feat(fuzz): Push and pop for slices (#9262)

aakoshh · web-flow · commit ab345b2f5a23 · 2025-08-11T13:56:51.000Z
diff --git a/tooling/ast_fuzzer/fuzz/src/targets/pass_vs_prev.rs b/tooling/ast_fuzzer/fuzz/src/targets/pass_vs_prev.rs
@@ -66,7 +66,7 @@ fn clone_ssa(ssa: &Ssa) -> Ssa {
 mod tests {
     /// ```ignore
     /// NOIR_AST_FUZZER_SEED=0x6819c61400001000 \
-    /// NOIR_AST_FUZZER_SHOW_AST=1 \
+    /// RUST_LOG=debug \
     /// cargo test -p noir_ast_fuzzer_fuzz pass_vs_prev
     /// ```
     #[test]
diff --git a/tooling/ast_fuzzer/src/compare/compiled.rs b/tooling/ast_fuzzer/src/compare/compiled.rs
@@ -178,6 +178,14 @@ impl Comparable for NargoErrorWithTypes {
                 AssertionFailed(_, _, _),
                 SolvingError(OpcodeResolutionError::UnsatisfiedConstrain { .. }, _),
             ) => msg1.is_some_and(|msg| msg.contains("divide by zero")),
+            (
+                SolvingError(OpcodeResolutionError::IndexOutOfBounds { .. }, _),
+                AssertionFailed(_, _, _),
+            ) => msg2.is_some_and(|msg| msg.contains("Index out of bounds")),
+            (
+                AssertionFailed(_, _, _),
+                SolvingError(OpcodeResolutionError::IndexOutOfBounds { .. }, _),
+            ) => msg1.is_some_and(|msg| msg.contains("Index out of bounds")),
             _ => false,
         }
     }
diff --git a/tooling/ast_fuzzer/src/program/func.rs b/tooling/ast_fuzzer/src/program/func.rs
@@ -664,8 +664,18 @@ impl<'a> FunctionContext<'a> {
         tgt_type: &Type,
         max_depth: usize,
     ) -> arbitrary::Result<Option<TrackedExpression>> {
-        // If we found our type, return it without further ado.
+        // If we found our type, we can return it without further ado.
         if src_type == tgt_type {
+            // If we want a slice, we can push onto it.
+            if let Type::Slice(item_type) = src_type {
+                if bool::arbitrary(u)? {
+                    let (item, item_dyn) = self.gen_expr(u, item_type, max_depth, Flags::TOP)?;
+                    let push_expr =
+                        self.call_slice_push(src_expr, src_type.clone(), bool::arbitrary(u)?, item);
+                    return Ok(Some((push_expr, src_dyn || item_dyn)));
+                }
+            }
+            // Otherwise just return as-is.
             return Ok(Some((src_expr, src_dyn)));
         }
 
@@ -710,7 +720,7 @@ impl<'a> FunctionContext<'a> {
                 };
                 Ok(Some((expr, src_dyn)))
             }
-            (Type::Array(len, item_typ), _) if *len > 0 => {
+            (Type::Array(len, item_type), _) if *len > 0 => {
                 // Indexing arrays that contains references with dynamic indexes was banned in #8888
                 // If we are already looking for an index where we can't use dynamic inputs,
                 // don't switch to using them again, as the result can indirectly poison the outer array.
@@ -723,7 +733,7 @@ impl<'a> FunctionContext<'a> {
                 // }
                 let (idx_expr, idx_dyn) = {
                     let no_dynamic = self.in_no_dynamic
-                        || !self.unconstrained() && types::contains_reference(item_typ);
+                        || !self.unconstrained() && types::contains_reference(item_type);
                     let was_in_no_dynamic = std::mem::replace(&mut self.in_no_dynamic, no_dynamic);
 
                     // Choose a random index.
@@ -738,20 +748,36 @@ impl<'a> FunctionContext<'a> {
                 let item_expr = Expression::Index(Index {
                     collection: Box::new(src_expr),
                     index: Box::new(idx_expr),
-                    element_type: *item_typ.clone(),
+                    element_type: *item_type.clone(),
                     location: Location::dummy(),
                 });
                 // Produce the target type from the item.
                 self.gen_expr_from_source(
                     u,
                     (item_expr, src_dyn || idx_dyn),
-                    item_typ,
+                    item_type,
                     src_mutable,
                     tgt_type,
                     max_depth,
                 )
             }
-            (Type::Slice(item_typ), _) => {
+            (Type::Slice(item_type), Type::Tuple(fields))
+                if fields.len() == 2
+                    && &fields[0] == item_type.as_ref()
+                    && &fields[1] == src_type =>
+            {
+                let pop_front = self.call_slice_pop(src_expr, src_type.clone(), true);
+                Ok(Some((pop_front, src_dyn)))
+            }
+            (Type::Slice(item_type), Type::Tuple(fields))
+                if fields.len() == 2
+                    && &fields[0] == src_type
+                    && &fields[1] == item_type.as_ref() =>
+            {
+                let pop_back = self.call_slice_pop(src_expr, src_type.clone(), false);
+                Ok(Some((pop_back, src_dyn)))
+            }
+            (Type::Slice(item_type), _) => {
                 // We don't know the length of the slice at compile time,
                 // so we need to call the builtin function to get it,
                 // and use it for the length modulo.
@@ -762,7 +788,7 @@ impl<'a> FunctionContext<'a> {
                     (self.gen_literal(u, &types::U32)?, false)
                 } else {
                     let no_dynamic = self.in_no_dynamic
-                        || !self.unconstrained() && types::contains_reference(item_typ);
+                        || !self.unconstrained() && types::contains_reference(item_type);
                     let was_in_no_dynamic = std::mem::replace(&mut self.in_no_dynamic, no_dynamic);
 
                     // Choose a random index.
@@ -794,27 +820,7 @@ impl<'a> FunctionContext<'a> {
                 let ident_2 = Ident { id: self.next_ident_id(), ..ident_1.clone() };
 
                 // Get the runtime length.
-                let len_expr = {
-                    let array_len_ident = Ident {
-                        location: None,
-                        definition: Definition::Builtin("array_len".to_string()),
-                        mutable: false,
-                        name: "len".to_string(),
-                        typ: Type::Function(
-                            vec![src_type.clone()],
-                            Box::new(types::U32),
-                            Box::new(Type::Unit),
-                            false,
-                        ),
-                        id: self.next_ident_id(),
-                    };
-                    Expression::Call(Call {
-                        func: Box::new(Expression::Ident(array_len_ident)),
-                        arguments: vec![Expression::Ident(ident_1)],
-                        return_type: types::U32,
-                        location: Location::dummy(),
-                    })
-                };
+                let len_expr = self.call_array_len(Expression::Ident(ident_1), src_type.clone());
 
                 // Take the modulo.
                 let idx_expr = expr::modulo(idx_expr, len_expr);
@@ -823,15 +829,15 @@ impl<'a> FunctionContext<'a> {
                 let item_expr = Expression::Index(Index {
                     collection: Box::new(Expression::Ident(ident_2)),
                     index: Box::new(idx_expr),
-                    element_type: *item_typ.clone(),
+                    element_type: *item_type.clone(),
                     location: Location::dummy(),
                 });
 
                 // Produce the target type from the item.
                 let Some((expr, is_dyn)) = self.gen_expr_from_source(
                     u,
                     (item_expr, src_dyn || idx_dyn),
-                    item_typ,
+                    item_type,
                     src_mutable,
                     tgt_type,
                     max_depth,
@@ -1149,7 +1155,23 @@ impl<'a> FunctionContext<'a> {
         // Generate a type or choose an existing one.
         let max_depth = self.max_depth();
         let comptime_friendly = self.config().comptime_friendly;
-        let typ = self.ctx.gen_type(u, max_depth, false, false, true, comptime_friendly, true)?;
+        let mut typ =
+            self.ctx.gen_type(u, max_depth, false, false, true, comptime_friendly, true)?;
+
+        // If we picked the target type to be a slice, we can consider popping from it.
+        if let Type::Slice(ref item_type) = typ {
+            if bool::arbitrary(u)? {
+                let fields = if bool::arbitrary(u)? {
+                    // ([T], T) <- pop_back
+                    vec![typ.clone(), item_type.as_ref().clone()]
+                } else {
+                    // (T, [T]) <- pop_front
+                    vec![item_type.as_ref().clone(), typ.clone()]
+                };
+                typ = Type::Tuple(fields);
+            }
+        }
+
         let (expr, is_dyn) = self.gen_expr(u, &typ, max_depth, Flags::TOP)?;
         let mutable = bool::arbitrary(u)?;
         Ok(self.let_var(mutable, typ, expr, true, is_dyn, local_name))
@@ -2045,6 +2067,98 @@ impl<'a> FunctionContext<'a> {
         };
         (*id, name.clone(), let_expr)
     }
+
+    /// Construct a `Call` to the `array_len` builtin function, calling it with the
+    /// identifier of a slice or an array.
+    fn call_array_len(&mut self, array_or_slice: Expression, typ: Type) -> Expression {
+        let func_ident = Ident {
+            location: None,
+            definition: Definition::Builtin("array_len".to_string()),
+            mutable: false,
+            name: "len".to_string(),
+            typ: Type::Function(vec![typ], Box::new(types::U32), Box::new(Type::Unit), false),
+            id: self.next_ident_id(),
+        };
+        Expression::Call(Call {
+            func: Box::new(Expression::Ident(func_ident)),
+            arguments: vec![array_or_slice],
+            return_type: types::U32,
+            location: Location::dummy(),
+        })
+    }
+
+    /// Construct a `Call` to the `slice_push_front` or `slice_push_back` builtin function.
+    fn call_slice_push(
+        &mut self,
+        slice: Expression,
+        slice_type: Type,
+        is_front: bool,
+        item: Expression,
+    ) -> Expression {
+        let item_type = match slice_type {
+            Type::Slice(ref item_type) => item_type.as_ref().clone(),
+            other => unreachable!("only called with slice type; got {other}"),
+        };
+        let name = if is_front { "push_front" } else { "push_back" };
+        let func_ident = Ident {
+            location: None,
+            definition: Definition::Builtin(format!("slice_{name}")),
+            mutable: false,
+            name: name.to_string(),
+            typ: Type::Function(
+                vec![slice_type.clone(), item_type],
+                Box::new(slice_type.clone()),
+                Box::new(Type::Unit),
+                false,
+            ),
+            id: self.next_ident_id(),
+        };
+        Expression::Call(Call {
+            func: Box::new(Expression::Ident(func_ident)),
+            arguments: vec![slice, item],
+            return_type: slice_type,
+            location: Location::dummy(),
+        })
+    }
+
+    /// Construct a `Call` to the `slice_pop_front` or `slice_pop_back` builtin function.
+    fn call_slice_pop(
+        &mut self,
+        slice: Expression,
+        slice_type: Type,
+        is_front: bool,
+    ) -> Expression {
+        let item_type = match slice_type {
+            Type::Slice(ref item_type) => item_type.as_ref().clone(),
+            other => unreachable!("only called with slice type; got {other}"),
+        };
+        let name = if is_front { "pop_front" } else { "pop_back" };
+        let fields = if is_front {
+            vec![item_type, slice_type.clone()]
+        } else {
+            vec![slice_type.clone(), item_type]
+        };
+        let return_type = Type::Tuple(fields);
+        let func_ident = Ident {
+            location: None,
+            definition: Definition::Builtin(format!("slice_{name}")),
+            mutable: false,
+            name: name.to_string(),
+            typ: Type::Function(
+                vec![slice_type],
+                Box::new(return_type.clone()),
+                Box::new(Type::Unit),
+                false,
+            ),
+            id: self.next_ident_id(),
+        };
+        Expression::Call(Call {
+            func: Box::new(Expression::Ident(func_ident)),
+            arguments: vec![slice],
+            return_type,
+            location: Location::dummy(),
+        })
+    }
 }
 
 #[cfg(test)]
diff --git a/tooling/ast_fuzzer/src/program/mod.rs b/tooling/ast_fuzzer/src/program/mod.rs
@@ -565,7 +565,10 @@ fn make_name(mut id: usize, is_global: bool) -> String {
         id /= 26;
     }
     name.reverse();
-    let name = name.into_iter().collect::<String>();
+    let mut name = name.into_iter().collect::<String>();
+    if matches!(name.as_str(), "as" | "if" | "fn" | "for" | "loop") {
+        name = format!("{name}_");
+    }
     if is_global { format!("G_{name}") } else { name }
 }
 
diff --git a/tooling/ast_fuzzer/src/program/types.rs b/tooling/ast_fuzzer/src/program/types.rs
@@ -71,9 +71,9 @@ pub fn types_produced(typ: &Type) -> HashSet<Type> {
         acc.insert(typ.clone());
 
         match typ {
-            Type::Array(len, typ) => {
+            Type::Array(len, item_type) => {
                 if *len > 0 {
-                    visit(acc, typ);
+                    visit(acc, item_type);
                 }
                 // Technically we could produce `[T; N]` from `[S; N]` if
                 // we can produce `T` from `S`, but let's ignore that;
@@ -83,9 +83,9 @@ pub fn types_produced(typ: &Type) -> HashSet<Type> {
                 // we might generate `[foo[1] as u64, 3u64]` instead of "mapping"
                 // over the entire foo. Same goes for tuples.
             }
-            Type::Tuple(types) => {
-                for typ in types {
-                    visit(acc, typ);
+            Type::Tuple(item_types) => {
+                for item_type in item_types {
+                    visit(acc, item_type);
                 }
             }
             Type::String(_) => {
@@ -119,8 +119,12 @@ pub fn types_produced(typ: &Type) -> HashSet<Type> {
                 // Maybe we can also cast to u1 or u8 etc?
                 acc.insert(Type::Field);
             }
-            Type::Slice(typ) => {
-                visit(acc, typ);
+            Type::Slice(item_type) => {
+                // pop_front -> (T, [T])
+                acc.insert(Type::Tuple(vec![item_type.as_ref().clone(), typ.clone()]));
+                // pop_back -> ([T], T)
+                acc.insert(Type::Tuple(vec![typ.clone(), item_type.as_ref().clone()]));
+                visit(acc, item_type);
             }
             Type::Reference(typ, _) => {
                 visit(acc, typ);

Original file line number	Diff line number	Diff line change
`@@ -565,7 +565,10 @@ fn make_name(mut id: usize, is_global: bool) -> String {`
`565`	`565`	`id /= 26;`
`566`	`566`	`}`
`567`	`567`	`name.reverse();`
`568`		`- let name = name.into_iter().collect::<String>();`
	`568`	`+ let mut name = name.into_iter().collect::<String>();`
	`569`	`+ if matches!(name.as_str(), "as" \| "if" \| "fn" \| "for" \| "loop") {`
	`570`	`+ name = format!("{name}_");`
	`571`	`+ }`
`569`	`572`	`if is_global { format!("G_{name}") } else { name }`
`570`	`573`	`}`
`571`	`574`