Skip to content

fuzz(instr): copy mock_compile_message semantics for instruction harness#10174

Draft
mjain-jump wants to merge 1 commit into
mainfrom
mjain/fix-instruction-harness
Draft

fuzz(instr): copy mock_compile_message semantics for instruction harness#10174
mjain-jump wants to merge 1 commit into
mainfrom
mjain/fix-instruction-harness

Conversation

@mjain-jump

Copy link
Copy Markdown
Contributor

No description provided.

Copilot AI review requested due to automatic review settings June 10, 2026 22:10
@mjain-jump mjain-jump marked this pull request as draft June 10, 2026 22:11

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Aligns the instruction fuzz harness with Agave/Solana runtime semantics so fixtures execute under message-compilation and sysvar behaviors that better match real validator execution.

Changes:

  • OR duplicate instruction-account is_writable/is_signer flags during harness setup to match Agave message compilation.
  • Demote the invoked program account to read-only unless the upgradeable loader is present (Agave-compatible behavior).
  • Attempt to restore the instructions sysvar account when it is not referenced (Agave only mutates it when referenced).

Comment on lines 297 to 300
if( index >= test_ctx->accounts_count ) {
FD_LOG_ERR(( "invariant violation: instruction account index out of range (%u > %u)",
index, test_ctx->instr_accounts_count ));
}
Comment on lines +379 to +381
if( !referenced && input->accounts[j].data ) {
fd_memcpy( ctx->txn_out->accounts.account[j]->data, input->accounts[j].data->bytes, input->accounts[j].data->size );
}
@greptile-jt

greptile-jt Bot commented Jun 10, 2026

Copy link
Copy Markdown

Greptile Summary

This PR aligns the instruction fuzz harness (fd_instr_harness.c) with Agave's message compilation semantics to improve fuzz differential testing accuracy. Three behavioral changes are made:

  • OR-ing duplicate account flags: When an account appears multiple times in the instruction accounts list, its is_writable and is_signer flags are now OR-ed together across all references, matching how Agave's message compiler merges duplicate account entries.
  • Program account demotion: The program's own account is now demoted to read-only unless the BPF upgradeable loader is present among the instruction's referenced accounts, replicating Agave's write-protection rule.
  • Instructions sysvar restoration: After instruction execution, the instructions sysvar account data is restored to its original state if it wasn't explicitly referenced as an instruction account, since Agave only updates this sysvar for referenced accounts.

All three changes address mismatches between Firedancer's harness setup and Agave's actual behavior during message compilation and execution, which would have caused false-positive fuzz divergences.

Confidence Score: 4/5

This PR is safe to merge — it corrects fuzz harness behavior to match Agave semantics with sound bounds checking and no production code changes.

Score of 4 reflects that the changes are limited to fuzz test harness code (no production impact), the logic is well-commented with Agave references, and all array accesses are bounded by prior invariant checks (accounts_count <= MAX_TX_ACCOUNT_LOCKS = FD_TXN_ACCT_ADDR_MAX = 128). No critical issues found. Minor deduction for the restoration code not explicitly restoring data_len (though analysis confirms it's unchanged by the execution path).

No files require special attention.

Important Files Changed

Filename Overview
src/flamenco/runtime/tests/fd_instr_harness.c Adds three behavioral fixes to match Agave's message compilation: OR-ing duplicate account writable/signer flags, demoting program accounts to read-only when upgradeable loader is absent, and restoring instructions sysvar data for non-referenced accounts. All bounds checks are sound (index < accounts_count <= FD_TXN_ACCT_ADDR_MAX = 128). No critical issues found.

Sequence Diagram

sequenceDiagram
    participant Fuzzer
    participant Harness as fd_instr_harness
    participant Executor as fd_execute_instr
    participant SysvarInstr as Instructions Sysvar

    Fuzzer->>Harness: fd_solfuzz_pb_instr_ctx_create(input)
    Note over Harness: Load accounts from protobuf
    Note over Harness: [NEW] OR writable/signer flags<br/>across duplicate account refs
    Note over Harness: [NEW] Demote program account<br/>to read-only if no upgradeable loader
    Harness->>Harness: fd_instr_info_setup_instr_account()<br/>with merged flags

    Fuzzer->>Harness: fd_solfuzz_pb_instr_run(input)
    Harness->>Executor: fd_execute_instr()
    Executor->>SysvarInstr: update_current_instr_idx()<br/>(modifies last 2 bytes)
    Executor-->>Harness: exec_result

    Note over Harness: [NEW] Check if instructions sysvar<br/>is a referenced instruction account
    alt Not referenced
        Harness->>SysvarInstr: Restore original data bytes
    end

    Harness-->>Fuzzer: effects (output)
Loading

Reviews (1): Last reviewed commit: "fuzz(instr): copy mock_compile_message s..." | Re-trigger Greptile

@github-actions

Copy link
Copy Markdown

Performance Measurements ⏳

Suite Baseline New Change
backtest mainnet-424669000-perf per slot 0.050405 s 0.050376 s -0.058%
backtest mainnet-424669000-perf snapshot load 1.946 s 1.908 s -1.953%
backtest mainnet-424669000-perf total elapsed 65.325441 s 65.287708 s -0.058%
firedancer mem usage with mainnet.toml 504.41 GiB 504.41 GiB 0.000%

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants