fuzz: overnight cmpct fill extra-txn and store_reorg timeout - #403
Merged
Conversation
added 2 commits
September 8, 2026 07:15
![rbitcoin-grok[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Overnight cmpct_differential panics on the fill seed (`[0, 1, 0, 1]`) with ours=[] core=[1]. Core v31 latches IBD in UpdateIBDStatus (LoadChainTip / connect), not setmocktime. A 2011 regtest genesis stays in IBD under the default 24h maxtipage, so P2P tx is dropped and never reaches vExtraTxnForCompact. Compact blocks still process via CanDirectFetch (mocktime). Pass -maxtipage=999999999 on the P2P bitcoind so genesis is recent at LoadChainTip.
Overnight store_reorg ASan hits libFuzzer -timeout=30 on tiny units (`[0, 1, 254]`, `[1, 0, 0, 0]`). Equal-work siblings are parked in held_bodies and try_apply_held walks every parked body on each accept. A persistent OnceLock hub grows without bound. Reopen the tiny hub every 16 apply calls so overnight churn still covers sibling-after-rewind without one unit exceeding 30s.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Overnight fuzz run 34224357973 (and the previous night, 34127666012) failed two jobs. Both are harness, not consensus splits.
cmpct_differential— fill seedours=[] core=[1]Panic on corpus seed
cmpct_fuzz_fill.bin([0, 1, 0, 1]), MS=0, first unit after compile:Our reconstruct with the fill tx is empty-missing (unit test already pins that). Core
getblocktxnstill asked for index 1.Core v31
IsInitialBlockDownload()is a lock-free latch (m_cached_is_ibd) updated only inUpdateIBDStatus(LoadChainTip/ConnectTip/DisconnectTip).setmocktimedoes not leave IBD. A 2011 regtest genesis vs wall-clock 2026 stays in IBD under the default 24h-maxtipage, soProcessMessage(TX)returns immediately. Compact blocks still process (CanDirectFetchuses mocktime). Fill extra-txn never populated.Fix:
-maxtipage=999999999on the P2Pbitcoindargv so genesis is recent atLoadChainTip.setmocktimestays forCanDirectFetch.store_reorg— ASan-timeout=30on[1, 0, 0, 0]Slow-unit
[0, 1, 254], then timeout 38s on[1, 0, 0, 0]. SharedOnceLockhub: every equal-work sibling ishold_body'd, thentry_apply_heldwalks all parked bodies. Overnight churn unbounded; ASan + 30s fires.Fix: reopen the tiny hub every 16
store_reorg_applycalls. Sibling-after-rewind still runs inside a window; one unit cannot accumulate thousands of held tips.Test plan
cargo test --manifest-path fuzz/Cargo.toml --lib p2p_args_listen_v2_bind_whitelistcargo test -p rbitcoin-net store_reorgscripts/fuzz-run.test.shfmtdenyclippyast-greptestwindowsmacosmultinodecoverage)Not a
core-functionalPR.