bellpepper-emulated: Avoid AssignmentMissing error when using MetricCS

crates/ed25519/Cargo.toml

@@ -25,3 +25,4 @@ getrandom = { version = "0.2.0", default-features = false, features = ["js"] }
 
 [dev-dependencies]
 pasta_curves = { workspace = true }
+bellpepper = { workspace = true }

crates/ed25519/src/circuit.rs

@@ -488,6 +488,7 @@ mod tests {
     use crate::curve::Ed25519Curve;
 
     use super::*;
+    use bellpepper::util_cs::metric_cs::MetricCS;
     use bellpepper_core::test_cs::TestConstraintSystem;
     use num_bigint::{BigUint, RandBigInt};
     use num_integer::Integer;
@@ -729,4 +730,45 @@ mod tests {
         assert!(cs.is_satisfied());
         cs.num_constraints()
     }
+
+    #[test]
+    fn alloc_affine_scalar_multiplication_metric_cs() {
+        let b = Ed25519Curve::basepoint();
+        let mut rng = rand::thread_rng();
+
+        let mut scalar = rng.gen_biguint(256u64);
+        scalar >>= 3; // scalar now has 253 significant bits
+        let p = Ed25519Curve::scalar_multiplication(&b, &scalar);
+
+        let mut scalar_vec: Vec<Boolean> = vec![];
+        for _i in 0..253 {
+            if scalar.is_odd() {
+                scalar_vec.push(Boolean::constant(true))
+            } else {
+                scalar_vec.push(Boolean::constant(false))
+            };
+            scalar >>= 1;
+        }
+
+        let mut cs = MetricCS::<Fp>::new();
+
+        let b_alloc = AllocatedAffinePoint::alloc_affine_point(
+            &mut cs.namespace(|| "allocate base point"),
+            &b,
+        );
+        assert!(b_alloc.is_ok());
+        let b_al = b_alloc.unwrap();
+
+        let p_alloc = b_al.ed25519_scalar_multiplication(
+            &mut cs.namespace(|| "scalar multiplication"),
+            &scalar_vec,
+        );
+        assert!(p_alloc.is_ok());
+        let p_al = p_alloc.unwrap();
+
+        assert_eq!(p, p_al.value);
+
+        assert_eq!(cs.num_constraints(), 798_750);
+        assert_eq!(cs.num_inputs(), 1);
+    }
 }

crates/emulated/src/field_element.rs

@@ -627,29 +627,36 @@ where
         let res_overflow = a1.overflow.max(a0.overflow);
 
         let res_alloc_limbs = if let Some(cond) = condition.get_value() {
-            // If the condition has a value, then the limbs must also have a value, so we bubble
-            // the assignment missing error in this case
             let res_values = if cond {
                 match &a1.limbs {
                     EmulatedLimbs::Allocated(a1_var) => a1_var
                         .iter()
-                        .map(|v| v.get_value().ok_or(SynthesisError::AssignmentMissing))
-                        .collect::<Result<_, _>>()?,
-                    EmulatedLimbs::Constant(a1_const) => a1_const.clone(),
+                        .map(|v| v.get_value())
+                        .collect::<Option<Vec<_>>>(),
+                    EmulatedLimbs::Constant(a1_const) => Some(a1_const.clone()),
                 }
             } else {
                 match &a0.limbs {
                     EmulatedLimbs::Allocated(a0_var) => a0_var
                         .iter()
-                        .map(|v| v.get_value().ok_or(SynthesisError::AssignmentMissing))
-                        .collect::<Result<_, _>>()?,
-                    EmulatedLimbs::Constant(a0_const) => a0_const.clone(),
+                        .map(|v| v.get_value())
+                        .collect::<Option<Vec<_>>>(),
+                    EmulatedLimbs::Constant(a0_const) => Some(a0_const.clone()),
                 }
             };
-            EmulatedLimbs::allocate_limbs(
-                &mut cs.namespace(|| "allocate result limbs"),
-                &res_values,
-            )
+
+            if let Some(res_values) = res_values {
+                EmulatedLimbs::allocate_limbs(
+                    &mut cs.namespace(|| "allocate result limbs"),
+                    &res_values,
+                )
+            } else {
+                // Allocate "empty" limbs in case this is a MetricCS
+                EmulatedLimbs::allocate_empty_limbs(
+                    &mut cs.namespace(|| "allocate result limbs"),
+                    limb_count,
+                )?
+            }
         } else {
             // Otherwise, allocate "empty" limbs in case this is a MetricCS or TestCS
             EmulatedLimbs::allocate_empty_limbs(

crates/emulated/src/util.rs

@@ -121,15 +121,19 @@ pub fn alloc_num_equals_constant<F: PrimeField, CS: ConstraintSystem<F>>(
 ) -> Result<AllocatedBit, SynthesisError> {
     // Allocate and constrain `r`: result boolean bit.
     // It equals `true` if `a` equals `b`, `false` otherwise
-    let a_value = a.get_value().ok_or(SynthesisError::AssignmentMissing)?;
-    let r = AllocatedBit::alloc(cs.namespace(|| "r"), Some(a_value == b))?;
-
     // Allocate t s.t. t=1 if a == b else 1/(a - b)
-    let t_value = if a_value == b {
-        F::ONE
+    let (r_value, t_value) = if let Some(a_value) = a.get_value() {
+        let t_value = if a_value == b {
+            F::ONE
+        } else {
+            (a_value - b).invert().unwrap()
+        };
+        (Some(a_value == b), t_value)
     } else {
-        (a_value - b).invert().unwrap()
+        (None, F::ONE)
     };
+
+    let r = AllocatedBit::alloc(cs.namespace(|| "r"), r_value)?;
     let t = AllocatedNum::alloc_infallible(cs.namespace(|| "t"), || t_value);
 
     cs.enforce(