fuzz-testing failure in fuzz-cse

[steven-johnson]

Running fuzz-cse with this input crashes:

testcase-5204202551836672.txt.zip

[ RUN      ] LLVMFuzzer.TestOneInput
FUZZTEST_PRNG_SEED=0PqgSqbHAGUVOPYRM_p-ztFPJ8nxNMi0m5xzV87R8Cs
[.] Replaying /tmp/testcase-5204202551836672
[!] Code under test used 131136 bytes of stack. Configured limit is 131072. You can change the limit by specifying FUZZTEST_STACK_LIMIT environment variable.
[*] Test diagnostics data written to: /usr/local/google/_blaze_srj/946bb3bde313178eff52037f7d7bdc9b/execroot/google3/blaze-out/k8-opt-asan/testlogs/third_party/halide/halide/test/fuzz_cse/test.test_diagnostics/ff2d30d99ac53d44.part

=================================================================
=== Fuzzing stats

Elapsed time: 298.006923ms
Total runs: 1
Edges covered: 0
Total edges: 0
Corpus size: 0
Max stack used: 0

=================================================================
=== BUG FOUND!

third_party/googlefuzztest/llvm_fuzzer_wrapper.cc:173: Counterexample found for LLVMFuzzer.TestOneInput.
The test fails with input:
argument 0: {253, 202, 67, 187, 45, 45, 45, 45, 45, 109, 187, 90, 187, 92, 161, 204, 49, 54, 191, 183, 175, 182, 140, 1, 253, 187, 187, 0, 187, 187, 187, 187, 187, 187, 187, 29, 187, 187, 5, 187, 1, 120, 120, 95, 239, 207, 239, 239, 239, 239, 121, 95, 52, 122, 212, 6, 55, 239, 207, 239, 50, 95, 57, 184, 0, 49, 122, 95, 51, 120, 120, 248, 248, 95, 0, 239, 239, 239, 239, 239, 122, 95, 55, 235, 239, 239, 50, 95, 52, 121, 95, 49, 116, 52, 56, 53, 49, 48, 49, 70, 0, 58, 95, 51}

=================================================================
=== Reproducer test

TEST(LLVMFuzzer, TestOneInputRegression) {
  TestOneInput(
    {253, 202, 67, 187, 45, 45, 45, 45, 45, 109, 187, 90, 187, 92, 161, 204, 49, 54, 191, 183, 175, 182, 140, 1, 253, 187, 187, 0, 187, 187, 187, 187, 187, 187, 187, 29, 187, 187, 5, 187, 1, 120, 120, 95, 239, 207, 239, 239, 239, 239, 121, 95, 52, 122, 212, 6, 55, 239, 207, 239, 50, 95, 57, 184, 0, 49, 122, 95, 51, 120, 120, 248, 248, 95, 0, 239, 239, 239, 239, 239, 122, 95, 55, 235, 239, 239, 50, 95, 52, 121, 95, 49, 116, 52, 56, 53, 49, 48, 49, 70, 0, 58, 95, 51}
  );
}

=================================================================
*** SIGABRT received by PID 1009803 (TID 1009803) on cpu 38 from PID 1009803; stack trace: ***
PC: @     0x7f04bedc8347  (unknown)  gsignal
    @     0x5649451f8a97        304  base/process_state.cc:1239 FailureSignalHandler()
    @     0x5649443aa1da         80  third_party/googlefuzztest/internal/runtime.cc:205 fuzztest::internal::HandleCrash()
    @     0x7f04bef3b1c0  396541792  (unknown)
    @     0x5649443bc4e1        128  third_party/googlefuzztest/internal/coverage.cc:148 fuzztest::internal::ExecutionCoverage::UpdateMaxStack()
    @     0x5649443bd685         48  third_party/googlefuzztest/internal/coverage.cc:380 __sanitizer_cov_trace_const_cmp1
    @     0x56493b1ecc7d         48  third_party/crosstool/v18/stable/toolchain/bin/../include/c++/v1/string:1746 _ZNSt3__ussIcNS_11char_traitsIcEENS_9allocatorIcEEEEDaRKNS_12basic_stringIT_T0_T1_EESB_
    @     0x56493c0bf84c        160  third_party/crosstool/v18/stable/toolchain/bin/../include/c++/v1/__functional/operations.h:403 Halide::Internal::Scope<>::ref<>()
    @     0x56493c34c542        192  third_party/halide/halide/src/Simplify_Exprs.cpp:235 Halide::Internal::Simplify::visit()
    @     0x56493c0cc2f9        160  third_party/halide/halide/src/IRVisitor.h:184 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380a8d        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c11071e        288  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc619        160  third_party/halide/halide/src/IRVisitor.h:186 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c11071e        288  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc619        160  third_party/halide/halide/src/IRVisitor.h:186 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c380b3f        320  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc3a2        160  third_party/halide/halide/src/IRVisitor.h:204 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c4a24b1        192  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc72d        160  third_party/halide/halide/src/IRVisitor.h:208 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()
    @     0x56493c897487        256  third_party/halide/halide/src/IRVisitor.h:346 Halide::Internal::Simplify::visit()
    @     0x56493c0cc1c5        160  third_party/halide/halide/src/IRVisitor.h:218 Halide::Internal::VariadicVisitor<>::dispatch_expr<>()

[abadams]

Does not repro for me either.

[abadams]

Note

Automated triage: this issue was flagged by Claude as likely safe to close, for the reason below. The reasoning was checked against the current source, and a second pass tried and failed to refute it, but no human verified this specific text. If the reason is wrong, please reopen the issue and say so — some fraction of these are expected to be wrong.

Reason (CLOSE_FIXED): The failure was a stack-depth blowup (131136 bytes vs a 131072 limit) from deep Simplify recursion on an expression the CSE fuzzer had built far deeper than its nominal depth-5 limit, because it could reuse already-built subexpressions without regard to remaining depth. That generator bug was fixed.

Evidence: Commit c6458ff "Limit depth more strictly in CSE fuzz test (#8512)" changed test/fuzz/cse.cpp to record each expression's generation depth and only reuse one "generated under conditions at least as strict as our current depth limit". @abadams also could not reproduce it, and the byte corpus is no longer replayable since the fuzz harness was rewritten in #9050/#9053 (test/fuzz/fuzz_helpers.h, random_expr_generator.h).

Closing: the unbounded expression depth in the CSE fuzzer that caused this stack blowup was fixed in #8512 (commit c6458ff), which stops random_expr from reusing subexpressions deeper than the current depth budget. The attached corpus is also no longer replayable after the fuzz-harness rewrite in #9050.