Skip to content

Inconsistencies on whether Instruction::MakeArray should be hoisted in brillig runtimes #9646

@TomAFrench

Description

@TomAFrench

In can_be_hoisted we say that MakeArray instructions cannot be hoisted unless in an ACIR runtime.

// Arrays can be mutated in unconstrained code so code that handles this case must
// take care to track whether the array was possibly mutated or not before
// hoisted. Since we don't know if the containing pass checks for this, we
// can only assume these are safe to hoist in constrained code.
MakeArray { .. } => function.runtime().is_acir(),

Despite this, we have handling for hoisting a MakeArray instruction in hoist_loop_invariants

// If we are hoisting a MakeArray instruction,
// we need to issue an extra inc_rc in case they are mutated afterward.
if self.inserter.function.runtime().is_brillig()
&& matches!(
self.inserter.function.dfg[instruction_id],
Instruction::MakeArray { .. }
)
{
let result =
self.inserter.function.dfg.instruction_results(instruction_id)[0];
let inc_rc = Instruction::IncrementRc { value: result };
let call_stack = self
.inserter
.function
.dfg
.get_instruction_call_stack_id(instruction_id);
self.inserter
.function
.dfg
.insert_instruction_and_results(inc_rc, *block, None, call_stack);
}

This implies that hoisting these instruction was blocked at some point without cleaning up previous handling.

Metadata

Metadata

Assignees

Labels

auditPreparation or execution of security code audits.loop_invariant

Type

No type

Projects

Status

✅ Done

Relationships

None yet

Development

No branches or pull requests

Issue actions