Can be reproduced on current master with D_GLIBCXX_DEBUG
:
0/usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/debug/safe_iterator.h:883:
1In function:
2 __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1,
3 std::random_access_iterator_tag>::_Self __gnu_debug::operator+(const
4 __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1,
5 std::random_access_iterator_tag>::_Self &,
6 __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1,
7 std::random_access_iterator_tag>::difference_type)
8
9Error: attempt to advance a dereferenceable iterator 369 steps, which falls
10outside its valid range.
11
12Objects involved in the operation:
13 iterator @ 0x0x7ffd3d613138 {
14 type = std::__cxx1998::_Bit_const_iterator (constant iterator);
15 state = dereferenceable;
16 references sequence with type 'std::__debug::vector<bool, std::allocator<bool> >' @ 0x0x7ffd3d663590
17 }
18==65050== ERROR: libFuzzer: deadly signal
19 [#0](/bitcoin-bitcoin/0/) 0x559ab9787690 in __sanitizer_print_stack_trace (/bitcoin/src/test/fuzz/fuzz+0x5a1690)
20 [#1](/bitcoin-bitcoin/1/) 0x559ab9733998 in fuzzer::PrintStackTrace() (/bitcoin/src/test/fuzz/fuzz+0x54d998)
21 [#2](/bitcoin-bitcoin/2/) 0x559ab9718ae3 in fuzzer::Fuzzer::CrashCallback() (/bitcoin/src/test/fuzz/fuzz+0x532ae3)
22 [#3](/bitcoin-bitcoin/3/) 0x7f70a0e723bf (/lib/x86_64-linux-gnu/libpthread.so.0+0x153bf)
23 [#4](/bitcoin-bitcoin/4/) 0x7f70a0b3418a in raise (/lib/x86_64-linux-gnu/libc.so.6+0x4618a)
24 [#5](/bitcoin-bitcoin/5/) 0x7f70a0b13858 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x25858)
25 [#6](/bitcoin-bitcoin/6/) 0x7f70a0f21148 (/lib/x86_64-linux-gnu/libstdc++.so.6+0xa1148)
26 [#7](/bitcoin-bitcoin/7/) 0x559ab9f60a96 in __gnu_debug::operator+(__gnu_debug::_Safe_iterator<std::__cxx1998::_Bit_const_iterator, std::__debug::vector<bool, std::allocator<bool> >, std::random_access_iterator_tag> const&, long) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/debug/safe_iterator.h:881:2
27 [#8](/bitcoin-bitcoin/8/) 0x559ab9f61062 in SanityCheckASMap(std::__debug::vector<bool, std::allocator<bool> > const&, int) util/asmap.cpp:159:21
28 [#9](/bitcoin-bitcoin/9/) 0x559ab9e4fdfa in SanityCheckASMap(std::__debug::vector<bool, std::allocator<bool> > const&) netaddress.cpp:1242:12
29 [#10](/bitcoin-bitcoin/10/) 0x559ab9793fcb in addrman_fuzz_target(Span<unsigned char const>) test/fuzz/addrman.cpp:43:14
30 [#11](/bitcoin-bitcoin/11/) 0x559ab978a03c in std::_Function_handler<void (Span<unsigned char const>), void (*)(Span<unsigned char const>)>::_M_invoke(std::_Any_data const&, Span<unsigned char const>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:300:2
31 [#12](/bitcoin-bitcoin/12/) 0x559aba2692c7 in std::function<void (Span<unsigned char const>)>::operator()(Span<unsigned char const>) const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:688:14
32 [#13](/bitcoin-bitcoin/13/) 0x559aba269132 in LLVMFuzzerTestOneInput test/fuzz/fuzz.cpp:63:5
33 [#14](/bitcoin-bitcoin/14/) 0x559ab971a1a1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/bitcoin/src/test/fuzz/fuzz+0x5341a1)
34 [#15](/bitcoin-bitcoin/15/) 0x559ab97198e5 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) (/bitcoin/src/test/fuzz/fuzz+0x5338e5)
35 [#16](/bitcoin-bitcoin/16/) 0x559ab971bb87 in fuzzer::Fuzzer::MutateAndTestOne() (/bitcoin/src/test/fuzz/fuzz+0x535b87)
36 [#17](/bitcoin-bitcoin/17/) 0x559ab971c885 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) (/bitcoin/src/test/fuzz/fuzz+0x536885)
37 [#18](/bitcoin-bitcoin/18/) 0x559ab970b23e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/bitcoin/src/test/fuzz/fuzz+0x52523e)
38 [#19](/bitcoin-bitcoin/19/) 0x559ab9734082 in main (/bitcoin/src/test/fuzz/fuzz+0x54e082)
39 [#20](/bitcoin-bitcoin/20/) 0x7f70a0b150b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
40 [#21](/bitcoin-bitcoin/21/) 0x559ab96dffdd in _start (/bitcoin/src/test/fuzz/fuzz+0x4f9fdd)