fix(backend): serialize hash-to-field in concurrent commitment hints

backend/accelerated/icicle/internal/generator/templates/groth16.icicle.go.tmpl

@@ -836,6 +836,9 @@ func Prove(r1cs *cs.R1CS, pk *ProvingKey, fullWitness witness.Witness, cfg *icic
 	proveMu.Lock()
 	defer proveMu.Unlock()
 
+	// the solver may run the hints of independent commitments concurrently,
+	// the hash function is shared between them so it needs a lock
+	var htfLock sync.Mutex
 	solverOpts = append(solverOpts, solver.OverrideHint(bsb22ID, func(_ *big.Int, in []*big.Int, out []*big.Int) error {
 		i := int(in[0].Int64())
 		in = in[1:]
@@ -889,9 +892,11 @@ func Prove(r1cs *cs.R1CS, pk *ProvingKey, fullWitness witness.Witness, cfg *icic
 		<-ckBasisMsmDone
 		runtime.KeepAlive(privateCommittedValues[i]) // host slices must survive until CUDA finishes copying
 
+		htfLock.Lock()
 		opt.HashToFieldFn.Write(constraint.SerializeCommitment(proof.Commitments[i].Marshal(), hashed, (fr.Bits-1)/8+1))
 		hashBts := opt.HashToFieldFn.Sum(nil)
 		opt.HashToFieldFn.Reset()
+		htfLock.Unlock()
 		nbBuf := fr.Bytes
 		if opt.HashToFieldFn.Size() < fr.Bytes {
 			nbBuf = opt.HashToFieldFn.Size()

backend/groth16/groth16_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/consensys/gnark/frontend"
 	"github.com/consensys/gnark/frontend/cs/r1cs"
 	"github.com/consensys/gnark/test"
+	"github.com/stretchr/testify/require"
 )
 
 func TestCustomHashToField(t *testing.T) {
@@ -182,3 +183,58 @@ func getCurves() []ecc.ID {
 	}
 	return gnark.Curves()
 }
+
+func TestIndependentCommitments(t *testing.T) {
+	assert := require.New(t)
+	ccs, err := frontend.Compile(ecc.BN254.ScalarField(), r1cs.NewBuilder, &independentCommitmentsCircuit{})
+	assert.NoError(err)
+	pk, vk, err := groth16.Setup(ccs)
+	assert.NoError(err)
+	witness, err := frontend.NewWitness(independentCommitmentsAssignment(), ecc.BN254.ScalarField())
+	assert.NoError(err)
+	pubWitness, err := witness.Public()
+	assert.NoError(err)
+	// the commitment hints may run concurrently, prove a few times to catch
+	// any interference between them
+	for i := 0; i < 20; i++ {
+		proof, err := groth16.Prove(ccs, pk, witness)
+		assert.NoError(err)
+		assert.NoError(groth16.Verify(proof, vk, pubWitness), "proof %d", i)
+	}
+}
+
+// independentCommitmentsCircuit has two commitments which don't depend on each
+// other, with enough constraints around them so that the solver computes both
+// commitment hints in the same level, in parallel.
+type independentCommitmentsCircuit struct {
+	X [400]frontend.Variable
+	Y [400]frontend.Variable `gnark:",public"`
+}
+
+func (c *independentCommitmentsCircuit) Define(api frontend.API) error {
+	for i := 0; i < len(c.X)/2; i++ {
+		api.AssertIsEqual(api.Mul(c.X[i], c.X[i]), c.Y[i])
+	}
+	cmt1, err := api.(frontend.Committer).Commit(c.X[0], c.X[1])
+	if err != nil {
+		return err
+	}
+	for i := len(c.X) / 2; i < len(c.X); i++ {
+		api.AssertIsEqual(api.Mul(c.X[i], c.X[i]), c.Y[i])
+	}
+	cmt2, err := api.(frontend.Committer).Commit(c.X[2], c.X[3])
+	if err != nil {
+		return err
+	}
+	api.AssertIsDifferent(cmt1, cmt2)
+	return nil
+}
+
+func independentCommitmentsAssignment() *independentCommitmentsCircuit {
+	var a independentCommitmentsCircuit
+	for i := range a.X {
+		a.X[i] = i + 2
+		a.Y[i] = (i + 2) * (i + 2)
+	}
+	return &a
+}