Afl++ fuzz-stream crash report

[rhodes-b]

Issue Description

Reporting afl++ crash (I let it run for 24 hours)

Expected Behavior

no crashes

Actual Behavior

NA

Reproduction Steps

current2.txt

this was what I got down to for a minimal reproduction cat current2.txt | fuzz-stream

I discovered it has something to do with the spacer head which is clearing the previous cell, it might also be related to the page resize though I didn't get far enough and in gdb alot of stuff seemed optimized out to poke if something wasn't getting copied over correctly
https://github.com/ghostty-org/ghostty/blob/main/src/terminal/Terminal.zig#L484

in which the codepoint ends up being zero because its a background cell
https://github.com/ghostty-org/ghostty/blob/main/src/terminal/page.zig#L1487

I'd love to attempt a fix, but I think it would take me too long to get there / probably not be the correct fix

Ghostty Logs

debug(terminal): prev after move right: .{ .cell = .{ .content_tag = .codepoint, .content = .{ .codepoint = 1536, .color_palette = 0, .color_rgb = .{ ... } }, .style_id = 0, .wide = .wide, .protected = false, .hyperlink = true, .semantic_content = .output, ._padding = 0 }, .left = 1 }
info(page_list): adjusting page capacity=.{ .cols = 80, .rows = 576, .styles = 128, .hyperlink_bytes = 384, .grapheme_bytes = 8192, .string_bytes = 2048 }
debug(terminal): prev after spacer trail: .{ .cell = .{ .content_tag = .bg_color_palette, .content = .{ .codepoint = 699050, .color_palette = 170, .color_rgb = .{ ... } }, .style_id = 43690, .wide = .spacer_tail, .protected = false, .hyperlink = true, .semantic_content = .prompt, ._padding = 43690 }, .left = 1 }
debug(terminal): c=FFFD grapheme attach to left=1 primary_cp=0
thread 18168 panic: reached unreachable code
/nix/store/l517kk45fip5v57rmc24rz6s6as2mp8x-zig-0.15.2/lib/std/debug.zig:559:14: 0x560e362477fc in assert (stream)
    if (!ok) unreachable; // assertion failure
             ^
/home/user/workspace/ghostty/src/terminal/page.zig:1487:54: 0x560e362c811e in appendGrapheme (stream)
        if (build_options.slow_runtime_safety) assert(cell.codepoint() != 0);
                                                     ^
/home/user/workspace/ghostty/src/terminal/Screen.zig:2139:50: 0x560e362755c7 in appendGrapheme (stream)
    self.cursor.page_pin.node.data.appendGrapheme(
                                                 ^
/home/user/workspace/ghostty/src/terminal/Terminal.zig:535:51: 0x560e36272edc in print (stream)
            try self.screens.active.appendGrapheme(prev.cell, c);
                                                  ^
/home/user/workspace/ghostty/src/terminal/stream_readonly.zig:50:46: 0x560e36278e9d in vt__anon_11874 (stream)
            .print => try self.terminal.print(value.cp),
                                             ^
/home/user/workspace/ghostty/src/terminal/stream.zig:744:32: 0x560e36296b9d in zig_fuzz_test (stream)
            try self.handler.vt(.print, .{ .cp = c });
                               ^
../../pkg/afl++/afl.c:136:7: 0x560e3624427b in main (/home/user/workspace/ghostty/test/fuzz-libghostty/../../pkg/afl++/afl.c)
      zig_fuzz_test(buf, len);

Ghostty Version

main branch

OS Version Information

Nixos 25.11

(Linux only) Display Server

Wayland

(Linux only) Desktop Environment/Window Manager

No response

Minimal Ghostty Configuration

NA

Additional Relevant Configuration

No response

I acknowledge that:

• I have reviewed the FAQ and confirm that my issue is NOT among them.
• I have searched the Ghostty repository (both open and closed Discussions and Issues) and confirm this is not a duplicate of an existing issue or discussion.
• I have checked the "Preview" tab on all text fields to ensure that everything looks right, and have wrapped all configuration and code in code blocks with a group of three backticks (```) on separate lines.

[rhodes-b]

attaching other crashes (I didnt look into these at all)

current2-min.txt <--- this is not the same as above just same current2 prefix

current3-min.txt <-- this just segfaults no backtrace

current-4.txt <-- sefaults no backtrace maybe same cause as above

[mitchellh]

Confirmed current3-min.txt is the same as current2.txt

[mitchellh]

Excellent thank you for these. I have a minimization of the first one and a fix queued up for tomorrow.

[mitchellh]

#11261 for the first one. Wasn't happy with the fix so just pushed all the info I have on it.

[mitchellh]

current2-min.txt fixed here: #11264

[mitchellh]

I think we've got all this tracked now, the other 3 were all #11261. Thank you!