fuzz: Fix variable in `clusterlin_postlinearize_tree` check
What the developer wrote
Authored by marcofleon
fuzz: Fix variable in `clusterlin_postlinearize_tree` check
The test intends to verify that running `PostLinearize` a
second time on a tree-structured graph doesn't change the
result. But `PostLinearize` was being called on the original
variable, not the copy. So the check was comparing the
unmodified copy against itself, which is useless.
Fix by post-linearizing the correct variable.
What changed, and why it matters
This is a one-line bug fix in a fuzz test (automated randomized test) for Bitcoin Core's transaction clustering logic. The test meant to check that running an optimization twice on a copy of a tree-shaped dependency graph produces the same result, but it accidentally ran the optimization on the original variable instead of the copy. That made the comparison trivial and useless. The fix corrects the variable name so the test actually exercises the intended behavior. It does not affect live Bitcoin node code, wallets, consensus, or network behavior.
No security action required. Treat as a normal test-quality fix. Reviewers may optionally verify that the corrected fuzz target now reaches the intended code path and that no similar copy/paste mistakes exist in adjacent fuzz targets.
Security signals we found
Test-only fuzz harness bug with no production code change
No input validation, memory safety, cryptographic, consensus, or networking code touched
No privilege boundary crossed
Evidence from the diff
In src/test/fuzz/cluster_linearize.cpp, the fuzz target clusterlin_postlinearize_tree intended to verify idempotency of PostLinearize on tree-structured dependency graphs. The developer copied post_linearization into post_post_linearization but then called PostLinearize(depgraph_tree, post_linearization) and SanityCheck(depgraph_tree, post_linearization) on the original variable, leaving post_post_linearization unmodified. The subsequent CompareChunks(post_post_chunking, post_chunking) therefore compared identical chunking outputs. The patch changes the two calls to use post_post_linearization, restoring the intended test invariant. This is purely a test-code correctness fix; no production code paths are modified.
Changed components
src/test/fuzz/cluster_linearize.cppFuzz target clusterlin_postlinearize_treeInspect captured patch +2 / −2
diff --git a/src/test/fuzz/cluster_linearize.cpp b/src/test/fuzz/cluster_linearize.cpp
index 86734591..d2286cae 100644
--- a/src/test/fuzz/cluster_linearize.cpp
+++ b/src/test/fuzz/cluster_linearize.cpp
@@ -1309,8 +1309,8 @@ FUZZ_TARGET(clusterlin_postlinearize_tree)
// Verify that post-linearizing again does not change the diagram. The result must be identical
// as post_linearization ought to be optimal already with a tree-structured graph.
auto post_post_linearization = post_linearization;
- PostLinearize(depgraph_tree, post_linearization);
- SanityCheck(depgraph_tree, post_linearization);
+ PostLinearize(depgraph_tree, post_post_linearization);
+ SanityCheck(depgraph_tree, post_post_linearization);
auto post_post_chunking = ChunkLinearization(depgraph_tree, post_post_linearization);
auto cmp_post = CompareChunks(post_post_chunking, post_chunking);
assert(cmp_post == 0);
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.