Misoptimization, crasher 1957

[proppy]

Repro:

bazel test -c opt  //xls/fuzzer:run_crasher_test_2025-07-25_1957

Error message:

E0725 08:01:12.260726     385 sample_runner.cc:824] Exception when running sample: INVALID_ARGUMENT: SampleError: Result miscompare for sample 0:
args: bits[32]:0x0; [bits[40]:0x1_0000_0000, bits[40]:0x8_4440_1080, bits[40]:0x55_5555_5555, bits[40]:0x3f_3a33_e2b8, bits[40]:0x21_1054_3246, bits[40]:0x2, bits[40]:0x83_0200_00ff, bits[40]:0x2_8208_26c4, bits[40]:0xf8_ebb1_e710, bits[40]:0x60_0408_8102, bits[40]:0x22_0000_006a]; bits[19]:0x6_4ffc; bits[38]:0x3f_ffff_ffff
evaluated opt IR (JIT), evaluated opt IR (interpreter), simulated, simulated_ng =
   ([bits[40]:0x8_4440_1080, bits[40]:0x55_5555_5555, bits[40]:0x3f_3a33_e2b8, bits[40]:0x21_1054_3246, bits[40]:0x2, bits[40]:0x83_0200_00ff, bits[40]:0x2_8208_26c4], [bits[40]:0x55_5555_5555, bits[40]:0x3f_3a33_e2b8, bits[40]:0x21_1054_3246, bits[40]:0x2, bits[40]:0x83_0200_00ff, bits[40]:0x2_8208_26c4, bits[40]:0xf8_ebb1_e710, bits[40]:0x60_0408_8102, bits[40]:0x22_0000_006a, bits[40]:0x1_0000_0000, bits[40]:0x8_4440_1080])
evaluated unopt IR (JIT), evaluated unopt IR (interpreter), interpreted DSLX =
   ([bits[40]:0x8_4440_1080, bits[40]:0x55_5555_5555, bits[40]:0x3f_3a33_e2b8, bits[40]:0x21_1054_3246, bits[40]:0x2, bits[40]:0x83_0200_00ff, bits[40]:0x2_8208_26c4], [bits[40]:0x55_5555_5555, bits[40]:0x3f_3a33_e2b8, bits[40]:0x21_1054_3246, bits[40]:0x2, bits[40]:0x83_0200_00ff, bits[40]:0x2_8208_26c4, bits[40]:0x2_8208_26c4, bits[40]:0x2_8208_26c4, bits[40]:0x2_8208_26c4, bits[40]:0x2_8208_26c4, bits[40]:0x2_8208_26c4])
Error: INVALID_ARGUMENT: SampleError: Result miscompare for sample 0:
args: bits[32]:0x0; [bits[40]:0x1_0000_0000, bits[40]:0x8_4440_1080, bits[40]:0x55_5555_5555, bits[40]:0x3f_3a33_e2b8, bits[40]:0x21_1054_3246, bits[40]:0x2, bits[40]:0x83_0200_00ff, bits[40]:0x2_8208_26c4, bits[40]:0xf8_ebb1_e710, bits[40]:0x60_0408_8102, bits[40]:0x22_0000_006a]; bits[19]:0x6_4ffc; bits[38]:0x3f_ffff_ffff
evaluated opt IR (JIT), evaluated opt IR (interpreter), simulated, simulated_ng =
   ([bits[40]:0x8_4440_1080, bits[40]:0x55_5555_5555, bits[40]:0x3f_3a33_e2b8, bits[40]:0x21_1054_3246, bits[40]:0x2, bits[40]:0x83_0200_00ff, bits[40]:0x2_8208_26c4], [bits[40]:0x55_5555_5555, bits[40]:0x3f_3a33_e2b8, bits[40]:0x21_1054_3246, bits[40]:0x2, bits[40]:0x83_0200_00ff, bits[40]:0x2_8208_26c4, bits[40]:0xf8_ebb1_e710, bits[40]:0x60_0408_8102, bits[40]:0x22_0000_006a, bits[40]:0x1_0000_0000, bits[40]:0x8_4440_1080])
evaluated unopt IR (JIT), evaluated unopt IR (interpreter), interpreted DSLX =
   ([bits[40]:0x8_4440_1080, bits[40]:0x55_5555_5555, bits[40]:0x3f_3a33_e2b8, bits[40]:0x21_1054_3246, bits[40]:0x2, bits[40]:0x83_0200_00ff, bits[40]:0x2_8208_26c4], [bits[40]:0x55_5555_5555, bits[40]:0x3f_3a33_e2b8, bits[40]:0x21_1054_3246, bits[40]:0x2, bits[40]:0x83_0200_00ff, bits[40]:0x2_8208_26c4, bits[40]:0x2_8208_26c4, bits[40]:0x2_8208_26c4, bits[40]:0x2_8208_26c4, bits[40]:0x2_8208_26c4, bits[40]:0x2_8208_26c4])
=== Source Location Trace: ===
xls/fuzzer/cpp_sample_runner.cc:119
third_party/xls/fuzzer/run_fuzz.cc:233

[ericastor]

I think this is a mis-optimization, rather than a JIT miscompare? It seems that the interpreter & JIT agree, but after optimization, the result changes.

[ericastor]

Minimized reproduction:

package subrosa

top fn function_0(param: bits[4][2] id=1) -> bits[4][2] {
  array_concat.2: bits[4][4] = array_concat(param, param, id=2)
  literal.3: bits[1] = literal(value=0, id=3)
  array_slice.4: bits[4][1] = array_slice(array_concat.2, literal.3, width=1, id=4)
  ret array_slice.5: bits[4][2] = array_slice(array_slice.4, literal.3, width=2, id=5)
}

With input [bits[4]:0, bits[4]:1], we get the result [0, 0] before optimization, but [0, 1] after optimization.

[ericastor]

Actually, minimized a bit further, the array_simp pass is converting:

fn function_0(param: bits[4][2] id=1) -> bits[4][2] {
  literal.3: bits[1] = literal(value=0, id=3)
  array_slice.4: bits[4][1] = array_slice(param, literal.3, width=1, id=4)
  ret array_slice.5: bits[4][2] = array_slice(array_slice.4, literal.3, width=2, id=5)
}

into

fn function_0(param: bits[4][2] id=1) -> bits[4][2] {
  ret param: bits[4][2] = param(name=param, id=1)
}

which is incorrect. @psivaraj - care to take a look?

[ericastor]

... I may have gotten a bit nerd-sniped. I think I've got a fix that preserves all the existing functionality, may actually improve the performance, and I think it might enable optimization for some additional cases.

I'll upload a draft PR shortly.