[pull] master from google:master

projects/s2geometry/build.sh

@@ -18,7 +18,13 @@
 cp $SRC/s2_fuzzer.cc $SRC/s2geometry/src/
 
 cd $SRC/
-git clone --depth=1 --branch 20260107.1 https://github.com/abseil/abseil-cpp
+# Keep this tag in sync with the abseil version s2geometry itself pins in its
+# CMakeLists.txt FETCH_ABSEIL block, which is what upstream CI builds against.
+# s2geometry now includes "absl/base/throw_delegate.h" (via
+# src/s2/util/gtl/compact_array.h), a header that only exists from abseil
+# 20260526.0 onwards -- with the older 20260107.1 pin every s2 translation unit
+# failed with "'absl/base/throw_delegate.h' file not found".
+git clone --depth=1 --branch 20260526.0 https://github.com/abseil/abseil-cpp
 cd abseil-cpp
 mkdir build && cd build
 cmake -DCMAKE_POSITION_INDEPENDENT_CODE=ON ../  && make && make install

projects/tinyusb/build.sh

@@ -26,12 +26,49 @@ for f in test/fuzz/device/*/Makefile; do
   sed -i '/^[[:space:]]\+src[[:space:]]/s|src|$(abspath src)|' "$f"
 done
 
+# test/fuzz/make.mk bakes a fixed instrumentation choice into CFLAGS:
+#   COVERAGE_FLAGS  ?= -fsanitize-coverage=trace-pc-guard
+#   SANITIZER_FLAGS ?= -fsanitize=fuzzer -fsanitize=address
+# Those are the right defaults for a developer running the harnesses by hand,
+# but under OSS-Fuzz the engine and the sanitizer are chosen for us and are
+# already present in $CFLAGS/$LIB_FUZZING_ENGINE. Both are "?=", so clearing
+# them in the environment hands that choice back to OSS-Fuzz and stops, for
+# example, an msan build from also being asked for -fsanitize=address.
+export COVERAGE_FLAGS=""
+export SANITIZER_FLAGS=""
+
 fuzz_harness=$(ls -d test/fuzz/device/*/)
 for h in $fuzz_harness
 do
+  name=$(basename $h)
   make -C $h get-deps
-  make -C $h all
-  cp $h/_build/$(basename $h) $OUT/
+
+  if [ "$name" = "net_ncm" ]; then
+    # net_ncm is the one harness that does not include the shared
+    # make.mk/rules.mk. It is a standalone single-file harness whose Makefile
+    # sets its own flags outright:
+    #   CFLAGS += $(addprefix -I,$(INC)) -g -O1 -fsanitize=address
+    #   FUZZ_FLAGS := -fsanitize=fuzzer
+    # so it never consults $LIB_FUZZING_ENGINE and linked libFuzzer's main() no
+    # matter which engine was requested. Under centipede the resulting binary
+    # cannot dump a PC table, so check_build reported net_ncm as a broken target
+    # ("Could not get PCTable") and failed the whole project; the hardcoded
+    # -fsanitize=address would likewise collide with an msan build.
+    #
+    # Override both on the command line, which takes precedence over the "+="
+    # and ":=" in the Makefile, and re-supply the two include paths that the
+    # overridden CFLAGS line would otherwise have contributed ($(TOP)/src and
+    # the harness directory, which holds tusb_config.h). -lc++ is needed because
+    # this harness links with $CC rather than $CXX while the engine archive is
+    # C++.
+    make -C $h all \
+      CFLAGS="$CFLAGS -I$SRC/tinyusb/src -I." \
+      FUZZ_FLAGS="$LIB_FUZZING_ENGINE -lc++"
+  else
+    make -C $h all
+  fi
+
+  cp $h/_build/$name $OUT/
   corpus=$h/$(basename $h)_seed_corpus.zip
   if test -f $corpus; then
     cp $corpus $OUT/