test: add script_tests cases covering more interpreter mutants #36128

1. 
   ViniciusCestarii commented at 1:21 PM on August 31, 2026: contributor

   Kills some live mutants on interpreter.cpp that affect consensus found with https://github.com/ViniciusCestarii/mutant-harness. They are:

   interpreter.cpp (killed by 4e7de2ac4cc6c08ff27620de01ccd9d66c568459): OP_IF / OP_NOTIF tapscript minimal-IF:

   diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
   index 98b16ec..f9b08fe 100644
   --- a/src/script/interpreter.cpp
   +++ b/src/script/interpreter.cpp
   @@ -624,7 +624,7 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
   -                            if (vch.size() > 1 || (vch.size() == 1 && vch[0] != 1)) {
   +                            if (vch.size() > 1 || (vch.size() == 1 && vch[0] > 1)) {
   

   interpreter.cpp (killed by f1380123b6f8912e2ca599f30f2d89c0af9b9c5f): P2WSH:

   diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
   index 98b16ec..73a1bb5 100644
   --- a/src/script/interpreter.cpp
   +++ b/src/script/interpreter.cpp
   @@ -1940,7 +1940,7 @@ static bool VerifyWitnessProgram(const CScriptWitness& witness, int witversion,
   -            if (memcmp(hash_exec_script.begin(), program.data(), 32)) {
   +            if (memcmp(hash_exec_script.begin(), program.data(), 31)) {
   

   interpreter.cpp (killed by 44a7083d43604b3d5c923ffc9011d8043a27d052): opcode limit:

   diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
   index 98b16ec..b117045 100644
   --- a/src/script/interpreter.cpp
   +++ b/src/script/interpreter.cpp
   @@ -457,7 +457,7 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
   -            if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) {
   +            if (sigversion == SigVersion::BASE) {
   

   Recommend reviewing per commit.

2. test: cover TAPSCRIPT_MINIMALIF for OP_IF and OP_NOTIF with 1-byte vector 0x00 4e7de2ac4c
3. test: cover P2WSH trailing byte mismatch f1380123b6
4. test: cover MAX_OPS_PER_SCRIPT in P2WSH witness scripts 44a7083d43
5. DrahtBot added the label Tests on Aug 31, 2026
6. 
   DrahtBot commented at 1:21 PM on August 31, 2026: contributor

   <!--e57a25ab6845829454e8d69fc972939a-->

   The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

   <!--006a51241073e994b41acfe9ec718e94-->

   Code Coverage & Benchmarks

   For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/36128.

   <!--021abf342d371248e50ceaed478a90ca-->

   Reviews

   See the guideline and AI policy for information on the review process.

   Type	Reviewers
   ACK	sedited, aaron-leeb, fametrano
   Concept ACK	ismaelsadeeq

   If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

   <!--5faf32d7da4f0f540f40219e4f7537a3-->

7. sedited approved
8. 
   sedited commented at 1:26 PM on September 5, 2026: contributor

   ACK 44a7083d43604b3d5c923ffc9011d8043a27d052

9. 
   aaron-leeb commented at 2:43 AM on September 27, 2026: none

   tACK 44a7083

   I reviewed the changes and tested all three mutations locally by manually reintroducing the mutated code in interpreter.cpp, recompiling, and running test_bitcoin -t script_tests. In all three cases, the newly added test vectors successfully caught the consensus logic breaks.

   • 4e7de2a I changed != to >. The test now catches this mutation and fails properly. I understand that this new test data helps prevent transaction malleability from being reintroduced in Tapscript by enforcing strict minimal-IF rules.

   • f138012 I changed 32 to 31. The test failed as expected meaning the new test data kills the mutation. Checking that all 32 bytes of the hash must be identical.

   • 44a7083 I removed the sigversion == SigVersion::WITNESS_V0 check from the opcode limit conditional. The test suite correctly fails on the newly added >201 opcodes executed in a P2WSH witness script test vector. From my understanding, this test is crucial for ensuring the 201 MAX_OPS_PER_SCRIPT limit remains strictly enforced for P2WSH contracts, preventing potential DoS vulnerabilities from being reintroduced.

   Reviewing Bitcoin Core PRs is fun 💯

10. 
    ismaelsadeeq commented at 7:19 AM on September 30, 2026: member

    Nice, Concept ACK

11. DrahtBot requested review from ismaelsadeeq on Sep 30, 2026
12. 
    fametrano commented at 9:48 PM on October 1, 2026: contributor

    ACK 44a7083d43604b3d5c923ffc9011d8043a27d052

    I ran the 4 new rows through btclib's script interpreter and each gives the expected error code.

13. sedited merged this on Oct 5, 2026
14. sedited closed this on Oct 5, 2026

    ---

Review Requested
ismaelsadeeq