72 instructions.reserve(7);
75 auto generate_point = [&rng]() {
85 instructions.push_back(
87 instructions.push_back(
90 .result_address = inf_addr,
94 auto p1 = generate_point();
95 auto p2 = generate_point();
105 backfill_point(p1, p1_x_addr, p1_y_addr, p1_inf_addr);
106 backfill_point(p2, p2_x_addr, p2_y_addr, p2_inf_addr);
110 .p1_infinite = p1_inf_addr,
113 .p2_infinite = p2_inf_addr,
136 .result_address = addr,
146template <
typename InstructionType>
165 instructions.push_back(InstructionType{
166 .a_address = a_addr, .b_address = b_addr, .result_address =
generate_address_ref(rng, max_operand) });
172template <
typename InstructionType>
197 instructions.push_back(InstructionType{
198 .a_address = a_addr, .b_address = b_addr, .result_address =
generate_address_ref(rng, max_operand) });
216 instructions.reserve(3);
219 auto generate_nonzero_field = [&rng]() {
259 for (
size_t i = 0; i < 25; i++) {
261 item_address.
address +=
static_cast<uint32_t
>(i);
263 .result_address = item_address,
284 instructions.reserve(8 + 16 + 1);
289 for (
size_t i = 0; i < 8; i++) {
291 item_address.
address +=
static_cast<uint32_t
>(i);
293 .result_address = item_address,
300 for (
size_t i = 0; i < 16; i++) {
302 item_address.
address +=
static_cast<uint32_t
>(i);
304 .result_address = item_address,
308 instructions.push_back(
310 .input_address = input_address,
331 instructions.reserve(5);
340 instructions.push_back(
346 .result_address = output_bits_addr,
353 for (uint32_t i = 0; i < num_limbs; i++) {
369 instructions.push_back(
374 .radix_address = radix_addr,
375 .num_limbs_address = num_limbs_addr,
376 .output_bits_address = output_bits_addr,
399 instructions.reserve(3);
432 instructions.reserve(3);
465 .is_static_call = rng() % 2 == 0 } };
469 instructions.reserve(5);
501 .is_static_call = rng() % 2 == 0 });
519 instructions.reserve(2);
543 return generate_alu_with_matching_tags<ADD_8_Instruction>(rng,
MAX_8BIT_OPERAND);
545 return generate_alu_with_matching_tags<SUB_8_Instruction>(rng,
MAX_8BIT_OPERAND);
547 return generate_alu_with_matching_tags<MUL_8_Instruction>(rng,
MAX_8BIT_OPERAND);
549 return generate_alu_with_matching_tags_not_ff<DIV_8_Instruction>(rng,
MAX_8BIT_OPERAND);
565 return generate_alu_with_matching_tags_not_ff<AND_8_Instruction>(rng,
MAX_8BIT_OPERAND);
567 return generate_alu_with_matching_tags_not_ff<OR_8_Instruction>(rng,
MAX_8BIT_OPERAND);
569 return generate_alu_with_matching_tags_not_ff<XOR_8_Instruction>(rng,
MAX_8BIT_OPERAND);
616 return generate_alu_with_matching_tags<ADD_16_Instruction>(rng,
MAX_16BIT_OPERAND);
618 return generate_alu_with_matching_tags<SUB_16_Instruction>(rng,
MAX_16BIT_OPERAND);
620 return generate_alu_with_matching_tags<MUL_16_Instruction>(rng,
MAX_16BIT_OPERAND);
622 return generate_alu_with_matching_tags_not_ff<DIV_16_Instruction>(rng,
MAX_16BIT_OPERAND);
640 return generate_alu_with_matching_tags_not_ff<AND_16_Instruction>(rng,
MAX_16BIT_OPERAND);
642 return generate_alu_with_matching_tags_not_ff<OR_16_Instruction>(rng,
MAX_16BIT_OPERAND);
644 return generate_alu_with_matching_tags_not_ff<XOR_16_Instruction>(rng,
MAX_16BIT_OPERAND);
735 if (default_tag.has_value()) {
786 uint32_t max_operand_value)
800template <
typename BinaryInstructionType>
817template <
typename BinaryInstructionType>
1426 [](
auto&) {
throw std::runtime_error(
"Unknown instruction"); } },
::FuzzInstruction FuzzInstruction
FF generate_random_field(std::mt19937_64 &rng)
void mutate_field(bb::avm2::FF &value, std::mt19937_64 &rng, const FieldMutationConfig &config)
#define FLAT_PUBLIC_LOGS_PAYLOAD_LENGTH
T select(std::mt19937_64 &rng) const
constexpr bool is_infinity() const noexcept
constexpr const BaseField & x() const noexcept
constexpr const BaseField & y() const noexcept
static const StandardAffinePoint & one()
constexpr Set128MutationConfig BASIC_SET_128_MUTATION_CONFIGURATION
constexpr AddressRefMutationConfig BASIC_ADDRESS_REF_MUTATION_CONFIGURATION
constexpr SLoadMutationConfig BASIC_SLOAD_MUTATION_CONFIGURATION
constexpr GetEnvVarMutationConfig BASIC_GETENVVAR_MUTATION_CONFIGURATION
constexpr Set16MutationConfig BASIC_SET_16_MUTATION_CONFIGURATION
L1ToL2MsgExistsMutationOptions
constexpr NoteHashExistsMutationConfig BASIC_NOTEHASHEXISTS_MUTATION_CONFIGURATION
NoteHashExistsMutationOptions
constexpr ToRadixBEMutationConfig BASIC_TORADIXBE_MUTATION_CONFIGURATION
constexpr Set64MutationConfig BASIC_SET_64_MUTATION_CONFIGURATION
EmitNoteHashMutationOptions
@ contract_address_address
constexpr MemoryTagGenerationConfig BASIC_MEMORY_TAG_GENERATION_CONFIGURATION
constexpr ReturndatasizeWithReturndatacopyMutationConfig BASIC_RETURNDATASIZE_WITH_RETURNDATACOPY_MUTATION_CONFIGURATION
SuccessCopyMutationOptions
constexpr Uint64MutationConfig BASIC_UINT64_T_MUTATION_CONFIGURATION
constexpr CalldataCopyMutationConfig BASIC_CALLDATACOPY_MUTATION_CONFIGURATION
constexpr GetContractInstanceMutationConfig BASIC_GETCONTRACTINSTANCE_MUTATION_CONFIGURATION
InstructionGenerationOptions
@ RETURNDATASIZE_WITH_RETURNDATACOPY
constexpr L1ToL2MsgExistsMutationConfig BASIC_L1TOL2MSGEXISTS_MUTATION_CONFIGURATION
constexpr Uint32MutationConfig BASIC_UINT32_T_MUTATION_CONFIGURATION
constexpr UnaryInstruction8MutationConfig BASIC_UNARY_INSTRUCTION_8_MUTATION_CONFIGURATION
ReturndatasizeWithReturndatacopyMutationOptions
constexpr SetFFMutationConfig BASIC_SET_FF_MUTATION_CONFIGURATION
constexpr Set32MutationConfig BASIC_SET_32_MUTATION_CONFIGURATION
constexpr FieldMutationConfig BASIC_FIELD_MUTATION_CONFIGURATION
UnaryInstruction8MutationOptions
constexpr BinaryInstruction8MutationConfig BASIC_BINARY_INSTRUCTION_8_MUTATION_CONFIGURATION
constexpr Uint16MutationConfig BASIC_UINT16_T_MUTATION_CONFIGURATION
constexpr SStoreMutationConfig BASIC_SSTORE_MUTATION_CONFIGURATION
CalldataCopyMutationOptions
EmitUnencryptedLogMutationOptions
constexpr NullifierExistsMutationConfig BASIC_NULLIFIER_EXISTS_MUTATION_CONFIGURATION
constexpr EmitUnencryptedLogMutationConfig BASIC_EMITUNENCRYPTEDLOG_MUTATION_CONFIGURATION
constexpr CallMutationConfig BASIC_CALL_MUTATION_CONFIGURATION
constexpr SendL2ToL1MsgMutationConfig BASIC_SENDL2TOL1MSG_MUTATION_CONFIGURATION
constexpr VariableRefMutationConfig BASIC_VARIABLE_REF_MUTATION_CONFIGURATION
constexpr EmitNoteHashMutationConfig BASIC_EMITNOTEHASH_MUTATION_CONFIGURATION
constexpr MemoryTagMutationConfig BASIC_MEMORY_TAG_MUTATION_CONFIGURATION
constexpr Uint8MutationConfig BASIC_UINT8_T_MUTATION_CONFIGURATION
VariableRefMutationOptions
constexpr InstructionGenerationConfig BASIC_INSTRUCTION_GENERATION_CONFIGURATION
constexpr SuccessCopyMutationConfig BASIC_SUCCESSCOPY_MUTATION_CONFIGURATION
GetContractInstanceMutationOptions
@ contract_address_address
AddressRefMutationOptions
BinaryInstruction8MutationOptions
SendL2ToL1MsgMutationOptions
constexpr Set8MutationConfig BASIC_SET_8_MUTATION_CONFIGURATION
NullifierExistsMutationOptions
@ contract_address_address
StrictMock< MockContext > context
overloaded(Ts...) -> overloaded< Ts... >
std::variant< VariableRef, AddressRef > ParamRef
std::vector< FuzzInstruction > generate_sha256compression_instruction(std::mt19937_64 &rng)
VariableRef generate_variable_ref(std::mt19937_64 &rng)
std::vector< FuzzInstruction > generate_call_instruction(std::mt19937_64 &rng, const bb::avm2::fuzzer::FuzzerContext &context)
std::vector< FuzzInstruction > generate_alu_with_matching_tags_not_ff(std::mt19937_64 &rng, uint32_t max_operand)
AddressingMode generate_addressing_mode(std::mt19937_64 &rng)
std::vector< FuzzInstruction > generate_alu_with_matching_tags(std::mt19937_64 &rng, uint32_t max_operand)
std::vector< FuzzInstruction > generate_sload_instruction(std::mt19937_64 &rng)
std::vector< FuzzInstruction > generate_ecadd_instruction(std::mt19937_64 &rng)
std::vector< FuzzInstruction > generate_keccakf_instruction(std::mt19937_64 &rng)
std::vector< FuzzInstruction > generate_toradixbe_instruction(std::mt19937_64 &rng)
std::vector< FuzzInstruction > generate_fdiv_instruction(std::mt19937_64 &rng, uint32_t max_operand)
constexpr uint32_t MAX_8BIT_OPERAND
FuzzInstruction generate_set_for_tag(bb::avm2::MemoryTag tag, AddressRef addr, std::mt19937_64 &rng)
constexpr uint32_t MAX_16BIT_OPERAND
std::vector< FuzzInstruction > generate_getcontractinstance_instruction(std::mt19937_64 &rng, const bb::avm2::fuzzer::FuzzerContext &context)
std::vector< FuzzInstruction > generate_emitunencryptedlog_instruction(std::mt19937_64 &rng)
AddressRef generate_address_ref(std::mt19937_64 &rng, uint32_t max_operand_value)
MemoryTag generate_memory_tag(std::mt19937_64 &rng, const MemoryTagGenerationConfig &config)
void mutate_or_default_tag(MemoryTag &value, std::mt19937_64 &rng, MemoryTag default_tag, double probability=0.1)
Mutate the memory tag or set to the chosen tag with a given probability.
void mutate_memory_tag(MemoryTag &value, std::mt19937_64 &rng, const MemoryTagMutationConfig &config)
void mutate_variable_ref(VariableRef &variable, std::mt19937_64 &rng, std::optional< MemoryTag > default_tag)
Most of the tags will be equal to the default tag.
void mutate_l1tol2msgexists_instruction(L1TOL2MSGEXISTS_Instruction &instruction, std::mt19937_64 &rng)
void mutate_poseidon2perm_instruction(POSEIDON2PERM_Instruction &instruction, std::mt19937_64 &rng)
void mutate_keccakf1600_instruction(KECCAKF1600_Instruction &instruction, std::mt19937_64 &rng)
void mutate_not_16_instruction(NOT_16_Instruction &instruction, std::mt19937_64 &rng)
void mutate_call_instruction(CALL_Instruction &instruction, std::mt19937_64 &rng)
void mutate_cast_16_instruction(CAST_16_Instruction &instruction, std::mt19937_64 &rng)
void mutate_emit_note_hash_instruction(EMITNOTEHASH_Instruction &instruction, std::mt19937_64 &rng)
std::optional< MemoryTag > get_param_ref_tag(const ParamRef ¶m)
void mutate_nullifier_exists_instruction(NULLIFIEREXISTS_Instruction &instruction, std::mt19937_64 &rng)
void mutate_set_16_instruction(SET_16_Instruction &instruction, std::mt19937_64 &rng)
void mutate_instruction(FuzzInstruction &instruction, std::mt19937_64 &rng, const FuzzerContext &context)
void mutate_sload_instruction(SLOAD_Instruction &instruction, std::mt19937_64 &rng)
void mutate_sstore_instruction(SSTORE_Instruction &instruction, std::mt19937_64 &rng)
void mutate_calldatacopy_instruction(CALLDATACOPY_Instruction &instruction, std::mt19937_64 &rng)
void mutate_getenvvar_instruction(GETENVVAR_Instruction &instruction, std::mt19937_64 &rng)
void mutate_address_ref(AddressRef &address, std::mt19937_64 &rng, uint32_t max_operand_value)
void mutate_returndatasize_with_returndatacopy_instruction(RETURNDATASIZE_WITH_RETURNDATACOPY_Instruction &instruction, std::mt19937_64 &rng)
void mutate_ecadd_instruction(ECADD_Instruction &instruction, std::mt19937_64 &rng)
void mutate_set_32_instruction(SET_32_Instruction &instruction, std::mt19937_64 &rng)
void mutate_note_hash_exists_instruction(NOTEHASHEXISTS_Instruction &instruction, std::mt19937_64 &rng)
void mutate_set_128_instruction(SET_128_Instruction &instruction, std::mt19937_64 &rng)
void mutate_mov_8_instruction(MOV_8_Instruction &instruction, std::mt19937_64 &rng)
void mutate_emitunencryptedlog_instruction(EMITUNENCRYPTEDLOG_Instruction &instruction, std::mt19937_64 &rng)
void mutate_toradixbe_instruction(TORADIXBE_Instruction &instruction, std::mt19937_64 &rng)
void mutate_not_8_instruction(NOT_8_Instruction &instruction, std::mt19937_64 &rng)
void mutate_binary_instruction_8(BinaryInstructionType &instruction, std::mt19937_64 &rng)
void mutate_set_ff_instruction(SET_FF_Instruction &instruction, std::mt19937_64 &rng)
std::vector< FuzzInstruction > generate_instruction(std::mt19937_64 &rng, const FuzzerContext &context)
Generate one instruction and optionally backfill.
void mutate_set_64_instruction(SET_64_Instruction &instruction, std::mt19937_64 &rng)
void mutate_emit_nullifier_instruction(EMITNULLIFIER_Instruction &instruction, std::mt19937_64 &rng)
void mutate_getcontractinstance_instruction(GETCONTRACTINSTANCE_Instruction &instruction, std::mt19937_64 &rng)
void mutate_binary_instruction_16(BinaryInstructionType &instruction, std::mt19937_64 &rng)
void mutate_mov_16_instruction(MOV_16_Instruction &instruction, std::mt19937_64 &rng)
void mutate_sha256compression_instruction(SHA256COMPRESSION_Instruction &instruction, std::mt19937_64 &rng)
void mutate_set_8_instruction(SET_8_Instruction &instruction, std::mt19937_64 &rng)
void mutate_cast_8_instruction(CAST_8_Instruction &instruction, std::mt19937_64 &rng)
void mutate_successcopy_instruction(SUCCESSCOPY_Instruction &instruction, std::mt19937_64 &rng)
void mutate_sendl2tol1msg_instruction(SENDL2TOL1MSG_Instruction &instruction, std::mt19937_64 &rng)
void mutate_param_ref(ParamRef ¶m, std::mt19937_64 &rng, std::optional< MemoryTag > default_tag, uint32_t max_operand_value)
AvmFlavorSettings::G1::Fq Fq
constexpr decltype(auto) get(::tuplet::tuple< T... > &&t) noexcept
mem[result_offset] = mem[a_address] + mem[b_address] (16-bit)
mem[result_offset] = mem[a_address] + mem[b_address]
mem[result_offset] = mem[a_address] & mem[b_address] (16-bit)
mem[result_offset] = mem[a_address] & mem[b_address]
CALLDATACOPY: M[dstOffset:dstOffset+M[copySizeOffset]] = calldata[M[cdStartOffset]:M[cdStartOffset]+M...
CAST_16: cast mem[src_offset_index] to target_tag and store at dst_offset.
CAST_8: cast mem[src_offset_index] to target_tag and store at dst_offset.
mem[result_offset] = mem[a_address] / mem[b_address] (16-bit)
mem[result_offset] = mem[a_address] / mem[b_address]
EMITNOTEHASH: M[note_hash_offset] = note_hash; emit note hash to the note hash tree.
AddressRef note_hash_address
EMITNULIFIER: inserts new nullifier to the nullifier tree.
ParamRef nullifier_address
ParamRef log_size_address
mem[result_offset] = mem[a_address] == mem[b_address] (16-bit)
mem[result_offset] = mem[a_address] == mem[b_address]
ParamRef contract_address_address
GETENVVAR: M[result_offset] = getenvvar(type)
AddressRef result_address
KECCAKF1600: Perform Keccak-f[1600] permutation on 25 U64 values M[dst_address:dst_address+25] = kecc...
L1TOL2MSGEXISTS: Check if a L1 to L2 message exists M[result_address] = L1TOL2MSGEXISTS(M[msg_hash_ad...
ParamRef msg_hash_address
mem[result_offset] = mem[a_address] < mem[b_address] (16-bit)
mem[result_offset] = mem[a_address] < mem[b_address]
mem[result_offset] = mem[a_address] <= mem[b_address] (16-bit)
mem[result_offset] = mem[a_address] <= mem[b_address]
MOV_16 instruction: mem[dst_offset] = mem[src_offset].
MemoryTagWrapper value_tag
MOV_8 instruction: mem[dst_offset] = mem[src_offset].
MemoryTagWrapper value_tag
mem[result_offset] = mem[a_address] * mem[b_address] (16-bit)
mem[result_offset] = mem[a_address] * mem[b_address]
NOTEHASHEXISTS: M[result_offset] = NOTEHASHEXISTS(M[notehash_offset], M[leaf_index_offset]) len = len...
NULLIFIEREXISTS: checks if nullifier exists in the nullifier tree Gets contract's address by GETENVVA...
ParamRef nullifier_address
mem[result_offset] = mem[a_address] | mem[b_address] (16-bit)
mem[result_offset] = mem[a_address] | mem[b_address]
POSEIDON2PERM: Perform Poseidon2 permutation on 4 FF values M[dst_address:dst_address+4] = poseidon2_...
: RETURNDATASIZE + RETURNDATACOPY:
uint16_t copy_size_offset
MemoryTagWrapper value_tag
MemoryTagWrapper value_tag
MemoryTagWrapper value_tag
MemoryTagWrapper value_tag
MemoryTagWrapper value_tag
MemoryTagWrapper value_tag
SHA256COMPRESSION: Perform SHA256 compression M[dst_address:dst_address+8] = sha256_compression(M[sta...
mem[result_offset] = mem[a_address] << mem[b_address] (16-bit)
mem[result_offset] = mem[a_address] << mem[b_address]
mem[result_offset] = mem[a_address] >> mem[b_address] (16-bit)
mem[result_offset] = mem[a_address] >> mem[b_address]
SLOAD: M[slot_offset] = slot; M[result_offset] = S[M[slotOffset]].
SSTORE: M[slot_offset_index] = slot; S[M[slotOffset]] = M[srcOffset].
mem[result_offset] = mem[a_address] - mem[b_address] (16-bit)
mem[result_offset] = mem[a_address] - mem[b_address]
TORADIXBE: Convert a field element to a vector of limbs in big-endian radix representation M[dst_addr...
AddressingModeWrapper mode
uint32_t base_offset_seed
A seed for the generation of the base offset Used for Relative/IndirectRelative modes only Sets M[0] ...
uint32_t index
Index of the variable in the memory_manager.stored_variables map.
uint16_t pointer_address_seed
A seed for the generation of the pointer address Used for Indirect/IndirectRelative modes only.
mem[result_offset] = mem[a_address] ^ mem[b_address] (16-bit)
mem[result_offset] = mem[a_address] ^ mem[b_address]
BB_INLINE constexpr bool is_zero() const noexcept
void mutate_uint16_t(uint16_t &value, std::mt19937_64 &rng, const Uint16MutationConfig &config)
void mutate_uint32_t(uint32_t &value, std::mt19937_64 &rng, const Uint32MutationConfig &config)
void mutate_uint64_t(uint64_t &value, std::mt19937_64 &rng, const Uint64MutationConfig &config)
void mutate_uint8_t(uint8_t &value, std::mt19937_64 &rng, const Uint8MutationConfig &config)
uint64_t generate_random_uint64(std::mt19937_64 &rng)
uint32_t generate_random_uint32(std::mt19937_64 &rng)
uint16_t generate_random_uint16(std::mt19937_64 &rng)
uint8_t generate_random_uint8(std::mt19937_64 &rng)