fix(avm)!: pre-audit review of context.pil by jeanmon · Pull Request #19549 · AztecProtocol/aztec-packages

jeanmon · 2026-01-13T14:20:06Z

Linear issue: AVM-44

AztecBot · 2026-01-13T14:52:40Z

Flakey Tests

🤖 says: This CI run detected 5 tests that failed, but were tolerated due to a .test_patterns.yml entry.

\033FLAKED\033 (8;;http://ci.aztec-labs.com/cfd821ffe607aa65�cfd821ffe607aa658;;�):  yarn-project/end-to-end/scripts/run_test.sh simple src/e2e_epochs/epochs_invalidate_block.parallel.test.ts "committee member invalidates a block if proposer does not come through" (94s) (code: 1) group:e2e-p2p-epoch-flakes (\033jeanmon\033: Remove an old TODO)
\033FLAKED\033 (8;;http://ci.aztec-labs.com/26ca0f527967dca1�26ca0f527967dca18;;�): yarn-project/end-to-end/scripts/run_test.sh web3signer src/composed/web3signer/e2e_multi_validator_node_key_store.test.ts (37s) (code: 1) (\033jeanmon\033: Remove an old TODO)
\033FLAKED\033 (8;;http://ci.aztec-labs.com/2389817d9fac43eb�2389817d9fac43eb8;;�): yarn-project/scripts/run_test.sh stdlib/src/p2p/topics.test.ts (2s) (code: 1) group:e2e-p2p-epoch-flakes (\033jeanmon\033: Remove an old TODO)
\033FLAKED\033 (8;;http://ci.aztec-labs.com/922ef617f8ecd480�922ef617f8ecd4808;;�):  yarn-project/end-to-end/scripts/run_test.sh simple src/e2e_p2p/gossip_network.test.ts (433s) (code: 1) group:e2e-p2p-epoch-flakes (\033jeanmon\033: Remove an old TODO)
\033FLAKED\033 (8;;http://ci.aztec-labs.com/0eec33bbca504682�0eec33bbca5046828;;�):  yarn-project/end-to-end/scripts/run_test.sh simple src/e2e_epochs/epochs_invalidate_block.parallel.test.ts "proposer invalidates multiple blocks" (603s) (code: 124) group:e2e-p2p-epoch-flakes (\033jeanmon\033: Remove an old TODO)

dbanks12

Really nice work!

dbanks12 · 2026-01-13T20:03:54Z

+    // Selectors related to exiting a nested context
+    pol commit nested_return; // @boolean (by definition)
+    nested_return = has_parent_ctx * sel_execute_return;
+    pol commit nested_failure; // @boolean (by definition)
+    nested_failure = has_parent_ctx * sel_failure;
+    // Since `sel_exit_call = sel_failure + sel_execute_return`, we can define the following alias
+    // to characterize exiting from a nested context.
+    pol NESTED_EXIT_CALL = nested_failure + nested_return; // = has_parent_ctx * sel_exit_call;


Is it true that sel_execute_return can only be 1 if there has been no failure? The opcode cannot fail during its execution?

Exactly, this comes from #[INFALLIBLE_OPCODES_SUCCESS] and this explanation is present before the definition of sel_exit_call.
We use this property a lot. Basically, when an opcode selector is turned on in execution, it means that the only error which might occur is an opcode error. #[INFALLIBLE_OPCODES_SUCCESS] prevents to turn on this error for those we know will not fail such as RETURN.

dbanks12 · 2026-01-13T20:24:47Z

+    // Initialization: enqueued_call_start = 1 ==> parent_calldata_addr = 0;
+    // Propagation:
+    // NESTED_EXIT_CALL    = 1 ==> constraints come from lookups (#[CTX_STACK_ROLLBACK] and #[CTX_STACK_RETURN])
    // sel_enter_call      = 1 ==> parent_calldata_addr' = rop[4] (resolved operand 5 from execution trace)


just confirming that rop[4] does indeed correspond to resolved operand 5, or is this a typo?

These comments were already present and are all "incrementing the index by one" because humans like to start by index one. I think it is misleading and will remove such indices in the comment and just keep "from execution trace".

dbanks12 · 2026-01-13T20:36:58Z

+    //    RETRIEVED BYTECODES TREE
+    // =============================
+
+    // Here, we constrain the transition `retrieved_bytecodes_tree_root` to `prev_retrieved_bytecodes_tree_size`


This confuses me. Why would retrieved_*root transition to prev_*root? And i think you have a typo here because you say *root to *size

Oh we're not really transitioning? We're saying "on the next row, make sure that prev_*root points to this row's root? I'd reword to make clearer.

I rephrased this.

dbanks12 · 2026-01-13T20:40:47Z

+    // The state of the retrieved bytecodes tree should be continuous unless we have finished an enqueued call.
+    // `prev_retrieved_bytecodes_tree_root` and `prev_retrieved_bytecodes_tree_size` are initialized
+    // on `enqueued_call_start == 1` as part of the permutation (#[DISPATCH_EXEC_START] in tx.pil).
+    // The final values at the end of an enqueued call are sent back to the tx trace in the lookup #[DISPATCH_EXEC_END].


What does it mean for the bytecodes tree to be continuous? I'd clarify that it can evolve during an enqueued call as bytecodes are retrieved. And then we don't actually constrain that it propagates in context.pil at enqueued-call boundaries because it is sent-back and initialized like you say. Maybe just clarify the meaning of continuous.

I added clarifications on what we mean by continuous.

dbanks12 · 2026-01-13T20:43:00Z

    pol commit transaction_fee;
-    // Constrained boolean by tx trace for enqueued call, #[IS_STATIC_NEXT_ROW] during normal execution,
-    // IS_STATIC_IF_STATIC_CALL+IS_STATIC_IF_CALL_FROM_STATIC_CONTEXT for nested calls,
-    // and CTX_STACK_CALL for returns or failures.
    pol commit is_static;


Why remove comment? Is it made clear elsewhere?

I see that you add @boolean with a note later, although it doesn't specify exactly how is_static is constrained to be bool

Added some explanations.

BEGIN_COMMIT_OVERRIDE fix(avm): Fix relative addressing in fuzzer (#19550) feat(avm): avm fuzzer bytecode mutation (#19378) chore(avm): there is automatic conversion from uint128_t to FF chore(avm): ECC pre-audit - normalise infinity points (#19462) feat(bb-pilcom): single-component graph check (#19578) feat(avm): contract class mutation (#19498) chore: support uint128_t in uint256_t construction (#19581) fix!: remove unused column in update_check.pil (#19557) fix(avm)!: pre-audit review of context.pil (#19549) fix(avm): Relax fuzzer memory manager asserts (#19591) fix!: sha256.pil missing input propagation constraints (#19590) END_COMMIT_OVERRIDE

jeanmon marked this pull request as ready for review January 13, 2026 14:21

jeanmon requested review from IlyasRidhuan, Maddiaa0 and fcarreiro as code owners January 13, 2026 14:21

jeanmon requested review from dbanks12 and removed request for IlyasRidhuan, Maddiaa0 and fcarreiro January 13, 2026 14:21

dbanks12 approved these changes Jan 13, 2026

View reviewed changes

jeanmon force-pushed the jean/avm-44-execution-contextpil branch 3 times, most recently from 576d813 to ad16c1c Compare January 14, 2026 14:38

jeanmon added 17 commits January 14, 2026 15:12

Cleanup cpp headers

7c6eabe

Build fix - missing includes

83a54de

fix fuzzer build

60d64d4

Document simulation functions

4a012f5

Tracegen docu functions

0a7f6fa

Tracegen - migrate boolean to FF implicit conversion

cd46dd2

Comments on pc and next_pc in tracegen

c3438ad

Comments in context_stack.pil

7a19f5e

Comments on context_id lifecyle in context.pil

e1aabca

parent_id init constraint and comments

4bfa803

Comments on pc and next_pc in context.pil

1c91c31

Simplifications for nested selectors

d7058d2

Reduce unnecessary gating got sel_enter_call

b540a5b

Simplify alias DEFAULT_CTX_ROW

7170e72

Comments for msg_sender, contract_address, bytecode_id in context.pil

21b37e8

Propagation of transaction fee

96fa065

is_static propagation comments in context.pil

12951f0

jeanmon added 15 commits January 14, 2026 15:12

Comments in context.pil for calldata_addr/size

1020534

comments on return_data size/addr in context.pil

bec6959

Comments for last_child_success in context.pil

21d16b2

Comments on last_child_id in context.pil

aec442d

Comments related to gas limits in context.pil

d10cc99

Simplify DEFAULT_CTX_ROW

ed5931c

parent gas used in context.pil

18704ca

Retrieved bytecodes

347364e

Comments on l2/da gas used, tree states, context stack in context.pil

ca31a50

Comments on partitioning

79eb631

boolean annotations

94511d1

Superfluous space character

886cc62

Comment and generated files

e202a21

Addressing review feedback

ad7818a

Remove an old TODO

81a7651

jeanmon force-pushed the jean/avm-44-execution-contextpil branch from ad16c1c to 81a7651 Compare January 14, 2026 15:13

jeanmon merged commit 18d05a3 into merge-train/avm Jan 14, 2026
8 checks passed

jeanmon deleted the jean/avm-44-execution-contextpil branch January 14, 2026 15:46

AztecBot mentioned this pull request Jan 14, 2026

feat: merge-train/avm #19571

Merged

Conversation

jeanmon commented Jan 13, 2026

Uh oh!

AztecBot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Flakey Tests

Uh oh!

dbanks12 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

AztecBot commented Jan 13, 2026 •

edited

Loading