Skip to content

fix: size dict elements buffer to HashMap capacity, not len#1646

Merged
TomerStarkware merged 1 commit into
mainfrom
tomer/fix_dict_to_ptr
Jun 18, 2026
Merged

fix: size dict elements buffer to HashMap capacity, not len#1646
TomerStarkware merged 1 commit into
mainfrom
tomer/fix_dict_to_ptr

Conversation

@TomerStarkware

@TomerStarkware TomerStarkware commented Jun 18, 2026

Copy link
Copy Markdown
Collaborator

Summary

When materializing a Felt252Dict value (Value::Felt252Dict → native), the elements buffer was arena-allocated with room for map.len() slots. The runtime's dict_get only grows the elements buffer once the backing HashMap is full, so a runtime insert of a new key could write one slot past the end of the buffer and corrupt the arena.

This reorders the allocation so the FeltDict struct is created and reserved first, then sizes the elements buffer to the HashMap's actual capacity() (which reserve usually over-allocates). That guarantees there is always room for the runtime to fill every slot the HashMap can hold.

Changes

  • src/values.rs: allocate/register the FeltDict before the elements buffer, and size the buffer to dict.mappings.capacity() instead of map.len().

🤖 Generated with Claude Code


This change is Reviewable

@TomerStarkware TomerStarkware requested a review from orizi June 18, 2026 08:25
@TomerStarkware TomerStarkware force-pushed the tomer/fix_dict_to_ptr branch from 3d83051 to a2d2a66 Compare June 18, 2026 08:28
When materializing a Felt252Dict value, the elements buffer was
arena-allocated with room for `map.len()` slots. The runtime's
`dict_get` only grows the buffer once the backing HashMap is full, so a
runtime insert of a new key could write one slot past the end of the
buffer and corrupt the arena.

Allocate the buffer using the HashMap's capacity (read after `reserve`,
which usually over-allocates) so there is always room for the runtime to
fill every slot the HashMap can hold.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@TomerStarkware TomerStarkware force-pushed the tomer/fix_dict_to_ptr branch from a2d2a66 to 14d5c5e Compare June 18, 2026 08:28

@orizi orizi left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:lgtm:

@orizi reviewed 1 file and all commit messages, and made 1 comment.
Reviewable status: :shipit: complete! all files reviewed, all discussions resolved (waiting on TomerStarkware).

@github-actions

Copy link
Copy Markdown

Benchmarking results

Benchmark for program dict_insert

Open benchmarks
Command Mean [s] Min [s] Max [s] Relative
Cairo-vm (Rust, Cairo 1) 10.432 ± 0.045 10.368 10.496 5.74 ± 0.04
cairo-native (embedded AOT) 1.818 ± 0.011 1.806 1.838 1.00
cairo-native (embedded JIT using LLVM's ORC Engine) 1.828 ± 0.015 1.801 1.848 1.01 ± 0.01

Benchmark for program dict_snapshot

Open benchmarks
Command Mean [ms] Min [ms] Max [ms] Relative
Cairo-vm (Rust, Cairo 1) 517.0 ± 3.8 510.3 523.8 1.00
cairo-native (embedded AOT) 1629.6 ± 12.2 1614.2 1654.5 3.15 ± 0.03
cairo-native (embedded JIT using LLVM's ORC Engine) 1666.1 ± 12.0 1649.7 1689.0 3.22 ± 0.03

Benchmark for program factorial_2M

Open benchmarks
Command Mean [s] Min [s] Max [s] Relative
Cairo-vm (Rust, Cairo 1) 4.639 ± 0.014 4.620 4.662 2.21 ± 0.01
cairo-native (embedded AOT) 2.097 ± 0.007 2.089 2.109 1.00
cairo-native (embedded JIT using LLVM's ORC Engine) 2.108 ± 0.012 2.082 2.127 1.01 ± 0.01

Benchmark for program fib_2M

Open benchmarks
Command Mean [s] Min [s] Max [s] Relative
Cairo-vm (Rust, Cairo 1) 4.560 ± 0.043 4.524 4.670 2.79 ± 0.03
cairo-native (embedded AOT) 1.635 ± 0.012 1.614 1.652 1.00
cairo-native (embedded JIT using LLVM's ORC Engine) 1.669 ± 0.007 1.658 1.682 1.02 ± 0.01

Benchmark for program linear_search

Open benchmarks
Command Mean [ms] Min [ms] Max [ms] Relative
Cairo-vm (Rust, Cairo 1) 560.8 ± 4.0 555.4 565.0 1.00
cairo-native (embedded AOT) 1649.8 ± 9.3 1636.1 1663.7 2.94 ± 0.03
cairo-native (embedded JIT using LLVM's ORC Engine) 1692.6 ± 6.6 1684.8 1708.9 3.02 ± 0.02

Benchmark for program logistic_map

Open benchmarks
Command Mean [ms] Min [ms] Max [ms] Relative
Cairo-vm (Rust, Cairo 1) 474.9 ± 3.7 470.7 482.0 1.00
cairo-native (embedded AOT) 1801.4 ± 10.7 1785.6 1815.3 3.79 ± 0.04
cairo-native (embedded JIT using LLVM's ORC Engine) 1911.0 ± 13.5 1895.2 1938.2 4.02 ± 0.04

@github-actions

Copy link
Copy Markdown

Benchmark results Main vs HEAD.

Base

Command Mean [s] Min [s] Max [s] Relative
base dict_insert.cairo (JIT) 2.046 ± 0.037 2.005 2.137 1.01 ± 0.02
base dict_insert.cairo (AOT) 2.020 ± 0.027 1.969 2.067 1.00

Head

Command Mean [s] Min [s] Max [s] Relative
head dict_insert.cairo (JIT) 1.842 ± 0.009 1.824 1.854 1.00 ± 0.01
head dict_insert.cairo (AOT) 1.838 ± 0.012 1.811 1.855 1.00

Base

Command Mean [s] Min [s] Max [s] Relative
base dict_snapshot.cairo (JIT) 1.821 ± 0.028 1.783 1.859 1.03 ± 0.02
base dict_snapshot.cairo (AOT) 1.766 ± 0.017 1.741 1.792 1.00

Head

Command Mean [s] Min [s] Max [s] Relative
head dict_snapshot.cairo (JIT) 1.714 ± 0.015 1.687 1.744 1.04 ± 0.02
head dict_snapshot.cairo (AOT) 1.650 ± 0.021 1.627 1.688 1.00

Base

Command Mean [s] Min [s] Max [s] Relative
base factorial_2M.cairo (JIT) 2.279 ± 0.016 2.262 2.321 1.00 ± 0.01
base factorial_2M.cairo (AOT) 2.273 ± 0.018 2.246 2.302 1.00

Head

Command Mean [s] Min [s] Max [s] Relative
head factorial_2M.cairo (JIT) 2.124 ± 0.011 2.107 2.137 1.01 ± 0.01
head factorial_2M.cairo (AOT) 2.111 ± 0.016 2.093 2.133 1.00

Base

Command Mean [s] Min [s] Max [s] Relative
base fib_2M.cairo (JIT) 1.813 ± 0.026 1.765 1.854 1.00
base fib_2M.cairo (AOT) 1.819 ± 0.023 1.790 1.859 1.00 ± 0.02

Head

Command Mean [s] Min [s] Max [s] Relative
head fib_2M.cairo (JIT) 1.668 ± 0.007 1.659 1.684 1.01 ± 0.01
head fib_2M.cairo (AOT) 1.655 ± 0.008 1.645 1.670 1.00

Base

Command Mean [s] Min [s] Max [s] Relative
base linear_search.cairo (JIT) 1.884 ± 0.031 1.825 1.920 1.03 ± 0.02
base linear_search.cairo (AOT) 1.835 ± 0.024 1.804 1.869 1.00

Head

Command Mean [s] Min [s] Max [s] Relative
head linear_search.cairo (JIT) 1.707 ± 0.021 1.674 1.735 1.02 ± 0.02
head linear_search.cairo (AOT) 1.682 ± 0.017 1.655 1.709 1.00

Base

Command Mean [s] Min [s] Max [s] Relative
base logistic_map.cairo (JIT) 2.114 ± 0.018 2.089 2.147 1.06 ± 0.02
base logistic_map.cairo (AOT) 2.001 ± 0.023 1.973 2.040 1.00

Head

Command Mean [s] Min [s] Max [s] Relative
head logistic_map.cairo (JIT) 1.939 ± 0.015 1.919 1.970 1.07 ± 0.01
head logistic_map.cairo (AOT) 1.809 ± 0.011 1.791 1.825 1.00

@TomerStarkware TomerStarkware added this pull request to the merge queue Jun 18, 2026
Merged via the queue into main with commit ff87d86 Jun 18, 2026
15 checks passed
@TomerStarkware TomerStarkware deleted the tomer/fix_dict_to_ptr branch June 18, 2026 12:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants