FAILURE MAP
← Case archive

FA-90226 / Bytecode virtual machines / Open access

Peephole optimizer: division folded with floor semantics · case 01

Folded code computes -9 / 2 as -5 while the interpreter computes -4.

Verified by executionVariant 1 · 9 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The folder uses the host floor division instead of the VM's truncating division.

VERIFIED REPAIR

Fold division by truncating toward zero, like the runtime.

Unsuccessful approach: Negating based on the dividend alone gets positive-by-negative quotients wrong.

Case contract

Rewrite stack bytecode until a pass makes no change (at most 50 passes). Rules, applied left to right in one scan per pass: push a, push b, add/sub/mul/div folds to push (a op b) when the result fits in int16 (div truncates toward zero and is never folded by zero); not, not is removed; jmp L immediately followed by label L is removed; after ret or jmp, instructions up to the next label are deleted. Return the optimized instruction list.

Why this case matters

Bytecode compilers rely on peephole passes that must preserve semantics and encoding limits.

1 / The failure

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(code):
    code = [list(i) for i in code]
    for _ in range(50):
        changed = False
        out = []
        i = 0
        while i < len(code):
            ins = code[i]
            if (i + 2 < len(code) and ins[0] == 'push' and code[i + 1][0] == 'push'
                    and code[i + 2][0] in ('add', 'sub', 'mul', 'div')):
                a, b, op = ins[1], code[i + 1][1], code[i + 2][0]
                if not (op == 'div' and b == 0):
                    if op == 'add':
                        v = a + b
                    elif op == 'sub':
                        v = a - b
                    elif op == 'mul':
                        v = a * b
                    else:
                        v = a // b
                    if -32768 <= v <= 32767:
                        out.append(['push', v])
                        i += 3
                        changed = True
                        continue
            if ins[0] == 'not' and i + 1 < len(code) and code[i + 1][0] == 'not':
                i += 2
                changed = True
                continue
            if ins[0] == 'jmp' and i + 1 < len(code) and code[i + 1] == ['label', ins[1]]:
                i += 1
                changed = True
                continue
            out.append(ins)
            i += 1
            if ins[0] in ('ret', 'jmp'):
                j = i
                while j < len(code) and code[j][0] != 'label':
                    j += 1
                if j > i:
                    changed = True
                i = j
        code = out
        if not changed:
            break
    return code
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
cases = [[('regression: folding cascades across passes',
   ([['push', 2], ['push', 4], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 19], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 1], ['ret']],),
   [['push', -32768], ['push', 1], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 201], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 201], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 1], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 1], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 1], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 1], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 1], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 10], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 10], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -9],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -4], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 1], ['not'], ['not'], ['ret']],), [['push', 1], ['ret']])],
 [('regression: folding cascades across passes',
   ([['push', 2], ['push', 5], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 23], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 2], ['ret']],),
   [['push', -32768], ['push', 2], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 202], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 202], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 2], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 2], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 2], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 2], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 2], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 11], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 11], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -11],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -5], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 2], ['not'], ['not'], ['ret']],), [['push', 2], ['ret']])],
 [('regression: folding cascades across passes',
   ([['push', 2], ['push', 6], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 27], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 3], ['ret']],),
   [['push', -32768], ['push', 3], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 203], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 203], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 3], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 3], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 3], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 3], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 3], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 12], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 12], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -13],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -6], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 3], ['not'], ['not'], ['ret']],), [['push', 3], ['ret']])],
 [('regression: folding cascades across passes',
   ([['push', 2], ['push', 7], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 31], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 4], ['ret']],),
   [['push', -32768], ['push', 4], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 204], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 204], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 4], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 4], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 4], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 4], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 4], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 13], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 13], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -15],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -7], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 4], ['not'], ['not'], ['ret']],), [['push', 4], ['ret']])],
 [('regression: folding cascades across passes',
   ([['push', 2], ['push', 8], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 35], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 5], ['ret']],),
   [['push', -32768], ['push', 5], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 205], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 205], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 5], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 5], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 5], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 5], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 5], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 14], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 14], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -17],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -8], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 5], ['not'], ['not'], ['ret']],), [['push', 5], ['ret']])]]
for label, args, expected in cases[N - 1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
regression: folding cascades across passes[['push', 19], ['ret']][['push', 19], ['ret']]Passed
fold reaching the int16 minimum[['push', -32768], ['push', 1], ['ret']][['push', -32768], ['push', 1], ['ret']]Passed
fold reaching the int16 maximum[['push', 32767], ['push', 200], ['push', 201], ['mul'], ['ret']][['push', 32767], ['push', 200], ['push', 201], ['mul'], ['ret']]Passed
jump over code to a later label is kept[['jmp', 'L2'], ['label', 'L1'], ['push', 1], ['label', 'L2'], ['ret']][['jmp', 'L2'], ['label', 'L1'], ['push', 1], ['label', 'L2'], ['ret']]Passed
jump to the second of two adjacent labels[['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 1], ['ret']][['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 1], ['ret']]Passed
dead code after an unconditional jump[['label', 'E'], ['ret']][['label', 'E'], ['ret']]Passed
conditional jump keeps its fallthrough[['push', 0], ['jz', 'E'], ['push', 10], ['ret'], ['label', 'E'], ['push', 1], ['ret']][['push', 0], ['jz', 'E'], ['push', 10], ['ret'], ['label', 'E'], ['push', 1], ['ret']]Passed
division folds truncate toward zero[['push', -5], ['push', -4], ['push', 5], ['push', 0], ['div'], ['ret']][['push', -4], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]Failed
control: double negation removed[['push', 1], ['ret']][['push', 1], ['ret']]Passed

SHA-256 / 4afc091ec8fda03929d0eeba6d90756b83b18ec300bbe638f2b2c774584c7c0c

2 / The unsuccessful fix

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(code):
    code = [list(i) for i in code]
    for _ in range(50):
        changed = False
        out = []
        i = 0
        while i < len(code):
            ins = code[i]
            if (i + 2 < len(code) and ins[0] == 'push' and code[i + 1][0] == 'push'
                    and code[i + 2][0] in ('add', 'sub', 'mul', 'div')):
                a, b, op = ins[1], code[i + 1][1], code[i + 2][0]
                if not (op == 'div' and b == 0):
                    if op == 'add':
                        v = a + b
                    elif op == 'sub':
                        v = a - b
                    elif op == 'mul':
                        v = a * b
                    else:
                        v = -(abs(a) // abs(b)) if a < 0 else abs(a) // abs(b)
                    if -32768 <= v <= 32767:
                        out.append(['push', v])
                        i += 3
                        changed = True
                        continue
            if ins[0] == 'not' and i + 1 < len(code) and code[i + 1][0] == 'not':
                i += 2
                changed = True
                continue
            if ins[0] == 'jmp' and i + 1 < len(code) and code[i + 1] == ['label', ins[1]]:
                i += 1
                changed = True
                continue
            out.append(ins)
            i += 1
            if ins[0] in ('ret', 'jmp'):
                j = i
                while j < len(code) and code[j][0] != 'label':
                    j += 1
                if j > i:
                    changed = True
                i = j
        code = out
        if not changed:
            break
    return code
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
cases = [[('regression: folding cascades across passes',
   ([['push', 2], ['push', 4], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 19], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 1], ['ret']],),
   [['push', -32768], ['push', 1], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 201], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 201], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 1], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 1], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 1], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 1], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 1], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 10], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 10], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -9],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -4], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 1], ['not'], ['not'], ['ret']],), [['push', 1], ['ret']])],
 [('regression: folding cascades across passes',
   ([['push', 2], ['push', 5], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 23], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 2], ['ret']],),
   [['push', -32768], ['push', 2], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 202], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 202], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 2], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 2], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 2], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 2], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 2], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 11], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 11], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -11],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -5], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 2], ['not'], ['not'], ['ret']],), [['push', 2], ['ret']])],
 [('regression: folding cascades across passes',
   ([['push', 2], ['push', 6], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 27], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 3], ['ret']],),
   [['push', -32768], ['push', 3], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 203], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 203], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 3], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 3], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 3], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 3], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 3], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 12], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 12], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -13],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -6], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 3], ['not'], ['not'], ['ret']],), [['push', 3], ['ret']])],
 [('regression: folding cascades across passes',
   ([['push', 2], ['push', 7], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 31], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 4], ['ret']],),
   [['push', -32768], ['push', 4], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 204], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 204], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 4], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 4], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 4], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 4], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 4], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 13], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 13], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -15],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -7], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 4], ['not'], ['not'], ['ret']],), [['push', 4], ['ret']])],
 [('regression: folding cascades across passes',
   ([['push', 2], ['push', 8], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 35], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 5], ['ret']],),
   [['push', -32768], ['push', 5], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 205], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 205], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 5], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 5], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 5], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 5], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 5], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 14], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 14], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -17],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -8], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 5], ['not'], ['not'], ['ret']],), [['push', 5], ['ret']])]]
for label, args, expected in cases[N - 1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
regression: folding cascades across passes[['push', 19], ['ret']][['push', 19], ['ret']]Passed
fold reaching the int16 minimum[['push', -32768], ['push', 1], ['ret']][['push', -32768], ['push', 1], ['ret']]Passed
fold reaching the int16 maximum[['push', 32767], ['push', 200], ['push', 201], ['mul'], ['ret']][['push', 32767], ['push', 200], ['push', 201], ['mul'], ['ret']]Passed
jump over code to a later label is kept[['jmp', 'L2'], ['label', 'L1'], ['push', 1], ['label', 'L2'], ['ret']][['jmp', 'L2'], ['label', 'L1'], ['push', 1], ['label', 'L2'], ['ret']]Passed
jump to the second of two adjacent labels[['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 1], ['ret']][['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 1], ['ret']]Passed
dead code after an unconditional jump[['label', 'E'], ['ret']][['label', 'E'], ['ret']]Passed
conditional jump keeps its fallthrough[['push', 0], ['jz', 'E'], ['push', 10], ['ret'], ['label', 'E'], ['push', 1], ['ret']][['push', 0], ['jz', 'E'], ['push', 10], ['ret'], ['label', 'E'], ['push', 1], ['ret']]Passed
division folds truncate toward zero[['push', -4], ['push', 3], ['push', 5], ['push', 0], ['div'], ['ret']][['push', -4], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]Failed
control: double negation removed[['push', 1], ['ret']][['push', 1], ['ret']]Passed

SHA-256 / 4597be4fc6540329b5faa2e98ef5f3e6c30321dfa6f601bfd817160a5fb4c1cf

3 / The verified repair

Exit 0
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(code):
    code = [list(i) for i in code]
    for _ in range(50):
        changed = False
        out = []
        i = 0
        while i < len(code):
            ins = code[i]
            if (i + 2 < len(code) and ins[0] == 'push' and code[i + 1][0] == 'push'
                    and code[i + 2][0] in ('add', 'sub', 'mul', 'div')):
                a, b, op = ins[1], code[i + 1][1], code[i + 2][0]
                if not (op == 'div' and b == 0):
                    if op == 'add':
                        v = a + b
                    elif op == 'sub':
                        v = a - b
                    elif op == 'mul':
                        v = a * b
                    else:
                        v = abs(a) // abs(b) * (1 if (a < 0) == (b < 0) else -1)
                    if -32768 <= v <= 32767:
                        out.append(['push', v])
                        i += 3
                        changed = True
                        continue
            if ins[0] == 'not' and i + 1 < len(code) and code[i + 1][0] == 'not':
                i += 2
                changed = True
                continue
            if ins[0] == 'jmp' and i + 1 < len(code) and code[i + 1] == ['label', ins[1]]:
                i += 1
                changed = True
                continue
            out.append(ins)
            i += 1
            if ins[0] in ('ret', 'jmp'):
                j = i
                while j < len(code) and code[j][0] != 'label':
                    j += 1
                if j > i:
                    changed = True
                i = j
        code = out
        if not changed:
            break
    return code
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
cases = [[('regression: folding cascades across passes',
   ([['push', 2], ['push', 4], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 19], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 1], ['ret']],),
   [['push', -32768], ['push', 1], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 201], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 201], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 1], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 1], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 1], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 1], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 1], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 10], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 10], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -9],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -4], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 1], ['not'], ['not'], ['ret']],), [['push', 1], ['ret']])],
 [('regression: folding cascades across passes',
   ([['push', 2], ['push', 5], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 23], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 2], ['ret']],),
   [['push', -32768], ['push', 2], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 202], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 202], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 2], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 2], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 2], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 2], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 2], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 11], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 11], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -11],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -5], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 2], ['not'], ['not'], ['ret']],), [['push', 2], ['ret']])],
 [('regression: folding cascades across passes',
   ([['push', 2], ['push', 6], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 27], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 3], ['ret']],),
   [['push', -32768], ['push', 3], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 203], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 203], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 3], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 3], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 3], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 3], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 3], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 12], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 12], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -13],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -6], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 3], ['not'], ['not'], ['ret']],), [['push', 3], ['ret']])],
 [('regression: folding cascades across passes',
   ([['push', 2], ['push', 7], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 31], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 4], ['ret']],),
   [['push', -32768], ['push', 4], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 204], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 204], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 4], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 4], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 4], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 4], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 4], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 13], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 13], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -15],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -7], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 4], ['not'], ['not'], ['ret']],), [['push', 4], ['ret']])],
 [('regression: folding cascades across passes',
   ([['push', 2], ['push', 8], ['add'], ['push', 4], ['mul'], ['push', 5], ['sub'], ['ret']],),
   [['push', 35], ['ret']]),
  ('fold reaching the int16 minimum',
   ([['push', -16384], ['push', 2], ['mul'], ['push', 5], ['ret']],),
   [['push', -32768], ['push', 5], ['ret']]),
  ('fold reaching the int16 maximum',
   ([['push', 32766], ['push', 1], ['add'], ['push', 200], ['push', 205], ['mul'], ['ret']],),
   [['push', 32767], ['push', 200], ['push', 205], ['mul'], ['ret']]),
  ('jump over code to a later label is kept',
   ([['jmp', 'L2'], ['label', 'L1'], ['push', 5], ['label', 'L2'], ['ret']],),
   [['jmp', 'L2'], ['label', 'L1'], ['push', 5], ['label', 'L2'], ['ret']]),
  ('jump to the second of two adjacent labels',
   ([['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 5], ['ret']],),
   [['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 5], ['ret']]),
  ('dead code after an unconditional jump',
   ([['jmp', 'E'], ['push', 1], ['push', 5], ['label', 'E'], ['ret']],),
   [['label', 'E'], ['ret']]),
  ('conditional jump keeps its fallthrough',
   ([['push', 0], ['jz', 'E'], ['push', 14], ['ret'], ['label', 'E'], ['push', 1], ['ret']],),
   [['push', 0], ['jz', 'E'], ['push', 14], ['ret'], ['label', 'E'], ['push', 1], ['ret']]),
  ('division folds truncate toward zero',
   ([['push', -17],
     ['push', 2],
     ['div'],
     ['push', 7],
     ['push', -2],
     ['div'],
     ['push', 5],
     ['push', 0],
     ['div'],
     ['ret']],),
   [['push', -8], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]),
  ('control: double negation removed', ([['push', 5], ['not'], ['not'], ['ret']],), [['push', 5], ['ret']])]]
for label, args, expected in cases[N - 1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
regression: folding cascades across passes[['push', 19], ['ret']][['push', 19], ['ret']]Passed
fold reaching the int16 minimum[['push', -32768], ['push', 1], ['ret']][['push', -32768], ['push', 1], ['ret']]Passed
fold reaching the int16 maximum[['push', 32767], ['push', 200], ['push', 201], ['mul'], ['ret']][['push', 32767], ['push', 200], ['push', 201], ['mul'], ['ret']]Passed
jump over code to a later label is kept[['jmp', 'L2'], ['label', 'L1'], ['push', 1], ['label', 'L2'], ['ret']][['jmp', 'L2'], ['label', 'L1'], ['push', 1], ['label', 'L2'], ['ret']]Passed
jump to the second of two adjacent labels[['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 1], ['ret']][['jmp', 'L'], ['label', 'M'], ['label', 'L'], ['push', 1], ['ret']]Passed
dead code after an unconditional jump[['label', 'E'], ['ret']][['label', 'E'], ['ret']]Passed
conditional jump keeps its fallthrough[['push', 0], ['jz', 'E'], ['push', 10], ['ret'], ['label', 'E'], ['push', 1], ['ret']][['push', 0], ['jz', 'E'], ['push', 10], ['ret'], ['label', 'E'], ['push', 1], ['ret']]Passed
division folds truncate toward zero[['push', -4], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']][['push', -4], ['push', -3], ['push', 5], ['push', 0], ['div'], ['ret']]Passed
control: double negation removed[['push', 1], ['ret']][['push', 1], ['ret']]Passed

SHA-256 / d7ef94bd4df6dda1c5f85115e34e2b71b89fc17d04e7633479eb10dcdc8bda0e

Verification & scope

A deterministic, bounded teaching model of one bytecode virtual machine mechanism with a stipulated instruction encoding; it is not a production VM and claims no conformance to any real specification. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:51:24.657797+00:00.

Case digest / 7f3e24994e65a0c3187d915767b3c56ba19f09c1ed4a770e296727464e6840d0