stop scoring the fuzzer's own noise as target crashes - #259
Merged
Conversation
Two independent false-positive sources, both measured on a PyPy 3.11 stdlib fleet (fusil-pypy311_fleet_02, 255 kept dirs): 1. Three bomb signatures were never added to the stdout ignore regex. The regex has been extended once per bomb family, but `instancecheck` (the metaclass bomb) and the monitoring-callback bomb's `junk return` / `monitoring callback bomb` were added later without it. `instancecheck` is raised as SystemError -- a 1.0 word -- so the gap does not merely add noise, it manufactures crashes: 7 sessions kept in that one fleet. 2. signal.default_int_handler / _signal.default_int_handler raise KeyboardInterrupt, a BaseException, which blows straight through the generated script's `except Exception` handlers and kills the session (the #192 class). Called directly as a fuzz target it tagged 16 dirs `-sigint`; the rustpython fleets show the same, and the function exists on every interpreter. Its neighbours (pause/alarm/setitimer/pthread_kill) were already blacklisted for the same reason. Together these accounted for 23 of 255 kept dirs (9%) in that fleet, every one a session the fuzzer killed itself. test_ignore_regex_covers_every_raised_bomb_signature scrapes the raise sites and fails on any signature the regex misses, so the next bomb family cannot repeat this. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WhcpLoyjUWLbETGZnA9boj
This was referenced Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two independent false-positive sources, both measured on a PyPy 3.11 stdlib fleet
(
fusil-pypy311_fleet_02, 255 kept dirs). Together they account for 23 of 255 (9%) —every one a session the fuzzer killed itself.
1. Three bomb signatures missing from the stdout ignore regex
The regex has been extended once per bomb family, but three raise sites were added later
without it:
fusil instancecheckbomb_objects.py:685(metaclass bomb)fusil monitoring callback bombwrite_python_code.py:1807fusil junk returnwrite_python_code.py:1811instancecheckis raised as SystemError — a 1.0 word, so this isn't a cosmetic gap: itmanufactures crashes. 7 sessions kept in that one fleet.
test_ignore_regex_covers_every_raised_bomb_signaturescrapes the raise sites and fails onany signature the regex misses, so the next bomb family can't repeat this. Verified: with the
three alternatives removed it reports exactly those three.
2.
default_int_handlerkills the sessionsignal.default_int_handler/_signal.default_int_handlerraiseKeyboardInterrupt— aBaseException, so it blows straight through the generated script'sexcept Exceptionhandlers and takes the session with it. That's the #192 class.
Called directly as a fuzz target it tagged 16 dirs
-sigintin this fleet, and therustpython fleets show the same pattern. It exists on every interpreter, so this is not
PyPy-specific. Its neighbours (
pause/alarm/setitimer/pthread_kill) were alreadyblacklisted for exactly this reason — this one was just missed.
Full suite green (1254); ruff clean.
🤖 Generated with Claude Code