Fuzzer failure cause by popping front of vector

[TomAFrench]

Last night's fuzzer failed: https://github.com/noir-lang/noir/actions/runs/21932884367/job/63340538747

This got minimised to:

fn main() -> pub Field {
    // Safety: test
    unsafe { func_4(@[true, true]) }
}

unconstrained fn func_4(a: [bool]) -> Field {
    let mut idx: u32 = 0;
    while a[0] {
        if idx == 1 {
            break
        } else {
            idx = idx + 1;
            let _ = a.pop_front();
        }
    };
    0
}

This looks to be another instance of #11474

[aakoshh]

It's interesting though that there should be only 1 pop happening, so I would imagine after that a[0] still returns a bool 🤔

[aakoshh]

Ah, that's because popping the first item from a mutable vector results in the meta-data being shifted towards the back. In SSA it reads a[0] with array_get v1, index u32 3 minus 3 -> u1, which gets the 4th item, which is item 0 after the 3 meta-data fields.

• v1 starts out pointing to: [RC, Size, Capacity, Item0, Item1]; reading index 3 returns Item0
• after popping, I reckon v1 still points at the original address on the heap, but now that looks like [RC, RC, Size, Capacity, Item1]; now reading index 3 returns Capacity, and we get this error:

error: Assertion failed: 'condition value is not a boolean: Bit size for value 32 does not match the expected bit size 1'

[guipublic]

Closing because there is no more repro on master, this has been fixed by #11485.