fix(ast_fuzzer): forbid rebinding &mut T locals in constrained code - #12791
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
⚠️ Performance Alert ⚠️
Possible performance regression was detected for benchmark 'Brillig Execution Time'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.
| Benchmark suite | Current: e6fe726 | Previous: e5e4436 | Ratio |
|---|---|---|---|
private-kernel-reset |
0.046 s |
0.038 s |
1.21 |
This comment was automatically generated by workflow using github-action-benchmark.
CC: @TomAFrench
Drop the regression-seed scaffolding per review feedback: it relied on arb_program's generation algorithm not changing, so any future tweak to generation makes the seeds exercise unrelated paths.
There was a problem hiding this comment.
⚠️ Performance Alert ⚠️
Possible performance regression was detected for benchmark 'Test Suite Duration'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.
| Benchmark suite | Current: e6fe726 | Previous: c1f34cd | Ratio |
|---|---|---|---|
test_report_noir-lang_noir_bigcurve_ |
321 s |
253 s |
1.27 |
This comment was automatically generated by workflow using github-action-benchmark.
CC: @TomAFrench
There was a problem hiding this comment.
⚠️ Performance Alert ⚠️
Possible performance regression was detected for benchmark 'Elaboration Time'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.
| Benchmark suite | Current: e6fe726 | Previous: e5e4436 | Ratio |
|---|---|---|---|
rollup-checkpoint-root |
1.78 s |
1.41 s |
1.26 |
rollup-tx-base-private |
1.668 s |
1.38 s |
1.21 |
This comment was automatically generated by workflow using github-action-benchmark.
CC: @TomAFrench
There was a problem hiding this comment.
⚠️ Performance Alert ⚠️
Possible performance regression was detected for benchmark 'Execution Time'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.
| Benchmark suite | Current: e6fe726 | Previous: e5e4436 | Ratio |
|---|---|---|---|
rollup-checkpoint-root |
7.61 s |
5.92 s |
1.29 |
This comment was automatically generated by workflow using github-action-benchmark.
CC: @TomAFrench
There was a problem hiding this comment.
⚠️ Performance Alert ⚠️
Possible performance regression was detected for benchmark 'Compilation Time'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.
| Benchmark suite | Current: e6fe726 | Previous: e5e4436 | Ratio |
|---|---|---|---|
rollup-tx-base-private |
21.48 s |
17.64 s |
1.22 |
This comment was automatically generated by workflow using github-action-benchmark.
CC: @TomAFrench
There was a problem hiding this comment.
⚠️ Performance Alert ⚠️
Possible performance regression was detected for benchmark 'Brillig Compilation Time'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.
| Benchmark suite | Current: e6fe726 | Previous: e5e4436 | Ratio |
|---|---|---|---|
rollup-checkpoint-root |
2.83 s |
2.27 s |
1.25 |
This comment was automatically generated by workflow using github-action-benchmark.
CC: @TomAFrench
2 participants
Summary
0x309f877a00100000,0x39b83dfd00100000,0x66eee82e00100000) underorig_vs_morph,min_vs_full, andpass_vs_prevrespectively. All three panicked atRuntimeError::ReturnedReferenceFromDynamicIf(compiler/noirc_evaluator/src/ssa/ir/dfg/simplify/value_merger.rs:115) and share a single root cause: in constrained code the AST fuzzer was emittingref_var = &mut X;(bare rebind of a&mut T-typed local) inside a dynamicif/loop branch. The Noir frontend would normally reject that withMonomorphizationError::AssignedToVarContainingReference(compiler/noirc_frontend/src/monomorphization/mod.rs:2576), but the AST fuzzer bypasses the elaborator, so the bad assignment reached SSA and the value-merger refused to merge twoType::Reference(..)values across the merge point.tooling/ast_fuzzer/src/program/func.rs:gen_assignstill keeps&mut T-typed mutable locals in the candidate set (so it can keep generating*ref_var = ...deref-assigns), but it now forcescan_rebind = falsefor them in constrained code, which makesgen_lvaluealways take theLValue::Dereferencebranch. The pre-existing filter that excluded aggregates containing references in constrained code is unchanged.RCA gist
https://gist.github.com/AztecBot/2c7b203652f488725b8e2f1e45119bf8 — full analysis of all three failing ASTs and the shared bug pattern.
Failing CI: actions/runs/26383307255/job/77656632078.
Test plan
NOIR_AST_FUZZER_SEED=0x309f877a00100000 cargo test --release -p noir_ast_fuzzer_fuzz orig_vs_morph— passesNOIR_AST_FUZZER_SEED=0x39b83dfd00100000 cargo test --release -p noir_ast_fuzzer_fuzz min_vs_full— passesNOIR_AST_FUZZER_SEED=0x66eee82e00100000 cargo test --release -p noir_ast_fuzzer_fuzz pass_vs_prev— passesCI=1 cargo test --release -p noir_ast_fuzzer_fuzz— 6 passed, no regressionscargo test --release -p noir_ast_fuzzer --lib— 15 passedNo seed-based regression tests are included: they would pin to the current
arb_programbyte layout, so any future tweak to the generation algorithm would move what those seeds exercise and the tests would silently stop testing the intended pattern.