You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
While implementing PR-B0 (#202 fix, python/genvarloader/_dataset/_flat_variants.py), found that get_variants_flat has two call sites in python/genvarloader/_dataset/_haps.py:
_haps.py:676 (inside Haps.get_haps_and_shifts, reached via SeqTrack.__call__ in _reconstruct.py when with_seqs("variants") is combined with with_tracks(...)) — calls get_variants_flat(self, idx) with no regions argument, so regions is None and the new clip is unconditionally skipped there.
PR-B0 intentionally scoped the fix to the regions is not None case only (per the task brief), leaving this second call site unclipped. This means with_seqs("variants").with_tracks(...) can still return variants outside the queried region window, unlike the plain with_seqs("variants") (no tracks) path.
Suggested fix
Thread regions through the get_haps_and_shifts call at _haps.py:676 (it already has regions available in its own signature) so the same #202 keep-mask in get_variants_flat applies uniformly regardless of whether tracks are combined with variants output.
Verification note (from PR-B0 investigation)
With the currently-pinned genoray rev, pgen.var_idxs/.chunk (used by _write.py's PGEN write path) already return position-scoped results for disjoint BED regions, so the originally-described "PGEN contig-scoped leak" could not be reproduced end-to-end through gvl.write() + Dataset.open() for the unclipped-regions call site either. This follow-up may turn out to be defense-in-depth rather than an exploitable bug today — worth a quick repro attempt (e.g. with_seqs("variants").with_tracks(...) against a dataset with tracks) before investing in the fix, and closing as defensive-only if no live leak is found.
Context
While implementing PR-B0 (#202 fix,
python/genvarloader/_dataset/_flat_variants.py), found thatget_variants_flathas two call sites inpython/genvarloader/_dataset/_haps.py:_haps.py:621(Haps.__call__, the directwith_seqs("variants")dispatch) — passesregions, so the with_seqs("variants") (RaggedVariants) does not clip variants to the region window #202 region-overlap clip added in PR-B0 applies here._haps.py:676(insideHaps.get_haps_and_shifts, reached viaSeqTrack.__call__in_reconstruct.pywhenwith_seqs("variants")is combined withwith_tracks(...)) — callsget_variants_flat(self, idx)with noregionsargument, soregions is Noneand the new clip is unconditionally skipped there.PR-B0 intentionally scoped the fix to the
regions is not Nonecase only (per the task brief), leaving this second call site unclipped. This meanswith_seqs("variants").with_tracks(...)can still return variants outside the queried region window, unlike the plainwith_seqs("variants")(no tracks) path.Suggested fix
Thread
regionsthrough theget_haps_and_shiftscall at_haps.py:676(it already hasregionsavailable in its own signature) so the same #202 keep-mask inget_variants_flatapplies uniformly regardless of whether tracks are combined with variants output.Verification note (from PR-B0 investigation)
With the currently-pinned genoray rev,
pgen.var_idxs/.chunk(used by_write.py's PGEN write path) already return position-scoped results for disjoint BED regions, so the originally-described "PGEN contig-scoped leak" could not be reproduced end-to-end throughgvl.write()+Dataset.open()for the unclipped-regions call site either. This follow-up may turn out to be defense-in-depth rather than an exploitable bug today — worth a quick repro attempt (e.g.with_seqs("variants").with_tracks(...)against a dataset with tracks) before investing in the fix, and closing as defensive-only if no live leak is found.Split out from #202 during Wave B PR-B0 review.