Skip to content

chore(ssa_fuzzer): refactor ssa fuzzer part 3/4#9679

Merged
defkit merged 12 commits intosn/refactor_ssa_fuzzer2from
sn/refactor_ssa_fuzzer3
Sep 4, 2025
Merged

chore(ssa_fuzzer): refactor ssa fuzzer part 3/4#9679
defkit merged 12 commits intosn/refactor_ssa_fuzzer2from
sn/refactor_ssa_fuzzer3

Conversation

@defkit
Copy link
Contributor

@defkit defkit commented Aug 29, 2025

Description

Big changes to initial_witness and function arguments

Now functions can returns arrays and references, or consume arrays and references
So fuzzer can generate programs like this:

fn main(arr: [[Field; 2]; 2], index: u32) -> pub Field {
  arr[index];
}

or like this

fn main(a: Field) -> pub Field {
  let mut t = a;
  func(&mut t);
  t
}
fn func(a: &mut Field) {
  *a += 1;
}

type.rs -> typed_value.rs

block_context.rs

function_context.rs

  • Removed everything about initial witness
  • Function data now has input types

fuzz_target_lib.rs

  • Removed everything about initial witness

initial_witness.rs

  • Now support arrays as initial witness. Examples in tests/witness.rs. Ensures that every function has at least one boolean defined.

witness.rs -> initial_witness mod

  • Normal mutation for initial witness in followups

Problem*

Resolves

Summary*

Additional Context

Documentation*

Check one:

  • No documentation needed.
  • Documentation included in this PR.
  • [For Experimental Features] Documentation to be submitted in a separate PR.

PR Checklist*

  • I have tested the changes locally.
  • I have formatted the changes with Prettier and/or cargo fmt on default settings.

Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Test Suite Duration'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.

Benchmark suite Current: 42e8a8c Previous: 387b9b2 Ratio
test_report_noir-lang_noir-bignum_ 209 s 135 s 1.55
test_report_zkpassport_noir-ecdsa_ 3 s 2 s 1.50
test_report_zkpassport_noir_rsa_ 2 s 1 s 2

This comment was automatically generated by workflow using github-action-benchmark.

CC: @TomAFrench

@defkit defkit requested a review from Rumata888 August 29, 2025 18:05
@defkit
Copy link
Contributor Author

defkit commented Sep 1, 2025

I accidentally pushed to this branch instead of creating a new one
In pobeda commit I finally managed to do arrays of arrays and references to references

instruction.rs

  • Argument -> NumericArgument
  • New type Argument for array and reference ops. Works as NumericArgument but with Type

mutations

  • Now arrays in witness mutates as it should

tests

  • Added some tests showing new functionality

use libfuzzer_sys::arbitrary::Unstructured;
use rand::{Rng, rngs::StdRng};

fn generate_random_element_function(rng: &mut StdRng) -> WitnessValue {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is it called this? You are not generating a function.

//! This file contains mechanisms for deterministically mutating a given [WitnessValue](crate::fuzz_lib::fuzz_target_lib::WitnessValue) value
//! Types of mutations applied:
//! 1. Random (randomly select a new witness value)
//! 2. Max value
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You have other mutations, too

impl RandomDeletion {
fn mutate<T>(rng: &mut StdRng, vec: &mut Vec<T>) {
if !vec.is_empty() {
// do not remove the last element
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would be nice if there was an explanation why

@defkit defkit merged commit 463e2a7 into sn/refactor_ssa_fuzzer2 Sep 4, 2025
27 of 28 checks passed
@defkit defkit deleted the sn/refactor_ssa_fuzzer3 branch September 4, 2025 15:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants