feat(fuzz): AST fuzzing with SSA interpreter by aakoshh · Pull Request #8436 · noir-lang/noir

aakoshh · 2025-05-09T14:17:25Z

Description

Problem*

Resolves #8413
Part of #8218

Summary*

Adds a new pass_vs_prev target, which uses the SSA interpreter to execute two consecutive passes and check that the results between them don't change.

Currently limited to the first 3 passes that participate in the canary audit.

Additional Context

This includes a few fixes for the SSA interpreter:

Allow u1 shifting
Handle negative integers

Regarding #8451 that came up testing this, we're discussing whether we should ban 0 array inputs (at least for main). If not, the mapping of ABI to SSA values should work differently when the parameter is call_data and an empty array, because the call_data expects empty arrays to be skipped, while normal data access expects them to be present.

Documentation*

Check one:

No documentation needed.
Documentation included in this PR.
[For Experimental Features] Documentation to be submitted in a separate PR.

PR Checklist*

I have tested the changes locally.
I have formatted the changes with Prettier and/or cargo fmt on default settings.

compiler/noirc_evaluator/src/ssa/interpreter/value.rs

…efix

github-actions

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Execution Time'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.

Benchmark suite	Current: `1e08d6d`	Previous: `6accfc6`	Ratio
`rollup-merge`	`0.004` s	`0.003` s	`1.33`

This comment was automatically generated by workflow using github-action-benchmark.

CC: @TomAFrench

…efix

compiler/noirc_evaluator/src/ssa/interpreter/value.rs

tooling/ast_fuzzer/src/compare/interpreted.rs

…efix

…f/8413-ast-fuzz-prefix

…efix

Automated pull of nightly from the [noir](https://github.com/noir-lang/noir) programming language, a dependency of Aztec. BEGIN_COMMIT_OVERRIDE fix(licm): Account for nested loops being control dependent when analyzing outer loops (noir-lang/noir#8593) chore(refactor): Switch unreachable function removal to use centralized call graph (noir-lang/noir#8578) chore(test): Allow lambdas in fuzzing (noir-lang/noir#8584) chore: use insta for execution_success stdout (noir-lang/noir#8576) chore: use generator instead of zero for ec-add predicate (noir-lang/noir#8552) fix: use predicate expression as binary result (noir-lang/noir#8583) fix(ssa): Do not generate apply functions when no lambda variants exist (noir-lang/noir#8573) chore: put `nargo expand` snapshosts in the same directory (noir-lang/noir#8577) chore: Use FxHashMap for TypeBindings (noir-lang/noir#8574) chore(experimental): use larger stack size for parsing (noir-lang/noir#8347) chore: use insta snapshots for compile_failure stderr (noir-lang/noir#8569) chore(inlining): Mark functions with <= 10 instructions and no control flow as inline always (noir-lang/noir#8533) chore(ssa): Add weighted edges to call graph, move callers and callees methods to call graph (noir-lang/noir#8513) fix(frontend): Override to allow empty array input (noir-lang/noir#8568) fix: avoid logging all unused params in DIE pass (noir-lang/noir#8566) chore: bump external pinned commits (noir-lang/noir#8562) chore(deps): bump base-x from 3.0.9 to 3.0.11 (noir-lang/noir#8555) chore(fuzz): Call function pointers (noir-lang/noir#8531) feat: C++ codegen for msgpack (noir-lang/noir#7716) feat(performance): brillig array set optimization (noir-lang/noir#8550) chore(fuzz): AST fuzzer to use function valued arguments (Part 1) (noir-lang/noir#8514) fix(licm): Check whether the loop is executed when hoisting with a predicate (noir-lang/noir#8546) feat: Implement $crate (noir-lang/noir#8537) fix: add offset to ArrayGet (noir-lang/noir#8536) chore: remove some unused enum variants and functions (noir-lang/noir#8538) fix: disallow `()` in entry points (noir-lang/noir#8529) chore: Remove println in ssa interpreter (noir-lang/noir#8528) fix: don't overflow when casting signed value to u128 (noir-lang/noir#8526) chore(performance): Enable hoisting pure with predicate calls (noir-lang/noir#8522) feat(fuzz): AST fuzzing with SSA interpreter (noir-lang/noir#8436) chore: Add u1 ops to interpreter, convert Value panics to errors (noir-lang/noir#8469) chore: Release Noir(1.0.0-beta.6) (noir-lang/noir#8438) chore(fuzz): AST generator to add `ctx_limit` to all functions (noir-lang/noir#8507) fix(inlining): Use centralized CallGraph structure for inline info computation (noir-lang/noir#8489) fix: remove private builtins from `Field` impl (noir-lang/noir#8496) feat: primitive types are no longer keywords (noir-lang/noir#8470) fix: parenthesized pattern, and correct 1-element tuple printing (noir-lang/noir#8482) fix: fix visibility of methods in `std::meta` (noir-lang/noir#8497) fix: Change `can_be_main` to be recursive (noir-lang/noir#8501) chore: add SSA interpreter test for higher order functions (noir-lang/noir#8486) fix(frontend)!: Ban zero sized arrays and strings as program input (noir-lang/noir#8491) fix!: remove `to_be_radix` and `to_le_radix` from stdlib interface (noir-lang/noir#8495) END_COMMIT_OVERRIDE --------- Co-authored-by: AztecBot <tech@aztecprotocol.com> Co-authored-by: Tom French <15848336+TomAFrench@users.noreply.github.com>

aakoshh added 5 commits May 9, 2025 15:14

Skeleton of an SSA interpreter based fuzz target

ac0bf6e

Make SSA interpreter parts public

828ff75

Make results generic. Add interpreted results

f8e2a26

Map ABI input to SSA

5b2b12f

Add cargo fuzz target

3b730c6

jfecher reviewed May 9, 2025

View reviewed changes

compiler/noirc_evaluator/src/ssa/interpreter/value.rs Show resolved Hide resolved

aakoshh added 10 commits May 9, 2025 15:57

Build the inputs from the SSA

3879323

Remove println

9e588d8

Print SSA inputs

ec4b77e

Fix negative int handling in the interpreter

97e446d

Map ABI types into specific numeric value

38e18b7

Merge remote-tracking branch 'origin/master' into af/8413-ast-fuzz-pr…

d81213d

…efix

Ignore value IDs in error comparison

3b96985

Fix SSA input formatting

43e91b6

Pass tuples as separate values

c233781

Fix negative int conversion to Field in the interpreter

1e08d6d

github-actions bot reviewed May 12, 2025

View reviewed changes

aakoshh added 5 commits May 12, 2025 13:00

Flatten tuples wherever they are

a8a3801

Use Comparable::equivalent for results as well as error

44c403f

Allow shifting u1

3608983

Comparable to recurse into the element

4b66ef3

Merge remote-tracking branch 'origin/master' into af/8413-ast-fuzz-pr…

b219fc0

…efix

aakoshh mentioned this pull request May 12, 2025

SSA interpreter does not handle databus array indexing #8450

Closed

Avoid call_data parameters for now

b354cea

aakoshh marked this pull request as ready for review May 12, 2025 15:50

aakoshh requested a review from a team May 12, 2025 15:50

jfecher reviewed May 12, 2025

View reviewed changes

compiler/noirc_evaluator/src/ssa/interpreter/value.rs Outdated Show resolved Hide resolved

Allow arithmetic operations on u1 in the interpreter

c0013f2

This was referenced May 12, 2025

SSA Interpreter error: "array get index" got Field instead of u32 #8459

Closed

SSA Interpreter error: "Expected Field value in call to to_bits but instead found u8" #8461

Closed

Add test that shows wrong value returned by the SSA interpreter

fc98481

rkarabut reviewed May 14, 2025

View reviewed changes

tooling/ast_fuzzer/src/compare/interpreted.rs Outdated Show resolved Hide resolved

aakoshh and others added 6 commits May 14, 2025 12:14

Use log::debug! for printing stuff up front

2b1b9e9

Compare the details in Overflows

02e4f4d

Merge remote-tracking branch 'origin/master' into af/8413-ast-fuzz-pr…

caead66

…efix

'fix' casting and truncate

6c76d5c

Merge branch 'master' into jf/interpreter-additions

25ee60e

New test on master needed to be updated

fdbeed9

rkarabut self-requested a review May 15, 2025 06:29

rkarabut approved these changes May 15, 2025

View reviewed changes

aakoshh added 5 commits May 15, 2025 09:55

Merge remote-tracking branch 'origin/jf/interpreter-additions' into a…

5c573bd

…f/8413-ast-fuzz-prefix

Fix clippy

14b4487

Merge remote-tracking branch 'origin/master' into af/8413-ast-fuzz-pr…

5441875

…efix

Fix merge

eddf15e

Enable fuzzing morphs and the SSA interpreter on CI

bb532cc

aakoshh added this pull request to the merge queue May 15, 2025

Merged via the queue into master with commit bc6cf4f May 15, 2025
119 checks passed

aakoshh deleted the af/8413-ast-fuzz-prefix branch May 15, 2025 10:51

noirwhal mentioned this pull request May 15, 2025

chore: Release Noir(1.0.0-beta.7) #8520

Merged

AztecBot mentioned this pull request May 22, 2025

chore(next): release 1.0.0 AztecProtocol/aztec-packages#14467

Closed

AztecBot mentioned this pull request May 23, 2025

chore(next): release 0.88.0 AztecProtocol/aztec-packages#14495

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(fuzz): AST fuzzing with SSA interpreter#8436

feat(fuzz): AST fuzzing with SSA interpreter#8436
aakoshh merged 49 commits intomasterfrom
af/8413-ast-fuzz-prefix

aakoshh commented May 9, 2025 •

edited

Loading

Uh oh!

Uh oh!

github-actions bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

aakoshh commented May 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Problem*

Summary*

Additional Context

Documentation*

PR Checklist*

Uh oh!

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

⚠️ Performance Alert ⚠️

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aakoshh commented May 9, 2025 •

edited

Loading