xls icon indicating copy to clipboard operation
xls copied to clipboard

[fuzzer] jit mismatch, crasher baa8

Open ericastor opened this issue 1 month ago • 0 comments

Appears to be a JIT issue, and only manifests at LLVM opt-level 3 (LLVM opt-level 2 stops the problem). The issue seems to be difficult to minimize, the minimized IR is quite large.

Repro:

bazel test -c opt  //xls/fuzzer:run_crasher_test_2025-10-31_baa8

Error message:

Error: INVALID_ARGUMENT: SampleError: Result miscompare for sample 0:
args: bits[22]:0x2a_aaaa; bits[58]:0x1ff_ffff_ffff_ffff; bits[35]:0x7_ffff_ffff
evaluated opt IR (JIT), evaluated opt IR (interpreter), evaluated unopt IR (interpreter), interpreted DSLX =
   (bits[14]:0x0, [bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0], [bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0], bits[1]:0x0, bits[9]:0x0, bits[22]:0x2_aaaa)
evaluated unopt IR (JIT) =
   (bits[14]:0x0, [bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x0, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0], [bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x0, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0], bits[1]:0x0, bits[9]:0x0, bits[22]:0x2_aaaa)
=== Source Location Trace: === 
third_party/xls/fuzzer/cpp_sample_runner.cc:119
third_party/xls/fuzzer/run_fuzz.cc:233

Cleaned minimized IR: clean.ir.txt

ericastor avatar Oct 31 '25 13:10 ericastor