Skip to content

fuzz, txncache: add transaction cache fuzzer#10303

Open
two-heart wants to merge 1 commit into
firedancer-io:mainfrom
two-heart:txncache-fuzzer
Open

fuzz, txncache: add transaction cache fuzzer#10303
two-heart wants to merge 1 commit into
firedancer-io:mainfrom
two-heart:txncache-fuzzer

Conversation

@two-heart

Copy link
Copy Markdown
Contributor

Keeps a model to track invariants. Finds #9517

@greptile-jt

greptile-jt Bot commented Jun 20, 2026

Copy link
Copy Markdown
Prompt To Fix All With AI
This is a comment left during a code review.
Path: src/flamenco/runtime/fuzz_txncache_fork_graph.c
Line: 129

Comment:
**Missing `seed` argument to `fd_txncache_shmem_new`**

`fd_txncache_shmem_new` takes 4 parameters (`shmem`, `max_live_slots`, `max_txn_per_slot`, `seed`), but this call only passes 3. Every other call site in the codebase (e.g. `test_txncache.c`, `fd_svm_mini.c`) passes `0UL` as the seed. This will cause a compilation error.

```suggestion
  fd_txncache_shmem_t * shtc = fd_txncache_shmem_join( fd_txncache_shmem_new( fuzz_shmem, max_live_slots, max_txn_per_slot, 0UL ) );
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/flamenco/runtime/fuzz_txncache_fork_graph.c
Line: 836-838

Comment:
**Wrong fork_id passed to `fd_txncache_insert`**

`fd_txncache_insert`'s first fork argument is the *executing* fork (the fork the transaction ran on), not the ancestor holding the blockhash. Here `block_fork_id` (the ancestor) is passed instead of `fork_id` (the executing fork).

This causes two problems:
1. If `block_fork` is `FORK_FINAL` (frozen==2), the assertion `FD_TEST( fork->shmem->frozen<=1 )` inside `fd_txncache_insert` will fire.
2. If `block_fork` is `FORK_HASHED` (frozen==1), the transaction is stored with the wrong `fork_id`, causing model/target query mismatches since the model records `txn_fork = fork_id` while the target stores `fork_id = block_fork`.

Compare with `model_insert_one` (line 859) which correctly passes `fork_id`:

```suggestion
  fd_txncache_insert( m->tc, (fd_txncache_fork_id_t){ .val = fork_id }, m->fork[ block_fork ].blockhash.uc, txnhash->uc );
```

How can I resolve this? If you propose a fix, please make it concise.

Reviews (1): Last reviewed commit: "fuzz, txncache: add transaction cache fu..." | Re-trigger Greptile

Comment thread src/flamenco/runtime/fuzz_txncache_fork_graph.c Outdated
Comment thread src/flamenco/runtime/fuzz_txncache_fork_graph.c
Keeps a model to track invariants. Finds firedancer-io#9517
@greptile-jt

greptile-jt Bot commented Jun 20, 2026

Copy link
Copy Markdown

Reviews (2): Last reviewed commit: "fuzz, txncache: add transaction cache fu..." | Re-trigger Greptile


for( ulong action_idx=0UL; action_idx<FUZZ_MAX_ACTIONS && cur.rem; action_idx++ ) {
switch( fuzz_u8( &cur ) & 15U ) {
case 0U:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assume this is supposed to model a probability distribution?

@intrigus-lgtm intrigus-lgtm left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any reason to not move check_invariants to the txncache directly as e.g. done for fd_rdisp or fd_forest?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants