evilution 1.1.0 → 1.3.0

data/lib/evilution/mutator/operator/optional_default_injection.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../operator"
+
+# Reassign an optional parameter to its own default at the top of the body:
+# `def f(a = 1); body; end` becomes `def f(a = 1); a = 1; body; end`.
+#
+# Whatever a caller passed is overwritten, so the mutant survives only where
+# every example already passes the default — or passes a value the assertions
+# never distinguish from it. Where OptionalParameterToRequired asks whether the
+# default is ever used, this asks the opposite question: whether any other value
+# ever is.
+#
+# The parameter must be read somewhere in the body, otherwise overwriting it
+# changes nothing and the mutant would survive every suite. An endless method is
+# left alone: its body is a single expression, and putting a second statement in
+# front of it would change what the method returns rather than what it computes.
+# KeywordArgument owns optional keyword parameters, and a block's optional
+# parameter is left alone for the same reason it is elsewhere — a block ignores
+# arity, so the default is not a contract.
+class Evilution::Mutator::Operator::OptionalDefaultInjection < Evilution::Mutator::Base
+  def visit_def_node(node)
+    inject_defaults(node)
+    super
+  end
+
+  private
+
+  def inject_defaults(node)
+    return if node.equal_loc
+    return unless node.parameters
+
+    statements = body_statements(node.body)
+    return if statements.nil?
+
+    node.parameters.optionals.each { |optional| inject_default(optional, node.body, statements) }
+  end
+
+  # The read is looked for across the whole body, rescue and ensure clauses
+  # included, since a parameter read only in a rescue clause is still read. The
+  # injection itself goes ahead of the leading statements, which is the only
+  # place a statement can be added.
+  def inject_default(optional, body, statements)
+    name = optional.name.to_s
+    return if name.start_with?("_")
+    return unless Evilution::AST::LocalReads.new.call(body, name)
+
+    first = statements.body.first.location
+
+    add_mutation(
+      offset: first.start_offset,
+      length: 0,
+      replacement: "#{source_of(optional)}; ",
+      node: optional
+    )
+  end
+
+  # A method-level rescue/ensure (`def foo; stmts; rescue; ...; end`) makes the
+  # body a BeginNode whose location spans the entire `def...end`. The injection
+  # belongs ahead of the leading statements; returns nil for a rescue/ensure-only
+  # body and for an empty method, whose body is nil. A body that holds no
+  # statements is always nil rather than an empty StatementsNode, so a present
+  # node always has a first statement to inject ahead of.
+  def body_statements(body)
+    return body unless body.is_a?(Prism::BeginNode)
+
+    body.statements
+  end
+end

data/lib/evilution/mutator/operator/optional_parameter_to_required.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../operator"
+
+# Drop the default of an optional positional parameter, making it required:
+# `def f(a = 1)` becomes `def f(a)`.
+#
+# A survivor means no example calls the method without that argument, so the
+# default is never exercised and the value it supplies is unasserted. Callers
+# that pass the argument are unaffected, which is what separates this from a
+# mutation that breaks every call site.
+#
+# Ruby allows a required parameter to follow an optional one, so each optional
+# is mutated on its own and the rest of the signature stays as written.
+# KeywordArgument owns optional keyword parameters. Blocks are left alone: a
+# block ignores arity, so a missing argument arrives as nil rather than raising,
+# and making its parameter required would change nothing.
+class Evilution::Mutator::Operator::OptionalParameterToRequired < Evilution::Mutator::Base
+  def visit_def_node(node)
+    parameters = node.parameters
+    parameters.optionals.each { |optional| require_parameter(optional) } if parameters
+
+    super
+  end
+
+  private
+
+  def require_parameter(node)
+    location = node.location
+    name_loc = node.name_loc
+
+    add_mutation(
+      offset: location.start_offset,
+      length: location.length,
+      replacement: byteslice_source(name_loc.start_offset, name_loc.length),
+      node: node
+    )
+  end
+end

data/lib/evilution/mutator/operator/proc_to_lambda.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Turn a proc into a lambda: `proc { |a, b| ... }` and `Proc.new { ... }`
+# become `lambda { ... }`, with the block itself untouched.
+#
+# A lambda checks arity (wrong argument counts raise ArgumentError instead
+# of padding with nil or dropping extras), does not auto-splat a single
+# array argument, and `return` inside it returns from the lambda rather than
+# from the enclosing method. A survivor means no test relies on any of that.
+#
+# Only a literal block with no arguments qualifies: `proc(&blk)` and
+# `Proc.new(x) { }` are skipped.
+class Evilution::Mutator::Operator::ProcToLambda < Evilution::Mutator::Base
+  def visit_call_node(node)
+    rewrite(node) if proc_constructor?(node) && node.block.is_a?(Prism::BlockNode) && node.arguments.nil?
+    super
+  end
+
+  private
+
+  def proc_constructor?(node)
+    case node.name
+    when :proc then node.receiver.nil?
+    when :new then proc_constant?(node.receiver)
+    end
+  end
+
+  def proc_constant?(receiver)
+    case receiver
+    when Prism::ConstantReadNode then receiver.name == :Proc
+    when Prism::ConstantPathNode then receiver.parent.nil? && receiver.name == :Proc
+    end
+  end
+
+  # Replace the call head — `proc`, `Proc.new` or `Proc.new()` — leaving the
+  # block in place.
+  def rewrite(node)
+    head_end = (node.closing_loc || node.message_loc).end_offset
+    add_mutation(offset: node.start_offset, length: head_end - node.start_offset, replacement: "lambda", node: node)
+  end
+end

data/lib/evilution/mutator/operator/receiver_constructor_swap.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Swap a constructor for a sibling on the same receiver constant:
+# `Date.parse(value)` becomes `Date.iso8601(value)`, `Date.strptime(value)`,
+# `Date.rfc2822(value)` and the rest. Keyed on receiver and selector, which
+# the plain selector tables cannot express — `JSON.parse` is untouched.
+#
+# `parse` accepts almost any date-like string; the siblings accept one
+# format (strptime's default is ISO 8601) or, like `jd` / `civil`, numbers
+# only. A survivor means the tests only ever feed input every parser agrees
+# on, so an overly lenient parse goes unnoticed.
+#
+# Only the constant itself (`Date`, `::Date`) matches, not a namespaced
+# `Acme::Date`.
+class Evilution::Mutator::Operator::ReceiverConstructorSwap < Evilution::Mutator::Base
+  DATE_PARSE_SIBLINGS = %i[jd civil strptime iso8601 rfc3339 xmlschema rfc2822 rfc822 httpdate jisx0301].freeze
+  private_constant :DATE_PARSE_SIBLINGS
+
+  # receiver constant => { selector => replacements }. Time has no jd / civil
+  # / rfc3339 / jisx0301, and its strptime requires a format argument.
+  REPLACEMENTS = {
+    Date: { parse: DATE_PARSE_SIBLINGS },
+    DateTime: { parse: DATE_PARSE_SIBLINGS },
+    Time: { parse: %i[iso8601 xmlschema rfc2822 rfc822 httpdate] }
+  }.freeze
+  private_constant :REPLACEMENTS
+
+  def visit_call_node(node)
+    replacements_for(node).each do |replacement|
+      location = node.message_loc
+      add_mutation(offset: location.start_offset, length: location.length, replacement: replacement.to_s, node: node)
+    end
+    super
+  end
+
+  private
+
+  def replacements_for(node)
+    selectors = REPLACEMENTS[receiver_constant(node.receiver)]
+    selectors ? selectors.fetch(node.name, []) : []
+  end
+
+  def receiver_constant(receiver)
+    case receiver
+    when Prism::ConstantReadNode then receiver.name
+    when Prism::ConstantPathNode then receiver.name if receiver.parent.nil?
+    end
+  end
+end

data/lib/evilution/mutator/operator/reduce_to_sum.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Rewrite a `+` reduction into `sum`: `values.reduce(:+)` becomes
+# `values.sum`, `values.inject(10, :+)` becomes `values.sum(10)`, and the
+# same for the block-pass form `inject(&:+)`.
+#
+# The two differ on an empty collection (nil vs 0), on non-numeric elements
+# (`reduce` concatenates strings and arrays, `sum` raises TypeError without a
+# matching initial value) and on float precision (`sum` compensates rounding
+# error). A survivor means none of those edges is tested.
+class Evilution::Mutator::Operator::ReduceToSum < Evilution::Mutator::Base
+  SELECTORS = %i[reduce inject].freeze
+  private_constant :SELECTORS
+
+  NON_VALUE_ARGUMENTS = [Prism::SplatNode, Prism::KeywordHashNode].freeze
+  private_constant :NON_VALUE_ARGUMENTS
+
+  def visit_call_node(node)
+    rewrite(node) if node.receiver && SELECTORS.include?(node.name)
+    super
+  end
+
+  private
+
+  def rewrite(node)
+    initial = initial_arguments(node)
+    return unless initial && initial.length <= 1
+    return if initial.any? { |argument| NON_VALUE_ARGUMENTS.any? { |type| argument.is_a?(type) } }
+
+    # A literal block never reaches here, so the call ends at its argument
+    # list or block-pass: cut from the selector to the end of the call.
+    start = node.message_loc.start_offset
+    replacement = initial.empty? ? "sum" : "sum(#{source_of(initial.first)})"
+    add_mutation(offset: start, length: node.end_offset - start, replacement: replacement, node: node)
+  end
+
+  # The arguments besides the `+` operand — at most an initial value — when
+  # the call is a `+` reduction; nil otherwise.
+  def initial_arguments(node)
+    arguments = node.arguments ? node.arguments.arguments : []
+
+    if plus_block_pass?(node.block)
+      arguments unless plus_symbol?(arguments.last)
+    elsif node.block.nil? && plus_symbol?(arguments.last)
+      arguments[...-1]
+    end
+  end
+
+  def plus_block_pass?(block)
+    block.is_a?(Prism::BlockArgumentNode) && plus_symbol?(block.expression)
+  end
+
+  def plus_symbol?(node)
+    node.is_a?(Prism::SymbolNode) && node.unescaped == "+"
+  end
+end

data/lib/evilution/mutator/operator/regexp_anchor_to_predicate.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Rewrite a match against an anchored literal regexp into a prefix or suffix
+# predicate: `line =~ /^foo/` becomes `line.start_with?("foo")`, and
+# `line.match?(/bar$/)` becomes `line.end_with?("bar")`. Handles `=~`,
+# `match` and `match?`, with the regexp on either side.
+#
+# Line anchors carry the signal: `^` also matches after any newline, and `$`
+# / `\Z` before a trailing one, where the predicates do not — a survivor
+# means no test feeds multi-line input, or the anchor should have been `\A` /
+# `\z`. With the string anchors `\A` / `\z` the truth value is identical, so
+# only `=~` and `match` are rewritten there (their return value — an index
+# or MatchData — still differs from a boolean); `match?` would be an exact
+# equivalent and is skipped.
+#
+# Only a flag-free pattern of one anchor plus literal characters qualifies,
+# and only on a call without a block: `match` yields its MatchData to one,
+# which the predicate would silently drop.
+class Evilution::Mutator::Operator::RegexpAnchorToPredicate < Evilution::Mutator::Base
+  SELECTORS = %i[=~ match match?].freeze
+  private_constant :SELECTORS
+
+  START_ANCHORS = { "^" => :line, "\\A" => :string }.freeze
+  private_constant :START_ANCHORS
+
+  END_ANCHORS = { "$" => :line, "\\Z" => :line, "\\z" => :string }.freeze
+  private_constant :END_ANCHORS
+
+  METACHARACTERS = ".*+?()[]{}|^$".chars.to_set.freeze
+  private_constant :METACHARACTERS
+
+  # Operands that need no parentheses in front of `.start_with?`.
+  SIMPLE_OPERANDS = [
+    Prism::LocalVariableReadNode,
+    Prism::InstanceVariableReadNode,
+    Prism::ClassVariableReadNode,
+    Prism::GlobalVariableReadNode,
+    Prism::ConstantReadNode,
+    Prism::ConstantPathNode,
+    Prism::SelfNode,
+    Prism::StringNode,
+    Prism::ParenthesesNode
+  ].freeze
+  private_constant :SIMPLE_OPERANDS
+
+  # A backslash pair or a single character. A literal cannot end in a lone
+  # backslash, since that would escape its closing delimiter.
+  TOKEN = /\\.|./m
+  private_constant :TOKEN
+
+  IDENTIFIER = /\A[[:alpha:]_]/
+  private_constant :IDENTIFIER
+
+  def visit_call_node(node)
+    rewrite(node) if SELECTORS.include?(node.name)
+    super
+  end
+
+  private
+
+  def rewrite(node)
+    return unless node.arguments in Prism::ArgumentsNode[arguments: [argument]]
+    return if node.receiver.nil? || node.block
+
+    regexp, operand = split_operands(node.receiver, argument)
+    return if regexp.nil?
+
+    predicate, literal = anchored_literal(regexp, node.name)
+    return if predicate.nil?
+
+    replacement = "#{operand_source(operand)}#{call_operator(node)}#{predicate}(#{literal.inspect})"
+    replace_span(node: node, target: node, replacement: replacement)
+  end
+
+  def split_operands(receiver, argument)
+    if argument.is_a?(Prism::RegularExpressionNode)
+      [argument, receiver]
+    elsif receiver.is_a?(Prism::RegularExpressionNode)
+      [receiver, argument]
+    end
+  end
+
+  # [predicate, literal] when the pattern is one anchor plus literal
+  # characters and the rewrite is not an exact equivalent; nil otherwise.
+  def anchored_literal(regexp, selector)
+    return if regexp.closing_loc.length > 1
+
+    predicate, kind, body = split_anchor(regexp.content.scan(TOKEN))
+    return if predicate.nil? || (kind == :string && selector == :match?)
+
+    literal = literal_text(body)
+    [predicate, literal] if literal && !literal.empty?
+  end
+
+  # A pattern anchored at both ends needs no check here: the other anchor
+  # (`\z`, `\Z`, `$`, `^`, `\A`) is never a literal character, so
+  # literal_text rejects the body.
+  def split_anchor(tokens)
+    if (start_kind = START_ANCHORS[tokens.first])
+      [:start_with?, start_kind, tokens.drop(1)]
+    elsif (end_kind = END_ANCHORS[tokens.last])
+      [:end_with?, end_kind, tokens[...-1]]
+    end
+  end
+
+  def literal_text(tokens)
+    chars = tokens.map { |token| literal_char(token) }
+    chars.join if chars.all?
+  end
+
+  def literal_char(token)
+    if token.start_with?("\\")
+      escaped = token[1]
+      escaped unless escaped.match?(/[[:alnum:]]/)
+    elsif !METACHARACTERS.include?(token)
+      token
+    end
+  end
+
+  def operand_source(operand)
+    source = source_of(operand)
+    simple_operand?(operand) ? source : "(#{source})"
+  end
+
+  def simple_operand?(operand)
+    return true if SIMPLE_OPERANDS.any? { |type| operand.is_a?(type) }
+
+    operand.is_a?(Prism::CallNode) && (operand.name.match?(IDENTIFIER) || operand.name == :[])
+  end
+
+  def call_operator(node)
+    node.call_operator_loc ? node.call_operator_loc.slice : "."
+  end
+end

data/lib/evilution/mutator/operator/safe_navigation_removal.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Replace safe navigation with a plain call: `user&.name` becomes
+# `user.name`, and the same for the `||=`, `&&=` and operator-write forms.
+#
+# The mutant only differs when the receiver is nil, where it raises
+# NoMethodError instead of short-circuiting. A survivor means no test ever
+# reaches the call with a nil receiver, so the `&.` is unexercised.
+#
+# Receivers that can never be nil — `self` and literals — are skipped, since
+# the mutant is equivalent there.
+class Evilution::Mutator::Operator::SafeNavigationRemoval < Evilution::Mutator::Base
+  NEVER_NIL_RECEIVERS = [
+    Prism::SelfNode,
+    Prism::StringNode,
+    Prism::InterpolatedStringNode,
+    Prism::XStringNode,
+    Prism::InterpolatedXStringNode,
+    Prism::SymbolNode,
+    Prism::InterpolatedSymbolNode,
+    Prism::IntegerNode,
+    Prism::FloatNode,
+    Prism::RationalNode,
+    Prism::ImaginaryNode,
+    Prism::ArrayNode,
+    Prism::HashNode,
+    Prism::RangeNode,
+    Prism::RegularExpressionNode,
+    Prism::InterpolatedRegularExpressionNode,
+    Prism::TrueNode,
+    Prism::FalseNode,
+    Prism::LambdaNode
+  ].freeze
+  private_constant :NEVER_NIL_RECEIVERS
+
+  def visit_call_node(node)
+    mutate_safe_navigation(node)
+    super
+  end
+
+  def visit_call_or_write_node(node)
+    mutate_safe_navigation(node)
+    super
+  end
+
+  def visit_call_and_write_node(node)
+    mutate_safe_navigation(node)
+    super
+  end
+
+  def visit_call_operator_write_node(node)
+    mutate_safe_navigation(node)
+    super
+  end
+
+  private
+
+  def mutate_safe_navigation(node)
+    return unless node.safe_navigation?
+    return if NEVER_NIL_RECEIVERS.any? { |type| node.receiver.is_a?(type) }
+
+    operator = node.call_operator_loc
+    add_mutation(offset: operator.start_offset, length: operator.length, replacement: ".", node: node)
+  end
+end

data/lib/evilution/mutator/operator/send_mutation.rb

@@ -25,22 +25,50 @@ class Evilution::Mutator::Operator::SendMutation < Evilution::Mutator::Base
     count: [:size],
     select: [:filter],
     filter: [:select],
-    to_s: [:to_i],
-    to_i: [:to_s],
+    to_s: %i[to_i to_str],
+    to_i: %i[to_s to_int],
     to_f: [:to_i],
-    to_a: [:to_h],
-    to_h: [:to_a],
+    to_a: %i[to_h to_ary],
+    to_h: %i[to_a to_hash],
     downcase: [:upcase],
     upcase: [:downcase],
     strip: %i[lstrip rstrip],
     lstrip: [:strip],
     rstrip: [:strip],
     chomp: [:chop],
-    chop: [:chomp]
+    chop: [:chomp],
+    bytes: [:chars],
+    chars: [:bytes],
+    start_with?: [:end_with?],
+    end_with?: [:start_with?],
+    ceil: [:floor],
+    floor: [:ceil],
+    transform_keys: [:transform_values],
+    transform_values: [:transform_keys],
+    append: [:prepend],
+    prepend: [:append],
+    reverse_merge: [:merge],
+    even?: [:odd?],
+    odd?: [:even?],
+    zero?: [:nonzero?],
+    negative?: [:positive?],
+    positive?: [:negative?],
+    pred: [:succ],
+    succ: [:pred],
+    is_a?: [:instance_of?],
+    kind_of?: [:instance_of?]
+  }.freeze
+
+  # Swapped only when called with exactly one argument. Kept out of
+  # REPLACEMENTS, which symbol_to_proc_replacement also reads: `&:method`
+  # always calls with none, and a zero-argument `method` is usually an
+  # accessor such as `request.method` (the HTTP verb), not Object#method.
+  ONE_ARGUMENT_REPLACEMENTS = {
+    method: [:public_method]
   }.freeze
 
   def visit_call_node(node)
-    replacements = REPLACEMENTS[node.name]
+    replacements = replacements_for(node)
     return super unless replacements
     return super unless node.receiver
 
@@ -58,4 +86,12 @@ class Evilution::Mutator::Operator::SendMutation < Evilution::Mutator::Base
 
     super
   end
+
+  private
+
+  def replacements_for(node)
+    REPLACEMENTS.fetch(node.name) do
+      ONE_ARGUMENT_REPLACEMENTS[node.name] if node.arguments && node.arguments.arguments.length == 1
+    end
+  end
 end

data/lib/evilution/mutator/operator/symbol_to_proc_replacement.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "send_mutation"
+require_relative "collection_replacement"
+
+# Apply the call-site selector tables to a symbol block-pass: `map(&:to_s)`
+# becomes `map(&:to_i)`, `map(&:first)` becomes `map(&:last)`.
+#
+# send_mutation and collection_replacement only see explicit calls, so a
+# selector passed as `&:sym` was never swapped — only removed. This reads
+# both tables live, so selectors added to them apply here too.
+#
+# Replacements that are Ruby aliases of the original (`collect` / `map`,
+# `find` / `detect`, `select` / `filter`, `length` / `size` / `count`) are
+# skipped: on the receivers these selectors are normally mapped over, the
+# mutant behaves identically.
+class Evilution::Mutator::Operator::SymbolToProcReplacement < Evilution::Mutator::Base
+  TABLES = [
+    Evilution::Mutator::Operator::SendMutation::REPLACEMENTS,
+    Evilution::Mutator::Operator::CollectionReplacement::REPLACEMENTS
+  ].freeze
+  private_constant :TABLES
+
+  ALIAS_GROUPS = [
+    %i[map collect],
+    %i[find detect],
+    %i[select filter],
+    %i[length size count]
+  ].freeze
+  private_constant :ALIAS_GROUPS
+
+  def visit_block_argument_node(node)
+    symbol = node.expression
+    replace_selector(node, symbol) if symbol.is_a?(Prism::SymbolNode)
+    super
+  end
+
+  private
+
+  def replace_selector(node, symbol)
+    selector = symbol.unescaped.to_sym
+    location = symbol.value_loc
+
+    replacements_for(selector).each do |replacement|
+      add_mutation(
+        offset: location.start_offset,
+        length: location.length,
+        replacement: replacement.to_s,
+        node: node
+      )
+    end
+  end
+
+  def replacements_for(selector)
+    aliases = ALIAS_GROUPS.find { |group| group.include?(selector) } || []
+    TABLES.flat_map { |table| table.fetch(selector, []) }.uniq - aliases
+  end
+end

data/lib/evilution/mutator/operator/to_i_to_integer.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Replace a lenient `to_i` with the strict `Integer()` conversion:
+# `value.to_i` becomes `Integer(value)`, `value.to_i(16)` becomes
+# `Integer(value, 16)`.
+#
+# `to_i` never fails — malformed input ("abc", "12abc", "") and nil become 0
+# or a leading-digits prefix — where `Integer()` raises. `Integer()` also
+# honours radix prefixes ("0x1A" is 26, "012" is octal 10) that `to_i`
+# ignores. A survivor means no test feeds invalid or prefixed input.
+#
+# Numeric literal receivers are skipped: both conversions agree on them.
+class Evilution::Mutator::Operator::ToIToInteger < Evilution::Mutator::Base
+  NUMERIC_LITERALS = [Prism::IntegerNode, Prism::FloatNode, Prism::RationalNode, Prism::ImaginaryNode].freeze
+  private_constant :NUMERIC_LITERALS
+
+  def visit_call_node(node)
+    rewrite(node) if node.name == :to_i && convertible?(node)
+    super
+  end
+
+  private
+
+  def convertible?(node)
+    receiver = node.receiver
+    receiver && node.block.nil? && NUMERIC_LITERALS.none? { |type| receiver.is_a?(type) }
+  end
+
+  def rewrite(node)
+    arguments = node.arguments ? node.arguments.arguments : []
+    return if arguments.length > 1 || arguments.any?(Prism::SplatNode)
+
+    parts = [node.receiver, *arguments].map { |part| source_of(part) }
+    replace_span(node: node, target: node, replacement: "Integer(#{parts.join(", ")})")
+  end
+end