Skip to content

fix(fuzz): Do not take a mutable reference over immutable vars which contain a mutable ref #8971

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aakoshh merged 2 commits into from
Jun 19, 2025
Merged

fix(fuzz): Do not take a mutable reference over immutable vars which contain a mutable ref #8971

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e6ddc54
Fix taking mutable reference over immutable tuple when it has a mutab…
aakoshh Jun 19, 2025
2442f57
Merge branch 'master' into af/fuzz-fix-mut-ref-over-immutable
aakoshh Jun 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 22 additions & 7 deletions tooling/ast_fuzzer/src/program/func.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -502,16 +502,21 @@
max_depth: usize,
) -> arbitrary::Result<Option<TrackedExpression>> {
if let Some(id) = self.choose_producer(u, typ)? {
let (mutable, src_name, src_type) = self.get_variable(&id).clone();
let (src_mutable, src_name, src_type) = self.get_variable(&id).clone();
let ident_id = self.next_ident_id();
let src_expr = expr::ident(id, ident_id, mutable, src_name, src_type.clone());
let src_expr = expr::ident(id, ident_id, src_mutable, src_name, src_type.clone());
let src_dyn = match id {
VariableId::Global(_) => false,
VariableId::Local(id) => self.is_dynamic(&id),
};
if let Some(expr) =
self.gen_expr_from_source(u, (src_expr, src_dyn), &src_type, typ, max_depth)?
{
if let Some(expr) = self.gen_expr_from_source(
u,
(src_expr, src_dyn),
&src_type,
src_mutable,
typ,
max_depth,
)? {
return Ok(Some(expr));
}
} else {
Expand Down Expand Up @@ -558,6 +563,7 @@
u: &mut Unstructured,
(src_expr, src_dyn): TrackedExpression,
src_type: &Type,
src_mutable: bool,
tgt_type: &Type,
max_depth: usize,
) -> arbitrary::Result<Option<TrackedExpression>> {
Expand Down Expand Up @@ -589,7 +595,7 @@
let expr = expr::deref(src_expr, tgt_type.clone());
Ok(Some((expr, src_dyn)))
}
(_, Type::Reference(typ, true)) if typ.as_ref() == src_type => {
(_, Type::Reference(typ, true)) if typ.as_ref() == src_type && src_mutable => {
let expr = expr::ref_mut(src_expr, typ.as_ref().clone());
Ok(Some((expr, src_dyn)))
}
Expand Down Expand Up @@ -626,6 +632,7 @@
u,
(item_expr, src_dyn || idx_dyn),
item_typ,
src_mutable,
tgt_type,
max_depth,
)
Expand All @@ -639,6 +646,7 @@
u,
(item_expr, src_dyn),
item_type,
src_mutable,
tgt_type,
max_depth,
)? {
Expand Down Expand Up @@ -1245,7 +1253,14 @@
});

// Derive the final result from the call, e.g. by casting, or accessing a member.
self.gen_expr_from_source(u, (call_expr, call_dyn), &return_type, typ, self.max_depth())
self.gen_expr_from_source(
u,
(call_expr, call_dyn),
&return_type,
true,
typ,
self.max_depth(),
)
}

/// Generate a call to a specific function, with arbitrary literals
Expand Down Expand Up @@ -1548,9 +1563,9 @@
ctx.config.max_loop_size = 10;
ctx.config.vary_loop_size = false;
ctx.gen_main_decl(&mut u);
let mut fctx = FunctionContext::new(&mut ctx, FuncId(0));

Check warning on line 1566 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)
fctx.budget = 2;

Check warning on line 1567 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)
let loop_code = format!("{}", fctx.gen_loop(&mut u).unwrap()).replace(" ", "");

Check warning on line 1568 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)

assert!(
loop_code.starts_with(
Expand All @@ -1573,8 +1588,8 @@
ctx.config.max_loop_size = 10;
ctx.config.vary_loop_size = false;
ctx.gen_main_decl(&mut u);
let mut fctx = FunctionContext::new(&mut ctx, FuncId(0));

Check warning on line 1591 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)
fctx.budget = 2;

Check warning on line 1592 in tooling/ast_fuzzer/src/program/func.rs

View workflow job for this annotation

GitHub Actions / Code 

Unknown word (fctx)
let while_code = format!("{}", fctx.gen_while(&mut u).unwrap()).replace(" ", "");

assert!(
Expand Down
Loading