From 91e9592353d908adf5e9b3bcdfaff53fc65b5aa2 Mon Sep 17 00:00:00 2001 From: Siegfried Pammer Date: Sat, 12 Sep 2026 15:00:31 +0200 Subject: [PATCH] Drop pending findings when an assembly bails out early A finding is recorded before the reference context exists, because the resolver keeps discovering references until the assembly is done. An assembly that fails in the type system returns without ever reporting its resolutions, so its keys stayed pending and the next assembly stamped its own reference set onto them. Naming the wrong references is worse than naming none, in a report that is read precisely to tell a reference problem from a decompiler defect. Assisted-by: Claude:claude-opus-5:Claude Code --- TestTools/nugetfuzz.cs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/TestTools/nugetfuzz.cs b/TestTools/nugetfuzz.cs index a2e9f54cc..f647ac94e 100644 --- a/TestTools/nugetfuzz.cs +++ b/TestTools/nugetfuzz.cs @@ -557,6 +557,10 @@ async Task GetPackage(string id, NuGetVersion version) async Task DecompileAssembly(string pkg, string dllPath, List searchDirs, NuGetFramework matchTarget, string? fallbackDir) { + // An assembly that bails out before reporting its resolutions leaves findings behind that + // never received a context. Dropping them here keeps the next assembly from stamping its + // own references onto them, which would name the wrong reference set for the finding. + pendingContext.Clear(); var name = Path.GetFileName(dllPath); PEFile module; try