Skip to content

[fuzzer] jit mismatch, crasher baa8 #3269

@ericastor

Description

@ericastor

Appears to be a JIT issue, and only manifests at LLVM opt-level 3 (LLVM opt-level 2 stops the problem). The issue seems to be difficult to minimize, the minimized IR is quite large.

Repro:

bazel test -c opt  //xls/fuzzer:run_crasher_test_2025-10-31_baa8

Error message:

Error: INVALID_ARGUMENT: SampleError: Result miscompare for sample 0:
args: bits[22]:0x2a_aaaa; bits[58]:0x1ff_ffff_ffff_ffff; bits[35]:0x7_ffff_ffff
evaluated opt IR (JIT), evaluated opt IR (interpreter), evaluated unopt IR (interpreter), interpreted DSLX =
   (bits[14]:0x0, [bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0], [bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0], bits[1]:0x0, bits[9]:0x0, bits[22]:0x2_aaaa)
evaluated unopt IR (JIT) =
   (bits[14]:0x0, [bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x0, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0], [bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x0, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x1, bits[2]:0x2, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0, bits[2]:0x0], bits[1]:0x0, bits[9]:0x0, bits[22]:0x2_aaaa)
=== Source Location Trace: === 
third_party/xls/fuzzer/cpp_sample_runner.cc:119
third_party/xls/fuzzer/run_fuzz.cc:233

Cleaned minimized IR: clean.ir.txt

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions