type-chrono: Add CustomBuildField/CustomReadField overloads for std::chrono::time_point by ryanofsky · Pull Request #303 · bitcoin-core/libmultiprocess

ryanofsky · 2026-07-08T18:08:19Z

Needed for bitcoin/bitcoin#10102 since bitcoin/bitcoin#34882 was merged, which uses NodeClock::time_point in the CNodeStats struct (m_last_send, m_last_recv, m_ping_start) returned by Node::getNodesStats.

DrahtBot · 2026-07-08T18:08:29Z

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Reviews

See the guideline and AI policy for information on the review process.

Type	Reviewers
ACK	maflcko, ViniciusCestarii

If your review is incorrectly listed, please copy-paste  into the comment that the bot should ignore.

maflcko · 2026-07-08T20:09:17Z

lgtm ACK b37d1d7

Sjors · 2026-07-09T11:55:31Z

Needed by bitcoin/bitcoin#34882

That's merged, by I assume you still need this?

maflcko · 2026-07-09T12:01:12Z

Needed by bitcoin/bitcoin#34882

That's merged, by I assume you still need this?

There was no rebase of bitcoin/bitcoin#10102 in 4 months, so I don't think bitcoin/bitcoin#10102 sees the changes from 34882 yet.

ryanofsky · 2026-07-09T12:42:50Z

Sorry PR description was written in a confusing way, should hopefully be clearer now. In order for bitcoin/bitcoin#10102 to work after bitcoin/bitcoin#34882 it needs these ReadField / BuildField overloads. It could define them itself, but it makes sense for libmultiprocess to provide them since it already provides many similar ones including ones for std::chrono::duration

ViniciusCestarii · 2026-07-09T13:17:51Z

+                      Value&& value, Output&& output)
+{
+    using Rep = typename Duration::rep;
+    static_assert(std::numeric_limits<decltype(output.get())>::lowest() <= std::numeric_limits<Rep>::lowest(),


The range checks in both CustomBuildField overloads have a signedness bug:

static_assert(std::numeric_limits<decltype(output.get())>::lowest() <= std::numeric_limits<Rep>::lowest(), ...);

When the capnp field type is unsigned (e.g. UInt64) and Rep is signed (e.g. int64_t for std::chrono::nanoseconds), the usual arithmetic conversions convert Rep::lowest() (INT64_MIN) to the unsigned type before comparing, turning it into a huge positive number. So 0 <= INT64_MIN silently evaluates to true, and the assert passes for a field that can't actually represent negative tick counts (e.g. any pre-epoch system_clock::time_point).

Concretely, this means a UInt64 field paired with a signed Duration::rep compiles today, and output.set(negative_count) wraps the value into UINT64_MAX. That's silently wrong for anything that reads the field as its declared (unsigned) type — a different language's capnp bindings, a JSON dump, or a raw comparison would see 18446744073709551615 instead of -1. A C++ round trip through the same chrono type can look fine, since the wrap is bit-for-bit invertible at equal width, which is what makes this easy to miss in testing.

Fix: use std::cmp_less_equal/std::cmp_greater_equal (C++20, ) instead of <=/>=, since they're designed to compare integers of differing signedness correctly:

static_assert(std::cmp_less_equal(std::numeric_limits<decltype(output.get())>::lowest(), std::numeric_limits<Rep>::lowest()), "capnp type does not have enough range to hold lowest std::chrono::time_point value"); static_assert(std::cmp_greater_equal(std::numeric_limits<decltype(output.get())>::max(), std::numeric_limits<Rep>::max()), "capnp type does not have enough range to hold highest std::chrono::time_point value");

I verified this by temporarily declaring a test field as UInt64 against a signed Rep: it compiled before the fix and correctly fails to compile after.

Happy to push chrono type tests as a follow-up PR if useful.

Note: I had AI help me write this up clearly, apologies if the phrasing feels more polished or sloppy than my usual comments.

re: #303 (comment)

Good catch! I think this makes sense and it looks like this same problem also exists other places: for durations above and also in type-number.h. I'll see if it's possible to fix them all here without breaking anything.

re: #303 (comment)

Added a new commit to fix this problem. Using std::cmp functions directly didn't work for time_point comparisons because floating point time point types are used in some places so I had to add wrappers to handle floats.

Use std::cmp_less_equal/std::cmp_greater_equal (C++20) in the range static_asserts to avoid signed/unsigned comparison pitfall: when one side is unsigned and the other signed, the usual arithmetic conversions silently convert the signed lowest() to a huge positive number, making the assert pass when it should fire. Also fix the identical pattern in type-number.h BuildPrimitive. Problem was reported by ViniciusCestarii in bitcoin-core#303 (comment) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ryanofsky

Thanks for the reviews!

Updated b37d1d7 -> 978028f (pr/timepoint.1 -> pr/timepoint.2, compare) switching to std::cmp functions for more reliable static asserts

ryanofsky · 2026-07-30T00:45:02Z

+                      Value&& value, Output&& output)
+{
+    using Rep = typename Duration::rep;
+    static_assert(std::numeric_limits<decltype(output.get())>::lowest() <= std::numeric_limits<Rep>::lowest(),


re: #303 (comment)

Added a new commit to fix this problem. Using std::cmp functions directly didn't work for time_point comparisons because floating point time point types are used in some places so I had to add wrappers to handle floats.

maflcko · 2026-07-30T05:42:08Z

Looks like iwyu fails?

Use std::cmp_less_equal/std::cmp_greater_equal (C++20) in the range static_asserts to avoid signed/unsigned comparison pitfall: when one side is unsigned and the other signed, the usual arithmetic conversions silently convert the signed lowest() to a huge positive number, making the assert pass when it should fire. Also fix the identical pattern in type-number.h BuildPrimitive. Problem was reported by ViniciusCestarii in bitcoin-core#303 (comment) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ryanofsky

Updated 978028f -> 1e33111 (pr/timepoint.2 -> pr/timepoint.3, compare) to fix IWYU error https://github.com/bitcoin-core/libmultiprocess/actions/runs/30503532739/job/90748227074

Rebased 1e33111 -> 7a72df0 (pr/timepoint.3 -> pr/timepoint.4, compare) adding new commit and rebasing to fix incompatibility with bool and std::cmp_less_equal/std::cmp_greater_equal in libc++ https://github.com/bitcoin-core/libmultiprocess/actions/runs/30551079943/job/90899596238?pr=303

Exclude bool from the integral BuildPrimitive overload (bool is integral per std::is_integral_v but not a standard integer per std::cmp_*); add a dedicated bool overload that static_asserts the capnp LocalType is also bool, so a schema mismatch (e.g. Float64 used for a bool parameter) produces a clear error pointing at the schema. This change is also needed so the next commit can tighten the integer range changes in the BuildPrimitive integer overload. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Use std::cmp_less_equal/std::cmp_greater_equal (C++20) in the range static_asserts to avoid signed/unsigned comparison pitfall: when one side is unsigned and the other signed, the usual arithmetic conversions silently convert the signed lowest() to a huge positive number, making the assert pass when it should fire. Also fix the identical pattern in type-number.h BuildPrimitive. Problem was reported by ViniciusCestarii in bitcoin-core#303 (comment) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…chrono::time_point Needed by bitcoin/bitcoin#34882 which uses NodeClock::time_point in the Node stats struct (m_last_send, m_last_recv, m_ping_start), requiring IPC serialization support for time_point types. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

uqlidi

looks good but there's a small suggestion

uqlidi · 2026-07-31T06:48:47Z

+    if constexpr (std::is_floating_point_v<A> || std::is_floating_point_v<B>) return a >= b;
+    else return std::cmp_greater_equal(a, b);


Suggested change

if constexpr (std::is_floating_point_v<A> || std::is_floating_point_v<B>) return a >= b;

else return std::cmp_greater_equal(a, b);

else return safe_less_equal(b, a);

re: #303 (comment)

This does seem like a good idea, but it's a minor cleanup so not planning to make the change here. Could be worth doing if this code changes again.

maflcko · 2026-07-31T08:41:06Z

lgtm ACK 7a72df0

ViniciusCestarii

ACK 7a72df0

d0eea62c58 ci: add Windows cross-compilation config using MinGW and Wine ae6cf017d4 test: Add TCP SocketListener and Windows compat to socketlistener.h 1938c199d7 util: make pthreads optional on Windows to enable MSVC builds 97011d4008 util: Fix Windows SpawnProcess hang when child exits before connecting to named pipe 7861351f24 util: Add Windows support ee09c2b269 util: Add Windows CommandLineFromArgv escaping function 860e2ffb5c util, test: guard Unix-only code for Windows build c79b49afe1 util, test: Replace UnixListener with SocketListener 15aa914f03 util, test: Add CloseSocket, use SocketId be5f87655a util: Improve SpawnProcess API and documentation 390b5f901f Merge bitcoin-core/libmultiprocess#344: test: listen_tests and connect_tests follow-ups e18ca520f4 Merge bitcoin-core/libmultiprocess#343: test: fix race in connect_tests disconnect-deferred-failure test c39c7850c6 doc: note construct() call in valid init interface test b9c36c6175 test: close sockets unconditionally and check errors with KJ_SYSCALL 7eb741e635 test: drop unnecessary KJ_EXPECT(true) 113f1d4d28 test: join server thread unconditionally in connect tests 44bc4630bc test: drop mp:: prefixes in connect tests 038d33eb31 test: share DefaultLogHandler between test files b54a163308 test: drop TestSetup socket members in connect tests 70467c5a72 test: add m_ prefix to TestSetup members in connect tests cc260f2526 test: replace capnp fix link with upstream PR 137a6e4e03 test: fix race in connect_tests disconnect-deferred-failure test 8dab0d4bde Merge bitcoin-core/libmultiprocess#341: ci: add -Wextra-semi to llvm config b3b134eed8 ci: add -Wextra-semi to llvm config bdd0cd6941 Merge bitcoin-core/libmultiprocess#339: refactor: add `[[noreturn]]` attributes a779a09764 ci: add -Wmissing-noreturn 636aaff576 refactor: add missing [[noreturn]] attributes cc11c2b1b4 Merge bitcoin-core/libmultiprocess#338: test: check ReadList return value 2d6e863c77 Merge bitcoin-core/libmultiprocess#334: ci: Set CMAKE_BUILD_PARALLEL_LEVEL to enable parallelism by default d4d10ff98a Merge bitcoin-core/libmultiprocess#332: ci: add -Wextra-semi to default config b540e70f25 Merge bitcoin-core/libmultiprocess#324: proxy: Name threads spawned by the event loop e5e367e785 Merge bitcoin-core/libmultiprocess#312: util: report back child errors to parent and throw 2220df68c9 Merge bitcoin-core/libmultiprocess#298: Fix error handling when creating clients (`mp::ConnectStream`) 51defb79ef Merge bitcoin-core/libmultiprocess#340: ci: Update `capnproto` prerequisites on NetBSD 7e94790b08 ci: Update `capnproto` prerequisites on NetBSD 9f25ffca5b test: Cover OS thread names for worker, pool, and async threads 648a18589c proxy: Name threads spawned by the event loop 49834b2609 ci: add -Wextra-semi to default config fae9a637e3 example: Remove unused kj/async.h include bb473690c9 Fix error handling when creating clients 44d191420c Add test coverage for ConnectStream 231361ae5a Correct stale UnixListener doc comment 060c1a50d0 Extract `UnixListener` class to a dedicated file 62f25af06c test: check ReadList return value ce51d73725 ci: Set CMAKE_BUILD_PARALLEL_LEVEL to enable parallism in build jobs by default 67302cd132 Merge bitcoin-core/libmultiprocess#331: Remove code for Cap'n Proto versions before 0.9 f13c64ab54 Merge bitcoin-core/libmultiprocess#330: ci: Compile with minimum supported g++ in olddeps 8e026f6625 Merge bitcoin-core/libmultiprocess#327: build: avoid unnecessary capnp-rpc dependency for mpgen e5206e9eb5 Merge bitcoin-core/libmultiprocess#325: cmake: Remove `QUIET` option from `find_package(CapnProto ...)` 879efea2bc Merge bitcoin-core/libmultiprocess#321: ci: Roll NetBSD releases to 11.0, drop 9.4 abf127a314 Merge bitcoin-core/libmultiprocess#317: ipc: Fix mpgen capnp tool path for vcpkg/Windows builds c437d7f107 Merge bitcoin-core/libmultiprocess#310: test: cover immediate client disconnects for `ListenConnections` 31bff8a673 Merge bitcoin-core/libmultiprocess#307: refactor: memcpy -> std::ranges::copy f355108b0a Merge bitcoin-core/libmultiprocess#303: type-chrono: Add CustomBuildField/CustomReadField overloads for std::chrono::time_point 2d678177c1 Merge bitcoin-core/libmultiprocess#296: ci: Bump channel to nixos-26.05 3f05b11624 util: kill and reap child on SpawnProcess error 4a56c1837a util: report back child error to parent and throw a9e70dbe77 ci: Add NetBSD release 11.0 2d33b14fb0 ci: Switch to default compiler on NetBSD 9.4 36f7400277 ci: Drop NetBSD release 9.4 bd508311b5 refactor: Drop stray semicolons after function definitions 788f17a850 Remove code for Cap'n Proto versions before 0.9 7402affd0c ci: Pin oldeps config to older nixpkgs channel to compile older cmake with older gcc edf6343562 ci: Compile with minimum supported g++-11 in olddeps fa47449afe cmake: avoid unnecessary capnp-rpc dependency for mpgen a494b764de cmake: Remove `QUIET` option from `find_package(CapnProto ...)` 26452e02d7 refactor: memcpy -> std::ranges::copy e1dcc6eb18 Merge bitcoin-core/libmultiprocess#316: cmake: Fix stale codegen when mpgen binary changes 7a72df02e2 type-chrono: Add CustomBuildField/CustomReadField overloads for std::chrono::time_point 45b685c3f5 type-number, type-chrono: Fix static assert signed/unsigned comparisons 45f6255975 type-number: exclude bool from the integral overload 8d6d464948 Merge bitcoin-core/libmultiprocess#315: Fix startup race in example a6fc80d254 Merge bitcoin-core/libmultiprocess#311: bugfix: clear FD_CLOEXEC in child instead of parent before fork 496fb84e69 test: cover immediate client disconnects for `ListenConnections` 36c6c63520 doc: Document reference-counted EventLoop lifetime 3a997e113c Fix startup race in mpexample f5c15ce33f Merge bitcoin-core/libmultiprocess#323: refactor: access ThreadContext through CurrentThread(), ci: switch Bitcoin Core to master 66298c737f ci: Switch back to Bitcoin Core's master branch 86b4810501 refactor: access ThreadContext through CurrentThread() eea9c64f6e cmake: Fix stale codegen when mpgen binary changes a26a08496b cmake: Fix mpgen capnp tool path for vcpkg/Windows builds 140d9ba6ff test: allow custom log handler in `ListenSetup` 1e0c7ff9a5 util: Clear FD_CLOEXEC in child instead of parent before fork 8550ee6a31 util, refactor: Add ChildFail helper for post-fork child errors 17eab90b52 test: Fix typo in listen_tests.cpp ce865a9ba8 refactor: Directly use value in CustomBuildField 3f221b5bfd Merge bitcoin-core/libmultiprocess#274: Add nonunix platform support 1b0f605606 doc: Remove trailing whitespace d8f8ca3119 ipc: Wrap mpgen main() in try-catch to print errors fbe5a14ad4 ci: Check out bitcoin/bitcoin PR #35084 instead of master 39d3690d83 types: Replace SFINAE with requires clauses to avoid MSVC C2039 error ba68520203 proxy, refactor: Fix C4305 truncation warning in Accessor on MSVC 1d81d47811 util, refactor: Fix PtrOrValue constructor for move-only types on MSVC b883fe1e52 proxy: Fix shutdownWrite() exception handling on macOS with dynamic libraries 0012411ccc proxy: Call shutdownWrite() in Connection destructor 38312ad191 proxy, refactor: Change ConnectStream and ServeStream to accept stream objects e96d5d742a proxy, refactor: Replace EventLoop wakeup fd integers with KJ stream objects db4f9a3d73 cmake: Bump minimum required Cap'n Proto version to 0.9 652934fb79 util, refactor: Add SocketPair() and use it in SpawnProcess 1c6ef7a26c util, refactor: Do not fork() and exec() separately 1389cf3132 util, refactor: Add SpawnConnectInfo type alias and use it c7ca1f00b6 util, refactor: Add SocketId type alias and use it be46a35203 util, refactor: Add ProcessId type alias and use it 91a78db780 doc: Bump version 13 > 14 fa2c56ec27 ci: Bump channel to nixos-26.05 git-subtree-dir: src/ipc/libmultiprocess git-subtree-split: d0eea62c58928f9660b8dc5541a62ea395c565ef

Use std::cmp_less_equal/std::cmp_greater_equal (C++20) in the range static_asserts to avoid signed/unsigned comparison pitfall: when one side is unsigned and the other signed, the usual arithmetic conversions silently convert the signed lowest() to a huge positive number, making the assert pass when it should fire. Also fix the identical pattern in type-number.h BuildPrimitive. Problem was reported by ViniciusCestarii in bitcoin-core/libmultiprocess#303 (comment) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ViniciusCestarii reviewed Jul 9, 2026

View reviewed changes

ryanofsky force-pushed the pr/timepoint branch from b37d1d7 to 978028f Compare July 30, 2026 00:43

ryanofsky commented Jul 30, 2026

View reviewed changes

ryanofsky force-pushed the pr/timepoint branch from 978028f to 1e33111 Compare July 30, 2026 14:18

ryanofsky commented Jul 30, 2026

View reviewed changes

ryanofsky and others added 3 commits July 30, 2026 11:19

ryanofsky force-pushed the pr/timepoint branch from 1e33111 to 7a72df0 Compare July 30, 2026 17:56

uqlidi suggested changes Jul 31, 2026

View reviewed changes

ViniciusCestarii reviewed Aug 1, 2026

View reviewed changes

ryanofsky merged commit f355108 into bitcoin-core:master Aug 3, 2026
13 checks passed

		if constexpr (std::is_floating_point_v<A> \|\| std::is_floating_point_v<B>) return a >= b;
		else return std::cmp_greater_equal(a, b);

	if constexpr (std::is_floating_point_v<A> \|\| std::is_floating_point_v<B>) return a >= b;
	else return std::cmp_greater_equal(a, b);
	else return safe_less_equal(b, a);

Uh oh!

Conversation

ryanofsky commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DrahtBot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews

Uh oh!

maflcko commented Jul 8, 2026

Uh oh!

Sjors commented Jul 9, 2026

Uh oh!

maflcko commented Jul 9, 2026

Uh oh!

ryanofsky commented Jul 9, 2026

Uh oh!

ViniciusCestarii Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

ryanofsky Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

ryanofsky Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

ryanofsky left a comment

Choose a reason for hiding this comment

Uh oh!

ryanofsky Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

maflcko commented Jul 30, 2026

Uh oh!

ryanofsky left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

uqlidi left a comment

Choose a reason for hiding this comment

Uh oh!

uqlidi Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

ryanofsky Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

maflcko commented Jul 31, 2026

Uh oh!

ViniciusCestarii left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

ryanofsky commented Jul 8, 2026 •

edited

Loading

DrahtBot commented Jul 8, 2026 •

edited

Loading

ryanofsky left a comment •

edited

Loading