Skip to content

Commit e508494

Browse files
committed
Fix a crash introduced few days ago
Crash is due to uninitialized ss->futilityMoveCount that when happens to be negative, yields to an out of range access in futility_margin(). Bug is subtle because it shows itself only in SMP case. Indeed in single thread mode we only use the Stack ss[MAX_PLY_PLUS_2]; Allocated at the begin of id_loop() and due to pure (bad) luck, it happens that for all the MAX_PLY_PLUS_2 elements, ss[i].futilityMoveCount >= 0 Note that the patch does not prevent futilityMoveCount to be overwritten after, for instance singular search or null verification, but to keep things readable and because the effect is almost unmeasurable, we here prefer a slightly incorrect but simpler patch. bench: 4311634
1 parent 2ef53ee commit e508494

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

src/search.cpp

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -523,6 +523,7 @@ namespace {
523523
bestValue = -VALUE_INFINITE;
524524
ss->currentMove = threatMove = (ss+1)->excludedMove = bestMove = MOVE_NONE;
525525
ss->ply = (ss-1)->ply + 1;
526+
ss->futilityMoveCount = 0;
526527
(ss+1)->skipNullMove = false; (ss+1)->reduction = DEPTH_ZERO;
527528
(ss+2)->killers[0] = (ss+2)->killers[1] = MOVE_NONE;
528529

@@ -806,7 +807,6 @@ namespace {
806807
<< " currmovenumber " << moveCount + PVIdx << sync_endl;
807808
}
808809

809-
ss->futilityMoveCount = 0;
810810
ext = DEPTH_ZERO;
811811
captureOrPromotion = pos.is_capture_or_promotion(move);
812812
givesCheck = pos.move_gives_check(move, ci);
@@ -906,6 +906,8 @@ namespace {
906906
// far in the move list we are to be more aggressive in the child node.
907907
ss->futilityMoveCount = moveCount;
908908
}
909+
else
910+
ss->futilityMoveCount = 0;
909911

910912
// Check for legality only before to do the move
911913
if (!RootNode && !SpNode && !pos.pl_move_is_legal(move, ci.pinned))

0 commit comments

Comments
 (0)