The descriptor fuzz target is intended to exercise descriptor satisfaction-size estimation for solvable descriptors.
It currently calls MaxSatisfactionWeight(true) twice, so the false branch is never exercised.
This PR changes max_sat_nonmaxsig to call MaxSatisfactionWeight(false), so fuzzing covers both branches.
<!--e57a25ab6845829454e8d69fc972939a-->
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.
<!--006a51241073e994b41acfe9ec718e94-->
For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35489.
<!--021abf342d371248e50ceaed478a90ca-->
See the guideline for information on the review process.
If your review is incorrectly listed, please copy-paste <code><!--meta-tag:bot-skip--></code> into the comment that the bot should ignore.
<!--5faf32d7da4f0f540f40219e4f7537a3-->
The fuzz target intends to exercise both
MaxSatisfactionWeight(true)andMaxSatisfactionWeight(false), then assert that the non-max-signature estimate does not exceed the max-signature estimate.
I don't think this is true. There is no assert for "does not exceed".
I don't think this is true. There is no assert for "does not exceed".
Right. The assert BOOST_CHECK(max_sat_nonmaxsig <= max_sat_maxsig); is in src/test/descriptor_tests.cpp:203, not in the fuzz target. I updated the PR description.
Right. The assert
BOOST_CHECK(max_sat_nonmaxsig <= max_sat_maxsig);is insrc/test/descriptor_tests.cpp:203, not in the fuzz target. I updated the PR description.
Perhaps it's worth adding this comparison here as well?
code review ACK 60cd2c5c594c336b177f553a17a5a57df2227f9f
happy to re-ACK if you add the comparison.
Also assert that the availability of the satisfaction weight estimate
does not depend on the signature-size assumption, and that assuming
non-max-size signatures never increases the estimate.
reACK 526aae3768df09b2d39621bc19cd18a388f03e42
ACK 526aae3768df09b2d39621bc19cd18a388f03e42