samples: expand SuperBomb protocol coverage + recursion-shape probes - #227
Merged
Conversation
Two low-effort additions to the hostile-object corpus that widen the surface alternative interpreters (RustPython, PyPy) crash on -- the dominant RustPython bug class is a native .unwrap()/panic! on a Python-level callback. SuperBomb (_SUPERBOMB_DUNDERS, 65 -> 87 slots): add the reflected binary ops (__rmod__/__rdivmod__/__rpow__/__rtruediv__/__rfloordiv__/__rmatmul__/__rand__/ __ror__/__rxor__/__rlshift__/__rrshift__), the in-place ops (__imul__/__isub__/ __imod__/__ipow__/__itruediv__/__ifloordiv__/__imatmul__/__iand__/__ior__/__ixor__/ __ilshift__/__irshift__), and the PEP 688 buffer protocol (__buffer__/ __release_buffer__ -- a raising __buffer__ detonates native buffer acquisition, an error path C/Rust code often skips). Each still raises the "fusil superbomb via <name>" message already covered by the ignore-regex. tricky_objects: add recursion-shape probes for the unguarded-native-recursion crash class (RustPython #2796): a pair of _TrickyRecur objects whose hash/eq/getitem/iter/ repr/call each re-enter the SAME protocol on a PARTNER object (mutual cross-object recursion, harder to short-circuit than self-recursion), and a deep list[list[...T...]] generic-alias bottomed on a TypeVar so the parameter walk actually recurses (RustPython segfaulted in genericalias::make_parameters_from_slice). CPython raises RecursionError; construction is cheap (recursion fires only when a protocol is exercised). These are corpus building blocks -- simple recursion is guarded by RustPython standalone; the segfaults need fusil's combined object graphs. Also fixes a pre-existing ~8% flake in test_failing_iterator_raises_during_iteration: FailingIterator draws from the bomb pool, which includes StopIteration, and `raise StopIteration` in a plain iterator's __next__ ends list() cleanly (no exception escapes) -- pin exc=ValueError so the test verifies its intent deterministically. (The seeded RNG made the new dunder draws surface this reliably.) Golden regenerated (samples are spliced verbatim). ruff + full suite green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two low-effort additions to the hostile-object corpus that widen the surface alternative interpreters (RustPython, PyPy) crash on — the dominant RustPython bug class is a native
.unwrap()/panic!on a Python-level callback. Independent of #226 (touches onlysamples/+ the golden).SuperBomb (
_SUPERBOMB_DUNDERS, 65 → 87 slots)__rmod__/__rdivmod__/__rpow__/__rtruediv__/__rfloordiv__/__rmatmul__/__rand__/__ror__/__rxor__/__rlshift__/__rrshift____imul__/__isub__/__imod__/__ipow__/__itruediv__/__ifloordiv__/__imatmul__/__iand__/__ior__/__ixor__/__ilshift__/__irshift____buffer__/__release_buffer__— a raising__buffer__detonates native buffer acquisition (memoryview(...), struct/array), an error path C/Rust code often skips.Each still raises the
fusil superbomb via <name>message already covered by the stdout ignore-regex, so no new suppression is needed.Recursion-shape probes (
tricky_objects)For the unguarded-native-recursion crash class (RustPython #2796):
_TrickyRecurobjects whosehash/eq/getitem/iter/repr/calleach re-enter the same protocol on a partner object (mutual cross-object recursion, harder to short-circuit than self-recursion);list[list[...T...]]generic-alias bottomed on aTypeVarso the parameter walk actually recurses (RustPython segfaulted ingenericalias::make_parameters_from_slice).CPython raises
RecursionError; construction is cheap (recursion fires only when a protocol is exercised). These are corpus building blocks — simple recursion is guarded by RustPython standalone; the segfaults need fusil's combined object graphs.Flaky-test fix
test_failing_iterator_raises_during_iterationwas ~8% flaky on any tree:FailingIteratordraws from the bomb pool (which includesStopIteration), andraise StopIterationin a plain iterator's__next__endslist()cleanly — no exception escapes, soassertRaisesfails. The seeded RNG made the new dunder draws surface it reliably. Fixed by pinningexc=ValueErrorso the test verifies its intent deterministically.Testing
Golden regenerated (samples are spliced verbatim into every script).
ruff check+ruff format --checkclean; full suite (1145 tests) green and stable across repeated runs.🤖 Generated with Claude Code