crash (FATAL: StorageLedger/merge) during statetest execution

[holiman]

The fuzzer found a case where the nimbus vm doesn't output a stateroot:
After using the minimizer, testing it in isolation:

root@16dfddf11bb5:/# /nimbvm --json --noreturndata --nomemory --nostorage /fuzztmp/00094809-mixed-5.json.min 
{"pc":0,"op":124,"gas":"0xf1de","gasCost":"0x3","memSize":0,"stack":[],"depth":1,"refund":0,"opName":"PUSH29"}
{"pc":30,"op":96,"gas":"0xf1db","gasCost":"0x3","memSize":0,"stack":["0x76295866ff4036c9b107f600260005560015450600160025560035450"],"depth":1,"refund":0,"opName":"PUSH1"}
{"pc":32,"op":84,"gas":"0xf1d8","gasCost":"0x834","memSize":0,"stack":["0x76295866ff4036c9b107f600260005560015450600160025560035450","0x9"],"depth":1,"refund":0,"opName":"SLOAD"}
{"pc":33,"op":80,"gas":"0xe9a4","gasCost":"0x2","memSize":0,"stack":["0x76295866ff4036c9b107f600260005560015450600160025560035450","0x0"],"depth":1,"refund":0,"opName":"POP"}
{"pc":34,"op":96,"gas":"0xe9a2","gasCost":"0x3","memSize":0,"stack":["0x76295866ff4036c9b107f600260005560015450600160025560035450"],"depth":1,"refund":0,"opName":"PUSH1"}
{"pc":36,"op":96,"gas":"0xe99f","gasCost":"0x3","memSize":0,"stack":["0x76295866ff4036c9b107f600260005560015450600160025560035450","0x2"],"depth":1,"refund":0,"opName":"PUSH1"}
{"pc":38,"op":85,"gas":"0xe99c","gasCost":"0x5654","memSize":0,"stack":["0x76295866ff4036c9b107f600260005560015450600160025560035450","0x2","0x2"],"depth":1,"refund":0,"opName":"SSTORE"}
{"pc":39,"op":96,"gas":"0x9348","gasCost":"0x3","memSize":0,"stack":["0x76295866ff4036c9b107f600260005560015450600160025560035450"],"depth":1,"refund":0,"opName":"PUSH1"}
{"pc":41,"op":96,"gas":"0x9345","gasCost":"0x3","memSize":0,"stack":["0x76295866ff4036c9b107f600260005560015450600160025560035450","0x0"],"depth":1,"refund":0,"opName":"PUSH1"}
{"pc":43,"op":85,"gas":"0x9342","gasCost":"0x1388","memSize":0,"stack":["0x76295866ff4036c9b107f600260005560015450600160025560035450","0x0","0x0"],"depth":1,"refund":0,"opName":"SSTORE"}
{"pc":44,"op":96,"gas":"0x7fba","gasCost":"0x3","memSize":0,"stack":["0x76295866ff4036c9b107f600260005560015450600160025560035450"],"depth":1,"refund":4800,"opName":"PUSH1"}
{"pc":46,"op":82,"gas":"0x7fb7","gasCost":"0x6","memSize":0,"stack":["0x76295866ff4036c9b107f600260005560015450600160025560035450","0x0"],"depth":1,"refund":0,"opName":"MSTORE"}
{"pc":47,"op":127,"gas":"0x7fb1","gasCost":"0x3","memSize":32,"stack":[],"depth":1,"refund":4800,"opName":"PUSH32"}
{"output":"","gasUsed":"0x5f70"}
FATAL: StorageLedger/merge(): Unspecified(Aristo, ctx=mergeFn(), error=UtilsAccWrongStorageRoot)

Minimized testcase:

{
  "00094809-mixed-5": {
    "env": {
      "currentCoinbase": "b94f5374fce5edbc8e2a8697c15331677e6ebf0b",
      "currentDifficulty": "0x200000",
      "currentRandom": "0x0000000000000000000000000000000000000000000000000000000000200000",
      "currentGasLimit": "0x26e1f476fe1e22",
      "currentNumber": "0x1",
      "currentTimestamp": "0x3e8",
      "previousHash": "0x044852b2a670ade5407e78fb2863c51de9fcb96542a07186fe3aeda6bb8a116d",
      "currentBaseFee": "0x10"
    },
    "pre": {
      "0x00000000000000000000000000000000000000f1": {
        "code": "0x7c076295866ff4036c9b107f60026000556001545060016002556003545060095450600260025560006000556000527f60016000557f7f60",
        "storage": {
          "0x0000000000000000000000000000000000000000000000000000000000000000": "0x0000000000000000000000000000000000000000000000000000000000000008"
        },
        "balance": "0x0",
        "nonce": "0x0"
      },
      "0xa94f5374fce5edbc8e2a8697c15331677e6ebf0b": {
        "code": "0x",
        "storage": {},
        "balance": "0xffffffffff",
        "nonce": "0x0"
      }
    },
    "transaction": {
      "gasPrice": "0x10",
      "nonce": "0x0",
      "to": "0x00000000000000000000000000000000000000f1",
      "data": [
        "0x1cf2af2f3707a3c842e804ffbb6a636a14c75a3b3af7a2ed0d0f8eafbefa3b1dd847338705e2ff4b6f7d1210dbc54c8cd372d4239de86e40838977e6a3ce2eb989a8e5631803b2db3a4d"
      ],
      "gasLimit": [
        "0x14886"
      ],
      "value": [
        "0x"
      ],
      "sender": "0xa94f5374fce5edbc8e2a8697c15331677e6ebf0b",
      "secretKey": "0x45a915e4d060149eb4365960e6a7a45f334393093061116b197e3240065ff2d8"
    },
    "out": "0x",
    "post": {
      "Merge": [
        {
          "hash": "0x0000000000000000000000000000000000000000000000000000000000000000",
          "logs": "0x0000000000000000000000000000000000000000000000000000000000000000",
          "indexes": {
            "data": 0,
            "gas": 0,
            "value": 0
          }
        }
      ]
    }
  }
}

[jangko]

It's a known regression, thanks for reporting. We are still hunting for it.

[arnetheduck]

nice! these small repros are excellent.