VoxelForge/Standalone/Research/WorldAssemblerM3/Linux61/REPORT.md

L61 sanitizer sweep

Builds and coverage

• Clang 19: address,undefined,float-cast-overflow; GCC: address,undefined. Both used -fno-sanitize-recover=undefined, -ffp-contract=off, and two build jobs.
• Clang's integer group was tried with unsigned overflow excluded. libstdc++ std::rotl emitted a non-actionable shift diagnostic, so the group is omitted from the standing stage.
• ASan runs used taskset -c 0-11 prlimit --rss=6442450944 to allow its shadow address space to map. Linux RSS limits are advisory; the measured descendant-tree peak from the complete comparable sweep was 1.798 GiB. The corrected final rerun used the same limit mode.
• Each compiler ran 19 cases at LOD0–8: natural SW, FI, all three profiles, caves, motifs, lattice, both passage styles, and the live surface crossing. General generators used two camera views; the suite also covers seeded random cameras. Total: 38 runs, 46 passing checks, no ASan/UBSan reports. No edit fixture was present.

Findings

The generator runs found no runtime sanitizer issue. The boundary findings below came from the requested static scan; they were fixed at the source.

File:line	Kind and trigger	Fix
VoxelClipmapDesiredTiles.h:35,49,57-68,129-171 (plugin and standalone)	Signed negation in floor/ceil division failed for INT_MIN; center/radius, ring, and tile-bound arithmetic could overflow at coordinate limits.	Quotient/remainder division, 64-bit intermediates and clamped bounds, bounded unsigned LOD shifts, and wide tile loops.
VoxelWorld.cpp:85-93,6254-6267,7679-7693,10100-10104,10388-10394,11473-11497,12141-12147,12886-12888 (plugin only)	Signed LOD shifts, biased division, origin/band calculations, and coordinate differences were unsafe for invalid levels or edge coordinates.	Central bounded unsigned scale/extent helpers; 64-bit arithmetic and clamping; reject initial clipmaps outside the supported voxel range.
VoxelContentManager.cpp:562-584,1109-1125,1476-1484,1533-1542 (plugin only)	-INT_MIN, player-cell ± radius, region-size products, and authored count spans could overflow.	Remainder-adjusted floor division, widened coordinates/count spans, capped reserve, and clamped count conversion.
VoxelDensityVolume.cpp:156-162,185-186,638-639 (plugin only)	Floor division negated INT_MIN; signed LOD shifts depended on valid levels.	Remainder-adjusted division and bounded unsigned shifts.
VoxelTypes.h:335-363 (plugin and standalone)	Signed shifts and coordinate-times-extent could overflow; CenterCm repeated the signed LOD shift.	Clamp LOD to 0–8, use unsigned shifts and 64-bit coordinate multiplication with clamping; derive CenterCm from the safe extent helper.

Unreal-only static scan

Scanned all 30 Source/VoxelForge/Private/*.cpp files. Standalone compiles 15; the other 15 were reviewed statically and are not compiled here: VoxelAtmosphereManager.cpp, VoxelContentManager.cpp, VoxelDensityVolume.cpp, VoxelForgeCoreAdapter.cpp, VoxelForgeModule.cpp, VoxelRedefinedDensityField.cpp, VoxelSeasonAsset.cpp, VoxelSeasonManifest.cpp, VoxelStackSampler.cpp, VoxelStartupTrace.cpp, VoxelStats.cpp, VoxelStrateDefinition.cpp, VoxelStratePreview.cpp, VoxelStrateRecipe.cpp, and VoxelWorld.cpp.

No signed-bias formulas or unbounded LOD shifts remain in that scan. Remaining private-source shifts are bounded (for example, VoxelGenerator.cpp:900 clamps LOD to 0–5; marching-cubes shifts are fixed bit masks). The Unreal files could not be compiled here.

Control, version, and hashes

The test-only Saved/Linux/l61/sanitizer/signed-overflow-control.cpp evaluates INT_MAX + 1. Both compilers report signed integer overflow, and the stage requires that diagnostic; logs are signed-overflow-control-clang.log and signed-overflow-control-gcc.log.

Version remains 211. Supported-input output is unchanged; only invalid or out-of-range arithmetic is bounded.

• Source stamp: c22b877c586423fbe67cdffb8ab762e3fe6e20e91897685447113fcb23944035
• Clang headless: 400b4a66a4d3f76f584f57aefed882bcfc736db563815145518583ac007bd57c
• GCC headless: 8f782ca4c73b6fc0a942fa06db4149426e58beaacd2bb9185974be4167a614b6
• Clang sanitizer: 2a1618d25904b1c3620cfcd0e37d59133fccd349df347442396bd0be42f7b21c
• GCC sanitizer: 6c70cc1c5c843b24de7f82e19a44947cdcd1d8bd4ba01a448027a230ebe5d3e7

Standing tier and results

Added a dedicated verify.py sanitize tier with a 1,200-second budget and the option to include it in full via verify.py full --sanitize.

Tier	Timeout	Result
Sanitize	1,200 s	PASS, 787.3 s
Fast	900 s	PASS, 251.4 s
Medium	2,400 s	PASS, 1,554.2 s
Full + five-run speed matrix	3,600 s	PASS, 1,709.3 s

The full tier checked Clang/GCC and W1/W8/W12 determinism, random cameras, the 30-cell set, baseline/candidate cost pairs, and five interleaved timings for all eight generator views. Expected black-image negative-control exits were handled by passing control checks.

Trials and failed attempts

Used all 15 verification attempts: seven discarded sanitizer attempts, the initial sanitizer pass, fast/medium/full, then the corrected sanitizer pass and final fast/medium/full. Discarded attempts were two missing-/usr/bin/time wrapper failures, the noisy integer-sanitizer diagnostic, a source-stamp change during a run, two stale-binary refusals, and a LeakSanitizer ptrace failure. A separate Clang release build briefly failed on a duplicate ExtentVoxels() declaration; it was corrected and rebuilt. Final tiers have no unexpected failed runs.

Orchestrator review (Claude)

Accepted. The stamp matches the final Clang and GCC builds (c22b877c…); the sanitize, fast, medium and full tiers all pass. The runtime sweep is clean (38 runs, 0 reports), and the planted signed-overflow control is caught by both compilers. The Unreal-only edits (VoxelWorld.cpp, VoxelContentManager.cpp, VoxelDensityVolume.cpp) can't be compiled here. I reviewed the VoxelWorld.cpp diff: the helpers are static FORCEINLINE, they use UE types (int32, int64, FMath::Clamp, MIN_int32/MAX_int32), and their LOD clamp of 0–8 matches UVoxelSettings::MaxClipLevel (ClampMax = "8") and CoreMaxClipLevel = 8, so they don't change supported behaviour. These go into the owner's Windows build list.