fix(compiler): reject incomplete EVM memory facts - #583
Open
abmcar wants to merge 1 commit into
Open
Conversation
⚡ Performance Regression Check Results✅ Performance Check Passed (interpreter)Performance Benchmark Results (threshold: 25%)
Summary: 194 benchmarks, 0 regressions ✅ Performance Check Passed (multipass)Performance Benchmark Results (threshold: 25%)
Summary: 193 benchmarks, 0 regressions |
Keep CFG topology for blocks whose entry stack is unresolved or dynamic-dispatch tainted, but prevent partial opcode facts from reaching memory-plan consumers. Make the facts builder own the fail-closed invariant and cover guaranteed-minimum, grouping, dead-store, and load-forwarding behavior.
abmcar
force-pushed
the
codex/fix-memory-plan-selector-dse
branch
from
July 29, 2026 08:15
e82e7b2 to
e670ea2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1. Does this PR affect any open issues?(Y/N) and add issue references (e.g. "fix #123", "re #123".):
2. What is the scope of this PR (e.g. component or file name):
EVM multipass frontend memory facts and memory-plan consumers.
3. Provide a description of the PR(e.g. more details, effects, motivations or doc link):
Mainnet block 21800000 exposed a multipass regression in the 0x Exchange
proxy. A selector store observed by
KECCAK256was eliminated, so multipasshashed a zero selector, loaded the wrong proxy storage slot, and reverted.
The receipt was internally gas-consistent, but the wrong execution path caused
the block-level
kWrongBlockGasfailure.The first bad commit treated an unresolved block-entry stack depth as zero
while collecting memory facts. A dynamic jump target could therefore simulate
SWAP3without its hidden live-ins and publish a false alias proof.This change:
stacks that are not derived from dynamic dispatch;
MemoryFactsBuilder::observeOpcodea no-op for an incomplete currentblock before any stack, value-id, operation, or metadata update;
at incomplete blocks; and
ownership, prechecks, grouping, dead-store elimination, and load forwarding.
Blocks with incomplete entry facts may lose memory-plan optimization
opportunities. Reliable static-entry blocks retain the existing proofs.
The gas schedule, EVMC host contract, replay witness, expected values, and
multipass mode are unchanged.
Change doc: docs/changes/2026-07-28-evm-memory-plan-selector-dse/README.md
Validation:
tools/format.sh check: passreceipt root + bloom and union post-state verified
fresh DB, DB access, header/body, receipt + bloom, per-block post, and union
post checks all true
The external EEST run passes 2710/2723 cases. Its 13 failing test names match
the same-environment clean-upstream baseline set captured during hardening;
the evmone and EEST assets are external to this repository.
tools/check_change_doc.pyis absent from the current repository, so thedocument declaration helper could not run locally.
4. Are there any breaking changes?(Y/N) and describe the breaking changes(e.g. more details, motivations or doc link):
5. Are there test cases for these changes?(Y/N) select and add more details, references or doc links:
The regression tests are in
src/tests/evm_jit_frontend_tests.cpp. Replaycommands, binary and corpus hashes, result JSON, and exported post-state are
sealed under the external evidence directory referenced by the change doc.
6. Release note