fuzz: Avoid dangling prevoutfetch threads after AFL fork #35767

pull maflcko wants to merge 2 commits into bitcoin:master from maflcko:2607-fuzz-afl-fork-threads-explode changing 2 files +4 −2
  1. maflcko commented at 5:42 PM on July 21, 2026: member

    Presumably fixes https://issues.oss-fuzz.com/issues/536943806

    This is a bit confusing, because the issue was already fixed in commit f608a409f7591b4f5cf170898bee58b9d9dcf1b6, by removing the AFL forkserver.

    However, OSS-Fuzz doesn't go through the AFL_LOOP, but through the AFL libFuzzer driver:

              [#0](/bitcoin-bitcoin/0/) 0x7e055245baab in __pthread_clockjoin_ex /build/glibc-B3wQXB/glibc-2.31/nptl/pthread_join_common.c:89:6
	    [#1](/bitcoin-bitcoin/1/) 0x5a27e904dcdd in operator() /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:293:14
	    [#2](/bitcoin-bitcoin/2/) 0x5a27e904dcdd in Join<(lambda at /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:292:44)> /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_thread_arg_retval.h:75:9
	    [#3](/bitcoin-bitcoin/3/) 0x5a27e904dcdd in ___interceptor_pthread_join /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:292:25
	    [#4](/bitcoin-bitcoin/4/) 0x5a27e90f4044 in std::__1::thread::join()
	    [#5](/bitcoin-bitcoin/5/) 0x5a27e9366277 in ThreadPool::Stop() [bitcoin-core/src/util/threadpool.h:146](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/util/threadpool.h#L146):53
	    [#6](/bitcoin-bitcoin/6/) 0x5a27e9365db9 in ThreadPool::~ThreadPool() [bitcoin-core/src/util/threadpool.h:94](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/util/threadpool.h#L94):9
...
          [#32](/bitcoin-bitcoin/32/) 0x5a27e95a9506 in (anonymous namespace)::ResetChainman(TestingSetup&) (.12669) [bitcoin-core/src/test/fuzz/process_messages.cpp:44](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/test/fuzz/process_messages.cpp#L44):27
	    [#33](/bitcoin-bitcoin/33/) 0x5a27e95a8c60 in process_messages_fuzz_target(std::__1::span<unsigned char const, 18446744073709551615ul>) [bitcoin-core/src/test/fuzz/process_messages.cpp:141](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/test/fuzz/process_messages.cpp#L141):9
...
            [#36](/bitcoin-bitcoin/36/) 0x5a27e97b7190 in test_one_input(std::__1::span<unsigned char const, 18446744073709551615ul>) bitcoin-core/src/test/fuzz/fuzz.cpp:86:5
            [#37](/bitcoin-bitcoin/37/) 0x5a27e97b7190 in LLVMFuzzerTestOneInput bitcoin-core/src/test/fuzz/fuzz.cpp:214:5
            [#38](/bitcoin-bitcoin/38/) 0x5a27e90ada19 in LLVMFuzzerRunDriver /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:427:13
            [#39](/bitcoin-bitcoin/39/) 0x5a27e90ad69b in main /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:323:10
            [#40](/bitcoin-bitcoin/40/) 0x7e055223b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16
            [#41](/bitcoin-bitcoin/41/) 0x5a27e8fc602d in _start

    So the correct fix would be to set AFL_DRIVER_DONT_DEFER=1. Ref: https://github.com/AFLplusplus/AFLplusplus/blob/ad5304010ae3be9d5cdc1ba51b09e14169c5cb87/utils/aflpp_driver/aflpp_driver.c#L161

    However, I don't know how to do this on OSS-Fuzz, so just drop the threads for now, because there are dedicated fuzz targets to test the multi-threaded case anyway.

  2. fuzz: Avoid dangling prevoutfetch threads after AFL fork fae067ec4a
  3. fuzz: [refactor] Use 100'000 digit separator in __AFL_LOOP
    This makes it easier to glance the exact value.
    faada35f9c
  4. DrahtBot added the label Fuzzing on Jul 21, 2026
  5. DrahtBot commented at 5:42 PM on July 21, 2026: contributor

    <!--e57a25ab6845829454e8d69fc972939a-->

    The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

    <!--006a51241073e994b41acfe9ec718e94-->

    Code Coverage & Benchmarks

    For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35767.

    <!--021abf342d371248e50ceaed478a90ca-->

    Reviews

    See the guideline and AI policy for information on the review process.

    Type Reviewers
    ACK andrewtoth, sedited, l0rinc

    If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

    <!--174a7506f384e20aa4161008e828411d-->

    Conflicts

    Reviewers, this pull request conflicts with the following ones:

    • #34875 (refactor: separate deferred script check collection from CheckInputScripts by l0rinc)

    If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

    <!--5faf32d7da4f0f540f40219e4f7537a3-->

  6. DrahtBot added the label CI failed on Jul 21, 2026
  7. maflcko removed the label CI failed on Jul 21, 2026
  8. l0rinc commented at 6:28 PM on July 21, 2026: contributor

    Presumably fixes https://issues.oss-fuzz.com/issues/536943806

    We don't see it (Access is denied to this issue), can you please summarize it for us?

  9. andrewtoth approved
  10. andrewtoth commented at 6:29 PM on July 21, 2026: contributor

    lgtm ACK faada35f9c09844d0aeec7025d06a94427671a22

  11. maflcko commented at 6:34 PM on July 21, 2026: member

    It is just the stack trace in OP, and that AFL was used.

    <details><summary>details</summary>

    Detailed Report: https://oss-fuzz.com/testcase?key=4798996590428160

Project: bitcoin-core
Fuzzing Engine: afl
Fuzz Target: process_messages
Job Type: afl_asan_bitcoin-core
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x7a05491fe9d0
Crash State:
  ___interceptor_pthread_join
  std::__1::thread::join
  ThreadPool::Stop
 
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Crash Revision: https://oss-fuzz.com/revisions?job=afl_asan_bitcoin-core&revision=202607100604

Reproducer Testcase: https://oss-fuzz.com/download?testcase_id=4798996590428160

Issue manually filed by: macro.fuzzing.uxuga

    [Environment] ASAN_OPTIONS=abort_on_error=1:alloc_dealloc_mismatch=0:allocator_may_return_null=1:allocator_release_to_os_interval_ms=500:allow_user_segv_handler=0:check_malloc_usable_size=0:detect_leaks=1:detect_odr_violation=0:detect_stack_use_after_return=1:fast_unwind_on_fatal=0:handle_abort=2:handle_segv=2:handle_sigbus=2:handle_sigfpe=2:handle_sigill=2:print_scariness=1:print_summary=1:print_suppressions=0:quarantine_size_mb=64:redzone=16:strict_memcmp=1:strip_path_prefix=/workspace/:symbolize=0:use_sigaltstack=1
	+----------------------------------------Release Build Stacktrace----------------------------------------+
	AddressSanitizer:DEADLYSIGNAL
	=================================================================
	==919==ERROR: AddressSanitizer: SEGV on unknown address 0x7a05491fe9d0 (pc 0x7e055245baab bp 0x00000000000a sp 0x7ffce38c5fc0 T0)
	==919==The signal is caused by a READ memory access.
	SCARINESS: 20 (wild-addr-read)
	    [#0](/bitcoin-bitcoin/0/) 0x7e055245baab in __pthread_clockjoin_ex /build/glibc-B3wQXB/glibc-2.31/nptl/pthread_join_common.c:89:6
	    [#1](/bitcoin-bitcoin/1/) 0x5a27e904dcdd in operator() /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:293:14
	    [#2](/bitcoin-bitcoin/2/) 0x5a27e904dcdd in Join<(lambda at /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:292:44)> /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_thread_arg_retval.h:75:9
	    [#3](/bitcoin-bitcoin/3/) 0x5a27e904dcdd in ___interceptor_pthread_join /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:292:25
	    [#4](/bitcoin-bitcoin/4/) 0x5a27e90f4044 in std::__1::thread::join()
	    [#5](/bitcoin-bitcoin/5/) 0x5a27e9366277 in ThreadPool::Stop() [bitcoin-core/src/util/threadpool.h:146](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/util/threadpool.h#L146):53
	    [#6](/bitcoin-bitcoin/6/) 0x5a27e9365db9 in ThreadPool::~ThreadPool() [bitcoin-core/src/util/threadpool.h:94](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/util/threadpool.h#L94):9
	    [#7](/bitcoin-bitcoin/7/) 0x5a27e93591b1 in std::__1::__shared_count::__release_shared[abi:de220000]() /usr/local/include/c++/v1/__memory/shared_count.h:92:7
	    [#8](/bitcoin-bitcoin/8/) 0x5a27e93591b1 in std::__1::__shared_weak_count::__release_shared[abi:de220000]() /usr/local/include/c++/v1/__memory/shared_count.h:121:25
	    [#9](/bitcoin-bitcoin/9/) 0x5a27e93591b1 in std::__1::shared_ptr<ThreadPool>::~shared_ptr[abi:de220000]() /usr/local/include/c++/v1/__memory/shared_ptr.h:561:17
	    [#10](/bitcoin-bitcoin/10/) 0x5a27e93591b1 in CoinsViewOverlay::~CoinsViewOverlay() [bitcoin-core/src/coins.h:730](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/coins.h#L730):61
	    [#11](/bitcoin-bitcoin/11/) 0x5a27e935bb70 in CoinsViewOverlay::~CoinsViewOverlay() [bitcoin-core/src/coins.h:730](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/coins.h#L730):43
	    [#12](/bitcoin-bitcoin/12/) 0x5a27ea6357b3 in std::__1::default_delete<CoinsViewOverlay>::operator()[abi:de220000](CoinsViewOverlay*) const /usr/local/include/c++/v1/__memory/unique_ptr.h:77:5
	    [#13](/bitcoin-bitcoin/13/) 0x5a27ea6357b3 in std::__1::unique_ptr<CoinsViewOverlay, std::__1::default_delete<CoinsViewOverlay>>::reset[abi:de220000](CoinsViewOverlay*) /usr/local/include/c++/v1/__memory/unique_ptr.h:290:7
	    [#14](/bitcoin-bitcoin/14/) 0x5a27ea6357b3 in std::__1::unique_ptr<CoinsViewOverlay, std::__1::default_delete<CoinsViewOverlay>>::~unique_ptr[abi:de220000]() /usr/local/include/c++/v1/__memory/unique_ptr.h:259:71
	    [#15](/bitcoin-bitcoin/15/) 0x5a27ea6357b3 in CoinsViews::~CoinsViews() [bitcoin-core/src/validation.h:482](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/validation.h#L482):7
	    [#16](/bitcoin-bitcoin/16/) 0x5a27ea6357b3 in std::__1::default_delete<CoinsViews>::operator()[abi:de220000](CoinsViews*) const /usr/local/include/c++/v1/__memory/unique_ptr.h:77:5
	    [#17](/bitcoin-bitcoin/17/) 0x5a27ea6357b3 in std::__1::unique_ptr<CoinsViews, std::__1::default_delete<CoinsViews>>::reset[abi:de220000](CoinsViews*) /usr/local/include/c++/v1/__memory/unique_ptr.h:290:7
	    [#18](/bitcoin-bitcoin/18/) 0x5a27ea6357b3 in std::__1::unique_ptr<CoinsViews, std::__1::default_delete<CoinsViews>>::~unique_ptr[abi:de220000]() /usr/local/include/c++/v1/__memory/unique_ptr.h:259:71
	    [#19](/bitcoin-bitcoin/19/) 0x5a27ea6357b3 in Chainstate::~Chainstate() [bitcoin-core/src/validation.h:553](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/validation.h#L553):7
	    [#20](/bitcoin-bitcoin/20/) 0x5a27ea642089 in std::__1::default_delete<Chainstate>::operator()[abi:de220000](Chainstate*) const /usr/local/include/c++/v1/__memory/unique_ptr.h:77:5
	    [#21](/bitcoin-bitcoin/21/) 0x5a27ea642089 in std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>::reset[abi:de220000](Chainstate*) /usr/local/include/c++/v1/__memory/unique_ptr.h:290:7
	    [#22](/bitcoin-bitcoin/22/) 0x5a27ea642089 in std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>::~unique_ptr[abi:de220000]() /usr/local/include/c++/v1/__memory/unique_ptr.h:259:71
	    [#23](/bitcoin-bitcoin/23/) 0x5a27ea642089 in void std::__1::__destroy_at[abi:de220000]<std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>, 0>(std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>*) /usr/local/include/c++/v1/__memory/construct_at.h:61:11
	    [#24](/bitcoin-bitcoin/24/) 0x5a27ea642089 in void std::__1::allocator_traits<std::__1::allocator<std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>>>::destroy[abi:de220000]<std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>, 0>(std::__1::allocator<std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>>&, std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>*) /usr/local/include/c++/v1/__memory/allocator_traits.h:313:5
	    [#25](/bitcoin-bitcoin/25/) 0x5a27ea642089 in std::__1::vector<std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>, std::__1::allocator<std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>>>::__base_destruct_at_end[abi:de220000](std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>*) /usr/local/include/c++/v1/__vector/vector.h:772:7
	    [#26](/bitcoin-bitcoin/26/) 0x5a27ea642089 in std::__1::vector<std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>, std::__1::allocator<std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>>>::clear[abi:de220000]() /usr/local/include/c++/v1/__vector/vector.h:552:5
	    [#27](/bitcoin-bitcoin/27/) 0x5a27ea642089 in std::__1::vector<std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>, std::__1::allocator<std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>>>::__destroy_vector::operator()[abi:de220000]() /usr/local/include/c++/v1/__vector/vector.h:251:16
	    [#28](/bitcoin-bitcoin/28/) 0x5a27ea641e27 in std::__1::vector<std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>, std::__1::allocator<std::__1::unique_ptr<Chainstate, std::__1::default_delete<Chainstate>>>>::~vector[abi:de220000]() /usr/local/include/c++/v1/__vector/vector.h:262:67
	    [#29](/bitcoin-bitcoin/29/) 0x5a27ea641e27 in ChainstateManager::~ChainstateManager() [bitcoin-core/src/validation.cpp:6175](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/validation.cpp#L6175):1
	    [#30](/bitcoin-bitcoin/30/) 0x5a27e95a9506 in std::__1::default_delete<ChainstateManager>::operator()[abi:de220000](ChainstateManager*) const /usr/local/include/c++/v1/__memory/unique_ptr.h:77:5
	    [#31](/bitcoin-bitcoin/31/) 0x5a27e95a9506 in std::__1::unique_ptr<ChainstateManager, std::__1::default_delete<ChainstateManager>>::reset[abi:de220000](ChainstateManager*) /usr/local/include/c++/v1/__memory/unique_ptr.h:290:7
	    [#32](/bitcoin-bitcoin/32/) 0x5a27e95a9506 in (anonymous namespace)::ResetChainman(TestingSetup&) (.12669) [bitcoin-core/src/test/fuzz/process_messages.cpp:44](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/test/fuzz/process_messages.cpp#L44):27
	    [#33](/bitcoin-bitcoin/33/) 0x5a27e95a8c60 in process_messages_fuzz_target(std::__1::span<unsigned char const, 18446744073709551615ul>) [bitcoin-core/src/test/fuzz/process_messages.cpp:141](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/test/fuzz/process_messages.cpp#L141):9
	    [#34](/bitcoin-bitcoin/34/) 0x5a27e97b7190 in std::__1::__function::__value_func<void (std::__1::span<unsigned char const, 18446744073709551615ul>)>::operator()[abi:de220000](std::__1::span<unsigned char const, 18446744073709551615ul>&&) const /usr/local/include/c++/v1/__functional/function.h:274:12
	    [#35](/bitcoin-bitcoin/35/) 0x5a27e97b7190 in std::__1::function<void (std::__1::span<unsigned char const, 18446744073709551615ul>)>::operator()(std::__1::span<unsigned char const, 18446744073709551615ul>) const /usr/local/include/c++/v1/__functional/function.h:772:10
	    [#36](/bitcoin-bitcoin/36/) 0x5a27e97b7190 in test_one_input(std::__1::span<unsigned char const, 18446744073709551615ul>) [bitcoin-core/src/test/fuzz/fuzz.cpp:86](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/test/fuzz/fuzz.cpp#L86):5
	    [#37](/bitcoin-bitcoin/37/) 0x5a27e97b7190 in LLVMFuzzerTestOneInput [bitcoin-core/src/test/fuzz/fuzz.cpp:214](https://github.com/bitcoin/bitcoin/blob/7d8137c1417b61589949b3e8b081e5310fe335f3/src/test/fuzz/fuzz.cpp#L214):5
	    [#38](/bitcoin-bitcoin/38/) 0x5a27e90ada19 in LLVMFuzzerRunDriver /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:427:13
	    [#39](/bitcoin-bitcoin/39/) 0x5a27e90ad69b in main /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:323:10
	    [#40](/bitcoin-bitcoin/40/) 0x7e055223b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16
	    [#41](/bitcoin-bitcoin/41/) 0x5a27e8fc602d in _start
	
	==919==Register values:
	rax = 0x0000000000000000  rbx = 0x00007a05491fe700  rcx = 0x0000000000000000  rdx = 0x0000000000000000
	rdi = 0x00007a05491fe700  rsi = 0x0000000000000000  rbp = 0x000000000000000a  rsp = 0x00007ffce38c5fc0
	 r8 = 0x0000000000000001   r9 = 0xffffff0000000000  r10 = 0x0000000000000000  r11 = 0xafffff00000fffff
	r12 = 0x00007b15518186d8  r13 = 0x00000f40aa0cb4f0  r14 = 0x00005a27eacce8b0  r15 = 0x0000000000000000
	AddressSanitizer can not provide additional info.
	SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libpthread.so.0+0x9aab) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078)
	==919==ABORTING
	
	
	+----------------------------------------Release Build Unsymbolized Stacktrace (diff)----------------------------------------+
	
	==919==The signal is caused by a READ memory access.
	SCARINESS: 20 (wild-addr-read)
	    [#0](/bitcoin-bitcoin/0/) 0x7e055245baab  (/lib/x86_64-linux-gnu/libpthread.so.0+0x9aab) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078)
	    [#1](/bitcoin-bitcoin/1/) 0x5a27e904dcdd  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0xc96cdd)
	    [#2](/bitcoin-bitcoin/2/) 0x5a27e90f4044  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0xd3d044)
	    [#3](/bitcoin-bitcoin/3/) 0x5a27e9366277  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0xfaf277)
	    [#4](/bitcoin-bitcoin/4/) 0x5a27e9365db9  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0xfaedb9)
	    [#5](/bitcoin-bitcoin/5/) 0x5a27e93591b1  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0xfa21b1)
	    [#6](/bitcoin-bitcoin/6/) 0x5a27e935bb70  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0xfa4b70)
	    [#7](/bitcoin-bitcoin/7/) 0x5a27ea6357b3  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0x227e7b3)
	    [#8](/bitcoin-bitcoin/8/) 0x5a27ea642089  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0x228b089)
	    [#9](/bitcoin-bitcoin/9/) 0x5a27ea641e27  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0x228ae27)
	    [#10](/bitcoin-bitcoin/10/) 0x5a27e95a9506  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0x11f2506)
	    [#11](/bitcoin-bitcoin/11/) 0x5a27e95a8c60  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0x11f1c60)
	    [#12](/bitcoin-bitcoin/12/) 0x5a27e97b7190  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0x1400190)
	    [#13](/bitcoin-bitcoin/13/) 0x5a27e90ada19  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0xcf6a19)
	    [#14](/bitcoin-bitcoin/14/) 0x5a27e90ad69b  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0xcf669b)
	    [#15](/bitcoin-bitcoin/15/) 0x7e055223b082  (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)
	    [#16](/bitcoin-bitcoin/16/) 0x5a27e8fc602d  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_bitcoin-core_83aef6625aaeafa301867de74608b320f3c923fe/revisions/process_messages+0xc0f02d)

    </details>

  12. in src/test/util/setup_common.cpp:313 in fae067ec4a 
     306 | @@ -307,8 +307,10 @@ ChainTestingSetup::ChainTestingSetup(const ChainType chainType, TestOpts opts)
 307 |              .check_block_index = 1,
 308 |              .notifications = *m_node.notifications,
 309 |              .signals = m_node.validation_signals.get(),
 310 | -            // Use no worker threads while fuzzing to avoid non-determinism
 311 | +            // Use no worker threads while fuzzing to avoid racy non-determinism
 312 | +            // and dangling thread handles if AFL forks after initialization.
 313 |              .worker_threads_num = EnableFuzzDeterminism() ? 0 : 2,
 314 | +            .prevoutfetch_threads_num = EnableFuzzDeterminism() ? 0 : 2,
    l0rinc commented at 7:20 PM on July 21, 2026:

    fae067e fuzz: Avoid dangling prevoutfetch threads after AFL fork:

    I understand the deterministic 0, but what's the reason for non-fuzz ChainTestingSetup reducing the threads from the default 8 to 2? Is this intentional?

                .prevoutfetch_threads_num = EnableFuzzDeterminism() ? 0 : DEFAULT_PREVOUTFETCH_THREADS,
    maflcko commented at 7:45 PM on July 21, 2026:

    Yes, I'd presume the threads will be idle for most unit test cases, so spinning up several idle threads shouldn't add any coverage.

    (Same rationale for the other validation worker threads.)

    l0rinc commented at 12:59 AM on July 22, 2026:

    Makes sense, thanks

  13. l0rinc commented at 7:23 PM on July 21, 2026: contributor

    mostly LGTM, left a question for clarification.

    Also, my agent checked and it looks like the OSS-Fuzz-side fix is supported directly:

    ClusterFuzz whitelists AFL_DRIVER_DONT_DEFER and explicitly recommends:

    [env] afl_driver_dont_defer = 1

    after detecting deferred-forkserver problems: https://github.com/google/clusterfuzz/blob/6ff486c47af95d6fa9d86238a65cc15adf5a9393/src/clusterfuzz/_internal/bot/fuzzers/afl/launcher.py#L959-L965

    This could be added to the existing process_messages.options (https://github.com/google/oss-fuzz/blob/ea7eeb3ee4de363d97c5067b9b72379423f63da2/projects/bitcoin-core/process_messages.options).

  14. maflcko commented at 7:49 PM on July 21, 2026: member

    This could be added to the existing process_messages.options

    Nice, but I think this setting needs to be applied to all fuzz targets that call the m_make_chainman lambda.

    Also, I am not sure if we officially support AFL LLVM mode, but if yes, it could make sense to fix it in this repo instead?

    Also, erring on the determinstic side seems also useful regardless of the fuzz engine?

  15. sedited approved
  16. sedited commented at 8:09 PM on July 21, 2026: contributor

    ACK faada35f9c09844d0aeec7025d06a94427671a22

  17. l0rinc commented at 12:59 AM on July 22, 2026: contributor

    ACK faada35f9c09844d0aeec7025d06a94427671a22

Contributors
maflckoDrahtBotl0rincandrewtothsedited
Labels
Fuzzing
Linked (view graph)
#1 JSON-RPC support for mobile devices ("ultra-lightweight" clients)#2 Long-term, safe, store-of-value#3 Encrypt wallet#4 Export/Import wallet in a human readable, future-proof format#5 Make the version number the protocol version and not the client version#6 Treat wallet as a generic keystore#32 Help output#33 Fix statusbar color#36 Show defaults in --help text#37 add -printtoconsole flat#38 the -4way command line argument is broken#39 Help changed, need translations#40 -rpcssl help text#41 Display version in help
github-metadata-mirror

This is a metadata mirror of the GitHub repository bitcoin/bitcoin. This site is not affiliated with GitHub. Content is generated from a GitHub metadata backup.
generated: 2026-07-22 06:50 UTC
This site is hosted by @0xB10C
More mirrored repositories can be found on mirror.b10c.me