From: Phillip Wood <phillip.wood123@gmail.com>
Date: Sun, 08 Feb 2026 11:14:37 GMT
Subject: Re: [Outreachy PATCH v6 1/3] environment: stop storing `core.attributesFile` globally
Message-ID: <88570b6c-2ff3-416f-b63f-2fb7c80c5af8@gmail.com>
In-Reply-To: <xmqq7bspcq3c.fsf@gitster.g>



On 07/02/2026 01:14, Junio C Hamano wrote:
> Olamide Caleb Bello <belkid98@gmail.com> writes:
> 
>> Suggested-by: Phillip Wood <phillip.wood123@gmail.com>
>> Mentored-by: Christian Couder <christian.couder@gmail.com>
>> Mentored-by: Usman Akinyemi <usmanakinyemi202@gmail.com>
>> Helped-by: Junio C Hamano <gitster@pobox.com>
>> Signed-off-by: Olamide Caleb Bello <belkid98@gmail.com>
>> ---
>>   attr.c        |  7 ++++---
>>   environment.c | 12 +++++++++---
>>   environment.h | 11 ++++++++++-
>>   repository.c  | 12 ++++++++++++
>>   repository.h  |  7 +++++++
>>   5 files changed, 42 insertions(+), 7 deletions(-)
> 
> I bisected our recent CI failures that break fuzz smoke test down to
> this change.

The documentation for the LibFuzzer [1] notes

     * The fuzzing engine will execute the fuzz target many times with
       different inputs in the same process.

and the first thing that the callback in oss-fuzz/fuzz-commit-graph.c 
does is

	initialize_repository(the_repository);

so I think the problem is that the assumption that a process will only 
initialize "the_repository" once is incompatible with the way LibFuzzer 
works. Maybe we should add

	memset(the_repository, 0, sizeof(*the_repository));

before the call in initialize_repository()?

Thanks

Phillip

[1] https://llvm.org/docs/LibFuzzer.html

> $ make -j32 \
>              NO_CURL=NoThanks \
>              CC=clang \
>              FUZZ_CXX=clang++ \
>              CFLAGS="-fsanitize=fuzzer-no-link,address" \
>              LIB_FUZZING_ENGINE="-fsanitize=fuzzer,address" \
>              fuzz-all >/dev/null &&
> $ oss-fuzz/fuzz-commit-graph -verbosity=0 -runs=1
> 
> INFO: Running with entropic power schedule (0xFF, 100).
> INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
> INFO: A corpus is not provided, starting from an empty corpus
> BUG: repository.c:63: repository initialized already
> ==2050473== ERROR: libFuzzer: deadly signal
>      #0 0x56169aaf4065 in __sanitizer_print_stack_trace (/home/gitster/git.git/oss-fuzz/fuzz-commit-graph+0x32a065) (BuildId: ec362419d512b5bd707ae18eef56a6a12a18fc92)
>      #1 0x56169aa4835c in fuzzer::PrintStackTrace() (/home/gitster/git.git/oss-fuzz/fuzz-commit-graph+0x27e35c) (BuildId: ec362419d512b5bd707ae18eef56a6a12a18fc92)
>      #2 0x56169aa2d2d7 in fuzzer::Fuzzer::CrashCallback() (/home/gitster/git.git/oss-fuzz/fuzz-commit-graph+0x2632d7) (BuildId: ec362419d512b5bd707ae18eef56a6a12a18fc92)
>      #3 0x7fb4c6f59def  (/lib/x86_64-linux-gnu/libc.so.6+0x3fdef) (BuildId: 61e1dea1f540b3b4b4d8ec76716e409cec096ece)
>      #4 0x7fb4c6fae95b in __pthread_kill_implementation nptl/pthread_kill.c:43:17
>      #5 0x7fb4c6f59cc1 in raise signal/../sysdeps/posix/raise.c:26:13
>      #6 0x7fb4c6f424ab in abort stdlib/abort.c:73:3
>      #7 0x56169ae91316 in BUG_vfl usage.c
>      #8 0x56169ae8f527 in BUG_fl (/home/gitster/git.git/oss-fuzz/fuzz-commit-graph+0x6c5527) (BuildId: ec362419d512b5bd707ae18eef56a6a12a18fc92)
>      #9 0x56169ad79d07 in initialize_repository (/home/gitster/git.git/oss-fuzz/fuzz-commit-graph+0x5afd07) (BuildId: ec362419d512b5bd707ae18eef56a6a12a18fc92)
>      #10 0x56169ab2c4e2 in LLVMFuzzerTestOneInput (/home/gitster/git.git/oss-fuzz/fuzz-commit-graph+0x3624e2) (BuildId: ec362419d512b5bd707ae18eef56a6a12a18fc92)
>      #11 0x56169aa2e9da in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/gitster/git.git/oss-fuzz/fuzz-commit-graph+0x2649da) (BuildId: ec362419d512b5bd707ae18eef56a6a12a18fc92)
>      #12 0x56169aa2dfe9 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) (/home/gitster/git.git/oss-fuzz/fuzz-commit-graph+0x263fe9) (BuildId: ec362419d512b5bd707ae18eef56a6a12a18fc92)
>      #13 0x56169aa2fdaf in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) (/home/gitster/git.git/oss-fuzz/fuzz-commit-graph+0x265daf) (BuildId: ec362419d512b5bd707ae18eef56a6a12a18fc92)
>      #14 0x56169aa30390 in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) (/home/gitster/git.git/oss-fuzz/fuzz-commit-graph+0x266390) (BuildId: ec362419d512b5bd707ae18eef56a6a12a18fc92)
>      #15 0x56169aa1cb65 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/gitster/git.git/oss-fuzz/fuzz-commit-graph+0x252b65) (BuildId: ec362419d512b5bd707ae18eef56a6a12a18fc92)
>      #16 0x56169aa48ec6 in main (/home/gitster/git.git/oss-fuzz/fuzz-commit-graph+0x27eec6) (BuildId: ec362419d512b5bd707ae18eef56a6a12a18fc92)
>      #17 0x7fb4c6f43ca7 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
>      #18 0x7fb4c6f43d64 in __libc_start_main csu/../csu/libc-start.c:360:3
>      #19 0x56169aa10ec0 in _start (/home/gitster/git.git/oss-fuzz/fuzz-commit-graph+0x246ec0) (BuildId: ec362419d512b5bd707ae18eef56a6a12a18fc92)
> 
> NOTE: libFuzzer has rudimentary signal handlers.