and explicitly partial coverage.
Workaround status: available
Workaround basis: All observed results retain the full original PTX, allowing the analyst to recover the name; the spaced and fully joined controls also demonstrate an equivalent inspection-copy spelling with complete layout facts.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6868 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Native analysis or decompilation ## Observed behavior The built source CLI preserves `output`, its eight-byte layout, and the following parameter's offset for `.ptr .global .align 16` and `.ptr.global.align 16`. Changing only the spacing to `.ptr .global.align 16` makes `output` unnamed, makes its size and offset unknown, and makes the following parameter's offset and total parameter bytes unknown. The result is explicitly partial, and the original PTX text survives. ## Reproduction Use a source checkout at the tested commit, with its locked dependencies and runtime build. `$REPO` denotes that checkout and `$TMP` a disposable directory. Node.js 24.22.1 was on `PATH` for the executed commands. Save this fixture as `$TMP/partly-joined.ptx`: ```ptx .version 8.0 .target sm_80 .address_size 64 .visible .entry k(.param .u64 .ptr .global.align 16 output, .param .u32 count) { ret; } ``` Executed public command: ```sh node "$REPO/scripts/rea.mjs" inspect-gpu-code-objects "$TMP/partly-joined.ptx" --analysis kernels --detail complete --json ``` Two executed controls use the same command and fixture, changing the first parameter's qualifiers to `.ptr .global .align 16` (`spaced.ptx`) or `.ptr.global.align 16` (`joined.ptx`). Each of these three public CLI inspections ran once before this draft. An earlier focused source-parser probe also observed the partly joined failure. Every CLI invocation exited 0 with empty stderr. No GPU code was executed. ## Expected behavior All three spellings should preserve `name: "output"`, the eight-byte `.u64` parameter, the following parameter's offset of 8, and total parameter bytes of 12. The pointee alignment is unrelated to the parameter's own alignment. NVIDIA's [PTX pointer-attribute specification](https://docs.nvidia.com/cuda/parallel-thread-execution/index.html#kernel-parameter-attribute-ptr) permits removing spaces between `.ptr`, the address-space qualifier, and `.align`. REA's [PTX contract](https://github.com/morluto/rea/blob/8d8d85ba22463b80715a1af1fdb51acc9b5d760b/docs/gpu-code-objects.md#L87-L114) supports pointer qualifiers and preserves known parameter names when layout decoding is unsupported. At minimum, an unknown layout must not erase the explicit identifier. ## Impact and scope A valid pointer declaration loses its known parameter name and layout facts solely because of permitted qualifier spacing. The uncertainty also removes the next parameter's offset and total argument byte count. Observed scope is a two-parameter standalone PTX input through the public source CLI. Three spacing variants were inspected; producer prevalence, other pointer address spaces, embedded fatbins, and MCP transport were not tested. The result honestly reports partial coverage, and reading the retained PTX provides a practical workaround. ## REA version Source commit `8d8d85ba22463b80715a1af1fdb51acc9b5d760b`; source-built CLI `--version`: `6.7.0`. No installed REA or published package was used. This report does not establish behavior in a published release. ## Runtime and platform Node.js v24.22.1; Linux 7.2.8-9-omarchy x86_64. No CUDA assembler, GPU runtime, Hopper, or Ghidra was used. Syntax validity is grounded in NVIDIA's specification; these exact fixtures were not independently assembled. ## Target and artifact context Three self-authored ASCII PTX 8.0 files targeting `sm_80`, address size 64, one entry, two parameters, and a `ret` instruction. They differ only in whitespace between the first parameter's pointer qualifiers. They contain no private sample data. ## Interface CLI ## Earliest failure stage Native analysis or reconstruction ## Relevant output or evidence Selected fields from the three observed CLI results: ```text qualifiers name first size first offset next offset parameter_bytes inspection .ptr .global .align 16 "output" 8 0 8 12 complete .ptr.global.align 16 "output" 8 0 8 12 complete .ptr .global.align 16 null null null null null partial ``` All results retained parameter_count=2, the second parameter's name `count` and size 4, and the exact input PTX text. The partly joined result included the generic unsupported-parameter-layout limitation. Object inspection and report payload coverage were partial for that input and complete for both controls. - Evidence provenance: observed public source CLI results, with source-derived cause and specification-grounded syntax expectation. - Local verification: reproduced before drafting. - Reproduction completeness: complete for the reduced source CLI case; no published-package, independent-assembler, real-producer, or MCP execution is claimed. ## Analysis or suspected cause Source-derived: [qualifier normalization](https://github.com/morluto/rea/blob/8d8d85ba22463b80715a1af1fdb51acc9b5d760b/src/gpu/PtxKernels.ts#L145-L158) splits a combined token only when it starts with `.ptr.`. It therefore normalizes `.ptr.global.align`, but leaves `.global.align` intact when `.ptr` is a separate token. The [qualifier loop](https://github.com/morluto/rea/blob/8d8d85ba22463b80715a1af1fdb51acc9b5d760b/src/gpu/PtxKernels.ts#L170-L194) treats `.global.align` as unknown and leaves `16` at the name position, producing null instead of the explicit following identifier. Related open report [#6861](https://github.com/morluto/rea/issues/6861) concerns post-type `.align` on a non-pointer declaration. This trigger has a recognized pointer and a joined address-space/alignment token; normalizing only tokens beginning `.ptr.` is the distinct failed boundary. The spaced pointer control here already succeeds; the remaining failure occurs while normalizing the joined `.global.align` token. NOT_ENOUGH_INFO: first affected source revision and producer prevalence were not established. Prepared with AI assistance; no project source was changed. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: Three public CLI observations establish that permitted qualifier spacing removes a known parameter name and layout facts, including the following offset, while preserving source text and explicitly partial coverage. - Workaround status: available - Workaround basis: All observed results retain the full original PTX, allowing the analyst to recover the name; the spaced and fully joined controls also demonstrate an equivalent inspection-copy spelling with complete layout facts.

bsakaguchi closed this issue

2026-10-31 00:47:42 +00:00

bsakaguchi referenced this issue

2026-10-31 01:12:16 +00:00

[PR #4279] [CLOSED] fix(browser): require exact WebMCP receiver segments #6154

bsakaguchi referenced this issue

2026-10-31 01:13:03 +00:00

[PR #4453] [CLOSED] fix(analysis): require an exact modelContext receiver segment for WebMCP declarations #6251