Benoit Jacob bjacob

Priority workload	SuperCollider	Record/Replay	Sampled	Inline Shadow
P0 Qwen3-0.6B prefill	🟩 20/20; clean + exact-fault trap; overhead pending refresh	🟩 20/20; clean + qualified miss; overhead pending refresh	🟩 20/20; clean + measured statistical detection; overhead pending refresh	🟩 20/20; clean + attributed diagnostic; overhead pending refresh
P1 Sharktank TP1 prefill	🟨 Clean 352/352; instability marker	🟨 Clean 352/352 + 92/92 barriers	🟨 Clean 352/352 + 18/22 barriers; automatic standard sampling profile	🟨 Clean 352/352 + 92/92; dynamic undercoverage
P1 Sharktank TP1 decode/combined	🟨 Clean decode + combined; 352/352; instability marker	🟨 Clean decode + combined; 352/352 + 92/92	🟨 Clean decode + combined; 352/352 + 18/22 barriers; automatic standard sampling profile	🟨 Clean decode + combined; 352/352 + 92/92; dynamic undercoverage
P2 Sharktank TP2 family	🟨 Clean 992/992; instability marker	🟨 Clean 992/992 +

Priority workload	SuperCollider	Record/Replay	Sampled	Inline Shadow
P0 Qwen3-0.6B prefill	🟩 20/20; clean + exact-fault trap; overhead pending refresh	🟩 20/20; clean + qualified miss; overhead pending refresh	🟩 20/20; clean + measured statistical detection; overhead pending refresh	🟩 20/20; clean + attributed diagnostic; overhead pending refresh
P1 Sharktank TP1 prefill	🟨 Clean 352/352; instability marker	🟨 Clean 352/352 + 92/92 barriers	🟨 Clean 352/352 + 18/22 barriers; automatic standard sampling profile	🟨 Clean 352/352 + 92/92; dynamic undercoverage
P1 Sharktank TP1 decode/combined	🟨 Clean decode + combined; 352/352; instability marker	🟨 Clean decode + combined; 352/352 + 92/92	🟨 Clean decode + combined; 352/352 + 18/22 barriers; automatic standard sampling profile	🟨 Clean decode + combined; 352/352 + 92/92; dynamic undercoverage
P2 Sharktank TP2 family	🟨 Clean 992/992; instability marker	🟨 Clean 992/992 +

Thanks for freezing the DAG. That is the reasonable thing to do now. You can take the next 2 hours to fully wrap up. It's 7 AM now; you can take until 9 AM if necessary.

Can you help me understand: What is the shape of the useful new scope that you kept discovering? Did you literally find new bugs in existing code that were only discovered by the new testing scope? Or was it more like pulling threads?

Both happened, but the dominant pattern was: New tests found literal bugs; fixing or validating each bug exposed a deeper missing invariant. Some concrete examples:

Real optimized binaries found actual preservation bugs:
- SuperCollider clobbered live v3 in the shared atomicAdd helper.
Stream-K analysis decoded executable padding as instructions.

Why the ConSan diff became large during the LLM fault-injection campaign

The scope increase was not simply the predictable result of “more tests.” The new iree-test-suites/LLM corpus and systematic bug injection invalidated several assumptions under which the earlier ConSan prototype appeared usable. Small kernels had spare registers, simple code-object ownership, familiar LDS barriers, and faults that could be represented by dropping one instruction. Production IREE models instead supplied register-saturated kernels, multiple processes and code objects, mixed FLAT/VGLOBAL/LDS operations, subtle atomic protocols, and enough runtime complexity that a run could look successful even when no intended kernel had been instrumented. Fault injection then made semantic incompleteness observable: an engine could run cleanly yet miss a wrong address, weakened ordering, failed compare-exchange, or slightly displaced barrier. The resulting work is the machinery needed to make the original claim—usable end-to-end conc

DBI SuperCollider MVP Plan

Goal

Demonstrate SuperCollider-style instrumentation of AMDGPU LDS accesses under rocJITsu DBI.

The concrete deliverable is an opt-in rocJITsu instrumentation mode that can catch at least some LDS races on selected tests. This is intentionally a race-exposure MVP, not a full happens-before sanitizer.

rocJITsu DBI / waitcheck exploratory digest

Date: 2026-07-03

Repo inspected: /home/benoit/workspace/TheRock/rocm-systems

Refs checked

Current local HEAD: 63c36973da
Jakub's waitcheck branch: origin/users/kuhar/waitcheck

How algebraic-fpsan represents transcendentals

Scratch discussion notes. Answers: "if transcendentals get no reserved slots, how are they represented at all?"

Short answer

A transcendental result is represented by an ordinary ring residue — a number in $[0,p)$ — produced by a stateless keyed hash of (which transcendental, input residue). It is not stored in any reserved/sentinel

An algebraic alternative to FPSan: the residue homomorphism $\mathbb{Z}[1/2] \to \mathbb{F}_p$

Working notes. Audience: us. Builds on understanding-fpsan.md.

0. The one-sentence difference from FPSan

FPSan encodes a float by a scrambling bijection $\varphi$ of its bit pattern and then does arithmetic in the payload ring $\mathbb{Z}/2^{w}$. That map is not a ring homomorphism: $\varphi(x{+}y) \neq \varphi(x){+}\varphi(y)$. The ring laws hold because the payload operations are the ring operations and the

	[2690860.263792] Out of memory: Killed process 2436488 (code) total-vm:1522820760kB, anon-rss:43396kB, file-rss:8kB, shmem-rss:32704kB, UID:1000 pgtables:4404kB oom_score_adj:300
	[2690862.359207] systemd-journald[842]: Under memory pressure, flushing caches.
	[2690862.382811] oom_reaper: reaped process 2436488 (code), now anon-rss:0kB, file-rss:0kB, shmem-rss:25832kB
	[2690865.062934] systemd-journald[842]: Under memory pressure, flushing caches.
	[2690894.206910] audit: type=1107 audit(1783106387.900:49786): pid=1990 uid=101 auid=4294967295 ses=4294967295 subj=unconfined msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/NetworkManager" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name=":1.13" pid=2446835 label="snap.firefox.firefox" peer_pid=2107 peer_label="unconfined"
	exe="/usr/bin/dbus-daemon" sauid=101 hostname=? addr=? terminal=?'
	[2690954.211506] audit: type=1107 audit(1783106447.905:49787): pid=1990 uid=101 auid=429496729

	New project: FPSan.

	Create a fpsan directory under workspace/.

	In it, clone out the Triton git repository: https://github.com/triton-lang/triton.git

	Stick to https for the remote.

	We want to study a new sanitizer developed there, named fpsan. It rewrites floating-point arithmetic into purely integer-arithmetic, in a way that completely alters the numerical outputs, so this is not at all trying to be useful computationally. Instead, the motivation comes from a key property that this compiler rewrite satisfies: if the input floating-point programs only differ by "fast-math-style" rewrites like rewriting a+(b+c) into (a+b)+c (which is not a technically correct rewrite of a floating-point program, due to lack of associativity of FP addition) then the fpsan-rewritten programs are exactly equivalent integer-arithmetic programs: they may only differ by a rewrite of the form a+(b+c) into (a+b)+c but now on modular integer arithmetic, where this rewrite is exact.