evilution 1.2.0 → 1.3.0

data/lib/evilution/mutator/operator/dynamic_dispatch_resolution.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Resolve a dynamic dispatch with a literal symbol into a direct call:
+# `target.send(:reset)` becomes `target.reset`, and the same for `__send__`
+# and `public_send`. Remaining arguments, a block-pass and a literal block
+# stay attached.
+#
+# The two forms differ only in visibility checks, so the mutant is emitted
+# only where those checks can disagree:
+#
+# - send / __send__ on an explicit receiver other than self: the direct call
+#   raises NoMethodError for a private method. With an implicit or self
+#   receiver a private method resolves either way (Ruby 2.7+).
+# - public_send with an implicit or self receiver: the direct call reaches a
+#   private method that public_send refuses. On any other receiver both
+#   refuse it, and only a protected method called from inside its class
+#   would differ.
+#
+# method_missing is reached the same way by both forms.
+class Evilution::Mutator::Operator::DynamicDispatchResolution < Evilution::Mutator::Base
+  SEND_SELECTORS = %i[send __send__].freeze
+  private_constant :SEND_SELECTORS
+
+  OPERATOR_NAMES = %w[
+    + - * / % ** == != < > <= >= <=> === =~ !~ ! [] []= << >> & | ^ ~ +@ -@
+  ].to_set.freeze
+  private_constant :OPERATOR_NAMES
+
+  METHOD_NAME = /\A[[:alpha:]_][[:alnum:]_]*[?!=]?\z/
+  private_constant :METHOD_NAME
+
+  def visit_call_node(node)
+    selector = literal_selector(node)
+    resolve(node, selector) if selector && visibility_can_differ?(node)
+    super
+  end
+
+  private
+
+  def literal_selector(node)
+    return unless node.arguments in Prism::ArgumentsNode[arguments: [Prism::SymbolNode => symbol, *]]
+
+    name = symbol.unescaped
+    name if name.match?(METHOD_NAME) || OPERATOR_NAMES.include?(name)
+  end
+
+  def visibility_can_differ?(node)
+    self_receiver = node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+
+    if SEND_SELECTORS.include?(node.name)
+      !self_receiver
+    else
+      node.name == :public_send && self_receiver
+    end
+  end
+
+  def resolve(node, selector)
+    start = node.message_loc.start_offset
+    following = following_item(node)
+
+    if following
+      replacement = "#{selector}#{node.opening_loc ? "(" : " "}"
+      finish = following.start_offset
+    else
+      replacement = selector
+      finish = node.closing_loc ? node.closing_loc.end_offset : node.arguments.end_offset
+    end
+
+    add_mutation(offset: start, length: finish - start, replacement: replacement, node: node)
+  end
+
+  # The argument after the selector, or the block-pass when the selector is
+  # the only argument.
+  def following_item(node)
+    node.arguments.arguments[1] || (node.block if node.block.is_a?(Prism::BlockArgumentNode))
+  end
+end

data/lib/evilution/mutator/operator/inequality_to_negated_identity.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Rewrite an inequality with stricter comparisons: `a != b` becomes
+# `!a.eql?(b)` and `!a.equal?(b)`.
+#
+# `eql?` adds a type check (`1 != 1.0` is false, `!1.eql?(1.0)` is true) and
+# `equal?` compares identity (two equal strings or arrays are still
+# different objects). A survivor means no test separates value equality from
+# the stricter forms, so the comparison in use is never pinned down.
+#
+# Comparisons against nil, true, false or a symbol literal are skipped: those
+# are singletons, so all three forms always agree.
+class Evilution::Mutator::Operator::InequalityToNegatedIdentity < Evilution::Mutator::Base
+  SELECTORS = %i[eql? equal?].freeze
+  private_constant :SELECTORS
+
+  SINGLETON_LITERALS = [Prism::NilNode, Prism::TrueNode, Prism::FalseNode, Prism::SymbolNode].freeze
+  private_constant :SINGLETON_LITERALS
+
+  def visit_call_node(node)
+    rewrite(node) if node.name == :!=
+    super
+  end
+
+  private
+
+  def rewrite(node)
+    return unless node.arguments in Prism::ArgumentsNode[arguments: [argument]]
+    return if [node.receiver, argument].any? { |operand| singleton_literal?(operand) }
+
+    left = receiver_source(node.receiver)
+    SELECTORS.each do |selector|
+      add_mutation(offset: node.start_offset, length: node.location.length,
+                   replacement: "!#{left}.#{selector}(#{source_of(argument)})", node: node)
+    end
+  end
+
+  def singleton_literal?(operand)
+    SINGLETON_LITERALS.any? { |type| operand.is_a?(type) }
+  end
+end

data/lib/evilution/mutator/operator/keyword_argument_removal.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Drop one keyword argument at a call site: `build(name: "x", size: 2)`
+# becomes `build(size: 2)` and `build(name: "x")`. Applies to any argument
+# list — calls, `super` and `yield`.
+#
+# A survivor means the callee never consumes that keyword, or its default
+# happens to match. argument_removal and argument_nil_substitution skip
+# keyword arguments entirely.
+#
+# Only `key: value` pairs are dropped; a `**opts` double splat stays, though
+# it still counts as a neighbour when removing the separator. A lone keyword
+# that is the whole argument list is left to argument_list_removal.
+class Evilution::Mutator::Operator::KeywordArgumentRemoval < Evilution::Mutator::Base
+  def visit_arguments_node(node)
+    node.arguments.each_with_index do |argument, index|
+      next unless argument.is_a?(Prism::KeywordHashNode)
+
+      drop_keywords(argument, index.zero? ? nil : node.arguments[index - 1])
+    end
+
+    super
+  end
+
+  private
+
+  def drop_keywords(hash, previous_argument)
+    elements = hash.elements
+    return if elements.length == 1 && previous_argument.nil?
+
+    elements.each_with_index do |element, index|
+      next unless element.is_a?(Prism::AssocNode)
+
+      drop_element(element, elements[index + 1], index.zero? ? previous_argument : elements[index - 1])
+    end
+  end
+
+  # Cut from the element to the next one, or — for the last element — from
+  # the end of whatever precedes it, so the separating comma goes too.
+  def drop_element(element, following, preceding)
+    start, finish = following ? [element.start_offset, following.start_offset] : [preceding.end_offset, element.end_offset]
+
+    add_mutation(offset: start, length: finish - start, replacement: "", node: element, skip_unparseable: true)
+  end
+end

data/lib/evilution/mutator/operator/proc_to_lambda.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Turn a proc into a lambda: `proc { |a, b| ... }` and `Proc.new { ... }`
+# become `lambda { ... }`, with the block itself untouched.
+#
+# A lambda checks arity (wrong argument counts raise ArgumentError instead
+# of padding with nil or dropping extras), does not auto-splat a single
+# array argument, and `return` inside it returns from the lambda rather than
+# from the enclosing method. A survivor means no test relies on any of that.
+#
+# Only a literal block with no arguments qualifies: `proc(&blk)` and
+# `Proc.new(x) { }` are skipped.
+class Evilution::Mutator::Operator::ProcToLambda < Evilution::Mutator::Base
+  def visit_call_node(node)
+    rewrite(node) if proc_constructor?(node) && node.block.is_a?(Prism::BlockNode) && node.arguments.nil?
+    super
+  end
+
+  private
+
+  def proc_constructor?(node)
+    case node.name
+    when :proc then node.receiver.nil?
+    when :new then proc_constant?(node.receiver)
+    end
+  end
+
+  def proc_constant?(receiver)
+    case receiver
+    when Prism::ConstantReadNode then receiver.name == :Proc
+    when Prism::ConstantPathNode then receiver.parent.nil? && receiver.name == :Proc
+    end
+  end
+
+  # Replace the call head — `proc`, `Proc.new` or `Proc.new()` — leaving the
+  # block in place.
+  def rewrite(node)
+    head_end = (node.closing_loc || node.message_loc).end_offset
+    add_mutation(offset: node.start_offset, length: head_end - node.start_offset, replacement: "lambda", node: node)
+  end
+end

data/lib/evilution/mutator/operator/receiver_constructor_swap.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Swap a constructor for a sibling on the same receiver constant:
+# `Date.parse(value)` becomes `Date.iso8601(value)`, `Date.strptime(value)`,
+# `Date.rfc2822(value)` and the rest. Keyed on receiver and selector, which
+# the plain selector tables cannot express — `JSON.parse` is untouched.
+#
+# `parse` accepts almost any date-like string; the siblings accept one
+# format (strptime's default is ISO 8601) or, like `jd` / `civil`, numbers
+# only. A survivor means the tests only ever feed input every parser agrees
+# on, so an overly lenient parse goes unnoticed.
+#
+# Only the constant itself (`Date`, `::Date`) matches, not a namespaced
+# `Acme::Date`.
+class Evilution::Mutator::Operator::ReceiverConstructorSwap < Evilution::Mutator::Base
+  DATE_PARSE_SIBLINGS = %i[jd civil strptime iso8601 rfc3339 xmlschema rfc2822 rfc822 httpdate jisx0301].freeze
+  private_constant :DATE_PARSE_SIBLINGS
+
+  # receiver constant => { selector => replacements }. Time has no jd / civil
+  # / rfc3339 / jisx0301, and its strptime requires a format argument.
+  REPLACEMENTS = {
+    Date: { parse: DATE_PARSE_SIBLINGS },
+    DateTime: { parse: DATE_PARSE_SIBLINGS },
+    Time: { parse: %i[iso8601 xmlschema rfc2822 rfc822 httpdate] }
+  }.freeze
+  private_constant :REPLACEMENTS
+
+  def visit_call_node(node)
+    replacements_for(node).each do |replacement|
+      location = node.message_loc
+      add_mutation(offset: location.start_offset, length: location.length, replacement: replacement.to_s, node: node)
+    end
+    super
+  end
+
+  private
+
+  def replacements_for(node)
+    selectors = REPLACEMENTS[receiver_constant(node.receiver)]
+    selectors ? selectors.fetch(node.name, []) : []
+  end
+
+  def receiver_constant(receiver)
+    case receiver
+    when Prism::ConstantReadNode then receiver.name
+    when Prism::ConstantPathNode then receiver.name if receiver.parent.nil?
+    end
+  end
+end

data/lib/evilution/mutator/operator/reduce_to_sum.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Rewrite a `+` reduction into `sum`: `values.reduce(:+)` becomes
+# `values.sum`, `values.inject(10, :+)` becomes `values.sum(10)`, and the
+# same for the block-pass form `inject(&:+)`.
+#
+# The two differ on an empty collection (nil vs 0), on non-numeric elements
+# (`reduce` concatenates strings and arrays, `sum` raises TypeError without a
+# matching initial value) and on float precision (`sum` compensates rounding
+# error). A survivor means none of those edges is tested.
+class Evilution::Mutator::Operator::ReduceToSum < Evilution::Mutator::Base
+  SELECTORS = %i[reduce inject].freeze
+  private_constant :SELECTORS
+
+  NON_VALUE_ARGUMENTS = [Prism::SplatNode, Prism::KeywordHashNode].freeze
+  private_constant :NON_VALUE_ARGUMENTS
+
+  def visit_call_node(node)
+    rewrite(node) if node.receiver && SELECTORS.include?(node.name)
+    super
+  end
+
+  private
+
+  def rewrite(node)
+    initial = initial_arguments(node)
+    return unless initial && initial.length <= 1
+    return if initial.any? { |argument| NON_VALUE_ARGUMENTS.any? { |type| argument.is_a?(type) } }
+
+    # A literal block never reaches here, so the call ends at its argument
+    # list or block-pass: cut from the selector to the end of the call.
+    start = node.message_loc.start_offset
+    replacement = initial.empty? ? "sum" : "sum(#{source_of(initial.first)})"
+    add_mutation(offset: start, length: node.end_offset - start, replacement: replacement, node: node)
+  end
+
+  # The arguments besides the `+` operand — at most an initial value — when
+  # the call is a `+` reduction; nil otherwise.
+  def initial_arguments(node)
+    arguments = node.arguments ? node.arguments.arguments : []
+
+    if plus_block_pass?(node.block)
+      arguments unless plus_symbol?(arguments.last)
+    elsif node.block.nil? && plus_symbol?(arguments.last)
+      arguments[...-1]
+    end
+  end
+
+  def plus_block_pass?(block)
+    block.is_a?(Prism::BlockArgumentNode) && plus_symbol?(block.expression)
+  end
+
+  def plus_symbol?(node)
+    node.is_a?(Prism::SymbolNode) && node.unescaped == "+"
+  end
+end

data/lib/evilution/mutator/operator/regexp_anchor_to_predicate.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Rewrite a match against an anchored literal regexp into a prefix or suffix
+# predicate: `line =~ /^foo/` becomes `line.start_with?("foo")`, and
+# `line.match?(/bar$/)` becomes `line.end_with?("bar")`. Handles `=~`,
+# `match` and `match?`, with the regexp on either side.
+#
+# Line anchors carry the signal: `^` also matches after any newline, and `$`
+# / `\Z` before a trailing one, where the predicates do not — a survivor
+# means no test feeds multi-line input, or the anchor should have been `\A` /
+# `\z`. With the string anchors `\A` / `\z` the truth value is identical, so
+# only `=~` and `match` are rewritten there (their return value — an index
+# or MatchData — still differs from a boolean); `match?` would be an exact
+# equivalent and is skipped.
+#
+# Only a flag-free pattern of one anchor plus literal characters qualifies,
+# and only on a call without a block: `match` yields its MatchData to one,
+# which the predicate would silently drop.
+class Evilution::Mutator::Operator::RegexpAnchorToPredicate < Evilution::Mutator::Base
+  SELECTORS = %i[=~ match match?].freeze
+  private_constant :SELECTORS
+
+  START_ANCHORS = { "^" => :line, "\\A" => :string }.freeze
+  private_constant :START_ANCHORS
+
+  END_ANCHORS = { "$" => :line, "\\Z" => :line, "\\z" => :string }.freeze
+  private_constant :END_ANCHORS
+
+  METACHARACTERS = ".*+?()[]{}|^$".chars.to_set.freeze
+  private_constant :METACHARACTERS
+
+  # Operands that need no parentheses in front of `.start_with?`.
+  SIMPLE_OPERANDS = [
+    Prism::LocalVariableReadNode,
+    Prism::InstanceVariableReadNode,
+    Prism::ClassVariableReadNode,
+    Prism::GlobalVariableReadNode,
+    Prism::ConstantReadNode,
+    Prism::ConstantPathNode,
+    Prism::SelfNode,
+    Prism::StringNode,
+    Prism::ParenthesesNode
+  ].freeze
+  private_constant :SIMPLE_OPERANDS
+
+  # A backslash pair or a single character. A literal cannot end in a lone
+  # backslash, since that would escape its closing delimiter.
+  TOKEN = /\\.|./m
+  private_constant :TOKEN
+
+  IDENTIFIER = /\A[[:alpha:]_]/
+  private_constant :IDENTIFIER
+
+  def visit_call_node(node)
+    rewrite(node) if SELECTORS.include?(node.name)
+    super
+  end
+
+  private
+
+  def rewrite(node)
+    return unless node.arguments in Prism::ArgumentsNode[arguments: [argument]]
+    return if node.receiver.nil? || node.block
+
+    regexp, operand = split_operands(node.receiver, argument)
+    return if regexp.nil?
+
+    predicate, literal = anchored_literal(regexp, node.name)
+    return if predicate.nil?
+
+    replacement = "#{operand_source(operand)}#{call_operator(node)}#{predicate}(#{literal.inspect})"
+    replace_span(node: node, target: node, replacement: replacement)
+  end
+
+  def split_operands(receiver, argument)
+    if argument.is_a?(Prism::RegularExpressionNode)
+      [argument, receiver]
+    elsif receiver.is_a?(Prism::RegularExpressionNode)
+      [receiver, argument]
+    end
+  end
+
+  # [predicate, literal] when the pattern is one anchor plus literal
+  # characters and the rewrite is not an exact equivalent; nil otherwise.
+  def anchored_literal(regexp, selector)
+    return if regexp.closing_loc.length > 1
+
+    predicate, kind, body = split_anchor(regexp.content.scan(TOKEN))
+    return if predicate.nil? || (kind == :string && selector == :match?)
+
+    literal = literal_text(body)
+    [predicate, literal] if literal && !literal.empty?
+  end
+
+  # A pattern anchored at both ends needs no check here: the other anchor
+  # (`\z`, `\Z`, `$`, `^`, `\A`) is never a literal character, so
+  # literal_text rejects the body.
+  def split_anchor(tokens)
+    if (start_kind = START_ANCHORS[tokens.first])
+      [:start_with?, start_kind, tokens.drop(1)]
+    elsif (end_kind = END_ANCHORS[tokens.last])
+      [:end_with?, end_kind, tokens[...-1]]
+    end
+  end
+
+  def literal_text(tokens)
+    chars = tokens.map { |token| literal_char(token) }
+    chars.join if chars.all?
+  end
+
+  def literal_char(token)
+    if token.start_with?("\\")
+      escaped = token[1]
+      escaped unless escaped.match?(/[[:alnum:]]/)
+    elsif !METACHARACTERS.include?(token)
+      token
+    end
+  end
+
+  def operand_source(operand)
+    source = source_of(operand)
+    simple_operand?(operand) ? source : "(#{source})"
+  end
+
+  def simple_operand?(operand)
+    return true if SIMPLE_OPERANDS.any? { |type| operand.is_a?(type) }
+
+    operand.is_a?(Prism::CallNode) && (operand.name.match?(IDENTIFIER) || operand.name == :[])
+  end
+
+  def call_operator(node)
+    node.call_operator_loc ? node.call_operator_loc.slice : "."
+  end
+end

data/lib/evilution/mutator/operator/safe_navigation_removal.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Replace safe navigation with a plain call: `user&.name` becomes
+# `user.name`, and the same for the `||=`, `&&=` and operator-write forms.
+#
+# The mutant only differs when the receiver is nil, where it raises
+# NoMethodError instead of short-circuiting. A survivor means no test ever
+# reaches the call with a nil receiver, so the `&.` is unexercised.
+#
+# Receivers that can never be nil — `self` and literals — are skipped, since
+# the mutant is equivalent there.
+class Evilution::Mutator::Operator::SafeNavigationRemoval < Evilution::Mutator::Base
+  NEVER_NIL_RECEIVERS = [
+    Prism::SelfNode,
+    Prism::StringNode,
+    Prism::InterpolatedStringNode,
+    Prism::XStringNode,
+    Prism::InterpolatedXStringNode,
+    Prism::SymbolNode,
+    Prism::InterpolatedSymbolNode,
+    Prism::IntegerNode,
+    Prism::FloatNode,
+    Prism::RationalNode,
+    Prism::ImaginaryNode,
+    Prism::ArrayNode,
+    Prism::HashNode,
+    Prism::RangeNode,
+    Prism::RegularExpressionNode,
+    Prism::InterpolatedRegularExpressionNode,
+    Prism::TrueNode,
+    Prism::FalseNode,
+    Prism::LambdaNode
+  ].freeze
+  private_constant :NEVER_NIL_RECEIVERS
+
+  def visit_call_node(node)
+    mutate_safe_navigation(node)
+    super
+  end
+
+  def visit_call_or_write_node(node)
+    mutate_safe_navigation(node)
+    super
+  end
+
+  def visit_call_and_write_node(node)
+    mutate_safe_navigation(node)
+    super
+  end
+
+  def visit_call_operator_write_node(node)
+    mutate_safe_navigation(node)
+    super
+  end
+
+  private
+
+  def mutate_safe_navigation(node)
+    return unless node.safe_navigation?
+    return if NEVER_NIL_RECEIVERS.any? { |type| node.receiver.is_a?(type) }
+
+    operator = node.call_operator_loc
+    add_mutation(offset: operator.start_offset, length: operator.length, replacement: ".", node: node)
+  end
+end

data/lib/evilution/mutator/operator/send_mutation.rb

@@ -25,22 +25,50 @@ class Evilution::Mutator::Operator::SendMutation < Evilution::Mutator::Base
     count: [:size],
     select: [:filter],
     filter: [:select],
-    to_s: [:to_i],
-    to_i: [:to_s],
+    to_s: %i[to_i to_str],
+    to_i: %i[to_s to_int],
     to_f: [:to_i],
-    to_a: [:to_h],
-    to_h: [:to_a],
+    to_a: %i[to_h to_ary],
+    to_h: %i[to_a to_hash],
     downcase: [:upcase],
     upcase: [:downcase],
     strip: %i[lstrip rstrip],
     lstrip: [:strip],
     rstrip: [:strip],
     chomp: [:chop],
-    chop: [:chomp]
+    chop: [:chomp],
+    bytes: [:chars],
+    chars: [:bytes],
+    start_with?: [:end_with?],
+    end_with?: [:start_with?],
+    ceil: [:floor],
+    floor: [:ceil],
+    transform_keys: [:transform_values],
+    transform_values: [:transform_keys],
+    append: [:prepend],
+    prepend: [:append],
+    reverse_merge: [:merge],
+    even?: [:odd?],
+    odd?: [:even?],
+    zero?: [:nonzero?],
+    negative?: [:positive?],
+    positive?: [:negative?],
+    pred: [:succ],
+    succ: [:pred],
+    is_a?: [:instance_of?],
+    kind_of?: [:instance_of?]
+  }.freeze
+
+  # Swapped only when called with exactly one argument. Kept out of
+  # REPLACEMENTS, which symbol_to_proc_replacement also reads: `&:method`
+  # always calls with none, and a zero-argument `method` is usually an
+  # accessor such as `request.method` (the HTTP verb), not Object#method.
+  ONE_ARGUMENT_REPLACEMENTS = {
+    method: [:public_method]
   }.freeze
 
   def visit_call_node(node)
-    replacements = REPLACEMENTS[node.name]
+    replacements = replacements_for(node)
     return super unless replacements
     return super unless node.receiver
 
@@ -58,4 +86,12 @@ class Evilution::Mutator::Operator::SendMutation < Evilution::Mutator::Base
 
     super
   end
+
+  private
+
+  def replacements_for(node)
+    REPLACEMENTS.fetch(node.name) do
+      ONE_ARGUMENT_REPLACEMENTS[node.name] if node.arguments && node.arguments.arguments.length == 1
+    end
+  end
 end

data/lib/evilution/mutator/operator/symbol_to_proc_replacement.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "send_mutation"
+require_relative "collection_replacement"
+
+# Apply the call-site selector tables to a symbol block-pass: `map(&:to_s)`
+# becomes `map(&:to_i)`, `map(&:first)` becomes `map(&:last)`.
+#
+# send_mutation and collection_replacement only see explicit calls, so a
+# selector passed as `&:sym` was never swapped — only removed. This reads
+# both tables live, so selectors added to them apply here too.
+#
+# Replacements that are Ruby aliases of the original (`collect` / `map`,
+# `find` / `detect`, `select` / `filter`, `length` / `size` / `count`) are
+# skipped: on the receivers these selectors are normally mapped over, the
+# mutant behaves identically.
+class Evilution::Mutator::Operator::SymbolToProcReplacement < Evilution::Mutator::Base
+  TABLES = [
+    Evilution::Mutator::Operator::SendMutation::REPLACEMENTS,
+    Evilution::Mutator::Operator::CollectionReplacement::REPLACEMENTS
+  ].freeze
+  private_constant :TABLES
+
+  ALIAS_GROUPS = [
+    %i[map collect],
+    %i[find detect],
+    %i[select filter],
+    %i[length size count]
+  ].freeze
+  private_constant :ALIAS_GROUPS
+
+  def visit_block_argument_node(node)
+    symbol = node.expression
+    replace_selector(node, symbol) if symbol.is_a?(Prism::SymbolNode)
+    super
+  end
+
+  private
+
+  def replace_selector(node, symbol)
+    selector = symbol.unescaped.to_sym
+    location = symbol.value_loc
+
+    replacements_for(selector).each do |replacement|
+      add_mutation(
+        offset: location.start_offset,
+        length: location.length,
+        replacement: replacement.to_s,
+        node: node
+      )
+    end
+  end
+
+  def replacements_for(selector)
+    aliases = ALIAS_GROUPS.find { |group| group.include?(selector) } || []
+    TABLES.flat_map { |table| table.fetch(selector, []) }.uniq - aliases
+  end
+end