Implementation looks good to me, thanks! Can you add a GUI test for cases like [0;] please?

Also need to check what's wrong with CI.

Fixed CI in #627. Can you rebase on main so CI can run on your code please?

The fuzzer seems unhappy. Did I break something?

You introduced an infinite loop apparently from what I can see.

Not similar but for example in 5e5d576 I improved errors from #602. So you need to do a bit more "by hand". Like if you have [ char, then it means that if the parser fails from this point, it means the user wrote some wrong array code and it should be reported.

Something like this?

Much better! Although spans are not there yet. :)

Ok so errors looks good, well done! Now about the regression introduced in this PR, you can reproduce it with https://github.com/askama-rs/askama/actions/runs/19646142627/artifacts/4664834571. Please also add it as a testcase to prevent future regressions.

So, if I understood it correctly, the fuzzing test shows that this:

use askama::Template;

#[derive(Template)]
#[template(
    source = r#"*{{d~[d~[d~[d~[d~[dd~[d~[d~[d~[d~[d~[D~[d~[d~[d~[d~[d~[D~[d~[dd~[d~[d~[d~[d~[d~[D~[d~[d~[d~[d~[d~[d~["#,
    ext = "txt"
)]
struct FuzzingMR626;

fn main() {}

should crash the parser while compiling. But it works locally for me. I just get a proper compile error:

error: expected element expression for array repeat syntax
 --> <source attribute>:1:101
       ""
 --> tests/ui/fuzzed_array_repeat.rs:5:14
  |
5 |     source = r#"*{{d~[d~[d~[d~[d~[dd~[d~[d~[d~[d~[d~[D~[d~[d~[d~[d~[d~[D~[d~[dd~[d~[d~[d~[d~[d~[D~[d~[d~[d~[d~[d~[d~["#,
  |              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Now that it's added as ui-test, it also succeeds in the CI 🤔
If I understand it correctly, it's an execution timeout hitting:

ALARM: working on the last Unit for 26 seconds
       and the timeout value is 25 (use -timeout=N to change)
MS: 1 InsertByte-; base unit: 277979817b963d163b1e362606013030a6416b77
0x2a,0x7b,0x7b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x44,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x44,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x44,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0xeb,0x7e,0x5b,0x64,0x7e,0x5b,0x64,0x7e,0x5b,
*{{d~[d~[d~[d~[d~[dd~[d~[d~[d~[d~[d~[D~[d~[d~[d~[d~[d~[D~[d~[dd~[d~[d~[d~[d~[d~[D~[d~[d~[d~[d\353~[d~[d~[
artifact_prefix='/tmp/tmpyszgve9c/'; Test unit written to /tmp/tmpyszgve9c/timeout-5b3d17454dfbee1fdbdeedce6b6dd76834468e29
Base64: Knt7ZH5bZH5bZH5bZH5bZH5bZGR+W2R+W2R+W2R+W2R+W2R+W0R+W2R+W2R+W2R+W2R+W2R+W0R+W2R+W2RkfltkfltkfltkfltkfltkfltEfltkfltkfltkfltk635bZH5bZH5b
==26== ERROR: libFuzzer: timeout after 26 seconds

Is there something I need/can change in my implementation to fix this?

I think adding a limit on recursion (like 10 levels?) is the only solution.

But isn't this something that can generally produce problems?
Like with function calls:

    {{ test(test(test(test(test(test(test(test(test(test(test(test(test(test()))))))))))))) }}

How come it only occured with this array repeat implementation now?
Shouldn't the previous implementation for normal arrays have the same problem?

We have a nesting protection with InputStream.state.level which we use like this:

// Level is decreased when `_level_guard` is dropped.
let _level_guard = i.state.level.nest(i)?;

Can you add this line in the new array parsing please?

Ahh, there was already a mechanism for this. I had no idea how to add a recursion check on this 😅

I refactored the implementation a little. Now, the backtracking scope is cut off after finding [ (like in the previous array implementation), and from there on - it can be either a normal value array, or the repeat syntax.
Please have another look.
Hope is, that this is more performant, because the backtracking scope is reduced.

This is great, thanks! Please just add one more test like [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ (you got the idea) to ensure we have the nested error triggered as well. After that the PR looks ready to me. :)

Thanks a lot!