Fuzz Failure in ChannelMonitor

[carlaKC]

Hit a fuzzing failure in 3700:

• Script to reproduce the failing test case
• Full test output

Stack Trace:

thread '<unnamed>' panicked at /Users/carla/Work/rust-lightning/lightning/src/chain/channelmonitor.rs:4439:7:
An unmature HTLC transaction conflicts with a maturing one; failed to call either transaction_unconfirmed for the conflicting transaction or block_disconnected for a block containing it.
stack backtrace:
   0:        0x1004f09cc - std::backtrace_rs::backtrace::libunwind::trace::h7f51f64da084d564
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/std/src/../../backtrace/src/backtrace/libunwind.rs:116:5
   1:        0x1004f09cc - std::backtrace_rs::backtrace::trace_unsynchronized::h0c7f623a469276df
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:        0x1004f09cc - std::sys::backtrace::_print_fmt::hd4ebb49eee8ba9e9
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/std/src/sys/backtrace.rs:66:9
   3:        0x1004f09cc - <std::sys::backtrace::BacktraceLock::print::DisplayBacktrace as core::fmt::Display>::fmt::h4b01b56329a0a8fc
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/std/src/sys/backtrace.rs:39:26
   4:        0x10050bb28 - core::fmt::rt::Argument::fmt::h06e9a80dc1e58715
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/core/src/fmt/rt.rs:177:76
   5:        0x10050bb28 - core::fmt::write::h5ac783d2f16cae69
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/core/src/fmt/mod.rs:1440:21
   6:        0x1004edeac - std::io::Write::write_fmt::h720b1505e3b25e8c
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/std/src/io/mod.rs:1887:15
   7:        0x1004f0880 - std::sys::backtrace::BacktraceLock::print::h822ac0a1da741b33
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/std/src/sys/backtrace.rs:42:9
   8:        0x1004f1c34 - std::panicking::default_hook::{{closure}}::h182e34e1427a763f
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/std/src/panicking.rs:295:22
   9:        0x1004f19ec - std::panicking::default_hook::hf3c673ab0d652139
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/std/src/panicking.rs:319:9
  10:        0x1001e0de8 - <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call::h265bed338f3d8634
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/alloc/src/boxed.rs:2007:9
  11:        0x1001e0de8 - test::test_main::{{closure}}::h824b36340d86f4f3
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/test/src/lib.rs:134:21
  12:        0x1004f25c0 - <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call::h7a45b14880faeee7
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/alloc/src/boxed.rs:2007:9
  13:        0x1004f25c0 - std::panicking::rust_panic_with_hook::ha68643d4311595e9
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/std/src/panicking.rs:836:13
  14:        0x1004f2100 - std::panicking::begin_panic_handler::{{closure}}::h0edcf2e5c8ce9186
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/std/src/panicking.rs:694:13
  15:        0x1004f0e8c - std::sys::backtrace::__rust_end_short_backtrace::h25049b070cf1a527
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/std/src/sys/backtrace.rs:168:18
  16:        0x1004f1de0 - rust_begin_unwind
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/std/src/panicking.rs:692:5
  17:        0x10051fe10 - core::panicking::panic_fmt::ha0b5c5252c2f1706
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/core/src/panicking.rs:75:14
  18:        0x1003a5424 - lightning::chain::channelmonitor::ChannelMonitorImpl<Signer>::block_confirmed::hcffb8496cdf91fcf
  19:        0x1003a6ccc - lightning::chain::channelmonitor::ChannelMonitorImpl<Signer>::transactions_confirmed::h830b3c9e16605918
                               at /Users/carla/Work/rust-lightning/lightning/src/chain/channelmonitor.rs:4377:3
  20:        0x1003a2a24 - lightning::chain::channelmonitor::ChannelMonitor<Signer>::transactions_confirmed::h73d6379ff5201df8
                               at /Users/carla/Work/rust-lightning/lightning/src/chain/channelmonitor.rs:2045:3
  21:        0x100215f30 - <lightning::chain::chainmonitor::ChainMonitor<ChannelSigner,C,T,F,L,P> as lightning::chain::Confirm>::transactions_confirmed::{{closure}}::h9dac1bedf04704e2
                               at /Users/carla/Work/rust-lightning/lightning/src/chain/chainmonitor.rs:711:4
  22:        0x100215f30 - core::ops::function::impls::<impl core::ops::function::Fn<A> for &F>::call::hb4f34779a5e4a540
                               at /Users/carla/.rustup/toolchains/stable-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/ops/function.rs:262:13
  23:        0x100215f30 - lightning::chain::chainmonitor::ChainMonitor<ChannelSigner,C,T,F,L,P>::update_monitor_with_chain_data::h95210b22be01df7f
                               at /Users/carla/Work/rust-lightning/lightning/src/chain/chainmonitor.rs:326:25
  24:        0x100215a50 - lightning::chain::chainmonitor::ChainMonitor<ChannelSigner,C,T,F,L,P>::process_chain_data::h931903e5a4d9e5d1
                               at /Users/carla/Work/rust-lightning/lightning/src/chain/chainmonitor.rs:286:8
  25:        0x10025509c - <lightning::chain::chainmonitor::ChainMonitor<ChannelSigner,C,T,F,L,P> as lightning::chain::Confirm>::transactions_confirmed::he3a1281c8ddc9025
                               at /Users/carla/Work/rust-lightning/lightning/src/chain/chainmonitor.rs:710:3
  26:        0x10025509c - lightning_fuzz::full_stack::MoneyLossDetector::connect_block::h79fe652e25c82300
                               at /Users/carla/Work/rust-lightning/fuzz/src/full_stack.rs:324:3
  27:        0x1001adba4 - lightning_fuzz::full_stack::do_test::h791f5e2dac030182
  28:        0x1001ac9cc - lightning_fuzz::full_stack::full_stack_test::h6f253fb8a5b1981a
                               at /Users/carla/Work/rust-lightning/fuzz/src/full_stack.rs:1064:2
  29:        0x1001b1f58 - full_stack_target::run_test_cases::{{closure}}::{{closure}}::h77a3634f60881c26
                               at /Users/carla/Work/rust-lightning/fuzz/src/bin/full_stack_target.rs:92:7
  30:        0x1001b1f58 - std::panicking::try::do_call::h0767324bb9351baf
                               at /Users/carla/.rustup/toolchains/stable-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/panicking.rs:584:40
  31:        0x1001b1f58 - std::panicking::try::hc00f1a7543bb5a76
                               at /Users/carla/.rustup/toolchains/stable-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/panicking.rs:547:19
  32:        0x1001b1f58 - std::panic::catch_unwind::h54b207cdcaf7ce71
                               at /Users/carla/.rustup/toolchains/stable-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/panic.rs:358:14
  33:        0x1001b203c - full_stack_target::run_test_cases::{{closure}}::h7f37d1fefa5852da
                               at /Users/carla/Work/rust-lightning/fuzz/src/bin/full_stack_target.rs:91:19
  34:        0x1001b203c - std::sys::backtrace::__rust_begin_short_backtrace::ha56d0fba4c5b21b1
                               at /Users/carla/.rustup/toolchains/stable-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/sys/backtrace.rs:152:18
  35:        0x1001ac1b8 - std::thread::Builder::spawn_unchecked_::{{closure}}::{{closure}}::h769f543836c78a3b
                               at /Users/carla/.rustup/toolchains/stable-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/thread/mod.rs:564:17
  36:        0x1001ac1b8 - <core::panic::unwind_safe::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once::h19c152591f831d50
                               at /Users/carla/.rustup/toolchains/stable-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/panic/unwind_safe.rs:272:9
  37:        0x1001ac1b8 - std::panicking::try::do_call::h2d0fd0a4de46823a
                               at /Users/carla/.rustup/toolchains/stable-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/panicking.rs:584:40
  38:        0x1001ac1b8 - std::panicking::try::h932a0db182366577
                               at /Users/carla/.rustup/toolchains/stable-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/panicking.rs:547:19
  39:        0x1001ac1b8 - std::panic::catch_unwind::h2e1e9873f6b5ed53
                               at /Users/carla/.rustup/toolchains/stable-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/panic.rs:358:14
  40:        0x1001ac1b8 - std::thread::Builder::spawn_unchecked_::{{closure}}::hfe921f83334e4869
                               at /Users/carla/.rustup/toolchains/stable-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/thread/mod.rs:562:30
  41:        0x1001ac1b8 - core::ops::function::FnOnce::call_once{{vtable.shim}}::h67a3cf7a55850d7f
                               at /Users/carla/.rustup/toolchains/stable-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5
  42:        0x1004f5b50 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h98145db6800904f2
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/alloc/src/boxed.rs:1993:9
  43:        0x1004f5b50 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::hcd35def5feddfd9f
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/alloc/src/boxed.rs:1993:9
  44:        0x1004f5b50 - std::sys::pal::unix::thread::Thread::new::thread_start::hdb877a8060df0ba1
                               at /rustc/4eb161250e340c8f48f66e2b929ef4a5bed7c181/library/std/src/sys/pal/unix/thread.rs:106:17
  45:        0x1847e9c0c - __pthread_cond_wait

[TheBlueMatt]

Ugh, yea, thanks. This is because the fuzzer can build two transactions that differ but have the same txid.