feat(ssa_fuzzer): custom mutations by defkit · Pull Request #8988 · noir-lang/noir

defkit · 2025-06-20T16:02:24Z

Description

Problem*

Right now the ssa_fuzzer generates random bytes which are converted into FuzzerData using Arbitrary and then mutates these bytes with bytes mutations (insert byte, erase byte etc.). This is not very efficient because cargo-fuzz default mutations have almost random effect on the resulting FuzzerData.

Summary*

Added custom mutations
Number of executions per second increased by 6 times on average

Additional Context

Cargo-fuzz doesn't support custom structure mutations, so now fuzzer generates bincode serialized FuzzerData

Documentation*

Check one:

No documentation needed.
Documentation included in this PR.
[For Experimental Features] Documentation to be submitted in a separate PR.

PR Checklist*

I have tested the changes locally.
I have formatted the changes with Prettier and/or cargo fmt on default settings.

github-actions

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Test Suite Duration'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.

Benchmark suite	Current: `21744e2`	Previous: `3838c69`	Ratio
`test_report_AztecProtocol_aztec-packages_noir-projects_noir-protocol-circuits_crates_blob`	`173` s	`141` s	`1.23`

This comment was automatically generated by workflow using github-action-benchmark.

CC: @TomAFrench

…rigin' into sn/ssa_fuzzer_mutations

tooling/ssa_fuzzer/fuzzer/src/mutations/mod.rs

tooling/ssa_fuzzer/fuzzer/src/mutations/instructions/mod.rs

tooling/ssa_fuzzer/fuzzer/src/mutations/instructions/instruction_mutator.rs

tooling/ssa_fuzzer/fuzzer/src/mutations/instructions/instruction_block_mutator.rs

tooling/ssa_fuzzer/fuzzer/src/mutations/witness_mutator.rs

Automated pull of nightly from the [noir](https://github.com/noir-lang/noir) programming language, a dependency of Aztec. BEGIN_COMMIT_OVERRIDE fix: check both coordinates for point doubling (noir-lang/noir#9039) fix: codegen generic type arguments (noir-lang/noir#9044) chore: remove accidentally committed files (noir-lang/noir#9048) fix(fuzz): enable print in comptime_vs_brillig_direct (noir-lang/noir#9045) chore: move a couple of test_utils functions into a module (noir-lang/noir#9052) chore: bump external pinned commits (noir-lang/noir#9046) fix: put constraint failure after binary operations that overflow (noir-lang/noir#9023) fix(ssa): Remove array from cache in constant folding if it's an argument to a `Call` (noir-lang/noir#9040) feat: some `nargo expand` fixes related to function and method calls (noir-lang/noir#9038) feat(ssa_fuzzer): custom mutations (noir-lang/noir#8988) feat: implicit coercion of str and fmtstr into CtString (noir-lang/noir#9032) chore: add idempotency check to `remove_unreachable_functions` (noir-lang/noir#9017) chore: add logging for signature failure cases which break barretenberg (noir-lang/noir#9030) feat(ssa): Handle `println` in the SSA interpreter (noir-lang/noir#9028) chore: don't compute used globals during DIE (noir-lang/noir#9029) fix(ssa_fuzzer): nested conditions in loops (noir-lang/noir#8997) fix(fuzz): Consider `==` turning into `!=` equivalent (noir-lang/noir#9025) fix(fuzz): Avoid overflow in `gen_unary` (noir-lang/noir#9024) fix(ssa): Perform `mem2reg` before DIE (noir-lang/noir#9018) fix: Strange use of predicates in euclidian division (noir-lang/noir#8934) fix: compute the dominance frontier of the reverse cfg using the extended cfg (noir-lang/noir#9019) fix(fuzz): Handle overflow errors from the elaborator (noir-lang/noir#9014) feat: show why an assertion will always fail if it's a static string (noir-lang/noir#9013) chore(ssa): Add `SsaPass:and_then` (noir-lang/noir#9016) fix: Add a remove_unreachable_instructions SSA pass (with unreachable terminator) (noir-lang/noir#9008) feat: `nargo expand` for LSP (noir-lang/noir#9012) fix(mem2reg): Add the value in `ArraySet` to `aliased_references` (noir-lang/noir#8976) feat(debug): Print ssa locations along with ssa (noir-lang/noir#9001) chore: move `nargo expand` code to its own crate (noir-lang/noir#9011) chore: redo typo PR by donatik27 (noir-lang/noir#9004) fix: recover generics when defining trait impl function (noir-lang/noir#9009) fix: replace public key with curve generators in inactive branches (noir-lang/noir#8993) fix(fuzz): Avoid overflowing binary ops in "no dynamic" mode (noir-lang/noir#8996) END_COMMIT_OVERRIDE --------- Co-authored-by: AztecBot <tech@aztecprotocol.com> Co-authored-by: Tom French <15848336+TomAFrench@users.noreply.github.com> Co-authored-by: Ary Borenszweig <asterite@gmail.com>

Automated pull of nightly from the [noir](https://github.com/noir-lang/noir) programming language, a dependency of Aztec. BEGIN_COMMIT_OVERRIDE chore(docs): Brillig VM docs (noir-lang/noir#9078) fix(expand): missing struct member visibility, and use "crate" instead of "super" when possible (noir-lang/noir#9081) fix: revert #9044 (noir-lang/noir#9080) chore: error on infinite recursion (noir-lang/noir#9063) fix(fuzz): Assign to an index variable to sequence side effects (noir-lang/noir#9056) chore: bump cargo deny (noir-lang/noir#9077) chore: Refactor `ConstrainEqFailed` to have `Option<String>` for `msg` (noir-lang/noir#9065) chore(debug): Toggle SSA locations when printing SSA (noir-lang/noir#9066) chore(acir_gen): Improve error message for radix decomposition (noir-lang/noir#9068) chore(ci): fix upload of benchmark results on master (noir-lang/noir#9069) fix: check both coordinates for point doubling (noir-lang/noir#9039) fix: codegen generic type arguments (noir-lang/noir#9044) chore: remove accidentally committed files (noir-lang/noir#9048) fix(fuzz): enable print in comptime_vs_brillig_direct (noir-lang/noir#9045) chore: move a couple of test_utils functions into a module (noir-lang/noir#9052) chore: bump external pinned commits (noir-lang/noir#9046) fix: put constraint failure after binary operations that overflow (noir-lang/noir#9023) fix(ssa): Remove array from cache in constant folding if it's an argument to a `Call` (noir-lang/noir#9040) feat: some `nargo expand` fixes related to function and method calls (noir-lang/noir#9038) feat(ssa_fuzzer): custom mutations (noir-lang/noir#8988) feat: implicit coercion of str and fmtstr into CtString (noir-lang/noir#9032) chore: add idempotency check to `remove_unreachable_functions` (noir-lang/noir#9017) chore: add logging for signature failure cases which break barretenberg (noir-lang/noir#9030) feat(ssa): Handle `println` in the SSA interpreter (noir-lang/noir#9028) chore: don't compute used globals during DIE (noir-lang/noir#9029) fix(ssa_fuzzer): nested conditions in loops (noir-lang/noir#8997) fix(fuzz): Consider `==` turning into `!=` equivalent (noir-lang/noir#9025) fix(fuzz): Avoid overflow in `gen_unary` (noir-lang/noir#9024) fix(ssa): Perform `mem2reg` before DIE (noir-lang/noir#9018) fix: Strange use of predicates in euclidian division (noir-lang/noir#8934) fix: compute the dominance frontier of the reverse cfg using the extended cfg (noir-lang/noir#9019) fix(fuzz): Handle overflow errors from the elaborator (noir-lang/noir#9014) feat: show why an assertion will always fail if it's a static string (noir-lang/noir#9013) chore(ssa): Add `SsaPass:and_then` (noir-lang/noir#9016) fix: Add a remove_unreachable_instructions SSA pass (with unreachable terminator) (noir-lang/noir#9008) feat: `nargo expand` for LSP (noir-lang/noir#9012) fix(mem2reg): Add the value in `ArraySet` to `aliased_references` (noir-lang/noir#8976) feat(debug): Print ssa locations along with ssa (noir-lang/noir#9001) chore: move `nargo expand` code to its own crate (noir-lang/noir#9011) chore: redo typo PR by donatik27 (noir-lang/noir#9004) fix: recover generics when defining trait impl function (noir-lang/noir#9009) fix: replace public key with curve generators in inactive branches (noir-lang/noir#8993) fix(fuzz): Avoid overflowing binary ops in "no dynamic" mode (noir-lang/noir#8996) END_COMMIT_OVERRIDE --------- Co-authored-by: AztecBot <tech@aztecprotocol.com> Co-authored-by: Tom French <15848336+TomAFrench@users.noreply.github.com> Co-authored-by: Ary Borenszweig <asterite@gmail.com>

Automated pull of nightly from the [noir](https://github.com/noir-lang/noir) programming language, a dependency of Aztec. BEGIN_COMMIT_OVERRIDE chore(docs): Brillig VM docs (noir-lang/noir#9078) fix(expand): missing struct member visibility, and use "crate" instead of "super" when possible (noir-lang/noir#9081) fix: revert AztecProtocol#9044 (noir-lang/noir#9080) chore: error on infinite recursion (noir-lang/noir#9063) fix(fuzz): Assign to an index variable to sequence side effects (noir-lang/noir#9056) chore: bump cargo deny (noir-lang/noir#9077) chore: Refactor `ConstrainEqFailed` to have `Option<String>` for `msg` (noir-lang/noir#9065) chore(debug): Toggle SSA locations when printing SSA (noir-lang/noir#9066) chore(acir_gen): Improve error message for radix decomposition (noir-lang/noir#9068) chore(ci): fix upload of benchmark results on master (noir-lang/noir#9069) fix: check both coordinates for point doubling (noir-lang/noir#9039) fix: codegen generic type arguments (noir-lang/noir#9044) chore: remove accidentally committed files (noir-lang/noir#9048) fix(fuzz): enable print in comptime_vs_brillig_direct (noir-lang/noir#9045) chore: move a couple of test_utils functions into a module (noir-lang/noir#9052) chore: bump external pinned commits (noir-lang/noir#9046) fix: put constraint failure after binary operations that overflow (noir-lang/noir#9023) fix(ssa): Remove array from cache in constant folding if it's an argument to a `Call` (noir-lang/noir#9040) feat: some `nargo expand` fixes related to function and method calls (noir-lang/noir#9038) feat(ssa_fuzzer): custom mutations (noir-lang/noir#8988) feat: implicit coercion of str and fmtstr into CtString (noir-lang/noir#9032) chore: add idempotency check to `remove_unreachable_functions` (noir-lang/noir#9017) chore: add logging for signature failure cases which break barretenberg (noir-lang/noir#9030) feat(ssa): Handle `println` in the SSA interpreter (noir-lang/noir#9028) chore: don't compute used globals during DIE (noir-lang/noir#9029) fix(ssa_fuzzer): nested conditions in loops (noir-lang/noir#8997) fix(fuzz): Consider `==` turning into `!=` equivalent (noir-lang/noir#9025) fix(fuzz): Avoid overflow in `gen_unary` (noir-lang/noir#9024) fix(ssa): Perform `mem2reg` before DIE (noir-lang/noir#9018) fix: Strange use of predicates in euclidian division (noir-lang/noir#8934) fix: compute the dominance frontier of the reverse cfg using the extended cfg (noir-lang/noir#9019) fix(fuzz): Handle overflow errors from the elaborator (noir-lang/noir#9014) feat: show why an assertion will always fail if it's a static string (noir-lang/noir#9013) chore(ssa): Add `SsaPass:and_then` (noir-lang/noir#9016) fix: Add a remove_unreachable_instructions SSA pass (with unreachable terminator) (noir-lang/noir#9008) feat: `nargo expand` for LSP (noir-lang/noir#9012) fix(mem2reg): Add the value in `ArraySet` to `aliased_references` (noir-lang/noir#8976) feat(debug): Print ssa locations along with ssa (noir-lang/noir#9001) chore: move `nargo expand` code to its own crate (noir-lang/noir#9011) chore: redo typo PR by donatik27 (noir-lang/noir#9004) fix: recover generics when defining trait impl function (noir-lang/noir#9009) fix: replace public key with curve generators in inactive branches (noir-lang/noir#8993) fix(fuzz): Avoid overflowing binary ops in "no dynamic" mode (noir-lang/noir#8996) END_COMMIT_OVERRIDE --------- Co-authored-by: AztecBot <tech@aztecprotocol.com> Co-authored-by: Tom French <15848336+TomAFrench@users.noreply.github.com> Co-authored-by: Ary Borenszweig <asterite@gmail.com>

Automated pull of nightly from the [noir](https://github.com/noir-lang/noir) programming language, a dependency of Aztec. BEGIN_COMMIT_OVERRIDE chore(docs): Brillig VM docs (noir-lang/noir#9078) fix(expand): missing struct member visibility, and use "crate" instead of "super" when possible (noir-lang/noir#9081) fix: revert #9044 (noir-lang/noir#9080) chore: error on infinite recursion (noir-lang/noir#9063) fix(fuzz): Assign to an index variable to sequence side effects (noir-lang/noir#9056) chore: bump cargo deny (noir-lang/noir#9077) chore: Refactor `ConstrainEqFailed` to have `Option<String>` for `msg` (noir-lang/noir#9065) chore(debug): Toggle SSA locations when printing SSA (noir-lang/noir#9066) chore(acir_gen): Improve error message for radix decomposition (noir-lang/noir#9068) chore(ci): fix upload of benchmark results on master (noir-lang/noir#9069) fix: check both coordinates for point doubling (noir-lang/noir#9039) fix: codegen generic type arguments (noir-lang/noir#9044) chore: remove accidentally committed files (noir-lang/noir#9048) fix(fuzz): enable print in comptime_vs_brillig_direct (noir-lang/noir#9045) chore: move a couple of test_utils functions into a module (noir-lang/noir#9052) chore: bump external pinned commits (noir-lang/noir#9046) fix: put constraint failure after binary operations that overflow (noir-lang/noir#9023) fix(ssa): Remove array from cache in constant folding if it's an argument to a `Call` (noir-lang/noir#9040) feat: some `nargo expand` fixes related to function and method calls (noir-lang/noir#9038) feat(ssa_fuzzer): custom mutations (noir-lang/noir#8988) feat: implicit coercion of str and fmtstr into CtString (noir-lang/noir#9032) chore: add idempotency check to `remove_unreachable_functions` (noir-lang/noir#9017) chore: add logging for signature failure cases which break barretenberg (noir-lang/noir#9030) feat(ssa): Handle `println` in the SSA interpreter (noir-lang/noir#9028) chore: don't compute used globals during DIE (noir-lang/noir#9029) fix(ssa_fuzzer): nested conditions in loops (noir-lang/noir#8997) fix(fuzz): Consider `==` turning into `!=` equivalent (noir-lang/noir#9025) fix(fuzz): Avoid overflow in `gen_unary` (noir-lang/noir#9024) fix(ssa): Perform `mem2reg` before DIE (noir-lang/noir#9018) fix: Strange use of predicates in euclidian division (noir-lang/noir#8934) fix: compute the dominance frontier of the reverse cfg using the extended cfg (noir-lang/noir#9019) fix(fuzz): Handle overflow errors from the elaborator (noir-lang/noir#9014) feat: show why an assertion will always fail if it's a static string (noir-lang/noir#9013) chore(ssa): Add `SsaPass:and_then` (noir-lang/noir#9016) fix: Add a remove_unreachable_instructions SSA pass (with unreachable terminator) (noir-lang/noir#9008) feat: `nargo expand` for LSP (noir-lang/noir#9012) fix(mem2reg): Add the value in `ArraySet` to `aliased_references` (noir-lang/noir#8976) feat(debug): Print ssa locations along with ssa (noir-lang/noir#9001) chore: move `nargo expand` code to its own crate (noir-lang/noir#9011) chore: redo typo PR by donatik27 (noir-lang/noir#9004) fix: recover generics when defining trait impl function (noir-lang/noir#9009) fix: replace public key with curve generators in inactive branches (noir-lang/noir#8993) fix(fuzz): Avoid overflowing binary ops in "no dynamic" mode (noir-lang/noir#8996) END_COMMIT_OVERRIDE --------- Co-authored-by: AztecBot <tech@aztecprotocol.com> Co-authored-by: Tom French <15848336+TomAFrench@users.noreply.github.com> Co-authored-by: Ary Borenszweig <asterite@gmail.com>

defkit added 12 commits June 11, 2025 11:15

squash sn/ssa_fuzzer_cycles

fcad0b1

wip

5d3fa30

wip

593e4b3

wip

0705e1f

HUGE WIP

f32b326

MEGA WIP

469e198

fixing

23d3be6

HOLY COW IT WORKS AND WORKS GOOD

fe65aed

tidy

1f6cf9c

merging

6356478

i forgor to reolsve conliefieifsiefiesifsiefjaosjefasfbrrrrrbrr

f374a7b

clippy

21744e2

github-actions bot reviewed Jun 20, 2025

View reviewed changes

defkit requested a review from Rumata888 June 20, 2025 16:43

defkit added 6 commits June 22, 2025 16:02

a

0447c89

src/fuzz_lib/base_context.rs

c75a3fb

init

98884c1

docs

507bd9a

Merge branch 'sn/nested_if_else_in_cycles', remote-tracking branch 'o…

6e86640

…rigin' into sn/ssa_fuzzer_mutations

amogus

ef304e4

Rumata888 requested changes Jun 23, 2025

View reviewed changes

defkit added 5 commits June 23, 2025 21:07

a

5d42ad4

KILL ALL FACTORIES

03ecd6d

follow comments

2e495f4

clippy

b1b873e

remove unrelated changes

1e8c3f4

defkit requested a review from Rumata888 June 23, 2025 23:54

Rumata888 approved these changes Jun 27, 2025

View reviewed changes

defkit added this pull request to the merge queue Jun 27, 2025

Merged via the queue into master with commit 4f52a7a Jun 27, 2025
119 checks passed

defkit deleted the sn/ssa_fuzzer_mutations branch June 27, 2025 16:35

noirwhal mentioned this pull request Jun 27, 2025

chore: Release Noir(1.0.0-beta.8) #8892

Merged

AztecBot mentioned this pull request Jun 28, 2025

chore: Bump Noir reference AztecProtocol/aztec-packages#15265

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(ssa_fuzzer): custom mutations#8988

feat(ssa_fuzzer): custom mutations#8988
defkit merged 23 commits intomasterfrom
sn/ssa_fuzzer_mutations

defkit commented Jun 20, 2025

Uh oh!

github-actions bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

defkit commented Jun 20, 2025

Description

Problem*

Summary*

Additional Context

Documentation*

PR Checklist*

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

⚠️ Performance Alert ⚠️

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants