Skip to content

fix(fuzz): Avoid overflowing binary ops in "no dynamic" mode#8996

Merged
aakoshh merged 4 commits intomasterfrom
af/fix-fuzz-no-overflow-in-no-dynamic
Jun 24, 2025
Merged

fix(fuzz): Avoid overflowing binary ops in "no dynamic" mode#8996
aakoshh merged 4 commits intomasterfrom
af/fix-fuzz-no-overflow-in-no-dynamic

Conversation

@aakoshh
Copy link
Contributor

@aakoshh aakoshh commented Jun 23, 2025

Description

Problem*

Workaround for #8995

Summary*

When the AST code generator is in "no dynamic" mode, avoid binary operations that can fail, otherwise we will get a compilation error saying that we are trying to index an array with a non-constant expression, which is true from the compiler perspective, but fell outside the mechanism implemented to prevent this kind of indexing, which only tracked whether variables came from either program inputs or unconstrained environment.

Additional Context

To replicate the error in the ticket:

NOIR_AST_FUZZER_SHOW_AST=1 NOIR_AST_FUZZER_SEED=0xcfb2f7da00100000 cargo test -p noir_ast_fuzzer_fuzz min_vs_full

Documentation*

Check one:

  • No documentation needed.
  • Documentation included in this PR.
  • [For Experimental Features] Documentation to be submitted in a separate PR.

PR Checklist*

  • I have tested the changes locally.
  • I have formatted the changes with Prettier and/or cargo fmt on default settings.

@aakoshh aakoshh requested review from a team and rkarabut June 23, 2025 12:47
asterite
asterite reviewed Jun 23, 2025
View reviewed changes
@aakoshh aakoshh enabled auto-merge June 23, 2025 14:49
@aakoshh aakoshh requested a review from asterite June 23, 2025 15:28
@aakoshh aakoshh disabled auto-merge June 23, 2025 19:28
@aakoshh aakoshh added this pull request to the merge queue Jun 24, 2025
Merged via the queue into master with commit f9b66d6 Jun 24, 2025
122 of 123 checks passed
@aakoshh aakoshh deleted the af/fix-fuzz-no-overflow-in-no-dynamic branch June 24, 2025 08:51
@noirwhal noirwhal mentioned this pull request Jun 24, 2025
Merged
@AztecBot AztecBot mentioned this pull request Jun 25, 2025
Merged
github-merge-queue bot pushed a commit to AztecProtocol/aztec-packages that referenced this pull request Jul 1, 2025
@AztecBot @TomAFrench @asterite
chore: Bump Noir reference (#15265)
0725943 
Automated pull of nightly from the
[noir](https://github.com/noir-lang/noir) programming language, a
dependency of Aztec.
BEGIN_COMMIT_OVERRIDE
fix: check both coordinates for point doubling
(noir-lang/noir#9039)
fix: codegen generic type arguments
(noir-lang/noir#9044)
chore: remove accidentally committed files
(noir-lang/noir#9048)
fix(fuzz): enable print in comptime_vs_brillig_direct
(noir-lang/noir#9045)
chore: move a couple of test_utils functions into a module
(noir-lang/noir#9052)
chore: bump external pinned commits
(noir-lang/noir#9046)
fix: put constraint failure after binary operations that overflow
(noir-lang/noir#9023)
fix(ssa): Remove array from cache in constant folding if it's an
argument to a `Call` (noir-lang/noir#9040)
feat: some `nargo expand` fixes related to function and method calls
(noir-lang/noir#9038)
feat(ssa_fuzzer): custom mutations
(noir-lang/noir#8988)
feat: implicit coercion of str and fmtstr into CtString
(noir-lang/noir#9032)
chore: add idempotency check to `remove_unreachable_functions`
(noir-lang/noir#9017)
chore: add logging for signature failure cases which break barretenberg
(noir-lang/noir#9030)
feat(ssa): Handle `println` in the SSA interpreter
(noir-lang/noir#9028)
chore: don't compute used globals during DIE
(noir-lang/noir#9029)
fix(ssa_fuzzer): nested conditions in loops
(noir-lang/noir#8997)
fix(fuzz): Consider `==` turning into `!=` equivalent
(noir-lang/noir#9025)
fix(fuzz): Avoid overflow in `gen_unary`
(noir-lang/noir#9024)
fix(ssa): Perform `mem2reg` before DIE
(noir-lang/noir#9018)
fix: Strange use of predicates in euclidian division
(noir-lang/noir#8934)
fix: compute the dominance frontier of the reverse cfg using the
extended cfg (noir-lang/noir#9019)
fix(fuzz): Handle overflow errors from the elaborator
(noir-lang/noir#9014)
feat: show why an assertion will always fail if it's a static string
(noir-lang/noir#9013)
chore(ssa): Add `SsaPass:and_then`
(noir-lang/noir#9016)
fix: Add a remove_unreachable_instructions SSA pass (with unreachable
terminator) (noir-lang/noir#9008)
feat: `nargo expand` for LSP
(noir-lang/noir#9012)
fix(mem2reg): Add the value in `ArraySet` to `aliased_references`
(noir-lang/noir#8976)
feat(debug): Print ssa locations along with ssa
(noir-lang/noir#9001)
chore: move `nargo expand` code to its own crate
(noir-lang/noir#9011)
chore: redo typo PR by donatik27
(noir-lang/noir#9004)
fix: recover generics when defining trait impl function
(noir-lang/noir#9009)
fix: replace public key with curve generators in inactive branches
(noir-lang/noir#8993)
fix(fuzz): Avoid overflowing binary ops in "no dynamic" mode
(noir-lang/noir#8996)
END_COMMIT_OVERRIDE

---------

Co-authored-by: AztecBot <tech@aztecprotocol.com>
Co-authored-by: Tom French <15848336+TomAFrench@users.noreply.github.com>
Co-authored-by: Ary Borenszweig <asterite@gmail.com>
github-merge-queue bot pushed a commit to AztecProtocol/aztec-packages that referenced this pull request Jul 2, 2025
@AztecBot @TomAFrench @asterite
chore: Bump Noir reference (#15265)
6df090c 
Automated pull of nightly from the
[noir](https://github.com/noir-lang/noir) programming language, a
dependency of Aztec.
BEGIN_COMMIT_OVERRIDE
chore(docs): Brillig VM docs
(noir-lang/noir#9078)
fix(expand): missing struct member visibility, and use "crate" instead
of "super" when possible (noir-lang/noir#9081)
fix: revert #9044 (noir-lang/noir#9080)
chore: error on infinite recursion
(noir-lang/noir#9063)
fix(fuzz): Assign to an index variable to sequence side effects
(noir-lang/noir#9056)
chore: bump cargo deny (noir-lang/noir#9077)
chore: Refactor `ConstrainEqFailed` to have `Option<String>` for `msg`
(noir-lang/noir#9065)
chore(debug): Toggle SSA locations when printing SSA
(noir-lang/noir#9066)
chore(acir_gen): Improve error message for radix decomposition
(noir-lang/noir#9068)
chore(ci): fix upload of benchmark results on master
(noir-lang/noir#9069)
fix: check both coordinates for point doubling
(noir-lang/noir#9039)
fix: codegen generic type arguments
(noir-lang/noir#9044)
chore: remove accidentally committed files
(noir-lang/noir#9048)
fix(fuzz): enable print in comptime_vs_brillig_direct
(noir-lang/noir#9045)
chore: move a couple of test_utils functions into a module
(noir-lang/noir#9052)
chore: bump external pinned commits
(noir-lang/noir#9046)
fix: put constraint failure after binary operations that overflow
(noir-lang/noir#9023)
fix(ssa): Remove array from cache in constant folding if it's an
argument to a `Call` (noir-lang/noir#9040)
feat: some `nargo expand` fixes related to function and method calls
(noir-lang/noir#9038)
feat(ssa_fuzzer): custom mutations
(noir-lang/noir#8988)
feat: implicit coercion of str and fmtstr into CtString
(noir-lang/noir#9032)
chore: add idempotency check to `remove_unreachable_functions`
(noir-lang/noir#9017)
chore: add logging for signature failure cases which break barretenberg
(noir-lang/noir#9030)
feat(ssa): Handle `println` in the SSA interpreter
(noir-lang/noir#9028)
chore: don't compute used globals during DIE
(noir-lang/noir#9029)
fix(ssa_fuzzer): nested conditions in loops
(noir-lang/noir#8997)
fix(fuzz): Consider `==` turning into `!=` equivalent
(noir-lang/noir#9025)
fix(fuzz): Avoid overflow in `gen_unary`
(noir-lang/noir#9024)
fix(ssa): Perform `mem2reg` before DIE
(noir-lang/noir#9018)
fix: Strange use of predicates in euclidian division
(noir-lang/noir#8934)
fix: compute the dominance frontier of the reverse cfg using the
extended cfg (noir-lang/noir#9019)
fix(fuzz): Handle overflow errors from the elaborator
(noir-lang/noir#9014)
feat: show why an assertion will always fail if it's a static string
(noir-lang/noir#9013)
chore(ssa): Add `SsaPass:and_then`
(noir-lang/noir#9016)
fix: Add a remove_unreachable_instructions SSA pass (with unreachable
terminator) (noir-lang/noir#9008)
feat: `nargo expand` for LSP
(noir-lang/noir#9012)
fix(mem2reg): Add the value in `ArraySet` to `aliased_references`
(noir-lang/noir#8976)
feat(debug): Print ssa locations along with ssa
(noir-lang/noir#9001)
chore: move `nargo expand` code to its own crate
(noir-lang/noir#9011)
chore: redo typo PR by donatik27
(noir-lang/noir#9004)
fix: recover generics when defining trait impl function
(noir-lang/noir#9009)
fix: replace public key with curve generators in inactive branches
(noir-lang/noir#8993)
fix(fuzz): Avoid overflowing binary ops in "no dynamic" mode
(noir-lang/noir#8996)
END_COMMIT_OVERRIDE

---------

Co-authored-by: AztecBot <tech@aztecprotocol.com>
Co-authored-by: Tom French <15848336+TomAFrench@users.noreply.github.com>
Co-authored-by: Ary Borenszweig <asterite@gmail.com>
github-merge-queue bot pushed a commit to AztecProtocol/aztec-packages that referenced this pull request Jul 2, 2025
@AztecBot @TomAFrench @asterite
chore: Bump Noir reference (#15265)
51da576 
Automated pull of nightly from the
[noir](https://github.com/noir-lang/noir) programming language, a
dependency of Aztec.
BEGIN_COMMIT_OVERRIDE
chore(docs): Brillig VM docs
(noir-lang/noir#9078)
fix(expand): missing struct member visibility, and use "crate" instead
of "super" when possible (noir-lang/noir#9081)
fix: revert #9044 (noir-lang/noir#9080)
chore: error on infinite recursion
(noir-lang/noir#9063)
fix(fuzz): Assign to an index variable to sequence side effects
(noir-lang/noir#9056)
chore: bump cargo deny (noir-lang/noir#9077)
chore: Refactor `ConstrainEqFailed` to have `Option<String>` for `msg`
(noir-lang/noir#9065)
chore(debug): Toggle SSA locations when printing SSA
(noir-lang/noir#9066)
chore(acir_gen): Improve error message for radix decomposition
(noir-lang/noir#9068)
chore(ci): fix upload of benchmark results on master
(noir-lang/noir#9069)
fix: check both coordinates for point doubling
(noir-lang/noir#9039)
fix: codegen generic type arguments
(noir-lang/noir#9044)
chore: remove accidentally committed files
(noir-lang/noir#9048)
fix(fuzz): enable print in comptime_vs_brillig_direct
(noir-lang/noir#9045)
chore: move a couple of test_utils functions into a module
(noir-lang/noir#9052)
chore: bump external pinned commits
(noir-lang/noir#9046)
fix: put constraint failure after binary operations that overflow
(noir-lang/noir#9023)
fix(ssa): Remove array from cache in constant folding if it's an
argument to a `Call` (noir-lang/noir#9040)
feat: some `nargo expand` fixes related to function and method calls
(noir-lang/noir#9038)
feat(ssa_fuzzer): custom mutations
(noir-lang/noir#8988)
feat: implicit coercion of str and fmtstr into CtString
(noir-lang/noir#9032)
chore: add idempotency check to `remove_unreachable_functions`
(noir-lang/noir#9017)
chore: add logging for signature failure cases which break barretenberg
(noir-lang/noir#9030)
feat(ssa): Handle `println` in the SSA interpreter
(noir-lang/noir#9028)
chore: don't compute used globals during DIE
(noir-lang/noir#9029)
fix(ssa_fuzzer): nested conditions in loops
(noir-lang/noir#8997)
fix(fuzz): Consider `==` turning into `!=` equivalent
(noir-lang/noir#9025)
fix(fuzz): Avoid overflow in `gen_unary`
(noir-lang/noir#9024)
fix(ssa): Perform `mem2reg` before DIE
(noir-lang/noir#9018)
fix: Strange use of predicates in euclidian division
(noir-lang/noir#8934)
fix: compute the dominance frontier of the reverse cfg using the
extended cfg (noir-lang/noir#9019)
fix(fuzz): Handle overflow errors from the elaborator
(noir-lang/noir#9014)
feat: show why an assertion will always fail if it's a static string
(noir-lang/noir#9013)
chore(ssa): Add `SsaPass:and_then`
(noir-lang/noir#9016)
fix: Add a remove_unreachable_instructions SSA pass (with unreachable
terminator) (noir-lang/noir#9008)
feat: `nargo expand` for LSP
(noir-lang/noir#9012)
fix(mem2reg): Add the value in `ArraySet` to `aliased_references`
(noir-lang/noir#8976)
feat(debug): Print ssa locations along with ssa
(noir-lang/noir#9001)
chore: move `nargo expand` code to its own crate
(noir-lang/noir#9011)
chore: redo typo PR by donatik27
(noir-lang/noir#9004)
fix: recover generics when defining trait impl function
(noir-lang/noir#9009)
fix: replace public key with curve generators in inactive branches
(noir-lang/noir#8993)
fix(fuzz): Avoid overflowing binary ops in "no dynamic" mode
(noir-lang/noir#8996)
END_COMMIT_OVERRIDE

---------

Co-authored-by: AztecBot <tech@aztecprotocol.com>
Co-authored-by: Tom French <15848336+TomAFrench@users.noreply.github.com>
Co-authored-by: Ary Borenszweig <asterite@gmail.com>
danielntmd pushed a commit to danielntmd/aztec-packages that referenced this pull request Jul 16, 2025
@AztecBot @TomAFrench @asterite
chore: Bump Noir reference (AztecProtocol#15265)
a2f21d3 
Automated pull of nightly from the
[noir](https://github.com/noir-lang/noir) programming language, a
dependency of Aztec.
BEGIN_COMMIT_OVERRIDE
chore(docs): Brillig VM docs
(noir-lang/noir#9078)
fix(expand): missing struct member visibility, and use "crate" instead
of "super" when possible (noir-lang/noir#9081)
fix: revert AztecProtocol#9044 (noir-lang/noir#9080)
chore: error on infinite recursion
(noir-lang/noir#9063)
fix(fuzz): Assign to an index variable to sequence side effects
(noir-lang/noir#9056)
chore: bump cargo deny (noir-lang/noir#9077)
chore: Refactor `ConstrainEqFailed` to have `Option<String>` for `msg`
(noir-lang/noir#9065)
chore(debug): Toggle SSA locations when printing SSA
(noir-lang/noir#9066)
chore(acir_gen): Improve error message for radix decomposition
(noir-lang/noir#9068)
chore(ci): fix upload of benchmark results on master
(noir-lang/noir#9069)
fix: check both coordinates for point doubling
(noir-lang/noir#9039)
fix: codegen generic type arguments
(noir-lang/noir#9044)
chore: remove accidentally committed files
(noir-lang/noir#9048)
fix(fuzz): enable print in comptime_vs_brillig_direct
(noir-lang/noir#9045)
chore: move a couple of test_utils functions into a module
(noir-lang/noir#9052)
chore: bump external pinned commits
(noir-lang/noir#9046)
fix: put constraint failure after binary operations that overflow
(noir-lang/noir#9023)
fix(ssa): Remove array from cache in constant folding if it's an
argument to a `Call` (noir-lang/noir#9040)
feat: some `nargo expand` fixes related to function and method calls
(noir-lang/noir#9038)
feat(ssa_fuzzer): custom mutations
(noir-lang/noir#8988)
feat: implicit coercion of str and fmtstr into CtString
(noir-lang/noir#9032)
chore: add idempotency check to `remove_unreachable_functions`
(noir-lang/noir#9017)
chore: add logging for signature failure cases which break barretenberg
(noir-lang/noir#9030)
feat(ssa): Handle `println` in the SSA interpreter
(noir-lang/noir#9028)
chore: don't compute used globals during DIE
(noir-lang/noir#9029)
fix(ssa_fuzzer): nested conditions in loops
(noir-lang/noir#8997)
fix(fuzz): Consider `==` turning into `!=` equivalent
(noir-lang/noir#9025)
fix(fuzz): Avoid overflow in `gen_unary`
(noir-lang/noir#9024)
fix(ssa): Perform `mem2reg` before DIE
(noir-lang/noir#9018)
fix: Strange use of predicates in euclidian division
(noir-lang/noir#8934)
fix: compute the dominance frontier of the reverse cfg using the
extended cfg (noir-lang/noir#9019)
fix(fuzz): Handle overflow errors from the elaborator
(noir-lang/noir#9014)
feat: show why an assertion will always fail if it's a static string
(noir-lang/noir#9013)
chore(ssa): Add `SsaPass:and_then`
(noir-lang/noir#9016)
fix: Add a remove_unreachable_instructions SSA pass (with unreachable
terminator) (noir-lang/noir#9008)
feat: `nargo expand` for LSP
(noir-lang/noir#9012)
fix(mem2reg): Add the value in `ArraySet` to `aliased_references`
(noir-lang/noir#8976)
feat(debug): Print ssa locations along with ssa
(noir-lang/noir#9001)
chore: move `nargo expand` code to its own crate
(noir-lang/noir#9011)
chore: redo typo PR by donatik27
(noir-lang/noir#9004)
fix: recover generics when defining trait impl function
(noir-lang/noir#9009)
fix: replace public key with curve generators in inactive branches
(noir-lang/noir#8993)
fix(fuzz): Avoid overflowing binary ops in "no dynamic" mode
(noir-lang/noir#8996)
END_COMMIT_OVERRIDE

---------

Co-authored-by: AztecBot <tech@aztecprotocol.com>
Co-authored-by: Tom French <15848336+TomAFrench@users.noreply.github.com>
Co-authored-by: Ary Borenszweig <asterite@gmail.com>
AztecBot added a commit to AztecProtocol/barretenberg that referenced this pull request Dec 3, 2025
@AztecBot @TomAFrench @asterite
chore: Bump Noir reference (#15265)
6c21eac 
Automated pull of nightly from the
[noir](https://github.com/noir-lang/noir) programming language, a
dependency of Aztec.
BEGIN_COMMIT_OVERRIDE
chore(docs): Brillig VM docs
(noir-lang/noir#9078)
fix(expand): missing struct member visibility, and use "crate" instead
of "super" when possible (noir-lang/noir#9081)
fix: revert #9044 (noir-lang/noir#9080)
chore: error on infinite recursion
(noir-lang/noir#9063)
fix(fuzz): Assign to an index variable to sequence side effects
(noir-lang/noir#9056)
chore: bump cargo deny (noir-lang/noir#9077)
chore: Refactor `ConstrainEqFailed` to have `Option<String>` for `msg`
(noir-lang/noir#9065)
chore(debug): Toggle SSA locations when printing SSA
(noir-lang/noir#9066)
chore(acir_gen): Improve error message for radix decomposition
(noir-lang/noir#9068)
chore(ci): fix upload of benchmark results on master
(noir-lang/noir#9069)
fix: check both coordinates for point doubling
(noir-lang/noir#9039)
fix: codegen generic type arguments
(noir-lang/noir#9044)
chore: remove accidentally committed files
(noir-lang/noir#9048)
fix(fuzz): enable print in comptime_vs_brillig_direct
(noir-lang/noir#9045)
chore: move a couple of test_utils functions into a module
(noir-lang/noir#9052)
chore: bump external pinned commits
(noir-lang/noir#9046)
fix: put constraint failure after binary operations that overflow
(noir-lang/noir#9023)
fix(ssa): Remove array from cache in constant folding if it's an
argument to a `Call` (noir-lang/noir#9040)
feat: some `nargo expand` fixes related to function and method calls
(noir-lang/noir#9038)
feat(ssa_fuzzer): custom mutations
(noir-lang/noir#8988)
feat: implicit coercion of str and fmtstr into CtString
(noir-lang/noir#9032)
chore: add idempotency check to `remove_unreachable_functions`
(noir-lang/noir#9017)
chore: add logging for signature failure cases which break barretenberg
(noir-lang/noir#9030)
feat(ssa): Handle `println` in the SSA interpreter
(noir-lang/noir#9028)
chore: don't compute used globals during DIE
(noir-lang/noir#9029)
fix(ssa_fuzzer): nested conditions in loops
(noir-lang/noir#8997)
fix(fuzz): Consider `==` turning into `!=` equivalent
(noir-lang/noir#9025)
fix(fuzz): Avoid overflow in `gen_unary`
(noir-lang/noir#9024)
fix(ssa): Perform `mem2reg` before DIE
(noir-lang/noir#9018)
fix: Strange use of predicates in euclidian division
(noir-lang/noir#8934)
fix: compute the dominance frontier of the reverse cfg using the
extended cfg (noir-lang/noir#9019)
fix(fuzz): Handle overflow errors from the elaborator
(noir-lang/noir#9014)
feat: show why an assertion will always fail if it's a static string
(noir-lang/noir#9013)
chore(ssa): Add `SsaPass:and_then`
(noir-lang/noir#9016)
fix: Add a remove_unreachable_instructions SSA pass (with unreachable
terminator) (noir-lang/noir#9008)
feat: `nargo expand` for LSP
(noir-lang/noir#9012)
fix(mem2reg): Add the value in `ArraySet` to `aliased_references`
(noir-lang/noir#8976)
feat(debug): Print ssa locations along with ssa
(noir-lang/noir#9001)
chore: move `nargo expand` code to its own crate
(noir-lang/noir#9011)
chore: redo typo PR by donatik27
(noir-lang/noir#9004)
fix: recover generics when defining trait impl function
(noir-lang/noir#9009)
fix: replace public key with curve generators in inactive branches
(noir-lang/noir#8993)
fix(fuzz): Avoid overflowing binary ops in "no dynamic" mode
(noir-lang/noir#8996)
END_COMMIT_OVERRIDE

---------

Co-authored-by: AztecBot <tech@aztecprotocol.com>
Co-authored-by: Tom French <15848336+TomAFrench@users.noreply.github.com>
Co-authored-by: Ary Borenszweig <asterite@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@asterite asterite asterite approved these changes

@rkarabut rkarabut Awaiting requested review from rkarabut

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@aakoshh @asterite