ci: fuzz_with_valgrind job broken

fanquake commented at 9:29 am on April 15, 2025: member

 0[ 99%] Building CXX object src/test/fuzz/CMakeFiles/fuzz.dir/__/__/wallet/test/fuzz/fees.cpp.o
 1[ 99%] Building CXX object src/test/fuzz/CMakeFiles/fuzz.dir/__/__/wallet/test/fuzz/notifications.cpp.o
 2In file included from /usr/include/c++/13/span:41,
 3                 from /ci_container_base/src/span.h:10,
 4                 from /ci_container_base/src/util/feefrac.h:11,
 5                 from /ci_container_base/src/txgraph.h:10,
 6                 from /ci_container_base/src/test/fuzz/txgraph.cpp:5:
 7In member function ‘constexpr const std::array<_Tp, _Nm>::value_type& std::array<_Tp, _Nm>::operator[](size_type) const [with _Tp = long unsigned int; long unsigned int _Nm = 2]’,
 8    inlined from ‘constexpr bool bitset_detail::MultiIntBitSet<I, N>::operator[](unsigned int) const [with I = long unsigned int; unsigned int N = 2]’ at /ci_container_base/src/util/bitset.h:351:22,
 9    inlined from ‘void cluster_linearize::LinearizationChunking<SetType>::BuildChunks() [with SetType = bitset_detail::MultiIntBitSet<long unsigned int, 2>]’ at /ci_container_base/src/cluster_linearize.h:448:24:
10/usr/include/c++/13/array:213:24: error: array subscript 2 is above array bounds of ‘std::__array_traits<long unsigned int, 2>::_Type’ {aka ‘const long unsigned int [2]’} [-Werror=array-bounds=]
11  213 |         return _M_elems[__n];
12      |                ~~~~~~~~^
13/usr/include/c++/13/array: In member function ‘void cluster_linearize::LinearizationChunking<SetType>::BuildChunks() [with SetType = bitset_detail::MultiIntBitSet<long unsigned int, 2>]’:
14/usr/include/c++/13/array:109:55: note: while referencing ‘std::array<long unsigned int, 2>::_M_elems’
15  109 |       typename __array_traits<_Tp, _Nm>::_Type        _M_elems;
16      |                                                       ^~~~~~~~
17In member function ‘constexpr const std::array<_Tp, _Nm>::value_type& std::array<_Tp, _Nm>::operator[](size_type) const [with _Tp = long unsigned int; long unsigned int _Nm = 2]’,
18    inlined from ‘constexpr bool bitset_detail::MultiIntBitSet<I, N>::operator[](unsigned int) const [with I = long unsigned int; unsigned int N = 2]’ at /ci_container_base/src/util/bitset.h:351:22,
19    inlined from ‘void txgraph_fuzz_target(FuzzBufferType)’ at /ci_container_base/src/test/fuzz/txgraph.cpp:490:21:
20/usr/include/c++/13/array:213:24: error: array subscript 2 is above array bounds of ‘std::__array_traits<long unsigned int, 2>::_Type’ {aka ‘const long unsigned int [2]’} [-Werror=array-bounds=]
21  213 |         return _M_elems[__n];
22      |                ~~~~~~~~^
23/usr/include/c++/13/array: In function ‘void txgraph_fuzz_target(FuzzBufferType)’:
24/usr/include/c++/13/array:109:55: note: while referencing ‘std::array<long unsigned int, 2>::_M_elems’
25  109 |       typename __array_traits<_Tp, _Nm>::_Type        _M_elems;
26      |                                                       ^~~~~~~~
27cc1plus: all warnings being treated as errors
28gmake[2]: *** [src/test/fuzz/CMakeFiles/fuzz.dir/build.make:1742: src/test/fuzz/CMakeFiles/fuzz.dir/txgraph.cpp.o] Error 1

maflcko commented at 9:47 am on April 15, 2025: member

This is a general bug in GCC (at least 13 and 14). I haven’t tried GCC 11, 12, or 15. Also, I haven’t looked into a minimal working reproducer, or upstream bugs, or fix, or workaround.

maflcko added the label Upstream on Apr 15, 2025

maflcko added the label CI failed on Apr 15, 2025

maflcko commented at 7:29 pm on April 15, 2025: member

It is a gcc-12 regression. Minimized so far:

 0# cat <<EOF > src/test/fuzz/txgraph_min.cpp                                                                                                                                    
 1#include <cluster_linearize.h>
 2#include <txgraph.h>
 3#include <util/bitset.h>
 4
 5#include <algorithm>
 6#include <map>
 7#include <memory>
 8#include <set>
 9#include <stdint.h>
10#include <utility>
11
12using namespace cluster_linearize;
13
14struct SimTxGraph {
15    static constexpr unsigned MAX_TRANSACTIONS = MAX_CLUSTER_COUNT_LIMIT * 2;
16    using SetType = BitSet<MAX_TRANSACTIONS>;
17    DepGraph<SetType> graph;
18};
19
20int main()
21{
22    SimTxGraph sim{};
23    std::vector<DepGraphIndex> simlin;
24    cluster_linearize::LinearizationChunking simlinchunk(sim.graph, simlin);
25}
26EOF

 0# /usr/bin/ccache /usr/bin/g++-15  -DABORT_ON_FAILED_ASSUME -I./bld-cmake/src -I./src  -O2 -g -std=c++20   -Wall -Wextra   -o /tmp/o -c /b-c/src/test/fuzz/txgraph_min.cpp   
 1In file included from /usr/include/c++/15/span:46,
 2                 from ./src/span.h:10,
 3                 from ./src/crypto/chacha20.h:8,
 4                 from ./src/random.h:9,
 5                 from ./src/cluster_linearize.h:15,
 6                 from /b-c/src/test/fuzz/txgraph_min.cpp:1:
 7In member function 'constexpr const std::array<_Tp, _Nm>::value_type& std::array<_Tp, _Nm>::operator[](size_type) const [with _Tp = long unsigned int; long unsigned int _Nm = 2]',
 8    inlined from 'constexpr bool bitset_detail::MultiIntBitSet<I, N>::operator[](unsigned int) const [with I = long unsigned int; unsigned int N = 2]' at ./src/util/bitset.h:351:22,
 9    inlined from 'cluster_linearize::LinearizationChunking<SetType>::LinearizationChunking(const cluster_linearize::DepGraph<SetType>&, std::span<const unsigned int>) [with SetType = bitset_detail::MultiIntBitSet<long unsigned int, 2>]' at ./src/cluster_linearize.h:418:24:
10/usr/include/c++/15/array:221:24: warning: array subscript 2 is above array bounds of 'std::__array_traits<long unsigned int, 2>::_Type' {aka 'const long unsigned int [2]'} [-Warray-bounds=]
11  221 |         return _M_elems[__n];
12      |                ~~~~~~~~^
13/usr/include/c++/15/array: In constructor 'cluster_linearize::LinearizationChunking<SetType>::LinearizationChunking(const cluster_linearize::DepGraph<SetType>&, std::span<const unsigned int>) [with SetType = bitset_detail::MultiIntBitSet<long unsigned int, 2>]':
14/usr/include/c++/15/array:117:55: note: while referencing 'std::array<long unsigned int, 2>::_M_elems'
15  117 |       typename __array_traits<_Tp, _Nm>::_Type        _M_elems;
16      |                                                       ^~~~~~~~

sipa commented at 8:08 pm on April 15, 2025: member

Weird.

maflcko commented at 8:48 pm on April 15, 2025: member

Weird.

Yeah, trying to reduce it further shows that it is fragile, so I gave up for now. Also there are hundreds of those issues, so I am not sure if it is worth it to report: https://gcc.gnu.org/bugzilla/buglist.cgi?quicksearch=array-bounds

maflcko commented at 7:20 am on April 17, 2025: member

I tried creduce, but at some point it seems to have transformed the false positive warning into a true positive warning.

ci: fuzz_with_valgrind job broken #32276