fix(fuzzer): make the widened AST generation actually fire

tooling/ast_fuzzer/fuzz/src/targets/acir_vs_brillig.rs

@@ -5,11 +5,14 @@ use crate::{compare_results_compiled, compile_into_circuit_or_die, default_ssa_o
 use arbitrary::Arbitrary;
 use arbitrary::Unstructured;
 use color_eyre::eyre;
+use noir_ast_fuzzer::Config;
 use noir_ast_fuzzer::compare::{CompareOptions, ComparePipelines};
 use noir_ast_fuzzer::rewrite::change_all_functions_into_unconstrained;
 
 pub fn fuzz(u: &mut Unstructured) -> eyre::Result<()> {
-    let config = default_config(u)?;
+    // This target asserts that the ACIR and Brillig builds of a program agree, which
+    // `#[no_predicates]` breaks by design: see [`Config::avoid_no_predicates`].
+    let config = Config { avoid_no_predicates: true, ..default_config(u)? };
 
     let inputs = ComparePipelines::arb(
         u,

tooling/ast_fuzzer/fuzz/src/targets/min_vs_full.rs

@@ -9,12 +9,16 @@ use crate::{
 use arbitrary::{Arbitrary, Unstructured};
 use color_eyre::eyre;
 use noir_ast_fuzzer::compare::{CompareOptions, ComparePipelines};
-use noir_ast_fuzzer::{compare::CompareResult, rewrite::change_all_functions_into_unconstrained};
+use noir_ast_fuzzer::{
+    Config, compare::CompareResult, rewrite::change_all_functions_into_unconstrained,
+};
 use noirc_evaluator::ssa::minimal_passes;
 
 pub fn fuzz(u: &mut Unstructured) -> eyre::Result<()> {
     let passes = minimal_passes();
-    let config = default_config(u)?;
+    // This target asserts that the minimally- and fully-compiled builds of a program agree,
+    // which `#[no_predicates]` breaks by design: see [`Config::avoid_no_predicates`].
+    let config = Config { avoid_no_predicates: true, ..default_config(u)? };
 
     let inputs = ComparePipelines::arb(
         u,

tooling/ast_fuzzer/fuzz/src/targets/orig_vs_morph.rs

@@ -7,6 +7,7 @@ use crate::targets::default_config;
 use crate::{compare_results_compiled, compile_into_circuit_or_die, default_ssa_options};
 use arbitrary::{Arbitrary, Unstructured};
 use color_eyre::eyre;
+use noir_ast_fuzzer::Config;
 use noir_ast_fuzzer::compare::{CompareMorph, CompareOptions};
 use noir_ast_fuzzer::rewrite;
 use noir_ast_fuzzer::scope::ScopeStack;
@@ -17,7 +18,10 @@ use noirc_frontend::monomorphization::ast::{
 use noirc_frontend::monomorphization::visitor::{visit_expr, visit_expr_be_mut};
 
 pub fn fuzz(u: &mut Unstructured) -> eyre::Result<()> {
-    let config = default_config(u)?;
+    // This target asserts that a program and its value-preserving morph agree, but a morph
+    // may change the predicate structure around a call, which changes what a
+    // `#[no_predicates]` callee executes by design: see [`Config::avoid_no_predicates`].
+    let config = Config { avoid_no_predicates: true, ..default_config(u)? };
     let rules = rules::collect(&config);
     let max_rewrites = 10;
     let inputs = CompareMorph::arb(

tooling/ast_fuzzer/src/lib.rs

@@ -95,6 +95,32 @@
     pub avoid_match: bool,
     /// Avoid using the vector type.
     pub avoid_vectors: bool,
+    /// Avoid calling a constrained function from another constrained function.
+    ///
+    /// `main` has the lowest function ID, and the rule that keeps the constrained call graph
+    /// acyclic only lets a function call lower IDs, so without an exception for `main` no
+    /// constrained function other than `main` is reachable and every one of them is deleted
+    /// as unreachable. Lifting that makes the whole constrained call graph — ACIR calling
+    /// ACIR, `#[fold]`, `#[no_predicates]` — reachable, which is a region of the compiler
+    /// nothing else exercises.
+    pub avoid_constrained_calls: bool,
+    /// Avoid marking functions with `#[fold]`.
+    ///
+    /// A `#[fold]` function is compiled into its own ACIR circuit, which is a backend path
+    /// reached through `Opcode::Call` with its own argument marshalling and predicate
+    /// handling at the boundary. It only means anything for a constrained function that is
+    /// actually called, so it depends on [`Config::avoid_constrained_calls`] being off.
+    pub avoid_fold: bool,
+    /// Avoid marking functions with `#[no_predicates]`.
+    ///
+    /// The attribute inlines the callee's body only after the flattening pass, so the body
+    /// runs unpredicated: a call sitting in an untaken branch really executes in ACIR while
+    /// in Brillig it does not. That is the attribute's documented behavior, but it means a
+    /// target that asserts two builds of the same program agree (ACIR vs Brillig, or two
+    /// predicate structures the morph is entitled to change) reports a false positive for
+    /// any program whose `#[no_predicates]` function is fallible or side-effecting. Such
+    /// targets set this flag; targets that compare a pass against its own input keep it off.
+    pub avoid_no_predicates: bool,
     /// Only use comptime friendly expressions.
     pub comptime_friendly: bool,
 }
@@ -167,6 +193,9 @@
             avoid_constrain: false,
             avoid_match: false,
             avoid_vectors: false,
+            avoid_constrained_calls: false,
+            avoid_fold: false,
+            avoid_no_predicates: false,
             comptime_friendly: false,
         }
     }

tooling/ast_fuzzer/src/program/func.rs

@@ -77,6 +77,7 @@
     caller_returns_ref: bool,
     callee_id: FuncId,
     callee_decl: &FunctionDeclaration,
+    allow_constrained_calls: bool,
 ) -> bool {
     // Nobody should call `main`.
     if callee_id == Program::main_id() {
@@ -87,8 +88,10 @@
     // Since the `limit` module currently inserts an `if ctx_limit == 0`,
     // returning a literal, it would violate this if the return has `&mut`,
     // therefore we don't make recursive calls from such functions, so the
-    // limit strategy is not applied to them.
-    if caller_returns_ref && caller_unconstrained {
+    // limit strategy is not applied to them. This holds whichever runtime the
+    // caller is in: `limit` keys the rewrite off whether the body makes a call,
+    // not off `unconstrained`.
+    if caller_returns_ref {
         return false;
     }
 
@@ -108,6 +111,23 @@
     // recursion by only calling functions with lower IDs,
     // otherwise the inliner could get stuck.
     if !callee_decl.unconstrained {
+        // Flattening cannot keep a reference that crosses a constrained call boundary inside
+        // the `enable_side_effects` region it belongs to, and the SSA fails to validate after
+        // the pass. Vectors are excluded for the same reason they are between ACIR and
+        // Brillig: they are not a shape a constrained call passes cleanly.
+        if callee_decl.has_refs() || callee_decl.returns_vectors() {
+            return false;
+        }
+
+        // `main` is the exception to the ordering rule below: it has the lowest ID, so
+        // the rule would forbid it from calling any ACIR function, and since nothing can
+        // call `main` and Brillig cannot call ACIR, no constrained function other than
+        // `main` would be reachable — `remove_unreachable_functions` would delete the
+        // whole constrained call graph. Nothing ever calls `main`, so letting it call any
+        // ACIR function cannot close a cycle.
+        if caller_id == Program::main_id() {
+            return allow_constrained_calls;
+        }
         // Higher calls lower, so we can use this rule to pick function parameters
         // as we create the declarations: we can pass functions already declared.
         return callee_id < caller_id;
@@ -186,7 +206,7 @@
     /// by locally defined variables. Block scopes add and remove layers.
     locals: ScopeStack<LocalId>,
     /// Indicate which local variables are derived from function inputs.
     dynamics: Stack<imbl::HashMap<LocalId, bool>>,
     /// Indicator of being in a loop (and hence able to generate
     /// break and continue statements)
     in_loop: bool,
@@ -228,7 +248,14 @@
 
         // Consider calling any allowed global function.
         for (callee_id, callee_decl) in &ctx.function_declarations {
-            if !can_call(id, decl.unconstrained, decl.returns_refs(), *callee_id, callee_decl) {
+            if !can_call(
+                id,
+                decl.unconstrained,
+                decl.returns_refs(),
+                *callee_id,
+                callee_decl,
+                !ctx.config.avoid_constrained_calls,
+            ) {
                 continue;
             }
             let produces = types::types_produced(&callee_decl.return_type);
@@ -731,10 +758,10 @@
                 let expr = expr::deref(src_expr, tgt_type.clone());
                 Ok(Some((expr, src_dyn)))
             }
             // Reborrow a field of a referenced tuple: `&mut (*r).i`.
             //
             // The reborrow has to alias the field in place. Copying it into a fresh allocation
             // instead silently detaches the two, so a write through the reborrow never reaches
             // the original — which is what noir-claude#1099 was.
             (Type::Reference(inner, true), Type::Reference(field_type, true))
                 if matches!(inner.as_ref(), Type::Tuple(fields)
@@ -773,22 +800,13 @@
             //
             // The conversion returns a value that shares the string's storage, so the ownership
             // pass has to keep them apart; noir-claude#1201 was exactly a missing clone here.
-            (Type::String(len), Type::Array(tgt_len, item_type))
-                if *len == *tgt_len
-                    && matches!(
-                        item_type.as_ref(),
-                        Type::Integer(Signedness::Unsigned, IntegerBitSize::Eight)
-                    ) =>
-            {
-                let expr = self.call_str_as_bytes(src_expr, *len, tgt_type.clone());
-                Ok(Some((expr, src_dyn)))
-            }
-            // Reinterpret a string as its byte array with `str_as_bytes`.
             //
-            // The conversion returns a value that shares the string's storage, so the ownership
-            // pass has to keep them apart; noir-claude#1201 was exactly a missing clone here.
+            // It prints as the method call `s.as_bytes()`, which only resolves against the
+            // standard library, so it is not available to the comptime targets: those
+            // elaborate the printed snippet on its own.
             (Type::String(len), Type::Array(tgt_len, item_type))
                 if *len == *tgt_len
+                    && !self.config().comptime_friendly
                     && matches!(
                         item_type.as_ref(),
                         Type::Integer(Signedness::Unsigned, IntegerBitSize::Eight)
@@ -801,8 +819,13 @@
             // becomes dynamically sized in real Noir, and it is what promotes the value into
             // the runtime memory-block representation that vector intrinsics and the
             // reference-counting machinery operate on.
+            //
+            // Like `str_as_bytes` it prints as a method call, so it is unavailable to the
+            // comptime targets.
             (Type::Array(_, item_type), Type::Vector(tgt_item))
-                if item_type == tgt_item && !self.in_no_dynamic =>
+                if item_type == tgt_item
+                    && !self.in_no_dynamic
+                    && !self.config().comptime_friendly =>
             {
                 let expr = self.call_as_vector(src_expr, src_type.clone(), tgt_type.clone());
                 Ok(Some((expr, src_dyn)))
@@ -1557,9 +1580,18 @@
             .current()
             .variables()
             .filter_map(|(id, (_, _, typ))| types::is_printable(typ).then_some((*id, typ.clone())))
-            // TODO(#10499): comptime function representations are at the moment just "(function)"
-            // (disable printing functions if comptime_friendly is on)
-            .filter(|(_, typ)| !types::is_function(typ) || !self.config().comptime_friendly)
+            .filter(|(_, typ)| {
+                !types::is_function(typ)
+                    // TODO(#10499): comptime function representations are at the moment
+                    // just "(function)".
+                    || (!self.config().comptime_friendly
+                        // Only unconstrained code may call the print oracle directly. A
+                        // constrained print is retargeted at a wrapper function by
+                        // `wrap_oracle_prints_in_functions`, which cannot wrap a function
+                        // value: it is passed as a tuple that flattens into several SSA
+                        // values, and those would not match the wrapper's one parameter.
+                        && self.unconstrained())
+            })
             .collect::<Vec<(LocalId, Type)>>();
 
         if opts.is_empty() {
@@ -2421,7 +2453,10 @@
             .iter()
             .skip(1) // Can't call main.
             .filter_map(|(func_id, func)| {
-                let matches = func.return_type == *return_type.as_ref()
+                // `#[fold]` functions are not eligible as function values; see the candidate
+                // filter in `Context::gen_function_decl`.
+                let matches = func.inline_type != InlineType::Fold
+                    && func.return_type == *return_type.as_ref()
                     && func.unconstrained == *unconstrained
                     && func.params.len() == param_types.len()
                     && func

tooling/ast_fuzzer/src/program/mod.rs

@@ -256,13 +256,18 @@ impl Context {
             self.function_declarations
                 .iter()
                 .filter_map(|(callee_id, callee)| {
-                    can_call(
-                        id,
-                        unconstrained,
-                        types::contains_reference(&return_type),
-                        *callee_id,
-                        callee,
-                    )
+                    // A `#[fold]` function receives the recursion limit by value while every
+                    // other function receives it by mutable reference, so its signature does
+                    // not match the one a function pointer of that shape is rewritten to.
+                    (callee.inline_type != InlineType::Fold
+                        && can_call(
+                            id,
+                            unconstrained,
+                            types::contains_reference(&return_type),
+                            *callee_id,
+                            callee,
+                            !self.config.avoid_constrained_calls,
+                        ))
                     .then_some(*callee_id)
                 })
                 .collect()
@@ -328,13 +333,25 @@ impl Context {
         let inline_type = if is_main {
             InlineType::default()
         } else {
+            // A `#[fold]` function compiles into a separate ACIR circuit, so its signature
+            // has to cross a circuit boundary: `acir_gen` builds its parameters with
+            // `create_value_from_type`, which only understands numbers and arrays.
+            let can_be_folded = !self.config.avoid_fold
+                && types::can_be_main(&return_type)
+                && params.iter().all(|(_, _, _, typ, _)| types::can_be_main(typ));
+
             // Automatically include any new inline type, except where the compiler does not
             // support it: `#[fold]` compiles the function into a separate ACIR circuit, which
             // has no meaning for an unconstrained function, and `#[no_predicates]` acts on the
             // flattening pass that unconstrained code does not run.
             let choices = InlineType::iter()
                 .filter(|it| {
-                    !(unconstrained && matches!(it, InlineType::Fold | InlineType::NoPredicates))
+                    if unconstrained {
+                        !matches!(it, InlineType::Fold | InlineType::NoPredicates)
+                    } else {
+                        (*it != InlineType::Fold || can_be_folded)
+                            && (*it != InlineType::NoPredicates || !self.config.avoid_no_predicates)
+                    }
                 })
                 .collect::<Vec<_>>();
             *u.choose(&choices)?
@@ -392,7 +409,12 @@ impl Context {
             return_visibility: decl.return_visibility,
             unconstrained: decl.unconstrained,
             inline_type: decl.inline_type,
-            is_entry_point: id == FuncId(0), // we only need main as an entry point
+            // `main`, plus every constrained function compiled into its own ACIR circuit.
+            // `acir_gen` emits one ACIR per entry point and `combine_artifacts` asserts that
+            // count against the entry points, so a `#[fold]` function has to be one.
+            // Mirrors `Monomorphizer::into_program`.
+            is_entry_point: id == Program::main_id()
+                || (!decl.unconstrained && decl.inline_type.is_entry_point()),
             allow_constant_return: false,
         };
         self.functions.insert(id, func);