Skip to content

red-knot panics found by the py-fuzzer fuzzer #14737

Open
@AlexWaygood

Description

The following code snippets surfaced by the py-fuzzer script all produce red-knot panics. Some of these may be duplicates in terms of their syntax structure; I haven't tried hard to deduplicate them. I've only gone through panics found in the first 500 seeds.

To run red-knot on all failing seeds in the first 500 seeds, you can run the following command from the Ruff repository root:

uvx --from ./python/py-fuzzer fuzz --bin=red_knot 0 5 16 19 25 28 30 36 39 57 76 81 91 100 102 107 110 115 116 119 120 125 127 138 141 147 158 168 174 175 224 234 247 255 260 261 282 294 295 311 313 321 332 344 347 348 350 351 353 361 374 382 386 391 395 397 400 409 414 451 452 454 455 463 473 488 492 494 497

They are all (or at least should be) valid Python syntax.

Failing seeds

Seeds 39, 25, 19, 107, 138, 110, 115, 120, 125, 116, 147, 174, 175, 260, 294, 313, 261, 347, 282, 350, 391, 386, 374, 414, 409, 451, 455, 497

The panics in these seeds all boil down to recursive type aliases of the form

type name = name

Seed 28

class name_5[**name_4](name_5.name_5):
    pass

Seed 30

async def name_5[name_2](name_5: (name_1 and name_5)(), /):
    pass

Seed 0

type name_5 = name_2
type name_2 = name_5

Seed 76

class name_4[**name_5](name_3, name_0=name_4.name_3):
    pass

Seed 81

class name_4[**name_2](name_4.name_1):
    pass

Seed 57

class name_4[name_5]({}, name_3=name_4.name_1):
    pass

Seed 91

type name_2 = name_3
(name_3 := name_2)

Seed 100

type name_5 = name_0
(name_0 := name_5)

Seed 168

class name_0[name_5](name_0.name_5):
    pass

Seed 158

async def name_4[*name_5](name_5: name_4(), /):
    pass

Seed 224

class name_2[name_5](name_2.name_4):
    pass

Seed 247

type name_3 = name_4
(name_0 := name_3)
(name_4 := name_0)

Seed 255

class name_5[**name_3](name_5.name_3):
    pass

Seed 234

def name_2[*name_0](*, name_4: name_4):
    pass
type name_4 = name_2()

Seed 332

class name_1[**name_0](name_1()()):
    pass

Seed 361

async def name_0[*name_5](name_4: name_0()):
    pass

Seed 351

class name_3[*name_1](something, **name_3.name_2):
    pass

Seed 344

type name_3 = name_4()

def name_4[*name_0](*, name_3: name_3):
    pass

Seed 311

class name_1[**name_4](name_1, name_1=name_5):
    pass
match name_2:
    case None:
        try:
            pass
        except name_1 as name_5:
            pass
    case []:
        type name_5 = name_1

Seed 400

class name_4[*name_2](name_5 if name_4() else name_4):
    pass

Seed 382

class name_1[name_1](name_4, name_1=name_3.name_2):
    pass
(name_3 := name_1)

Seed 395

class name_5[name_1](*name_5):
    pass

Seed 397

class name_0[name_4](name_0[name_1]):
    pass

Seed 488

class name_1[name_5](name_1.name_5):
    pass

Seed 473

async def name_2[*name_4](*, name_5: name_3()):
    pass
(name_3 := name_2)

Seed 492

class name_0[name_5](name_0.name_3):
    pass

Seed 454

type name_5 = name_0
name_0 = name_5

Seed 463

def name_3[**name_2](*, name_3: name_4):
    pass
type name_4 = name_3()

Also failing (but pysource-minimize can't minimize the panics in these for some reason, so the repros are too much text to paste into this GitHub issue) are the following seeds:

  • Seed 5
  • Seed 16
  • Seed 36
  • Seed 102
  • Seed 119
  • Seed 127
  • Seed 141
  • Seed 295
  • Seed 321
  • Seed 348
  • Seed 353
  • Seed 452
  • Seed 494

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingfuzzerSurfaced via fuzzing.red-knotMulti-file analysis & type inference

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions