Skip to content

fix(avm): Fix jumpif in fuzzer #19655

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sirasistant merged 2 commits into from
Jan 16, 2026
Merged

fix(avm): Fix jumpif in fuzzer #19655

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9419d60
fix(avm): Fix jumpif in fuzzer
sirasistant Jan 16, 2026
1e99712
Merge branch 'merge-train/avm' into arv/fix_jmpif
sirasistant Jan 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 3 additions & 15 deletions barretenberg/cpp/src/barretenberg/avm_fuzzer/fuzz_lib/control_flow.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,22 +250,10 @@ int predict_block_size(ProgramBlock* block)
case TerminatorType::JUMP:
return bytecode_length + JMP_SIZE; // finalized with jump
case TerminatorType::JUMP_IF: {
// if boolean condition is not set adding SET_8 instruction to the bytecode
// if boolean condition is not set add SET instruction to the bytecode
if (!block->get_terminating_condition_value().has_value()) {
for (uint16_t address = 0; address < 65535; address++) {
// if the memory address is already in use, we skip it
if (block->is_memory_address_set(address)) {
continue;
}
auto set_16_instruction =
SET_16_Instruction{ .value_tag = bb::avm2::MemoryTag::U1,
.result_address =
AddressRef{ .address = address, .mode = AddressingMode::Direct },
.value = 0 };
block->process_instruction(set_16_instruction);
bytecode_length = static_cast<int>(create_bytecode(block->get_instructions()).size());
break;
}
block->process_write_terminating_condition_value();
bytecode_length = static_cast<int>(create_bytecode(block->get_instructions()).size());
}
return bytecode_length + JMP_IF_SIZE + JMP_SIZE; // finalized with jumpi
}
Expand Down
9 changes: 9 additions & 0 deletions barretenberg/cpp/src/barretenberg/avm_fuzzer/fuzz_lib/program_block.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1633,6 +1633,15 @@ std::optional<uint16_t> ProgramBlock::get_terminating_condition_value()
return condition_addr;
}

void ProgramBlock::process_write_terminating_condition_value()
{
uint16_t value = condition_offset_index % 2;

@defkit defkit Jan 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice

process_set_16_instruction(SET_16_Instruction{
.value_tag = bb::avm2::MemoryTag::U1,
.result_address = AddressRef{ .address = condition_offset_index, .mode = AddressingMode::Direct },
.value = value });
}

bool ProgramBlock::is_memory_address_set(uint16_t address)
{
return memory_manager.is_memory_address_set(address);
Expand Down
1 change: 1 addition & 0 deletions barretenberg/cpp/src/barretenberg/avm_fuzzer/fuzz_lib/program_block.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,6 +173,7 @@ class ProgramBlock {
void insert_internal_call(ProgramBlock* target_block);

std::optional<uint16_t> get_terminating_condition_value();
void process_write_terminating_condition_value();
std::vector<bb::avm2::simulation::Instruction> get_instructions();

bool is_memory_address_set(uint16_t address);
Expand Down
Loading