The address that recovered by the SignVerifyChip does not match the caller_address

[kunxian-xia]

What command(s) is the bug in?

cargo test -p zkevm-circuits --features "onephase, enable-sign-verify, reject-eip2718" --release tx_circuit_tests::tx_circuit_1tx_1max_tx  -- --nocapture

Describe the bug

Running a few unit test inside the tx_circuit in scroll-stable branch, we can get VerifyingErrors like

 constraint: Constraint {
       gate: Gate {
       index: 55,
       name: "caller address == sv_address if it's not zero",
    },
    index: 0,
    name: "caller address == sv_address",
},

In the branch fix/ecdsa_err I added an internal assertion that requires the address that is recovered from SignData(which is the only data sent to SignVerifyChip) equal to tx.caller_address.

zkevm-circuits/zkevm-circuits/src/tx_circuit.rs

Lines 1676 to 1683 in 58e27c8

	// assert tx.caller_address == recovered_pk
	for (sign_data, tx) in keccak_inputs_sign_verify(&sign_datas)
	.into_iter().zip(self.txs.iter())
	{
	let pk_hash = keccak(&sign_data);
	let address = pk_hash.to_address();
	assert_eq!(address, tx.caller_address);
	}

Therefore, I think there might be some bug inside the SignVerifyChip.

Concrete steps to reproduce the bug

No response