Fix 33 reproduced fuzzing and static-review defects - #8514

Fixes 33 reproduced defects from devdanzin's fuzzing + static-review catalogs (rustpython-findings / rustpython-review-findings). Every one is an interpreter abort, panic, unbounded allocation or memory-unsafety reachable from ordinary pure-Python code.

One commit per defect, each independently revertable.
extra_tests/snippets/crash_regressions.py has a case per defect; every expected value in it was
checked against CPython 3.14.

Memory unsafety and unguarded native recursion

PyObject::hash dispatched the hash slot with no with_recursion, unlike the repr and rich-compare
dispatches beside it, so any element-wise __hash__ recursed one native frame per nesting level. The
guard goes on the dispatch, which covers tuple, GenericAlias, slice and code at once.

PyAtomicRef<T> stores a pointer to a Py<T> — Deref, load_raw, swap and Drop all read it that
way — but Debug cast it to a bare T and formatted the object header as payload. PyFunction's
code: PyAtomicRef<PyCode> has a pointer-chasing Debug, so {:?} on any Python function dereferenced
header words. The impl now casts to PyObject, which also covers the PyAtomicRef<PyObject> and
PyAtomicRef<Option<T>> instantiations that have no Py<T>.

_ctypes's no-argtypes conversion took its int branch through try_int, which goes through __int__
and so accepted a float; libc.strlen(1.5) passed 1 where a char * was expected. It now does a
PyLong_Check-equivalent downcast, matching ConvParam exactly — verified against CPython 3.13 for
1.5/0.0/1e300/True/5.

The hash guard sits on a hot path, so I measured it: dict/set insert, lookup and bare hash() over
300k keys are unchanged against the pre-guard build (within run-to-run noise, ±3% in both directions).

Missing GC traverse

RPYR-0012 needed a collector fix, not just the traverse opt-in. Traverse for PyIter<O> delegated to
the inherent PyObject::traverse of the object it wraps, so it reported that iterator's referents
instead of the iterator. The iterator's own reference was then never subtracted in the collector's
reference-subtraction pass, its referents kept a non-zero gc_refs, and everything reachable from them
was classified as a root. Every type with a PyIter field leaked as a result — map, filter, zip,
enumerate, reversed and the itertools iterators — while the same cycle through a list, tuple
or list_iterator collected. PyIter now reports the wrapped object, as PyObjectRef, PyRef<T> and
PyStackRef do.

Still leaking after the fix: itertools.tee, whose shared buffer is a PyRc<PyItertoolsTeeData> rather
than a Python object, so the collector cannot see through it. That needs a separate change.

Concurrency

.unwrap() / .expect() on a Python-reachable fallible value

Integer narrowing / arithmetic overflow

Unbounded eager collection of an iterable

The argument was materialized before being validated, so an infinite iterable exhausted memory. Each is now rejected in O(1).

posix_spawn's setsigdef/setsigmask now validate each signal while streaming instead of
collect-then-check, and os.setgroups takes its argument through the sequence protocol.

Also in here

Three things the review turned up alongside the fixes:

• itertools.combinations/combinations_with_replacement built their index vector with an infallible
  allocation, so an r that passes the ssize_t check but does not fit in memory aborted instead of
  raising MemoryError.
• The struct sequence constructor discarded its dict argument, so hidden fields (tm_zone,
  st_atime) were always None when constructed directly or restored from a (sequence, dict) pickle,
  and a non-dict second argument was accepted silently. It is now applied, validated, and rejects a key
  that names an already-supplied or non-existent field. os.stat_result and os.statvfs_result did
  not accept a second argument at all. Six expectedFailure markers in Lib/test/test_structseq.py
  became passes.
• test_code_module.test_unicode_error became an unexpected success once RUSTPY-0006 landed; its
  marker is removed.

Not addressed

Still reproducing, deliberately out of scope: the rest of the concurrency class (RUSTPY-0019/0023) and
itertools.tee's uncollectable shared buffer.

Already fixed on main, no longer reproducing: RPYR-0008, RUSTPY-0001/0009/0010/0011.

Verification

macOS (aarch64) and Linux (aarch64, Debian trixie container), on each platform:

• cargo clippy --keep-going --workspace --all-targets with the CI feature set and excludes — clean
• the CI cargo test invocation — pass
• 73 CPython test modules covering every touched area — 10,059 tests, all pass
• all 43 catalog reproducers re-run, plus the new regression snippet

Linux matters for several of these. os.setgroups is behind
#[cfg(not(any(target_os = "ios", target_os = "macos", target_os = "redox")))], so macOS cannot compile
it at all; on Linux it matches CPython 3.13 exactly (TypeError: setgroups argument must be a sequence),
as do all the posix_spawn paths. (1,) * (10**12) raises MemoryError on Linux for both CPython and
RustPython (on macOS both hang instead). And RUSTPY-0024's reproducer needs libc.so.6.

Two pre-existing conditions worth naming, both reproduced on untouched main: cargo test -p rustpython-capi SIGSEGVs in abstract_::iter::tests::next_item (CI excludes that crate), and
crates/capi/src/pystrcmp.rs trips clippy::unnecessary_cast on aarch64 Linux only, where c_char is
u8.

One difference from CPython remains: posix_spawn(setsigdef=...) reports signal number 0 out of range
where CPython appends the range, [1; 64]. That wording predates this PR and is left alone.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Improved asyncio task and exception handling, including clearer conflict errors.
  • Fixed mmap range validation and safer oversized sequence allocation.
  • Corrected empty collection representations and exception serialization.
  • Improved ctypes integer conversion, argument validation, and slice assignment checks.
  • Added safer validation for LZMA filters, process arguments, signals, and struct sequences.
  • Improved recursion and memory error reporting for generic aliases and iterators.

• Compatibility

  • Enhanced hashlib module initialization and standard-library behavior across CSV, math, typing, and operating-system utilities.

• Tests

  • Added broad regression coverage for the updated behavior, error handling, memory limits, garbage collection, and concurrency.