Skip to content

Constant folding deduplication bug in Brillig

Moderate
Savio-Sou published GHSA-qqxj-59g5-7jcv May 19, 2026

Package

No package listed

Affected versions

0cd423

Patched versions

1.0.0-beta.21

Description

The following code:

#[inline_never]                                                                                                                                                                            
unconstrained fn f(mut b: [bool; 1]) -> [bool; 1] {                                                                                                                                        
    for _ in 0_u32 ..= 0_u32 {                                                                                                                                                             
        b[0] = false;                                                                                                                                                                      
    };                                                                                                                                                                                     
    b                                                                                                                                                                                      
}
unconstrained fn main() -> pub [bool; 1] {                                                                                                                                                 
    let _ = f([true]);                                    
    [true]
}

returns [false] when the return value should be the literal [true]. Apparently constant folding gets confused around the two [true] literals involved?

Severity

Moderate

CVE ID

No known CVE

Weaknesses

No CWEs