fuzz: move backend mutating block to end of coins_view
What the developer wrote
Authored by Andrew Toth
fuzz: move backend mutating block to end of coins_view
Refactor TestCoinsView() to move code that directly modifies
backend_coins_view to the end of the function.
This prepares for a CoinsViewOverlay fuzz target that asserts
the backend_coins_view is not mutated by any methods before
BatchWrite is called.
Co-authored-by: l0rinc <pap.lorinc@gmail.com>
What changed, and why it matters
This commit is a test-only code cleanup. It moves a block of verification code from the middle to the end of a fuzz-testing function so that a future test can check that the underlying coin database is not modified before a specific write operation. No production code, network behavior, or wallet logic is changed, and there is no security fix.
No action required. This is a benign refactor of fuzz-test code.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change refactors TestCoinsView() in src/test/fuzz/coins_view.cpp. A block that reads backend_coins_view (the underlying CCoinsView) is relocated to the end of the function. The commit message states this prepares for a future CoinsViewOverlay fuzz target that will assert backend_coins_view is not mutated by methods prior to BatchWrite. The moved code is identical; only its position in the function changes.
Changed components
src/test/fuzz/coins_view.cppInspect captured patch +25 / −25
diff --git a/src/test/fuzz/coins_view.cpp b/src/test/fuzz/coins_view.cpp
index 813cf031..c967c12f 100644
--- a/src/test/fuzz/coins_view.cpp
+++ b/src/test/fuzz/coins_view.cpp
@@ -177,31 +177,6 @@ void TestCoinsView(FuzzedDataProvider& fuzzed_data_provider, CCoinsViewCache& co
});
}
- {
- const Coin& coin_using_access_coin = coins_view_cache.AccessCoin(random_out_point);
- const bool exists_using_access_coin = !(coin_using_access_coin == EMPTY_COIN);
- const bool exists_using_have_coin = coins_view_cache.HaveCoin(random_out_point);
- const bool exists_using_have_coin_in_cache = coins_view_cache.HaveCoinInCache(random_out_point);
- if (auto coin{coins_view_cache.GetCoin(random_out_point)}) {
- assert(*coin == coin_using_access_coin);
- assert(exists_using_access_coin && exists_using_have_coin_in_cache && exists_using_have_coin);
- } else {
- assert(!exists_using_access_coin && !exists_using_have_coin_in_cache && !exists_using_have_coin);
- }
- // If HaveCoin on the backend is true, it must also be on the cache if the coin wasn't spent.
- const bool exists_using_have_coin_in_backend = backend_coins_view.HaveCoin(random_out_point);
- if (!coin_using_access_coin.IsSpent() && exists_using_have_coin_in_backend) {
- assert(exists_using_have_coin);
- }
- if (auto coin{backend_coins_view.GetCoin(random_out_point)}) {
- assert(exists_using_have_coin_in_backend);
- // Note we can't assert that `coin_using_get_coin == *coin` because the coin in
- // the cache may have been modified but not yet flushed.
- } else {
- assert(!exists_using_have_coin_in_backend);
- }
- }
-
{
bool expected_code_path = false;
try {
@@ -305,6 +280,31 @@ void TestCoinsView(FuzzedDataProvider& fuzzed_data_provider, CCoinsViewCache& co
(void)IsWitnessStandard(CTransaction{random_mutable_transaction}, coins_view_cache);
});
}
+
+ {
+ const Coin& coin_using_access_coin = coins_view_cache.AccessCoin(random_out_point);
+ const bool exists_using_access_coin = !(coin_using_access_coin == EMPTY_COIN);
+ const bool exists_using_have_coin = coins_view_cache.HaveCoin(random_out_point);
+ const bool exists_using_have_coin_in_cache = coins_view_cache.HaveCoinInCache(random_out_point);
+ if (auto coin{coins_view_cache.GetCoin(random_out_point)}) {
+ assert(*coin == coin_using_access_coin);
+ assert(exists_using_access_coin && exists_using_have_coin_in_cache && exists_using_have_coin);
+ } else {
+ assert(!exists_using_access_coin && !exists_using_have_coin_in_cache && !exists_using_have_coin);
+ }
+ // If HaveCoin on the backend is true, it must also be on the cache if the coin wasn't spent.
+ const bool exists_using_have_coin_in_backend = backend_coins_view.HaveCoin(random_out_point);
+ if (!coin_using_access_coin.IsSpent() && exists_using_have_coin_in_backend) {
+ assert(exists_using_have_coin);
+ }
+ if (auto coin{backend_coins_view.GetCoin(random_out_point)}) {
+ assert(exists_using_have_coin_in_backend);
+ // Note we can't assert that `coin_using_get_coin == *coin` because the coin in
+ // the cache may have been modified but not yet flushed.
+ } else {
+ assert(!exists_using_have_coin_in_backend);
+ }
+ }
}
FUZZ_TARGET(coins_view, .init = initialize_coins_view)
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.