Repository navigation
fix: seed session-driver globals with sys/gc/fuzzer_rng - #884
Merged
Merged
Conversation
Session fuzzing (--session-fuzz) runs corpus files through lafleur.driver in a shared globals dict. Corpus files are stored core-only, so session parents and polluters were executed WITHOUT `import sys` — and their first line is the [fN] marker `print(..., file=sys.stderr)`. The driver seeded shared_globals with only __name__/__builtins__, so those scripts raised `NameError: name 'sys' is not defined` before the boilerplate-carrying child ran and defined sys in the shared namespace. A real session run (jit_run10) wasted 99.8% of its ignored-crashes on this; only ~15% child-only "solo" sessions were unaffected, defeating the warm-JIT purpose of session mode. The earlier boilerplate fixes (#867/#878) only covered the normal per-script path. Seed the driver's shared globals with sys, gc, collect, random, and a default fuzzer_rng so every session script runs regardless of order; the child's own boilerplate still overwrites fuzzer_rng with its seeded RNG. Closes #883 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Found by inspecting a real
--session-fuzzrun (jit_run10) that ran the latest code (commit 37e1c29) yet showed 2,591NameError: name 'sys' is not defined(99.8% of ignored-crashes).Root cause: session fuzzing runs corpus files through
lafleur.driverin a shared globals dict. Corpus files are stored core-only (noimport sys), so session parents/polluters — which run before the boilerplate-carrying child in[parent, child]/[polluters..., parent, child]sessions — raiseNameErroron their first line (the[fN]markerprint(..., file=sys.stderr)). The driver seededshared_globalswith only__name__/__builtins__. Only ~15% child-only "solo" sessions were unaffected.The earlier boilerplate fixes (#867/#878) only covered the normal per-script path; the driver is a separate execution path.
Fix: seed
shared_globalswith the runtime deps the stripped boilerplate supplies —sys,gc,collect,random, and a defaultfuzzer_rng. The child's own boilerplate still overwritesfuzzer_rngwith its seeded RNG when it runs.Verification
Direct repro on jit_run10's corpus, before vs after:
8/8 sampled corpus files: NameError:sys count 8 → 0.
Test plan
test_run_session_seeds_boilerplate_globals— a core-only script usingsys/gc/collect/fuzzer_rngruns tostatus: successwith no NameError.mypy lafleurclean;ruffclean.Closes #883
🤖 Generated with Claude Code