SSA Interpreter: `ConstantDoesNotFitInType`

[aakoshh]

Aim

Discovered testing #8610
This is a minimised version of the test failure in https://github.com/noir-lang/noir/actions/runs/15530190355/job/43718133418?pr=8610

The following program changes from passing to internal error during an SSA pass:

fn main(b: u1) -> pub u8 {
    9 >> b as u8
}

Prover.toml:

b = "0x0000000000000000000000000000000000000000000000000000000000000001"

Expected Behavior

It should return the same as execute:

❯ cargo run -q -p nargo_cli -- execute
[fuzz_testing] Circuit witness successfully solved
[fuzz_testing] Witness saved to target/fuzz_testing.gz
[fuzz_testing] Circuit output: Field(4)

Bug

❯ cargo run -q -p nargo_cli -- interpret \
        --ssa-pass "(step 17)" --show-ssa-pass "(step 17)" \
        --ssa-pass "(step 18)" --show-ssa-pass "(step 18)"
After Flattening (step 17):
acir(inline) pure fn main f0 {
  b0(v0: u1):
    v1 = cast v0 as u8
    v3 = shr u8 9, v1
    return v3
}

--- Interpreter result after Flattening (step 17):
Ok([Numeric(U8(4))])
---
After Removing Bit Shifts (step 18):
acir(inline) pure fn main f0 {
  b0(v0: u1):
    v1 = cast v0 as u8
    v3 = lt v1, u8 8
    v4 = cast v3 as u8
    v5 = cast v3 as u8
    v6 = unchecked_mul v4, v1
    v7 = cast v6 as Field
    v9 = call to_le_bits(v7) -> [u1; 8]
    v11 = array_get v9, index u32 7 -> u1
    v12 = not v11
    v13 = cast v11 as Field
    v14 = cast v12 as Field
    v16 = mul Field 2, v13
    v17 = add v14, v16
    v19 = array_get v9, index u32 6 -> u1
    v20 = not v19
    v21 = cast v19 as Field
    v22 = cast v20 as Field
    v23 = mul v17, v17
    v24 = mul v23, v22
    v25 = mul v23, Field 2
    v26 = mul v25, v21
    v27 = add v24, v26
    v29 = array_get v9, index u32 5 -> u1
    v30 = not v29
    v31 = cast v29 as Field
    v32 = cast v30 as Field
    v33 = mul v27, v27
    v34 = mul v33, v32
    v35 = mul v33, Field 2
    v36 = mul v35, v31
    v37 = add v34, v36
    v39 = array_get v9, index u32 4 -> u1
    v40 = not v39
    v41 = cast v39 as Field
    v42 = cast v40 as Field
    v43 = mul v37, v37
    v44 = mul v43, v42
    v45 = mul v43, Field 2
    v46 = mul v45, v41
    v47 = add v44, v46
    v49 = array_get v9, index u32 3 -> u1
    v50 = not v49
    v51 = cast v49 as Field
    v52 = cast v50 as Field
    v53 = mul v47, v47
    v54 = mul v53, v52
    v55 = mul v53, Field 2
    v56 = mul v55, v51
    v57 = add v54, v56
    v59 = array_get v9, index u32 2 -> u1
    v60 = not v59
    v61 = cast v59 as Field
    v62 = cast v60 as Field
    v63 = mul v57, v57
    v64 = mul v63, v62
    v65 = mul v63, Field 2
    v66 = mul v65, v61
    v67 = add v64, v66
    v69 = array_get v9, index u32 1 -> u1
    v70 = not v69
    v71 = cast v69 as Field
    v72 = cast v70 as Field
    v73 = mul v67, v67
    v74 = mul v73, v72
    v75 = mul v73, Field 2
    v76 = mul v75, v71
    v77 = add v74, v76
    v79 = array_get v9, index u32 0 -> u1
    v80 = not v79
    v81 = cast v79 as Field
    v82 = cast v80 as Field
    v83 = mul v77, v77
    v84 = mul v83, v82
    v85 = mul v83, Field 2
    v86 = mul v85, v81
    v87 = add v84, v86
    v88 = cast v87 as u8
    v90 = div u8 9, v88
    v91 = unchecked_mul v5, v90
    return v91
}

--- Interpreter result after Removing Bit Shifts (step 18):
Err(Internal(ConstantDoesNotFitInType { constant: -4445565806996234369311636851666491623585309773144300390028601026122215664337, typ: Unsigned { bit_size: 8 } }))
---

To Reproduce

See above.

For the record the test in CI was minimised with this command:

tooling/ast_fuzzer/minimizer/scripts/minimize.sh "ConstantDoesNotFitInType" interpret $PWD/test_programs/execution_success/fuzz_testing/src/main.nr

Workaround

None

Workaround Description

No response

Additional Context

No response

Project Impact

None

Blocker Context

No response

Nargo Version

cargo run -q -p nargo_cli -- --version

NoirJS Version

No response

Proving Backend Tooling & Version

No response

Would you like to submit a PR for this Issue?

None

Support Needs

No response

[asterite]

Also happens with this program:

fn main(b: u8) -> pub u8 {
    9 >> b
}

(so no need to go from u1 to u8 to trigger the bug)

[asterite]

I'm seeing that there's these instructions:

v18 = call to_le_bits(v17) -> [u1; 8]
v21 = array_get v18, index u32 7 -> u1
v22 = not v21

and they get these values:

v21 = u8 0
v22 = u8 255

So I thought the bug was that array_get is getting a u1 but the interpreter sees a u8, but... the call to_le_bits returns [u1; 8] and the interpreter thinks it's [u8; 8], I think that's the bug.