Bitcoin Core Fuzz Coverage Report

Coverage Report

Created: 2026-05-28 15:05

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/Users/brunogarcia/projects/bitcoin-core-dev/src/coins.cpp
Line
Count
Source
1
// Copyright (c) 2012-present The Bitcoin Core developers
2
// Distributed under the MIT software license, see the accompanying
3
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5
#include <coins.h>
6
7
#include <consensus/consensus.h>
8
#include <random.h>
9
#include <uint256.h>
10
#include <util/log.h>
11
#include <util/trace.h>
12
13
TRACEPOINT_SEMAPHORE(utxocache, add);
14
TRACEPOINT_SEMAPHORE(utxocache, spent);
15
TRACEPOINT_SEMAPHORE(utxocache, uncache);
16
17
CoinsViewEmpty& CoinsViewEmpty::Get()
18
0
{
19
0
    static CoinsViewEmpty instance;
20
0
    return instance;
21
0
}
22
23
std::optional<Coin> CCoinsViewCache::PeekCoin(const COutPoint& outpoint) const
24
0
{
25
0
    if (auto it{cacheCoins.find(outpoint)}; it != cacheCoins.end()) {
26
0
        return it->second.coin.IsSpent() ? std::nullopt : std::optional{it->second.coin};
27
0
    }
28
0
    return base->PeekCoin(outpoint);
29
0
}
30
31
CCoinsViewCache::CCoinsViewCache(CCoinsView* in_base, bool deterministic) :
32
0
    CCoinsViewBacked(in_base), m_deterministic(deterministic),
33
0
    cacheCoins(0, SaltedOutpointHasher(/*deterministic=*/deterministic), CCoinsMap::key_equal{}, &m_cache_coins_memory_resource)
34
0
{
35
0
    m_sentinel.second.SelfRef(m_sentinel);
36
0
}
37
38
0
size_t CCoinsViewCache::DynamicMemoryUsage() const {
39
0
    return memusage::DynamicUsage(cacheCoins) + cachedCoinsUsage;
40
0
}
41
42
std::optional<Coin> CCoinsViewCache::FetchCoinFromBase(const COutPoint& outpoint) const
43
0
{
44
0
    return base->GetCoin(outpoint);
45
0
}
46
47
0
CCoinsMap::iterator CCoinsViewCache::FetchCoin(const COutPoint &outpoint) const {
48
0
    const auto [ret, inserted] = cacheCoins.try_emplace(outpoint);
49
0
    if (inserted) {
50
0
        if (auto coin{FetchCoinFromBase(outpoint)}) {
51
0
            ret->second.coin = std::move(*coin);
52
0
            cachedCoinsUsage += ret->second.coin.DynamicMemoryUsage();
53
0
            Assert(!ret->second.coin.IsSpent());
Line
Count
Source
116
0
#define Assert(val) inline_assertion_check<true>(val, std::source_location::current(), #val)
54
0
        } else {
55
0
            cacheCoins.erase(ret);
56
0
            return cacheCoins.end();
57
0
        }
58
0
    }
59
0
    return ret;
60
0
}
61
62
std::optional<Coin> CCoinsViewCache::GetCoin(const COutPoint& outpoint) const
63
0
{
64
0
    if (auto it{FetchCoin(outpoint)}; it != cacheCoins.end() && !it->second.coin.IsSpent()) return it->second.coin;
65
0
    return std::nullopt;
66
0
}
67
68
0
void CCoinsViewCache::AddCoin(const COutPoint &outpoint, Coin&& coin, bool possible_overwrite) {
69
0
    assert(!coin.IsSpent());
70
0
    if (coin.out.scriptPubKey.IsUnspendable()) return;
71
0
    CCoinsMap::iterator it;
72
0
    bool inserted;
73
0
    std::tie(it, inserted) = cacheCoins.emplace(std::piecewise_construct, std::forward_as_tuple(outpoint), std::tuple<>());
74
0
    bool fresh = false;
75
0
    if (!possible_overwrite) {
76
0
        if (!it->second.coin.IsSpent()) {
77
0
            throw std::logic_error("Attempted to overwrite an unspent coin (when possible_overwrite is false)");
78
0
        }
79
        // If the coin exists in this cache as a spent coin and is DIRTY, then
80
        // its spentness hasn't been flushed to the parent cache. We're
81
        // re-adding the coin to this cache now but we can't mark it as FRESH.
82
        // If we mark it FRESH and then spend it before the cache is flushed
83
        // we would remove it from this cache and would never flush spentness
84
        // to the parent cache.
85
        //
86
        // Re-adding a spent coin can happen in the case of a re-org (the coin
87
        // is 'spent' when the block adding it is disconnected and then
88
        // re-added when it is also added in a newly connected block).
89
        //
90
        // If the coin doesn't exist in the current cache, or is spent but not
91
        // DIRTY, then it can be marked FRESH.
92
0
        fresh = !it->second.IsDirty();
93
0
    }
94
0
    if (!inserted) {
95
0
        Assume(TrySub(m_dirty_count, it->second.IsDirty()));
Line
Count
Source
128
0
#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
96
0
        Assume(TrySub(cachedCoinsUsage, it->second.coin.DynamicMemoryUsage()));
Line
Count
Source
128
0
#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
97
0
    }
98
0
    it->second.coin = std::move(coin);
99
0
    CCoinsCacheEntry::SetDirty(*it, m_sentinel);
100
0
    ++m_dirty_count;
101
0
    if (fresh) CCoinsCacheEntry::SetFresh(*it, m_sentinel);
102
0
    cachedCoinsUsage += it->second.coin.DynamicMemoryUsage();
103
0
    TRACEPOINT(utxocache, add,
104
0
           outpoint.hash.data(),
105
0
           (uint32_t)outpoint.n,
106
0
           (uint32_t)it->second.coin.nHeight,
107
0
           (int64_t)it->second.coin.out.nValue,
108
0
           (bool)it->second.coin.IsCoinBase());
109
0
}
110
111
0
void CCoinsViewCache::EmplaceCoinInternalDANGER(COutPoint&& outpoint, Coin&& coin) {
112
0
    const auto mem_usage{coin.DynamicMemoryUsage()};
113
0
    auto [it, inserted] = cacheCoins.try_emplace(std::move(outpoint), std::move(coin));
114
0
    if (inserted) {
115
0
        CCoinsCacheEntry::SetDirty(*it, m_sentinel);
116
0
        ++m_dirty_count;
117
0
        cachedCoinsUsage += mem_usage;
118
0
    }
119
0
}
120
121
0
void AddCoins(CCoinsViewCache& cache, const CTransaction &tx, int nHeight, bool check_for_overwrite) {
122
0
    bool fCoinbase = tx.IsCoinBase();
123
0
    const Txid& txid = tx.GetHash();
124
0
    for (size_t i = 0; i < tx.vout.size(); ++i) {
125
0
        bool overwrite = check_for_overwrite ? cache.HaveCoin(COutPoint(txid, i)) : fCoinbase;
126
        // Coinbase transactions can always be overwritten, in order to correctly
127
        // deal with the pre-BIP30 occurrences of duplicate coinbase transactions.
128
0
        cache.AddCoin(COutPoint(txid, i), Coin(tx.vout[i], nHeight, fCoinbase), overwrite);
129
0
    }
130
0
}
131
132
0
bool CCoinsViewCache::SpendCoin(const COutPoint &outpoint, Coin* moveout) {
133
0
    CCoinsMap::iterator it = FetchCoin(outpoint);
134
0
    if (it == cacheCoins.end()) return false;
135
0
    Assume(TrySub(m_dirty_count, it->second.IsDirty()));
Line
Count
Source
128
0
#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
136
0
    Assume(TrySub(cachedCoinsUsage, it->second.coin.DynamicMemoryUsage()));
Line
Count
Source
128
0
#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
137
0
    TRACEPOINT(utxocache, spent,
138
0
           outpoint.hash.data(),
139
0
           (uint32_t)outpoint.n,
140
0
           (uint32_t)it->second.coin.nHeight,
141
0
           (int64_t)it->second.coin.out.nValue,
142
0
           (bool)it->second.coin.IsCoinBase());
143
0
    if (moveout) {
144
0
        *moveout = std::move(it->second.coin);
145
0
    }
146
0
    if (it->second.IsFresh()) {
147
0
        cacheCoins.erase(it);
148
0
    } else {
149
0
        CCoinsCacheEntry::SetDirty(*it, m_sentinel);
150
0
        ++m_dirty_count;
151
0
        it->second.coin.Clear();
152
0
    }
153
0
    return true;
154
0
}
155
156
static const Coin coinEmpty;
157
158
0
const Coin& CCoinsViewCache::AccessCoin(const COutPoint &outpoint) const {
159
0
    CCoinsMap::const_iterator it = FetchCoin(outpoint);
160
0
    if (it == cacheCoins.end()) {
161
0
        return coinEmpty;
162
0
    } else {
163
0
        return it->second.coin;
164
0
    }
165
0
}
166
167
bool CCoinsViewCache::HaveCoin(const COutPoint& outpoint) const
168
0
{
169
0
    CCoinsMap::const_iterator it = FetchCoin(outpoint);
170
0
    return (it != cacheCoins.end() && !it->second.coin.IsSpent());
171
0
}
172
173
0
bool CCoinsViewCache::HaveCoinInCache(const COutPoint &outpoint) const {
174
0
    CCoinsMap::const_iterator it = cacheCoins.find(outpoint);
175
0
    return (it != cacheCoins.end() && !it->second.coin.IsSpent());
176
0
}
177
178
0
uint256 CCoinsViewCache::GetBestBlock() const {
179
0
    if (m_block_hash.IsNull())
180
0
        m_block_hash = base->GetBestBlock();
181
0
    return m_block_hash;
182
0
}
183
184
void CCoinsViewCache::SetBestBlock(const uint256& in_block_hash)
185
0
{
186
0
    m_block_hash = in_block_hash;
187
0
}
188
189
void CCoinsViewCache::BatchWrite(CoinsViewCacheCursor& cursor, const uint256& in_block_hash)
190
0
{
191
0
    for (auto it{cursor.Begin()}; it != cursor.End(); it = cursor.NextAndMaybeErase(*it)) {
192
0
        if (!it->second.IsDirty()) { // TODO a cursor can only contain dirty entries
193
0
            continue;
194
0
        }
195
0
        auto [itUs, inserted]{cacheCoins.try_emplace(it->first)};
196
0
        if (inserted) {
197
0
            if (it->second.IsFresh() && it->second.coin.IsSpent()) {
198
0
                cacheCoins.erase(itUs); // TODO fresh coins should have been removed at spend
199
0
            } else {
200
                // The parent cache does not have an entry, while the child cache does.
201
                // Move the data up and mark it as dirty.
202
0
                CCoinsCacheEntry& entry{itUs->second};
203
0
                assert(entry.coin.DynamicMemoryUsage() == 0);
204
0
                if (cursor.WillErase(*it)) {
205
                    // Since this entry will be erased,
206
                    // we can move the coin into us instead of copying it
207
0
                    entry.coin = std::move(it->second.coin);
208
0
                } else {
209
0
                    entry.coin = it->second.coin;
210
0
                }
211
0
                CCoinsCacheEntry::SetDirty(*itUs, m_sentinel);
212
0
                ++m_dirty_count;
213
0
                cachedCoinsUsage += entry.coin.DynamicMemoryUsage();
214
                // We can mark it FRESH in the parent if it was FRESH in the child
215
                // Otherwise it might have just been flushed from the parent's cache
216
                // and already exist in the grandparent
217
0
                if (it->second.IsFresh()) CCoinsCacheEntry::SetFresh(*itUs, m_sentinel);
218
0
            }
219
0
        } else {
220
            // Found the entry in the parent cache
221
0
            if (it->second.IsFresh() && !itUs->second.coin.IsSpent()) {
222
                // The coin was marked FRESH in the child cache, but the coin
223
                // exists in the parent cache. If this ever happens, it means
224
                // the FRESH flag was misapplied and there is a logic error in
225
                // the calling code.
226
0
                throw std::logic_error("FRESH flag misapplied to coin that exists in parent cache");
227
0
            }
228
229
0
            if (itUs->second.IsFresh() && it->second.coin.IsSpent()) {
230
                // The grandparent cache does not have an entry, and the coin
231
                // has been spent. We can just delete it from the parent cache.
232
0
                Assume(TrySub(m_dirty_count, itUs->second.IsDirty()));
Line
Count
Source
128
0
#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
233
0
                Assume(TrySub(cachedCoinsUsage, itUs->second.coin.DynamicMemoryUsage()));
Line
Count
Source
128
0
#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
234
0
                cacheCoins.erase(itUs);
235
0
            } else {
236
                // A normal modification.
237
0
                Assume(TrySub(cachedCoinsUsage, itUs->second.coin.DynamicMemoryUsage()));
Line
Count
Source
128
0
#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
238
0
                if (cursor.WillErase(*it)) {
239
                    // Since this entry will be erased,
240
                    // we can move the coin into us instead of copying it
241
0
                    itUs->second.coin = std::move(it->second.coin);
242
0
                } else {
243
0
                    itUs->second.coin = it->second.coin;
244
0
                }
245
0
                cachedCoinsUsage += itUs->second.coin.DynamicMemoryUsage();
246
0
                if (!itUs->second.IsDirty()) {
247
0
                    CCoinsCacheEntry::SetDirty(*itUs, m_sentinel);
248
0
                    ++m_dirty_count;
249
0
                }
250
                // NOTE: It isn't safe to mark the coin as FRESH in the parent
251
                // cache. If it already existed and was spent in the parent
252
                // cache then marking it FRESH would prevent that spentness
253
                // from being flushed to the grandparent.
254
0
            }
255
0
        }
256
0
    }
257
0
    SetBestBlock(in_block_hash);
258
0
}
259
260
void CCoinsViewCache::Flush(bool reallocate_cache)
261
0
{
262
0
    auto cursor{CoinsViewCacheCursor(m_dirty_count, m_sentinel, cacheCoins, /*will_erase=*/true)};
263
0
    base->BatchWrite(cursor, m_block_hash);
264
0
    Assume(m_dirty_count == 0);
Line
Count
Source
128
0
#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
265
0
    cacheCoins.clear();
266
0
    if (reallocate_cache) {
267
0
        ReallocateCache();
268
0
    }
269
0
    cachedCoinsUsage = 0;
270
0
}
271
272
void CCoinsViewCache::Sync()
273
0
{
274
0
    auto cursor{CoinsViewCacheCursor(m_dirty_count, m_sentinel, cacheCoins, /*will_erase=*/false)};
275
0
    base->BatchWrite(cursor, m_block_hash);
276
0
    Assume(m_dirty_count == 0);
Line
Count
Source
128
0
#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
277
0
    if (m_sentinel.second.Next() != &m_sentinel) {
278
        /* BatchWrite must clear flags of all entries */
279
0
        throw std::logic_error("Not all unspent flagged entries were cleared");
280
0
    }
281
0
}
282
283
void CCoinsViewCache::Reset() noexcept
284
0
{
285
0
    cacheCoins.clear();
286
0
    cachedCoinsUsage = 0;
287
0
    m_dirty_count = 0;
288
0
    SetBestBlock(uint256::ZERO);
289
0
}
290
291
void CCoinsViewCache::Uncache(const COutPoint& hash)
292
0
{
293
0
    CCoinsMap::iterator it = cacheCoins.find(hash);
294
0
    if (it != cacheCoins.end() && !it->second.IsDirty()) {
295
0
        Assume(TrySub(cachedCoinsUsage, it->second.coin.DynamicMemoryUsage()));
Line
Count
Source
128
0
#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
296
0
        TRACEPOINT(utxocache, uncache,
297
0
               hash.hash.data(),
298
0
               (uint32_t)hash.n,
299
0
               (uint32_t)it->second.coin.nHeight,
300
0
               (int64_t)it->second.coin.out.nValue,
301
0
               (bool)it->second.coin.IsCoinBase());
302
0
        cacheCoins.erase(it);
303
0
    }
304
0
}
305
306
0
unsigned int CCoinsViewCache::GetCacheSize() const {
307
0
    return cacheCoins.size();
308
0
}
309
310
bool CCoinsViewCache::HaveInputs(const CTransaction& tx) const
311
0
{
312
0
    if (!tx.IsCoinBase()) {
313
0
        for (unsigned int i = 0; i < tx.vin.size(); i++) {
314
0
            if (!HaveCoin(tx.vin[i].prevout)) {
315
0
                return false;
316
0
            }
317
0
        }
318
0
    }
319
0
    return true;
320
0
}
321
322
void CCoinsViewCache::ReallocateCache()
323
0
{
324
    // Cache should be empty when we're calling this.
325
0
    assert(cacheCoins.size() == 0);
326
0
    cacheCoins.~CCoinsMap();
327
0
    m_cache_coins_memory_resource.~CCoinsMapMemoryResource();
328
0
    ::new (&m_cache_coins_memory_resource) CCoinsMapMemoryResource{};
329
0
    ::new (&cacheCoins) CCoinsMap{0, SaltedOutpointHasher{/*deterministic=*/m_deterministic}, CCoinsMap::key_equal{}, &m_cache_coins_memory_resource};
330
0
}
331
332
void CCoinsViewCache::SanityCheck() const
333
0
{
334
0
    size_t recomputed_usage = 0;
335
0
    size_t count_dirty = 0;
336
0
    for (const auto& [_, entry] : cacheCoins) {
337
0
        if (entry.coin.IsSpent()) {
338
0
            assert(entry.IsDirty() && !entry.IsFresh()); // A spent coin must be dirty and cannot be fresh
339
0
        } else {
340
0
            assert(entry.IsDirty() || !entry.IsFresh()); // An unspent coin must not be fresh if not dirty
341
0
        }
342
343
        // Recompute cachedCoinsUsage.
344
0
        recomputed_usage += entry.coin.DynamicMemoryUsage();
345
346
        // Count the number of entries we expect in the linked list.
347
0
        if (entry.IsDirty()) ++count_dirty;
348
0
    }
349
    // Iterate over the linked list of flagged entries.
350
0
    size_t count_linked = 0;
351
0
    for (auto it = m_sentinel.second.Next(); it != &m_sentinel; it = it->second.Next()) {
352
        // Verify linked list integrity.
353
0
        assert(it->second.Next()->second.Prev() == it);
354
0
        assert(it->second.Prev()->second.Next() == it);
355
        // Verify they are actually flagged.
356
0
        assert(it->second.IsDirty());
357
        // Count the number of entries actually in the list.
358
0
        ++count_linked;
359
0
    }
360
0
    assert(count_dirty == count_linked && count_dirty == m_dirty_count);
361
0
    assert(recomputed_usage == cachedCoinsUsage);
362
0
}
363
364
static const uint64_t MIN_TRANSACTION_OUTPUT_WEIGHT{WITNESS_SCALE_FACTOR * ::GetSerializeSize(CTxOut())};
365
static const uint64_t MAX_OUTPUTS_PER_BLOCK{MAX_BLOCK_WEIGHT / MIN_TRANSACTION_OUTPUT_WEIGHT};
366
367
const Coin& AccessByTxid(const CCoinsViewCache& view, const Txid& txid)
368
0
{
369
0
    COutPoint iter(txid, 0);
370
0
    while (iter.n < MAX_OUTPUTS_PER_BLOCK) {
371
0
        const Coin& alternate = view.AccessCoin(iter);
372
0
        if (!alternate.IsSpent()) return alternate;
373
0
        ++iter.n;
374
0
    }
375
0
    return coinEmpty;
376
0
}
377
378
template <typename ReturnType, typename Func>
379
static ReturnType ExecuteBackedWrapper(Func func, const std::vector<std::function<void()>>& err_callbacks)
380
0
{
381
0
    try {
382
0
        return func();
383
0
    } catch(const std::runtime_error& e) {
384
0
        for (const auto& f : err_callbacks) {
385
0
            f();
386
0
        }
387
0
        LogError("Error reading from database: %s\n", e.what());
Line
Count
Source
99
0
#define LogError(...) LogPrintLevel_(BCLog::LogFlags::ALL, BCLog::Level::Error, /*should_ratelimit=*/true, __VA_ARGS__)
Line
Count
Source
91
0
#define LogPrintLevel_(category, level, should_ratelimit, ...) LogPrintFormatInternal(SourceLocation{__func__}, category, level, should_ratelimit, __VA_ARGS__)
        LogError("Error reading from database: %s\n", e.what());
Line
Count
Source
99
0
#define LogError(...) LogPrintLevel_(BCLog::LogFlags::ALL, BCLog::Level::Error, /*should_ratelimit=*/true, __VA_ARGS__)
Line
Count
Source
91
0
#define LogPrintLevel_(category, level, should_ratelimit, ...) LogPrintFormatInternal(SourceLocation{__func__}, category, level, should_ratelimit, __VA_ARGS__)
        LogError("Error reading from database: %s\n", e.what());
Line
Count
Source
99
0
#define LogError(...) LogPrintLevel_(BCLog::LogFlags::ALL, BCLog::Level::Error, /*should_ratelimit=*/true, __VA_ARGS__)
Line
Count
Source
91
0
#define LogPrintLevel_(category, level, should_ratelimit, ...) LogPrintFormatInternal(SourceLocation{__func__}, category, level, should_ratelimit, __VA_ARGS__)
388
        // Starting the shutdown sequence and returning false to the caller would be
389
        // interpreted as 'entry not found' (as opposed to unable to read data), and
390
        // could lead to invalid interpretation. Just exit immediately, as we can't
391
        // continue anyway, and all writes should be atomic.
392
0
        std::abort();
393
0
    }
394
0
}
Unexecuted instantiation: coins.cpp:std::__1::optional<Coin> ExecuteBackedWrapper<std::__1::optional<Coin>, CCoinsViewErrorCatcher::GetCoin(COutPoint const&) const::$_0>(CCoinsViewErrorCatcher::GetCoin(COutPoint const&) const::$_0, std::__1::vector<std::__1::function<void ()>, std::__1::allocator<std::__1::function<void ()>>> const&)
Unexecuted instantiation: coins.cpp:bool ExecuteBackedWrapper<bool, CCoinsViewErrorCatcher::HaveCoin(COutPoint const&) const::$_0>(CCoinsViewErrorCatcher::HaveCoin(COutPoint const&) const::$_0, std::__1::vector<std::__1::function<void ()>, std::__1::allocator<std::__1::function<void ()>>> const&)
Unexecuted instantiation: coins.cpp:std::__1::optional<Coin> ExecuteBackedWrapper<std::__1::optional<Coin>, CCoinsViewErrorCatcher::PeekCoin(COutPoint const&) const::$_0>(CCoinsViewErrorCatcher::PeekCoin(COutPoint const&) const::$_0, std::__1::vector<std::__1::function<void ()>, std::__1::allocator<std::__1::function<void ()>>> const&)
395
396
std::optional<Coin> CCoinsViewErrorCatcher::GetCoin(const COutPoint& outpoint) const
397
0
{
398
0
    return ExecuteBackedWrapper<std::optional<Coin>>([&]() { return CCoinsViewBacked::GetCoin(outpoint); }, m_err_callbacks);
399
0
}
400
401
bool CCoinsViewErrorCatcher::HaveCoin(const COutPoint& outpoint) const
402
0
{
403
0
    return ExecuteBackedWrapper<bool>([&]() { return CCoinsViewBacked::HaveCoin(outpoint); }, m_err_callbacks);
404
0
}
405
406
std::optional<Coin> CCoinsViewErrorCatcher::PeekCoin(const COutPoint& outpoint) const
407
0
{
408
0
    return ExecuteBackedWrapper<std::optional<Coin>>([&]() { return CCoinsViewBacked::PeekCoin(outpoint); }, m_err_callbacks);
409
0
}