go-speculation-window-taint-cache-trace-leak-detector

Answer

The solution is complete and verified. Here's the summary.

Diagnosis

/workspace/problem.json has empty error_message and stack_trace — there is no pre-existing code to debug. This is a greenfield build, so the "root cause" is the set of classic failure modes a naive analyzer hits:

1. Stack exhaustion — recursive CFG DFS / taint re-evaluation on 10k blocks.
2. Heap blowup — per-instruction/per-path environments > 512 MB.
3. False positives — masking/clamping not proven, so bounded indices are reported.
4. Non-deterministic output — Go map iteration order leaking into JSON.
5. Wrong depth — first-seen/longest path instead of minimal observable depth.
6. Wrong Spectre semantics — treating bounds_check as a real clamp.

Fix

A monotone per-block worklist fixpoint over a combined taint × interval × alignment abstract domain (no recursion, no per-path state), a cache-line test (offsetLo>>L == offsetHi>>L on an aligned base) that suppresses masked/clamped indices, and an iterative BFS for minimal speculation depth. Output is built from sorted slices — maps are never marshalled.

Verification (all executed on go1.26)

• Correctness: 8 behavioural tests pass — direct leak with exact depth, &7 suppressed, &63 still leaks, clamp suppressed, transitive taint, post-spec_end omitted, byte-determinism, loop convergence.
• Scale: TestLargeProgram analyzes 200,003 instructions / 10,001 blocks in 309 ms, 83 MiB live heap.
• Real process: GOMEMLIMIT=384MiB binary on a 12 MB JSON IR → 145 MiB peak RSS, 0.84 s, 5,000 leaks + 5,000 suppressions, exit 0.
• Stack safety: stress test pins debug.SetMaxStack(16 MiB).
• Availability: go vet, gofmt, and go test -race all clean.

Artifacts

• /workspace/SOLUTION.md — self-contained report: root-cause analysis, schema, algorithm, complete source embedded.
• /workspace/go-speculation/ — working module (ir.go, lattice.go, analyzer.go, main.go, tests, tools/gen).

I also extracted the embedded sources from the markdown into a fresh directory and rebuilt them there — gofmt clean, go vet clean, all tests pass — proving the document is genuinely self-contained.