https://specy.app/blog/posts/a-rustc-soundness-bug-in-the-wild

Scan-ID:
b8c0d1d2-3bd9-46ae-b427-14c5a0ac4c1eBeendet
Eingereichte URL:
https://specy.app/blog/posts/a-rustc-soundness-bug-in-the-wild
Bericht beendet:

Die von der Seite ausgehenden identifizierten Links

LinkText
https://github.com/ztlpn/minilpminilp
https://github.com/Specy/rooc/blob/main/src/solvers/milp_solver.rs#L66adding an adapter
https://github.com/mtolmacs/wasm2mapwasm2map
https://github.com/ztlpn/minilp/issues/6One random issue
https://github.com/ztlpn/minilp/blob/master/src/helpers.rs#L26unsafe
https://github.com/sparsemat/sprs/issues/370#issuecomment-2446583795an issue
https://play.rust-lang.org/?version=nightly&mode=debug&edition=2021&gist=0b00575c9057e816cddce89d00a0d856minimal reproduction
https://github.com/rust-lang/rust/issues/132353bug report
https://github.com/specy/roocrooc library
https://github.com/Specy/microlpminilp

JavaScript-Variablen · 32 gefunden

Globale JavaScript-Variablen, die in das Window Object einer Seite geladen werden, sind Variablen, die außerhalb von Funktionen deklariert werden und von jeder Stelle des Codes innerhalb des aktuellen Bereichs zugänglich sind

NameTyp
0object
1object
onbeforetoggleobject
documentPictureInPictureobject
onscrollendobject
google_js_reporting_queueobject
google_srtnumber
google_logging_queueobject
google_ad_modificationsobject
ggeacobject

Konsolenprotokoll-Meldungen · 0 gefunden

In der Web-Konsole protokollierte Meldungen

HTML

Der HTML-Rohtext der Seite

<!DOCTYPE html><html lang="en"><head>
    <meta charset="utf-8">
    <link rel="icon" href="https://specy.app/favicon.png">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    
		<link href="../../_app/immutable/assets/0.C3174Jl9.css" rel="stylesheet">
		<link href="../../_app/immutable/assets/IconBase.C6PPviNE.css" rel="stylesheet">
		<link href="../../_app/immutable/assets/5.Diorblkq.css" rel="stylesheet">
		<link href="../../_app/immutable/assets/Projects.BQCFgmYz.css" rel="stylesheet">
		<link rel="modulepreload" href="../../_app/immutable/entry/start.BF5rBACD.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/entry.CX_F79Zg.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/runtime.DsaQvs2C.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/index.DT0zMz25.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/control.CYgJF_JY.js">
		<link rel="modulepreload" href="../../_app/immutable/entry/app.CoL6AP9I.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/index-client.DENwmIDX.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/render.BT837Avl.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/svelte-head.Bd0YLz93.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/disclose-version.BT-lRIl8.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/if.WZTWlcfg.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/svelte-component.BS3Ichlf.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/props.CHerSkFZ.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/this.Bn1qo7XT.js">
		<link rel="modulepreload" href="../../_app/immutable/nodes/0.37AU8-y9.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/snippet.CHSnDYVg.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/toast.BikPJ3Li.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/attributes.CA9YizYj.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/IconBase.BqSAyz-x.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/user.EbL_QFwr.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/lifecycle.CWjUThmR.js">
		<link rel="modulepreload" href="../../_app/immutable/nodes/5.CmB1SPhf.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/each.T_hEuppI.js">
		<link rel="modulepreload" href="../../_app/immutable/chunks/Projects.VRFmKoe7.js"><!--[--><meta name="description" content="How a bug in the rustc compiler drove me to madness for two days"> <meta property="og:title" content="A rustc soundness bug in the wild"> <meta property="og:description" content="How a bug in the rustc compiler drove me to madness for two days"> <meta property="og:type" content="article"> <meta property="article:published_time" content="2024-11-13"> <meta property="article:author" content="Specy"> <meta property="article:section" content="Technology"> <meta property="article:tag" content="rust,rooc"> <meta name="keywords" content="rust,rooc"> <meta property="og:image" content="https://specy.app/images/og-image.png"><!--]--><title>A rustc soundness bug in the wild</title>
    <meta name="theme-color" content="#A65EE0">
    <meta name="author" content="Specy">
    <meta property="og:image" content="/images/description.webp">
    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin="">
    <link href="https://fonts.googleapis.com/css2?family=Fira+Code:[email protected]&amp;family=Libre+Baskerville:ital,wght@0,400;0,700;1,400&amp;display=swap" rel="stylesheet">
    <link rel="icon" type="image/png" href="https://specy.app/favicon.png">
    <script src="https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202411130101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8347249874872543&amp;plah=specy.app&amp;bust=31088996"></script><script async="" src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-8347249874872543" crossorigin="anonymous" data-checked-head="true"></script>
<meta http-equiv="origin-trial" content="AlK2UR5SkAlj8jjdEc9p3F3xuFYlF6LYjAML3EOqw1g26eCwWPjdmecULvBH5MVPoqKYrOfPhYVL71xAXI1IBQoAAAB8eyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiV2ViVmlld1hSZXF1ZXN0ZWRXaXRoRGVwcmVjYXRpb24iLCJleHBpcnkiOjE3NTgwNjcxOTksImlzU3ViZG9tYWluIjp0cnVlfQ=="><meta http-equiv="origin-trial" content="Amm8/NmvvQfhwCib6I7ZsmUxiSCfOxWxHayJwyU1r3gRIItzr7bNQid6O8ZYaE1GSQTa69WwhPC9flq/oYkRBwsAAACCeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZXN5bmRpY2F0aW9uLmNvbTo0NDMiLCJmZWF0dXJlIjoiV2ViVmlld1hSZXF1ZXN0ZWRXaXRoRGVwcmVjYXRpb24iLCJleHBpcnkiOjE3NTgwNjcxOTksImlzU3ViZG9tYWluIjp0cnVlfQ=="><meta http-equiv="origin-trial" content="A9wSqI5i0iwGdf6L1CERNdmsTPgVu44ewj8QxTBYgsv1LCPUVF7YmWOvTappqB1139jAymxUW/RO8zmMqo4zlAAAAACNeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiRmxlZGdlQmlkZGluZ0FuZEF1Y3Rpb25TZXJ2ZXIiLCJleHBpcnkiOjE3MzY4MTI4MDAsImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9"><meta http-equiv="origin-trial" content="A+d7vJfYtay4OUbdtRPZA3y7bKQLsxaMEPmxgfhBGqKXNrdkCQeJlUwqa6EBbSfjwFtJWTrWIioXeMW+y8bWAgQAAACTeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZXN5bmRpY2F0aW9uLmNvbTo0NDMiLCJmZWF0dXJlIjoiRmxlZGdlQmlkZGluZ0FuZEF1Y3Rpb25TZXJ2ZXIiLCJleHBpcnkiOjE3MzY4MTI4MDAsImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9"><link rel="modulepreload" as="script" crossorigin="" href="https://specy.app/_app/immutable/nodes/1.CNAyakC8.js"><link rel="modulepreload" as="script" crossorigin="" href="https://specy.app/_app/immutable/nodes/3.DDIe5LmC.js"><link rel="stylesheet" crossorigin="" href="https://specy.app/_app/immutable/assets/3.DgiJIf9m.css"></head>
<body>
<div id="svelte"><!--[--><!--[--><!----><div style="
	display: flex; 
	flex-direction: column;

    
				--background: #171A21;
				--background-text: #dbdbdb;
				--RGB-background: 23, 26, 33;
				--RGB-background-text: 219, 219, 219;
				

				--primary: #171A21;
				--primary-text: #dbdbdb;
				--RGB-primary: 23, 26, 33;
				--RGB-primary-text: 219, 219, 219;
				

				--secondary: #212630;
				--secondary-text: #dbdbdb;
				--RGB-secondary: 33, 38, 48;
				--RGB-secondary-text: 219, 219, 219;
				

				--tertiary: #2d3950;
				--tertiary-text: #dbdbdb;
				--RGB-tertiary: 45, 57, 80;
				--RGB-tertiary-text: 219, 219, 219;
				

				--footer: #212630;
				--footer-text: #dbdbdb;
				--RGB-footer: 33, 38, 48;
				--RGB-footer-text: 219, 219, 219;
				

				--accent: hsl(273.05, 67.64%, 62.44%);
				--accent-text: #181818;
				--RGB-accent: 166, 94, 224;
				--RGB-accent-text: 24, 24, 24;
				

				--accent2: #38454f;
				--accent2-text: #dbdbdb;
				--RGB-accent2: 56, 69, 79;
				--RGB-accent2-text: 219, 219, 219;
				

				--shadow-color: #454559;
				--shadow-color-text: #dbdbdb;
				--RGB-shadow-color: 69, 69, 89;
				--RGB-shadow-color-text: 219, 219, 219;
				

				--hint: #939393;
				--hint-text: #181818;
				--RGB-hint: 147, 147, 147;
				--RGB-hint-text: 24, 24, 24;
				

				--warn: #ed4f4f;
				--warn-text: #dbdbdb;
				--RGB-warn: 237, 79, 79;
				--RGB-warn-text: 219, 219, 219;
				

				--success: #356a59;
				--success-text: #dbdbdb;
				--RGB-success: 53, 106, 89;
				--RGB-success-text: 219, 219, 219;
				
    color: var(--primary-text); flex: 1; background-color: var(--background);
"><div class="column" style="flex: 1; position: relative;"><div class="background svelte-te071l"><canvas class="background-image svelte-te071l" width="68" height="51"></canvas></div> <div class="column" style="flex: 1; z-index: 2"><nav class="nav svelte-1mg1ajw"><div class="desktop-menu svelte-1mg1ajw"><a class="logo-wrapper svelte-1awiheq" href="/"><img src="/images/logo.png" alt="logo" class="logo svelte-1awiheq"> <div class="name svelte-1awiheq"><div>Specy</div> <div class="overflow-wrapper svelte-1awiheq"><div class="logo-line-wrapper svelte-1awiheq"><div class="logo-line svelte-1awiheq "></div> <div class="logo-app svelte-1awiheq"><span class="svelte-1awiheq">.</span> app</div></div></div></div></a><!----> <div class="links svelte-1mg1ajw" style=""><a href="/" style="" class="svelte-1mg1ajw">Home</a> <a href="/#web-apps" class="svelte-1mg1ajw">Apps</a> <a href="/blog" style="color: var(--accent)" class="svelte-1mg1ajw">Blog</a> <a href="/donate" style="" class="svelte-1mg1ajw">Donate</a></div></div> <div class="mobile-menu svelte-1mg1ajw "><div class="mobile-row svelte-1mg1ajw"><a class="logo-wrapper svelte-1awiheq" href="/"><img src="/images/logo.png" alt="logo" class="logo svelte-1awiheq"> <div class="name svelte-1awiheq"><div>Specy</div> <div class="overflow-wrapper svelte-1awiheq"><div class="logo-line-wrapper svelte-1awiheq"><div class="logo-line svelte-1awiheq "></div> <div class="logo-app svelte-1awiheq"><span class="svelte-1awiheq">.</span> app</div></div></div></div></a><!----> <div class="top-mobile-menu svelte-1mg1ajw"><div style="height:2rem"><!--[!--><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" class="svelte-c8tyih"><!--[!--><!--]--><!----><path d="M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z"></path><!----></svg><!--]--></div></div></div> <div class="links-mobile svelte-1mg1ajw "><a href="/" style="" class="svelte-1mg1ajw">Home</a> <a href="/#web-apps" style="" class="svelte-1mg1ajw">Apps</a> <a href="/blog" style="color: var(--accent)" class="svelte-1mg1ajw">Blog</a> <a href="/donate" style="" class="svelte-1mg1ajw">Donate</a></div></div></nav><!----> <!----><div class="progress  svelte-1ak3fvo"></div> <div class="page column svelte-1ak3fvo"><!----><!----><article class="content-wrapper svelte-jyj42k"><div class="content svelte-jyj42k"><header style="display: flex; flex-wrap: wrap; justify-content: space-between; align-items: center; gap: 1rem"><h1 class="main-header svelte-jyj42k">A rustc soundness bug in the wild</h1> <p class="date-published svelte-jyj42k">11/13/2024</p></header> <section class="blog-description svelte-jyj42k">How a bug in the rustc compiler drove me to madness for two days</section> <div class="badge-wrapper svelte-jyj42k"><!--[--><span class="badge svelte-jyj42k" style="--index: 0">rust</span><span class="badge svelte-jyj42k" style="--index: 1">rooc</span><!--]--></div> <!--[--><h1>Related Projects</h1> <div class="projects-wrapper svelte-jyj42k"><!--[--><div class="project svelte-1g7bjn8"><div class="row svelte-1g7bjn8"><img src="/images/rooc.png" alt="Rooc" class="svelte-1g7bjn8"> <div class="app-title svelte-1g7bjn8">Rooc</div></div> <div class="description svelte-1g7bjn8">Modeling language to solve MILP problems in the browser</div> <a href="https://rooc.specy.app" target="_blank" class="open-btn svelte-1g7bjn8" style="background-color: rgb(83, 87, 165)" rel="canonical"><div class="svelte-1g7bjn8">Open</div> <div class="icon svelte-1g7bjn8"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" class="svelte-c8tyih"><!--[!--><!--]--><!----><path d="M19 19H5V5h7V3H5c-1.11 0-2 .9-2 2v14c0 1.1.89 2 2 2h14c1.1 0 2-.9 2-2v-7h-2v7zM14 3v2h3.59l-9.83 9.83 1.41 1.41L19 6.41V10h2V3h-7z"></path><!----></svg><!----></div></a></div><!--]--></div><!--]--> <section class="md-content svelte-jyj42k"><h1 id="how-it-started"><a href="#how-it-started">How it started</a></h1> <p>I was working on <a href="https://rooc.specy.app" rel="nofollow">rooc</a>, a modeling language for optimization problems running in the web;
After months of “just one more feature” i decided to stop adding new things to the language, and instead focus on improving the
solvers, which so far implemented only a very simple one which i developed.</p> <p>My goal was to be able to run everything in the browser, so solvers must be able to compile to WebAssembly.</p> <p>The easiest way to do this is to find pure rust libraries, which would allow me to simply compile the rust code to the wasm target.</p> <p>After many failed attempts at compiling for wasm, searching through the whole crates.io, i stumbled upon <a href="https://github.com/ztlpn/minilp" rel="nofollow">minilp</a>, a rust only linear programming library. Perfect!</p> <p>But wait… <em>“The project was archived 2 years ago, last commit 4 years ago”</em>, oh well, i heard that rust is a stable language, so it should be fine, right?</p> <div class="container svelte-5crb98" style="font-size: 1.3rem; margin: -1rem 0"><div class="wavy-text svelte-5crb98"><!--[--><span style="
          animation-duration: 1.2s;
          animation-delay: 0s;
          --wave-vertical: 5px;
          --wave-skew: 5deg;
        " class="svelte-5crb98">R</span><span style="
          animation-duration: 1.2s;
          animation-delay: 0.1s;
          --wave-vertical: 5px;
          --wave-skew: 5deg;
        " class="svelte-5crb98">i</span><span style="
          animation-duration: 1.2s;
          animation-delay: 0.2s;
          --wave-vertical: 5px;
          --wave-skew: 5deg;
        " class="svelte-5crb98">g</span><span style="
          animation-duration: 1.2s;
          animation-delay: 0.30000000000000004s;
          --wave-vertical: 5px;
          --wave-skew: 5deg;
        " class="svelte-5crb98">h</span><span style="
          animation-duration: 1.2s;
          animation-delay: 0.4s;
          --wave-vertical: 5px;
          --wave-skew: 5deg;
        " class="svelte-5crb98">t</span><span style="
          animation-duration: 1.2s;
          animation-delay: 0.5s;
          --wave-vertical: 5px;
          --wave-skew: 5deg;
        " class="svelte-5crb98">?</span><span style="
          animation-duration: 1.2s;
          animation-delay: 0.6000000000000001s;
          --wave-vertical: 5px;
          --wave-skew: 5deg;
        " class="svelte-5crb98">?</span><!--]--></div></div><!----> <h1 id="implementation"><a href="#implementation">Implementation</a></h1> <p>After discovering the library i immediately added it as a solver to rooc, which was as easy as <a href="https://github.com/Specy/rooc/blob/main/src/solvers/milp_solver.rs#L66" rel="nofollow">adding an adapter</a> that transformed a <code>LinearModel</code> into a <code>minilp::Problem</code>.</p> <p>Let’s see how that goes!</p> <blockquote><p><code>cargo test</code></p></blockquote> <pre class="language-undefined"><!----><code class="language-undefined">Running testssolver_tests.rs
running 18 tests
...
test result: ok. 18 passed; 0 failed; 0 measured; 0 filtered out; finished in 0.03s</code><!----></pre> <p>Looks good to me! Let’s publish a new version of the library to npm with this newly added solver!</p> <p>But wait, right, before that i should probably test it in the browser, <em>just to make sure</em>.</p> <pre class="language-undefined"><!----><code class="language-undefined">Uncaught (in promise) RuntimeError: unreachable
    at __rust_start_panic (http://127.0.0.1:8080/wasm_bg.wasm:wasm-function[346]:0x274ec)
    at rust_panic (http://127.0.0.1:8080/wasm_bg.wasm:wasm-function[254]:0x26d0b)
    ...</code><!----></pre> <p>Huh? A panic? Oh well, i guess even this library does not work on the web…</p> <p>Being a bit discouraged, i kept searching on crates.io for alternatives, but sadly found none.</p> <p>My only chance was getting minilp to work, it seemed like there were no weird dependencies, no usage of OS specific things, so it <em>should</em> have worked on the web.</p> <h1 id="debugging-begins"><a href="#debugging-begins">Debugging begins</a></h1> <p>Maybe it’s a web only problem? WASM stack traces are a bit… cryptic, you don’t really know where or what happened, as it completely strips away any kind of debug information to keep bundle sizes small.
But let’s try using <a href="https://github.com/mtolmacs/wasm2map" rel="nofollow">wasm2map</a> to add debug map information to the wasm file, and see if we can get a better stack trace.</p> <pre class="language-undefined"><!----><code class="language-undefined">called `Option::unwrap()` on a `None` value
stack backtrace:
   ...
   3: core::option::unwrap_failed
   4: microlp::order_simple
   5: microlp::main</code><!----></pre> <p>Ah ok, it’s just a simple unwrap on a None value, i probably messed up somewhere in the adapter code.
Let me create a new test using the same model that had issues, so i don’t have a regression in the future.</p> <blockquote><p><code>cargo test</code></p></blockquote> <pre class="language-undefined"><!----><code class="language-undefined">Running testssolver_tests.rs
running 19 tests
...
test result: ok. 19 passed; 0 failed; 0 measured; 0 filtered out; finished in 0.03s</code><!----></pre> <p>What??? The test passed?</p> <div class="container svelte-5crb98" style="font-size: 1.3rem; margin: -1rem 0"><div class="wavy-text svelte-5crb98"><!--[--><span style="
          animation-duration: 1.2s;
          animation-delay: 0s;
          --wave-vertical: 5px;
          --wave-skew: 5deg;
        " class="svelte-5crb98">H</span><span style="
          animation-duration: 1.2s;
          animation-delay: 0.1s;
          --wave-vertical: 5px;
          --wave-skew: 5deg;
        " class="svelte-5crb98">o</span><span style="
          animation-duration: 1.2s;
          animation-delay: 0.2s;
          --wave-vertical: 5px;
          --wave-skew: 5deg;
        " class="svelte-5crb98">w</span><span style="
          animation-duration: 1.2s;
          animation-delay: 0.30000000000000004s;
          --wave-vertical: 5px;
          --wave-skew: 5deg;
        " class="svelte-5crb98">?</span><span style="
          animation-duration: 1.2s;
          animation-delay: 0.4s;
          --wave-vertical: 5px;
          --wave-skew: 5deg;
        " class="svelte-5crb98">?</span><!--]--></div></div><!----> <p>I just had this panic on me a <em>few seconds ago</em>?</p> <p>Ah whatever, let’s go to the issues page of the minilp repository, maybe someone else had this issue before.</p> <p><a href="https://github.com/ztlpn/minilp/issues/6" rel="nofollow">One random issue</a> shows another panic at runtime, so i guess the library doesn’t guarantee the lack of panics,
and it being archived, i should probably just fork it and fix it myself.</p> <p>Let’s look at the <code>minilp::order_simple</code> function and see what’s going on there.</p> <pre class="language-rust"><!----><code class="language-rust"><span class="token keyword">pub</span> <span class="token keyword">fn</span> <span class="token function-definition function">order_simple</span><span class="token operator">&lt;</span><span class="token lifetime-annotation symbol">'a</span><span class="token operator">&gt;</span><span class="token punctuation">(</span>size<span class="token punctuation">:</span> <span class="token keyword">usize</span><span class="token punctuation">,</span> get_col<span class="token punctuation">:</span> <span class="token keyword">impl</span> <span class="token class-name">Fn</span><span class="token punctuation">(</span><span class="token keyword">usize</span><span class="token punctuation">)</span> <span class="token punctuation">-&gt;</span> <span class="token operator">&amp;</span><span class="token lifetime-annotation symbol">'a</span> <span class="token punctuation">[</span><span class="token keyword">usize</span><span class="token punctuation">]</span><span class="token punctuation">)</span> <span class="token punctuation">-&gt;</span> <span class="token class-name">Perm</span> <span class="token punctuation">{</span>
    <span class="token keyword">let</span> <span class="token keyword">mut</span> cols_queue <span class="token operator">=</span> <span class="token class-name">ColsQueue</span><span class="token punctuation">::</span><span class="token function">new</span><span class="token punctuation">(</span>size<span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token comment">//some code...</span>
    <span class="token keyword">let</span> <span class="token keyword">mut</span> new2orig <span class="token operator">=</span> <span class="token class-name">Vec</span><span class="token punctuation">::</span><span class="token function">with_capacity</span><span class="token punctuation">(</span>size<span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token keyword">while</span> new2orig<span class="token punctuation">.</span><span class="token function">len</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token operator">&lt;</span> size <span class="token punctuation">{</span>
        <span class="token keyword">let</span> min <span class="token operator">=</span> cols_queue<span class="token punctuation">.</span><span class="token function">min</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token macro property">println!</span><span class="token punctuation">(</span><span class="token string">"min {:?}"</span><span class="token punctuation">,</span> min<span class="token punctuation">)</span><span class="token punctuation">;</span>
        new2orig<span class="token punctuation">.</span><span class="token function">push</span><span class="token punctuation">(</span>min<span class="token punctuation">.</span><span class="token function">unwrap</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token punctuation">}</span>
    <span class="token comment">//other code...</span>
<span class="token punctuation">}</span></code><!----></pre> <p>It seems correct? <code>cols_queue</code> is initialized with <code>size</code> so it should never be out of elements to pop, is there something else
that is modifying the <code>cols_queue</code>?</p> <p>I put a breakpoint in the <code>while</code> loop to see what’s going on, and… <em>it did not panic</em>?</p> <p>Ok this is starting to get weird, let’s look more in depth at the <code>fn pop_min(&amp;mut self) -&gt; Option&lt;usize&gt;</code> function,
it is returning a <code>None</code> value, so let’s put some debug prints to see:</p> <pre class="language-rust"><!----><code class="language-rust"><span class="token keyword">fn</span> <span class="token function-definition function">pop_min</span><span class="token punctuation">(</span><span class="token operator">&amp;</span><span class="token keyword">mut</span> <span class="token keyword">self</span><span class="token punctuation">)</span> <span class="token punctuation">-&gt;</span> <span class="token class-name">Option</span><span class="token operator">&lt;</span><span class="token keyword">usize</span><span class="token operator">&gt;</span> <span class="token punctuation">{</span>
    <span class="token keyword">let</span> col <span class="token operator">=</span> <span class="token keyword">loop</span> <span class="token punctuation">{</span>
        <span class="token keyword">if</span> <span class="token keyword">self</span><span class="token punctuation">.</span>min_score <span class="token operator">&gt;=</span> <span class="token keyword">self</span><span class="token punctuation">.</span>score2head<span class="token punctuation">.</span><span class="token function">len</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>
            <span class="token macro property">println!</span><span class="token punctuation">(</span><span class="token string">"None on min_score: {}"</span><span class="token punctuation">,</span> <span class="token keyword">self</span><span class="token punctuation">.</span>min_score<span class="token punctuation">)</span><span class="token punctuation">;</span>
            <span class="token keyword">return</span> <span class="token class-name">None</span><span class="token punctuation">;</span>
        <span class="token punctuation">}</span>
        <span class="token keyword">if</span> <span class="token keyword">let</span> <span class="token class-name">Some</span><span class="token punctuation">(</span>col<span class="token punctuation">)</span> <span class="token operator">=</span> <span class="token keyword">self</span><span class="token punctuation">.</span>score2head<span class="token punctuation">[</span><span class="token keyword">self</span><span class="token punctuation">.</span>min_score<span class="token punctuation">]</span> <span class="token punctuation">{</span>
            <span class="token keyword">break</span> col<span class="token punctuation">;</span>
        <span class="token punctuation">}</span>
        <span class="token keyword">self</span><span class="token punctuation">.</span>min_score <span class="token operator">+=</span> <span class="token number">1</span><span class="token punctuation">;</span>
    <span class="token punctuation">}</span><span class="token punctuation">;</span>
    <span class="token keyword">self</span><span class="token punctuation">.</span><span class="token function">remove</span><span class="token punctuation">(</span>col<span class="token punctuation">,</span> <span class="token keyword">self</span><span class="token punctuation">.</span>min_score<span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token class-name">Some</span><span class="token punctuation">(</span>col<span class="token punctuation">)</span>
<span class="token punctuation">}</span></code><!----></pre> <blockquote><p><code>cargo run</code></p></blockquote> <pre class="language-bash"><!----><code class="language-bash">min: Some<span class="token punctuation">(</span><span class="token number">1</span><span class="token punctuation">)</span>
min: Some<span class="token punctuation">(</span><span class="token number">2</span><span class="token punctuation">)</span>
min: Some<span class="token punctuation">(</span><span class="token number">3</span><span class="token punctuation">)</span>
called <span class="token variable"><span class="token variable">`</span>Option::unwrap<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token variable">`</span></span> on a <span class="token variable"><span class="token variable">`</span>None<span class="token variable">`</span></span> value</code><!----></pre> <p>Ok good, at least the bug happens now? <em>I guess?</em> But where is the <code>None on min_score: {}</code> print that i put in the <em>only</em> place where <code>None</code> is returned?</p> <p>Let’s add more prints!</p> <video src="https://github.com/user-attachments/assets/2631f7bf-4363-4305-8950-03b94b018d61" style="width: 100%; border-radius: 0.5rem" controls=""></video> <p><em>Yeeeeeeah</em>, no, this cannot be sound, there must be something wrong somewhere, i did see an <a href="https://github.com/ztlpn/minilp/blob/master/src/helpers.rs#L26" rel="nofollow">unsafe</a> in the library, so maybe some memory corruption is happening?</p> <p>Running miri did not show any issues, but going step by step with my debugger did show an illegal memory access, so definitely something is wrong with the library.</p> <p>I also noticed that the bug happens <em>only</em> when running in release mode, so that does narrow down the issue a bit.</p> <p>Just to be sure i ran the same code in debug mode but disabling all debug checks like bound checking and overflow checking, but the bug
did not reproduce. I managed to narrow it down to <code>opt-level = 1</code> causing the panic.</p> <p>I try to remove all <code>unsafe</code> usage everywhere in the library to make sure that’s not the issue. But the panic is still there.</p> <p>Hm, the only dependency of the crate is <code>sprs</code> which has <em>a ton</em> of unsafe code, let’s file <a href="https://github.com/sparsemat/sprs/issues/370#issuecomment-2446583795" rel="nofollow">an issue</a> to see if i’m breaking some invariants.</p> <blockquote><p>It is not clear it is a bug in sprs, try the following:</p> <pre class="language-rust"><!----><code class="language-rust"><span class="token function">order_simple</span><span class="token punctuation">(</span><span class="token number">4</span><span class="token punctuation">,</span> <span class="token closure-params"><span class="token closure-punctuation punctuation">|</span>c<span class="token closure-punctuation punctuation">|</span></span> <span class="token punctuation">{</span>
       <span class="token keyword">match</span> c <span class="token punctuation">{</span>
           <span class="token number">0</span> <span class="token operator">=&gt;</span> <span class="token operator">&amp;</span><span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">3</span><span class="token punctuation">]</span><span class="token punctuation">,</span>
           <span class="token number">1</span> <span class="token operator">=&gt;</span> <span class="token operator">&amp;</span><span class="token punctuation">[</span><span class="token number">2</span><span class="token punctuation">]</span><span class="token punctuation">,</span>
           <span class="token number">2</span> <span class="token operator">=&gt;</span> <span class="token operator">&amp;</span><span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">]</span><span class="token punctuation">,</span>
           <span class="token number">3</span> <span class="token operator">=&gt;</span> <span class="token operator">&amp;</span><span class="token punctuation">[</span><span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">3</span><span class="token punctuation">]</span><span class="token punctuation">,</span>
           _ <span class="token operator">=&gt;</span> <span class="token macro property">unreachable!</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">,</span>
       <span class="token punctuation">}</span>
   <span class="token punctuation">}</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code><!----></pre></blockquote> <p>Which… still panics? <em>Ok, ok, ok</em>, let’s recap:</p> <ul><li>The bug happens only in release mode</li> <li>There is no unsafe code anywhere in the library</li> <li>Miri does not report any issues</li> <li>There are no dependencies which might cause issues</li> <li>There is only 100% plain safe rust code</li></ul> <p>So how can it be panicking? Isn’t the whole purpose of rust to not have this kind of issues if you are not using unsafe code?</p> <h1 id="the-bug-report"><a href="#the-bug-report">The bug report</a></h1> <p>I decided to make sure i wasn’t making any silly mistakes and tried to build a <a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2021&amp;gist=0b00575c9057e816cddce89d00a0d856" rel="nofollow">minimal reproduction</a> using no dependencies or unsafe code:</p> <pre class="language-rust"><!----><code class="language-rust"><span class="token keyword">fn</span> <span class="token function-definition function">main</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>
    <span class="token function">order_simple</span><span class="token punctuation">(</span><span class="token number">4</span><span class="token punctuation">,</span> <span class="token closure-params"><span class="token closure-punctuation punctuation">|</span>c<span class="token closure-punctuation punctuation">|</span></span> <span class="token punctuation">{</span>
        <span class="token keyword">match</span> c <span class="token punctuation">{</span>
            <span class="token number">0</span> <span class="token operator">=&gt;</span> <span class="token operator">&amp;</span><span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">3</span><span class="token punctuation">]</span><span class="token punctuation">,</span>
            <span class="token number">1</span> <span class="token operator">=&gt;</span> <span class="token operator">&amp;</span><span class="token punctuation">[</span><span class="token number">2</span><span class="token punctuation">]</span><span class="token punctuation">,</span>
            <span class="token number">2</span> <span class="token operator">=&gt;</span> <span class="token operator">&amp;</span><span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">]</span><span class="token punctuation">,</span>
            <span class="token number">3</span> <span class="token operator">=&gt;</span> <span class="token operator">&amp;</span><span class="token punctuation">[</span><span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">3</span><span class="token punctuation">]</span><span class="token punctuation">,</span>
            _ <span class="token operator">=&gt;</span> <span class="token macro property">unreachable!</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">,</span>
        <span class="token punctuation">}</span>
    <span class="token punctuation">}</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token macro property">println!</span><span class="token punctuation">(</span><span class="token string">"All ok! Try running in release mode"</span><span class="token punctuation">)</span>
<span class="token punctuation">}</span></code><!----></pre> <blockquote><p><code>cargo run</code></p></blockquote> <pre class="language-undefined"><!----><code class="language-undefined">All ok! Try running in release mode</code><!----></pre> <blockquote><p><code>cargo run --release</code></p></blockquote> <pre class="language-bash"><!----><code class="language-bash">thread <span class="token string">'main'</span> panicked at <span class="token string">'called `Option::unwrap()` on a `None` value'</span></code><!----></pre> <p>Yup. Checks out. Time to file a <a href="https://github.com/rust-lang/rust/issues/132353" rel="nofollow">bug report</a> to the rustc repository!</p> <h1 id="the-fix"><a href="#the-fix">The fix</a></h1> <p>After a few minutes the bug was minimized to just:</p> <pre class="language-rust"><!----><code class="language-rust"><span class="token keyword">fn</span> <span class="token function-definition function">pop_min</span><span class="token punctuation">(</span><span class="token keyword">mut</span> score2head<span class="token punctuation">:</span> <span class="token class-name">Vec</span><span class="token operator">&lt;</span><span class="token class-name">Option</span><span class="token operator">&lt;</span><span class="token keyword">usize</span><span class="token operator">&gt;&gt;</span><span class="token punctuation">)</span> <span class="token punctuation">-&gt;</span> <span class="token class-name">Option</span><span class="token operator">&lt;</span><span class="token keyword">usize</span><span class="token operator">&gt;</span> <span class="token punctuation">{</span>
    <span class="token keyword">loop</span> <span class="token punctuation">{</span>
        <span class="token keyword">if</span> <span class="token keyword">let</span> <span class="token class-name">Some</span><span class="token punctuation">(</span>col<span class="token punctuation">)</span> <span class="token operator">=</span> score2head<span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">]</span> <span class="token punctuation">{</span>
            score2head<span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">]</span> <span class="token operator">=</span> <span class="token class-name">None</span><span class="token punctuation">;</span>
            <span class="token keyword">return</span> <span class="token class-name">Some</span><span class="token punctuation">(</span>col<span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code><!----></pre> <p>which turns out to have been caused by a <code>unsound_mir_opts</code> in the rustc compiler.
The issue was given a <code>P-critical</code> priority, the bugged code fixed in a few days, and released a week later.</p> <h1 id="conclusion"><a href="#conclusion">Conclusion</a></h1> <p>After the bug was resolved i managed to publish the new version of the <a href="https://github.com/specy/rooc" rel="nofollow">rooc library</a> which <em>now does</em> work in the browser, also forked the <a href="https://github.com/Specy/microlp" rel="nofollow">minilp</a> crate to fix some bugs and add some new features.</p> <p>I’m by no means a rust expert, nor a good low-level programmer, i’m just a frontender after all! But this experience taught
me a ton about debugging so i wanted to share the thought process going through this bug.</p><!----></section></div></article><!----><!----><!----><!----></div><!----> <div class="content-under svelte-1ak3fvo"></div><!----><!----></div></div><!----> <footer class="footer svelte-i1g2nx"><div class="footer-inner svelte-i1g2nx"><div class="footer-justify svelte-i1g2nx"><div class="logo-mobile svelte-i1g2nx"><a class="logo-wrapper svelte-i1g2nx" href="https://portfolio.specy.app" target="_blank"><img src="/images/logo.png" alt="logo" class="logo svelte-i1g2nx"> <div class="svelte-i1g2nx">Portfolio</div></a></div> <div class="logo-desktop svelte-i1g2nx"><div class="logo-wrapper svelte-i1g2nx"><img src="/images/logo.png" alt="logo" class="logo svelte-i1g2nx"> <div class="logo-text svelte-i1g2nx">Specy</div></div></div> <div class="desktop-portfolio svelte-i1g2nx"><a href="https://portfolio.specy.app" target="_blank" class="svelte-i1g2nx">Portfolio</a></div> <div class="icon-wrapper svelte-i1g2nx"><a class="icon svelte-i1g2nx" href="https://github.com/Specy" target="_blank"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 496 512" class="svelte-c8tyih"><!--[!--><!--]--><!----><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6zm-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3zm44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9zM244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8zM97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1zm-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7zm32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1zm-11.4-14.7c-1.6 1-1.6 3.6 0 5.9 1.6 2.3 4.3 3.3 5.6 2.3 1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2z"></path><!----></svg><!----></a> <a class="icon svelte-i1g2nx" href="https://discord.gg/Arsf65YYHq" target="_blank" style="margin-top: 0.2rem;"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512" class="svelte-c8tyih"><!--[!--><!--]--><!----><path d="M297.216 243.2c0 15.616-11.52 28.416-26.112 28.416-14.336 0-26.112-12.8-26.112-28.416s11.52-28.416 26.112-28.416c14.592 0 26.112 12.8 26.112 28.416zm-119.552-28.416c-14.592 0-26.112 12.8-26.112 28.416s11.776 28.416 26.112 28.416c14.592 0 26.112-12.8 26.112-28.416.256-15.616-11.52-28.416-26.112-28.416zM448 52.736V512c-64.494-56.994-43.868-38.128-118.784-107.776l13.568 47.36H52.48C23.552 451.584 0 428.032 0 398.848V52.736C0 23.552 23.552 0 52.48 0h343.04C424.448 0 448 23.552 448 52.736zm-72.96 242.688c0-82.432-36.864-149.248-36.864-149.248-36.864-27.648-71.936-26.88-71.936-26.88l-3.584 4.096c43.52 13.312 63.744 32.512 63.744 32.512-60.811-33.329-132.244-33.335-191.232-7.424-9.472 4.352-15.104 7.424-15.104 7.424s21.248-20.224 67.328-33.536l-2.56-3.072s-35.072-.768-71.936 26.88c0 0-36.864 66.816-36.864 149.248 0 0 21.504 37.12 78.08 38.912 0 0 9.472-11.52 17.152-21.248-32.512-9.728-44.8-30.208-44.8-30.208 3.766 2.636 9.976 6.053 10.496 6.4 43.21 24.198 104.588 32.126 159.744 8.96 8.96-3.328 18.944-8.192 29.44-15.104 0 0-12.8 20.992-46.336 30.464 7.68 9.728 16.896 20.736 16.896 20.736 56.576-1.792 78.336-38.912 78.336-38.912z"></path><!----></svg><!----></a></div></div> <div class="copyright svelte-i1g2nx">© 2024 Specy. All rights reserved.</div></div></footer><!----><!----> <!----><div class="toast-wrapper svelte-1lj56nd "><div class="toast-title svelte-1lj56nd" style="border-color:"><div></div> <div class="icon svelte-wuqdah" style="width:1.2rem; min-width: 1.2; height:1.2rem; ;"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 352 512" class="svelte-c8tyih"><!--[!--><!--]--><!----><path d="M242.72 256l100.07-100.07c12.28-12.28 12.28-32.19 0-44.48l-22.24-22.24c-12.28-12.28-32.19-12.28-44.48 0L176 189.28 75.93 89.21c-12.28-12.28-32.19-12.28-44.48 0L9.21 111.45c-12.28 12.28-12.28 32.19 0 44.48L109.28 256 9.21 356.07c-12.28 12.28-12.28 32.19 0 44.48l22.24 22.24c12.28 12.28 32.2 12.28 44.48 0L176 322.72l100.07 100.07c12.28 12.28 32.2 12.28 44.48 0l22.24-22.24c12.28-12.28 12.28-32.19 0-44.48L242.72 256z"></path><!----></svg><!----></div><!----></div> <div class="toast-text svelte-1lj56nd"></div> <div class="toast-progress svelte-1lj56nd"><div class="toast-progress-bar svelte-1lj56nd" style="
					animation-duration: 3000ms; 
					background-color: ;
				"></div></div></div><!----><!----></div><!----><!--]--> <!--[!--><div id="svelte-announcer" aria-live="assertive" aria-atomic="true" style="position: absolute; left: 0; top: 0; clip: rect(0 0 0 0); clip-path: inset(50%); overflow: hidden; white-space: nowrap; width: 1px; height: 1px"><!----></div><!--]--><!--]-->
			
			<script>
				{
					__sveltekit_ebjbud = {
						base: new URL("../..", location).pathname.slice(0, -1)
					};

					const element = document.currentScript.parentElement;

					const data = [null,null];

					Promise.all([
						import("../../_app/immutable/entry/start.BF5rBACD.js"),
						import("../../_app/immutable/entry/app.CoL6AP9I.js")
					]).then(([kit, app]) => {
						kit.start(app, element, {
							node_ids: [0, 5],
							data,
							form: null,
							error: null
						});
					});
				}
			</script>
		</div><ins class="adsbygoogle adsbygoogle-noablate" data-adsbygoogle-status="done" style="display: none !important;"><div id="aswift_0_host" style="border: none; height: 0px; width: 0px; margin: 0px; padding: 0px; position: relative; visibility: visible; background-color: transparent; display: inline-block;"><iframe id="aswift_0" name="aswift_0" style="left:0;position:absolute;top:0;border:0;width:undefinedpx;height:undefinedpx;" sandbox="allow-forms allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts allow-top-navigation-by-user-activation" frameborder="0" marginwidth="0" marginheight="0" vspace="0" hspace="0" allowtransparency="true" scrolling="no" src="https://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-8347249874872543&amp;output=html&amp;adk=1812271804&amp;adf=3025194257&amp;abgtt=6&amp;lmt=1731633253&amp;plat=1%3A8200%2C2%3A8200%2C3%3A2162688%2C4%3A2162688%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&amp;format=0x0&amp;url=https%3A%2F%2Fspecy.app%2Fblog%2Fposts%2Fa-rustc-soundness-bug-in-the-wild&amp;pra=5&amp;wgl=1&amp;aihb=0&amp;aiof=4&amp;asro=0&amp;ailel=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&amp;aiael=1~2~3~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&amp;aicel=33~38&amp;aifxl=29_18~30_19&amp;aiixl=29_5~30_6&amp;aiict=1&amp;itsi=-1&amp;aiopts=1&amp;aief=1&amp;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&amp;dt=1731633253476&amp;bpp=43&amp;bdt=273&amp;idt=370&amp;shv=r20241112&amp;mjsv=m202411130101&amp;ptt=9&amp;saldr=aa&amp;abxe=1&amp;eoidce=1&amp;nras=1&amp;correlator=3998395557235&amp;frm=20&amp;pv=2&amp;u_tz=0&amp;u_his=2&amp;u_h=1&amp;u_w=1&amp;u_ah=1&amp;u_aw=1&amp;u_cd=24&amp;u_sd=1&amp;dmc=2&amp;adx=-12245933&amp;ady=-12245933&amp;biw=796&amp;bih=600&amp;scr_x=0&amp;scr_y=0&amp;eid=42531706%2C95344187%2C31088996%2C95345967&amp;oid=2&amp;pvsid=4437084918971815&amp;tmod=408878720&amp;uas=0&amp;nvt=1&amp;fsapi=1&amp;fc=1920&amp;brdim=0%2C0%2C0%2C0%2C1%2C0%2C0%2C0%2C800%2C600&amp;vis=1&amp;rsz=%7C%7Cs%7C&amp;abl=NS&amp;fu=32768&amp;bc=31&amp;bz=0&amp;ifi=1&amp;uci=a!1&amp;fsb=1&amp;dtd=424" data-google-container-id="a!1" tabindex="0" title="Advertisement" aria-label="Advertisement" data-load-complete="true"></iframe></div></ins>


</body><iframe id="google_esf" name="google_esf" src="https://pagead2.googlesyndication.com/pagead/html/r20241112/r20190131/zrt_lookup_fy2021.html" style="display: none;"></iframe></html>