fix(avm): improve backfill and sload (#19241)

IlyasRidhuan · web-flow · commit 225fe4f3c72c · 2025-12-26T11:37:05.000Z
Increased the backfill rate to 80% since it was still rare to find an
ADD,SUB or MUL. Also added backfills for sload
diff --git a/barretenberg/cpp/src/barretenberg/avm_fuzzer/mutations/instructions/instruction.cpp b/barretenberg/cpp/src/barretenberg/avm_fuzzer/mutations/instructions/instruction.cpp
@@ -51,7 +51,8 @@ AddressRef generate_address_ref(std::mt19937_64& rng, uint32_t max_operand_value
 
 std::vector<FuzzInstruction> generate_ecadd_instruction(std::mt19937_64& rng)
 {
-    bool use_backfill = std::uniform_int_distribution<int>(0, 1)(rng) == 0;
+    // 80% chance to use backfill (4 out of 5) to increase success rate
+    bool use_backfill = std::uniform_int_distribution<int>(0, 4)(rng) != 0;
 
     if (!use_backfill) {
         // Random mode: use existing memory values (may fail if not valid points on curve)
@@ -100,6 +101,16 @@ std::vector<FuzzInstruction> generate_ecadd_instruction(std::mt19937_64& rng)
     AddressRef p2_y_addr = generate_address_ref(rng, MAX_16BIT_OPERAND);
     AddressRef p2_inf_addr = generate_address_ref(rng, MAX_8BIT_OPERAND);
 
+    // Force Direct addressing so SET instructions write to the same addresses that ECADD reads from.
+    // TODO: Implement smart backfilling for indirect addressing modes by also setting up
+    // the pointer addresses (e.g., M[pointer_address_seed] = target_address).
+    p1_x_addr.mode = AddressingMode::Direct;
+    p1_y_addr.mode = AddressingMode::Direct;
+    p1_inf_addr.mode = AddressingMode::Direct;
+    p2_x_addr.mode = AddressingMode::Direct;
+    p2_y_addr.mode = AddressingMode::Direct;
+    p2_inf_addr.mode = AddressingMode::Direct;
+
     backfill_point(p1, p1_x_addr, p1_y_addr, p1_inf_addr);
     backfill_point(p2, p2_x_addr, p2_y_addr, p2_inf_addr);
 
@@ -143,7 +154,8 @@ FuzzInstruction generate_set_for_tag(bb::avm2::MemoryTag tag, AddressRef addr, s
 template <typename InstructionType>
 std::vector<FuzzInstruction> generate_alu_with_matching_tags(std::mt19937_64& rng, uint32_t max_operand)
 {
-    bool use_backfill = std::uniform_int_distribution<int>(0, 1)(rng) == 0;
+    // 80% chance to use backfill (4 out of 5) to increase success rate
+    bool use_backfill = std::uniform_int_distribution<int>(0, 4)(rng) != 0;
 
     if (!use_backfill) {
         return { InstructionType{ .a_address = generate_variable_ref(rng),
@@ -155,6 +167,12 @@ std::vector<FuzzInstruction> generate_alu_with_matching_tags(std::mt19937_64& rn
     AddressRef a_addr = generate_address_ref(rng, max_operand);
     AddressRef b_addr = generate_address_ref(rng, max_operand);
 
+    // Force Direct addressing so SET instructions write to the same addresses that ALU reads from.
+    // TODO: Implement smart backfilling for indirect addressing modes by also setting up
+    // the pointer addresses (e.g., M[pointer_address_seed] = target_address).
+    a_addr.mode = AddressingMode::Direct;
+    b_addr.mode = AddressingMode::Direct;
+
     std::vector<FuzzInstruction> instructions;
     instructions.push_back(generate_set_for_tag(tag, a_addr, rng));
     instructions.push_back(generate_set_for_tag(tag, b_addr, rng));
@@ -168,7 +186,8 @@ std::vector<FuzzInstruction> generate_alu_with_matching_tags(std::mt19937_64& rn
 template <typename InstructionType>
 std::vector<FuzzInstruction> generate_alu_with_matching_tags_not_ff(std::mt19937_64& rng, uint32_t max_operand)
 {
-    bool use_backfill = std::uniform_int_distribution<int>(0, 1)(rng) == 0;
+    // 80% chance to use backfill (4 out of 5) to increase success rate
+    bool use_backfill = std::uniform_int_distribution<int>(0, 4)(rng) != 0;
 
     if (!use_backfill) {
         return { InstructionType{ .a_address = generate_variable_ref(rng),
@@ -186,6 +205,12 @@ std::vector<FuzzInstruction> generate_alu_with_matching_tags_not_ff(std::mt19937
     AddressRef a_addr = generate_address_ref(rng, max_operand);
     AddressRef b_addr = generate_address_ref(rng, max_operand);
 
+    // Force Direct addressing so SET instructions write to the same addresses that ALU reads from.
+    // TODO: Implement smart backfilling for indirect addressing modes by also setting up
+    // the pointer addresses (e.g., M[pointer_address_seed] = target_address).
+    a_addr.mode = AddressingMode::Direct;
+    b_addr.mode = AddressingMode::Direct;
+
     std::vector<FuzzInstruction> instructions;
     instructions.push_back(generate_set_for_tag(tag, a_addr, rng));
     instructions.push_back(generate_set_for_tag(tag, b_addr, rng));
@@ -196,7 +221,8 @@ std::vector<FuzzInstruction> generate_alu_with_matching_tags_not_ff(std::mt19937
 
 std::vector<FuzzInstruction> generate_fdiv_instruction(std::mt19937_64& rng, uint32_t max_operand)
 {
-    bool use_backfill = std::uniform_int_distribution<int>(0, 1)(rng) == 0;
+    // 80% chance to use backfill (4 out of 5) to increase success rate
+    bool use_backfill = std::uniform_int_distribution<int>(0, 4)(rng) != 0;
 
     if (!use_backfill) {
         // Random mode: use existing memory values
@@ -221,6 +247,12 @@ std::vector<FuzzInstruction> generate_fdiv_instruction(std::mt19937_64& rng, uin
     AddressRef a_addr = generate_address_ref(rng, max_operand);
     AddressRef b_addr = generate_address_ref(rng, max_operand);
 
+    // Force Direct addressing so SET instructions write to the same addresses that FDIV reads from.
+    // TODO: Implement smart backfilling for indirect addressing modes by also setting up
+    // the pointer addresses (e.g., M[pointer_address_seed] = target_address).
+    a_addr.mode = AddressingMode::Direct;
+    b_addr.mode = AddressingMode::Direct;
+
     // SET the dividend (a)
     instructions.push_back(SET_FF_Instruction{
         .value_tag = bb::avm2::MemoryTag::FF, .result_address = a_addr, .value = generate_nonzero_field() });
@@ -238,7 +270,8 @@ std::vector<FuzzInstruction> generate_fdiv_instruction(std::mt19937_64& rng, uin
 
 std::vector<FuzzInstruction> generate_keccakf_instruction(std::mt19937_64& rng)
 {
-    bool use_backfill = std::uniform_int_distribution<int>(0, 1)(rng) == 0;
+    // 80% chance to use backfill (4 out of 5) to increase success rate
+    bool use_backfill = std::uniform_int_distribution<int>(0, 4)(rng) != 0;
     if (!use_backfill) {
         // Random mode
         return { KECCAKF1600_Instruction{ .src_address = generate_variable_ref(rng),
@@ -249,6 +282,10 @@ std::vector<FuzzInstruction> generate_keccakf_instruction(std::mt19937_64& rng)
     // Keccak needs to backfill 25 U64 values, these need be contiguous in memory
 
     AddressRef src_address = generate_address_ref(rng, MAX_16BIT_OPERAND - 24);
+    // Force Direct addressing so SET instructions write to the same addresses that KECCAKF1600 reads from.
+    // TODO: Implement smart backfilling for indirect addressing modes by also setting up
+    // the pointer addresses (e.g., M[pointer_address_seed] = target_address).
+    src_address.mode = AddressingMode::Direct;
     for (size_t i = 0; i < 25; i++) {
         instructions.push_back(
             SET_64_Instruction{ .value_tag = bb::avm2::MemoryTag::U64,
@@ -263,7 +300,8 @@ std::vector<FuzzInstruction> generate_keccakf_instruction(std::mt19937_64& rng)
 
 std::vector<FuzzInstruction> generate_sha256compression_instruction(std::mt19937_64& rng)
 {
-    bool use_backfill = std::uniform_int_distribution<int>(0, 1)(rng) == 0;
+    // 80% chance to use backfill (4 out of 5) to increase success rate
+    bool use_backfill = std::uniform_int_distribution<int>(0, 4)(rng) != 0;
     if (!use_backfill) {
         // Random mode
         return { SHA256COMPRESSION_Instruction{ .state_address = generate_variable_ref(rng),
@@ -277,6 +315,10 @@ std::vector<FuzzInstruction> generate_sha256compression_instruction(std::mt19937
 
     // Generate state address (8 contiguous U32 values)
     AddressRef state_address = generate_address_ref(rng, MAX_16BIT_OPERAND - 7);
+    // Force Direct addressing so SET instructions write to the same addresses that SHA256COMPRESSION reads from.
+    // TODO: Implement smart backfilling for indirect addressing modes by also setting up
+    // the pointer addresses (e.g., M[pointer_address_seed] = target_address).
+    state_address.mode = AddressingMode::Direct;
     for (size_t i = 0; i < 8; i++) {
         instructions.push_back(SET_32_Instruction{
             .value_tag = bb::avm2::MemoryTag::U32,
@@ -287,6 +329,7 @@ std::vector<FuzzInstruction> generate_sha256compression_instruction(std::mt19937
 
     // Generate input address (16 contiguous U32 values)
     AddressRef input_address = generate_address_ref(rng, MAX_16BIT_OPERAND - 15);
+    input_address.mode = AddressingMode::Direct;
     for (size_t i = 0; i < 16; i++) {
         instructions.push_back(SET_32_Instruction{
             .value_tag = bb::avm2::MemoryTag::U32,
@@ -304,7 +347,8 @@ std::vector<FuzzInstruction> generate_sha256compression_instruction(std::mt19937
 
 std::vector<FuzzInstruction> generate_toradixbe_instruction(std::mt19937_64& rng)
 {
-    bool use_backfill = std::uniform_int_distribution<int>(0, 1)(rng) == 0;
+    // 80% chance to use backfill (4 out of 5) to increase success rate
+    bool use_backfill = std::uniform_int_distribution<int>(0, 4)(rng) != 0;
     if (!use_backfill) {
         // Random mode
         return { TORADIXBE_Instruction{ .value_address = generate_variable_ref(rng),
@@ -324,6 +368,14 @@ std::vector<FuzzInstruction> generate_toradixbe_instruction(std::mt19937_64& rng
     AddressRef num_limbs_addr = generate_address_ref(rng, MAX_16BIT_OPERAND);
     AddressRef output_bits_addr = generate_address_ref(rng, MAX_8BIT_OPERAND);
 
+    // Force Direct addressing so SET instructions write to the same addresses that TORADIXBE reads from.
+    // TODO: Implement smart backfilling for indirect addressing modes by also setting up
+    // the pointer addresses (e.g., M[pointer_address_seed] = target_address).
+    value_addr.mode = AddressingMode::Direct;
+    radix_addr.mode = AddressingMode::Direct;
+    num_limbs_addr.mode = AddressingMode::Direct;
+    output_bits_addr.mode = AddressingMode::Direct;
+
     // SET the radix (U32) - pick radix between 2 and 256
     uint32_t radix = std::uniform_int_distribution<uint32_t>(2, 256)(rng);
     instructions.push_back(
@@ -360,6 +412,47 @@ std::vector<FuzzInstruction> generate_toradixbe_instruction(std::mt19937_64& rng
     return instructions;
 }
 
+// A better way in the future is to pass in a vector of possible slots that have been written to,
+// this would allow us to supply external world state info.
+std::vector<FuzzInstruction> generate_sload_instruction(std::mt19937_64& rng)
+{
+    // 80% chance to use backfill (4 out of 5) to increase success rate
+    bool use_backfill = std::uniform_int_distribution<int>(0, 4)(rng) != 0;
+
+    if (!use_backfill) {
+        // Random mode: requires at least one prior SSTORE to have been processed
+        return { SLOAD_Instruction{ .slot_index = generate_random_uint16(rng),
+                                    .slot_address = generate_address_ref(rng, MAX_16BIT_OPERAND),
+                                    .result_address = generate_address_ref(rng, MAX_16BIT_OPERAND) } };
+    }
+
+    // Backfill mode: generate SSTORE first to ensure storage_addresses is non-empty
+    // This guarantees SLOAD will find a valid slot (get_slot uses modulo on non-empty vector)
+    std::vector<FuzzInstruction> instructions;
+    instructions.reserve(3);
+
+    AddressRef sstore_src = generate_address_ref(rng, MAX_16BIT_OPERAND);
+    // Force Direct addressing so SET writes to the same address that SSTORE reads from.
+    // TODO: Implement smart backfilling for indirect addressing modes.
+    sstore_src.mode = AddressingMode::Direct;
+
+    // SET a value to store
+    instructions.push_back(SET_FF_Instruction{
+        .value_tag = bb::avm2::MemoryTag::FF, .result_address = sstore_src, .value = generate_random_field(rng) });
+
+    // SSTORE - appends to storage_addresses in memory_manager
+    instructions.push_back(SSTORE_Instruction{ .src_address = sstore_src,
+                                               .result_address = generate_address_ref(rng, MAX_16BIT_OPERAND),
+                                               .slot = generate_random_field(rng) });
+
+    // SLOAD - now guaranteed to succeed (storage_addresses not empty, get_slot uses modulo)
+    instructions.push_back(SLOAD_Instruction{ .slot_index = generate_random_uint16(rng),
+                                              .slot_address = generate_address_ref(rng, MAX_16BIT_OPERAND),
+                                              .result_address = generate_address_ref(rng, MAX_16BIT_OPERAND) });
+
+    return instructions;
+}
+
 std::vector<FuzzInstruction> generate_instruction(std::mt19937_64& rng)
 {
     InstructionGenerationOptions option = BASIC_INSTRUCTION_GENERATION_CONFIGURATION.select(rng);
@@ -494,9 +587,7 @@ std::vector<FuzzInstruction> generate_instruction(std::mt19937_64& rng)
                                      .result_address = generate_address_ref(rng, MAX_16BIT_OPERAND),
                                      .slot = generate_random_field(rng) } };
     case InstructionGenerationOptions::SLOAD:
-        return { SLOAD_Instruction{ .slot_index = generate_random_uint16(rng),
-                                    .slot_address = generate_address_ref(rng, MAX_16BIT_OPERAND),
-                                    .result_address = generate_address_ref(rng, MAX_16BIT_OPERAND) } };
+        return generate_sload_instruction(rng);
     case InstructionGenerationOptions::GETENVVAR:
         return { GETENVVAR_Instruction{ .result_address = generate_address_ref(rng, MAX_16BIT_OPERAND),
                                         .type = generate_random_uint8(rng) } };
