mirror of
https://github.com/bitcoin/bitcoin.git
synced 2026-09-12 05:32:22 +02:00
f11dc6170e
87b080fe2bfuzz: reset the reused mempool in process_message(s) (Hao Xu)d522fd3196fuzz: prepare deterministic mempool rebuilds (Hao Xu)b11456386bfuzz: let the test input toggle IBD in the p2p fuzz targets (Hao Xu)2a29cee684test: add helper to reset chainman and mempool (Hao Xu)2a4ef42d34fuzz: share a single FakeNodeClock in the chainman-resetting fuzz targets (Hao Xu) Pull request description: ## Problem `process_message` and `process_messages` keep the node in IBD (`ResetIbd()`) and mine their coinbases with the default bare-`OP_TRUE` output script. As a result `net_processing` returns early at the `IsInitialBlockDownload()` check and never reaches the transaction-handling path; and even if it did, a tx spending a bare-`OP_TRUE` coinbase is rejected as `NONSTANDARD` by `ValidateInputsStandardness`. The reused mempool therefore always stays empty and that path is never exercised. ## Changes Both targets now get the same treatment: 1. **Toggle IBD from the test input** — a `bool` decides whether to also `JumpOutOfIbd()`, exercising both the IBD and non-IBD paths. In `process_message` it is consumed last, so existing corpus entries read `false` and are unchanged. In `process_messages` the messages run in a loop, so the bool must be consumed *first* (see the corpus note below). 2. **Use a spendable `P2WSH_OP_TRUE` coinbase** — both anyone-can-spend (an `OP_TRUE` witness, no signature) and a standard witness output, so a fuzz-built tx spending a mature coinbase can actually be accepted into the mempool. 3. **Reset the rng before rebuilding (preparation)** — rebuilding the chainman (and, in the next commit, the mempool) consumes the global PRNG. Reset it with `MakeRandDeterministicDANGEROUS()` first so the rebuild is deterministic across iterations. Mirrors the `cmpctblock` harness. 4. **Reset the reused mempool** — now that the mempool can become non-empty, rebuild it together with the chainman in `ResetChainmanAndMempool()` when the block index grew or the mempool changed. A dirty mempool is detected by its sequence number rather than its size, since a tx can be added and removed within one iteration (leaving the size unchanged). ## Corpus note ~~In `process_messages` the IBD bool is consumed before the message loop (first integral read), which shifts the `FuzzedDataProvider` layout. Existing `process_messages` corpus entries can be migrated by appending a single `0x00` byte at the end (read as `false`, keeping the IBD path); every other consumed value stays the same. This is a qa-assets change accompanying this PR.~~ This note no longer applies because the IBD toggle is now consumed inside the message loop. Appending a single `0x00` byte would not reliably target that bool or preserve the rest of the input layout. The accompanying `qa-assets` update should migrate or regenerate the affected `process_messages` corpus entries for the current layout. ACKs for top commit: Crypt-iQ: crACK87b080fe2bmaflcko: review ACK87b080fe2b🏁 frankomosh: Review ACK87b080fe2bTree-SHA512: e557b2ca3329767a45fe8315c63df9c3191a3a46a17c5e75ea3e4ad0c25e0e500a687fa650297a386b0a2ebb95503d069089ca5ae3d0a34caab98367aeb28683