evilution 1.3.0 → 1.4.0

data/lib/evilution/mutator/operator/regexp_character_type_complement.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../../ast/regexp_pattern"
+
+# Flip a character type of a regexp to its complement: `\d` becomes `\D`,
+# `\w` becomes `\W`, `\b` becomes `\B`, and back.
+#
+# The pattern keeps its shape but accepts the opposite characters, so a
+# survivor means the suite never feeds the pattern both input it should match
+# and input it should reject at that position.
+#
+# `\X` (grapheme cluster) and `\R` (line break) are not complements — `\X`
+# matches a line break too — so they are left alone, as are Unicode
+# properties. The pattern is read with regexp_parser, so escaped backslashes
+# and extended-mode comments are not mistaken for character types.
+#
+# Unlike the structural regexp edits, a flip needs no compile check: it swaps
+# one escape for another of the same kind and cannot touch a group or a
+# reference. Across 37,840 flips in real code, every mutant compiled.
+class Evilution::Mutator::Operator::RegexpCharacterTypeComplement < Evilution::Mutator::Base
+  # Complements by the scanner's token kind and name rather than by text:
+  # inside a character class `\b` scans as a backspace escape, and `\p{Digit}`
+  # shares the `digit` name under the property kind.
+  COMPLEMENTS = {
+    type: {
+      digit: "\\D", nondigit: "\\d",
+      space: "\\S", nonspace: "\\s",
+      word: "\\W", nonword: "\\w",
+      hex: "\\H", nonhex: "\\h"
+    },
+    anchor: { word_boundary: "\\B", nonword_boundary: "\\b" }
+  }.freeze
+
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node)
+    pattern.tokens.each { |token| flip(node, token) } if pattern
+    super
+  end
+
+  private
+
+  def flip(node, token)
+    complement = COMPLEMENTS.fetch(token.type, {})[token.token]
+    return if complement.nil?
+
+    add_mutation(
+      offset: token.start_offset,
+      length: token.end_offset - token.start_offset,
+      replacement: complement,
+      node: node
+    )
+  end
+end

data/lib/evilution/mutator/operator/regexp_named_group_rename.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../../ast/regexp_pattern"
+
+# Rename a named regexp group: `/(?<user>\w+)@/` becomes `/(?<_user>\w+)@/`.
+#
+# The pattern still matches and still captures, but `m[:user]`, `$~[:user]` or
+# the local variable that `/(?<user>...)/ =~ s` binds no longer find it. A survivor
+# means nothing outside the pattern reads the named capture.
+#
+# References inside the pattern (`\k<user>`, `\g<user>`, `\k<user+1>`) are
+# renamed along with the group, as is every group sharing the name, so the
+# pattern itself stays valid and only outside references break; with every
+# occurrence renamed together it always compiles. The new name is the old one
+# with an underscore in front, more if that name is taken. As with
+# RegexpCaptureToPassive, a regexp passed straight to `match?` or `!~` exposes
+# no captures and is skipped.
+class Evilution::Mutator::Operator::RegexpNamedGroupRename < Evilution::Mutator::Base
+  CAPTURE_FREE_CALLS = %i[match? !~].freeze
+  NAMED_GROUP_TOKENS = %i[named_ab named_sq].freeze
+
+  # `(?<name>` / `(?'name'`, and `\k<name>`, `\g'name'`, `\k<name+1>`.
+  GROUP_NAME = /\A(\(\?[<'])([^>']+)([>'])\z/
+  REFERENCE_NAME = /\A(\\[kg][<'])([^>'+-]+)(.*)\z/m
+
+  def initialize(**options)
+    super
+    @capture_free = Set.new.compare_by_identity
+  end
+
+  def visit_call_node(node)
+    if CAPTURE_FREE_CALLS.include?(node.name)
+      @capture_free << node.receiver
+      @capture_free.merge(node.arguments.arguments) if node.arguments
+    end
+    super
+  end
+
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node) unless @capture_free.include?(node)
+    rename_groups(node, pattern) if pattern
+    super
+  end
+
+  private
+
+  def rename_groups(node, pattern)
+    occurrences = name_occurrences(pattern.tokens)
+    group_names = occurrences.filter_map { |_token, name, kind| name if kind == :group }.uniq
+
+    group_names.each do |name|
+      renamed = free_name(name, group_names)
+      edits = occurrences.select { |_token, other, _kind| other == name }
+      emit_rename(node, edits, renamed)
+    end
+  end
+
+  # Every group opener and named reference, with the name it carries.
+  def name_occurrences(tokens)
+    tokens.filter_map do |token|
+      if token.type == :group && NAMED_GROUP_TOKENS.include?(token.token)
+        [token, token.text[GROUP_NAME, 2], :group]
+      elsif token.type == :backref && token.token.to_s.start_with?("name")
+        [token, token.text[REFERENCE_NAME, 2], :reference]
+      end
+    end
+  end
+
+  def free_name(name, taken)
+    candidate = "_#{name}"
+    candidate = "_#{candidate}" while taken.include?(candidate)
+    candidate
+  end
+
+  # The occurrences are spread through the pattern, while a mutation replaces
+  # one contiguous range, so the range runs from the first to the last and is
+  # rewritten with every occurrence renamed.
+  def emit_rename(node, edits, renamed)
+    start_offset = edits.first.first.start_offset
+    length = edits.last.first.end_offset - start_offset
+
+    add_mutation(
+      offset: start_offset,
+      length: length,
+      replacement: apply_renames(byteslice_source(start_offset, length), edits, start_offset, renamed),
+      node: node
+    )
+  end
+
+  # Applied last to first, so a rename never shifts the offsets of those still
+  # to come.
+  def apply_renames(text, edits, base_offset, renamed)
+    edits.reverse_each do |token, _name, kind|
+      relative = token.start_offset - base_offset
+      text = text.byteslice(0, relative) + renamed_text(token.text, kind, renamed) +
+             text.byteslice((relative + token.text.bytesize)..)
+    end
+    text
+  end
+
+  def renamed_text(text, kind, renamed)
+    pattern = kind == :group ? GROUP_NAME : REFERENCE_NAME
+    text.sub(pattern) { "#{Regexp.last_match(1)}#{renamed}#{Regexp.last_match(3)}" }
+  end
+end

data/lib/evilution/mutator/operator/regexp_option_removal.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../../ast/regexp_pattern"
+
+# Drop the `i` or `m` option of a regexp literal: `/admin/i` becomes `/admin/`,
+# `/a.b/m` becomes `/a.b/`.
+#
+# Without `i` the pattern matches only the letter case it is written in;
+# without `m` a `.` no longer matches a newline. A survivor means no example
+# feeds the pattern input in another case, or a newline where a `.` stands.
+#
+# A flag is only dropped where it changes something: `i` needs a cased letter
+# written in the pattern (escapes such as `\d` and `\w` do not count), and `m`
+# needs a `.` outside a character class. Other options (`x`, `o`, encodings)
+# are left alone.
+class Evilution::Mutator::Operator::RegexpOptionRemoval < Evilution::Mutator::Base
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node)
+    if pattern
+      drop_option(node, "i") if node.ignore_case? && cased_letter?(pattern)
+      drop_option(node, "m") if node.multi_line? && dot?(pattern)
+    end
+
+    super
+  end
+
+  private
+
+  def cased_letter?(pattern)
+    pattern.tokens.any? do |token|
+      token.type == :literal && token.text.each_char.any? { |char| char.swapcase != char }
+    end
+  end
+
+  def dot?(pattern)
+    pattern.tokens.any? { |token| token.type == :meta && token.token == :dot }
+  end
+
+  # The options follow the closing delimiter: `/im`, `}mi`.
+  def drop_option(node, option)
+    closing = node.closing_loc
+
+    add_mutation(
+      offset: closing.start_offset + closing.slice.index(option),
+      length: 1,
+      replacement: "",
+      node: node
+    )
+  end
+end

data/lib/evilution/mutator/operator/regexp_quantifier_minimum_swap.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../../ast/regexp_pattern"
+
+# Swap a regexp quantifier between "zero or more" and "one or more": `*`
+# becomes `+` and `+` becomes `*`, keeping a lazy (`*?`) or possessive (`*+`)
+# quantifier lazy or possessive.
+#
+# Only the empty case changes: `/\A\d*\z/` accepts "" and `/\A\d+\z/` does
+# not. A survivor means no example checks how the pattern treats an absent
+# repetition. RegexSimplification's quantifier removal changes the many case
+# too; this isolates the empty one.
+#
+# Making a recursive `\g<name>` call mandatory can make the pattern recurse
+# forever, so each mutant is compiled first and dropped if it does not.
+class Evilution::Mutator::Operator::RegexpQuantifierMinimumSwap < Evilution::Mutator::Base
+  SWAPS = {
+    zero_or_more: "+", zero_or_more_reluctant: "+?", zero_or_more_possessive: "++",
+    one_or_more: "*", one_or_more_reluctant: "*?", one_or_more_possessive: "*+"
+  }.freeze
+
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node)
+    pattern.tokens.each { |token| swap(node, pattern, token) } if pattern
+    super
+  end
+
+  private
+
+  def swap(node, pattern, token)
+    return unless token.type == :quantifier
+
+    replacement = SWAPS[token.token]
+    return if replacement.nil?
+    return unless pattern.compiles?(token.start_offset, token.end_offset, replacement)
+
+    add_mutation(
+      offset: token.start_offset,
+      length: token.end_offset - token.start_offset,
+      replacement: replacement,
+      node: node
+    )
+  end
+end

data/lib/evilution/mutator/operator/rescue_else_concatenation.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../rescue_handlers"
+
+# Move the else clause of a rescue into the code it guards, keeping the rescue:
+#
+#   begin                    begin
+#     fetch(id)                fetch(id)
+#   rescue StandardError ->    notify
+#     default                rescue StandardError
+#   else                       default
+#     notify                 end
+#   end
+#
+# The else code still runs only when the body succeeded; the one thing that
+# changes is that an error it raises is now caught by the rescue, where an
+# else clause is not protected. A survivor means no test lets the else code
+# fail in a way the rescue would swallow.
+#
+# Only a rescue with at least one broad clause — a bare `rescue`, or one
+# naming StandardError or Exception — is mutated. Under a rescue for specific
+# classes the moved code changes behaviour only if it raises one of them,
+# which it rarely does, so those mutants would mostly survive without saying
+# anything. An empty else clause and a rescue around an empty body are
+# skipped; ensure clauses and every rescue clause stay as written.
+class Evilution::Mutator::Operator::RescueElseConcatenation < Evilution::Mutator::Base
+  BROAD_EXCEPTIONS = %w[StandardError ::StandardError Exception ::Exception].freeze
+
+  def visit_begin_node(node)
+    else_clause = node.else_clause
+    move_else(node, else_clause) if node.statements && else_clause && else_clause.statements && broad_rescue?(node)
+    super
+  end
+
+  private
+
+  def broad_rescue?(node)
+    Evilution::Mutator::RescueHandlers.new(node).clauses.any? do |clause|
+      clause.exceptions.empty? || clause.exceptions.any? { |exception| BROAD_EXCEPTIONS.include?(exception.slice) }
+    end
+  end
+
+  # One edit from the end of the body to the end of the else body: the else
+  # statements go first, then the rescue clauses as they were, with the
+  # whitespace (and a one-line `;`) that led into `else` trimmed off.
+  def move_else(node, else_clause)
+    body_end = node.statements.location.end_offset
+    continuation = Evilution::Mutator::RescueHandlers.continuation(@file_source, node.statements)
+
+    add_mutation(
+      offset: body_end,
+      length: else_clause.statements.location.end_offset - body_end,
+      replacement: "#{continuation}#{else_clause.statements.slice}#{rescue_clauses_text(body_end, else_clause)}",
+      node: else_clause
+    )
+  end
+
+  def rescue_clauses_text(body_end, else_clause)
+    byteslice_source(body_end, else_clause.else_keyword_loc.start_offset - body_end).rstrip.delete_suffix(";")
+  end
+end

data/lib/evilution/mutator/operator/rescue_handler_concatenation.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../rescue_handlers"
+
+# Run a rescue handler after the code it protects as well, keeping the rescue:
+#
+#   begin                  begin
+#     fetch(id)              fetch(id)
+#   rescue NotFound    ->    rollback
+#     rollback             rescue NotFound
+#   end                      rollback
+#                          end
+#
+# The failure path is untouched; only a successful run changes, now also
+# doing what the handler does. A survivor means the handler is harmless when
+# nothing failed — the tests never show it is meant for the failure only.
+# Dropping the rescue as well would repeat RescueRemoval and hide this signal
+# behind any test of the failure path.
+#
+# With several rescue clauses each handler is used in its own mutant. An empty
+# handler adds nothing and is skipped, as is one that only produces a value
+# (`nil`, a literal, a variable, a bare `next`): run after the body it changes
+# nothing but the return value, which RescueHandlerPromotion already probes.
+# Handlers that only work inside the rescue are skipped too (see
+# Mutator::RescueHandlers). A rescue modifier sits in value position, where a
+# statement sequence does not fit, and is left alone.
+class Evilution::Mutator::Operator::RescueHandlerConcatenation < Evilution::Mutator::Base
+  VALUE_TYPES = [
+    Prism::NilNode, Prism::TrueNode, Prism::FalseNode, Prism::IntegerNode, Prism::FloatNode,
+    Prism::StringNode, Prism::SymbolNode, Prism::SelfNode, Prism::ConstantReadNode,
+    Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode
+  ].freeze
+
+  def visit_begin_node(node)
+    append_handlers(node) if node.rescue_clause && node.statements
+    super
+  end
+
+  private
+
+  def append_handlers(node)
+    body_end = node.statements.location.end_offset
+    separator = Evilution::Mutator::RescueHandlers.continuation(@file_source, node.statements)
+
+    Evilution::Mutator::RescueHandlers.new(node).clauses.each do |clause|
+      handler = clause.statements
+      next if handler.nil? || value_only?(handler)
+      next unless Evilution::Mutator::RescueHandlers.movable?(handler, clause.reference)
+
+      add_mutation(offset: body_end, length: 0, replacement: "#{separator}#{handler.slice}", node: clause)
+    end
+  end
+
+  def value_only?(handler)
+    handler.body.all? { |statement| value?(statement) }
+  end
+
+  # A method call may act, so only literals, plain reads and a bare `next` /
+  # `return` count.
+  def value?(statement)
+    case statement
+    when *VALUE_TYPES then true
+    when Prism::ArrayNode, Prism::HashNode then statement.elements.empty?
+    when Prism::NextNode, Prism::ReturnNode then statement.arguments.nil?
+    else false
+    end
+  end
+end

data/lib/evilution/mutator/operator/rescue_handler_promotion.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../rescue_handlers"
+
+# Run a rescue handler instead of the code it protects:
+# `begin; fetch(id); rescue NotFound; default; end` becomes
+# `begin; default; end`, a method-level rescue does the same to the method
+# body, and `fetch(id) rescue default` becomes `default`.
+#
+# The happy path never runs, so a survivor means the tests accept the
+# fallback value where the real result was expected — they never check what
+# the protected code returns.
+#
+# With several rescue clauses each handler is promoted in its own mutant. An
+# else clause goes with the body, since it only runs when nothing is rescued;
+# an ensure clause stays. An empty handler becomes `nil`, what a swallowed
+# error returns.
+#
+# Handlers that only make sense inside the rescue are skipped, since promoted
+# they fail for that reason alone; Mutator::RescueHandlers holds the rule.
+class Evilution::Mutator::Operator::RescueHandlerPromotion < Evilution::Mutator::Base
+  def visit_begin_node(node)
+    promote_handlers(node) if node.rescue_clause && node.statements
+    super
+  end
+
+  def visit_rescue_modifier_node(node)
+    fallback = node.rescue_expression
+    replace(node, fallback.slice, node) if Evilution::Mutator::RescueHandlers.movable?(fallback, nil)
+    super
+  end
+
+  private
+
+  def promote_handlers(node)
+    start_offset = node.statements.location.start_offset
+    end_offset = protected_end(node)
+
+    Evilution::Mutator::RescueHandlers.new(node).clauses.each do |clause|
+      next unless Evilution::Mutator::RescueHandlers.movable?(clause.statements, clause.reference)
+
+      handler = clause.statements ? clause.statements.slice : "nil"
+      add_mutation(offset: start_offset, length: end_offset - start_offset, replacement: handler, node: clause)
+    end
+  end
+
+  # The body, every rescue clause and an else clause are replaced; an ensure
+  # clause and the closing `end` stay. A rescue clause's location runs on
+  # through the clauses after it, and an else clause's up to the keyword that
+  # follows it, so the span ends at the last clause's own content.
+  def protected_end(node)
+    else_clause = node.else_clause
+    return Evilution::Mutator::RescueHandlers.new(node).clauses.last.location.end_offset if else_clause.nil?
+
+    return else_clause.statements.location.end_offset if else_clause.statements
+
+    else_clause.else_keyword_loc.end_offset
+  end
+
+  def replace(target, replacement, node)
+    location = target.location
+    add_mutation(offset: location.start_offset, length: location.length, replacement: replacement, node: node)
+  end
+end

data/lib/evilution/mutator/operator/return_keyword_removal.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../rescue_handlers"
+
+# Drop the `return` keyword and keep its value: `return :neg if x.negative?`
+# becomes `:neg if x.negative?`.
+#
+# Control flow continues past the point where the method used to leave, so a
+# survivor means no test notices the code after a guard clause or an early
+# return running anyway. ReturnValueRemoval keeps the early exit and drops the
+# value; this keeps the value and drops the exit. Several values become an
+# array, as `return` would make them: `return a, b` becomes `[a, b]`.
+#
+# A return in tail position — the method's last statement, the last statement
+# of a branch that is itself in tail position, or the tail of a lambda — is
+# skipped: its value is the result either way. A return inside a block always
+# leaves the method, so it is never tail position. A bare `return` has no
+# value to keep.
+class Evilution::Mutator::Operator::ReturnKeywordRemoval < Evilution::Mutator::Base
+  # For each node that passes a value on, the parts whose value becomes its
+  # own. With an else clause a begin body's value is not the result, the
+  # else's is; each rescue handler's value can be the result too.
+  TAIL_PARTS = {
+    Prism::StatementsNode => ->(node) { [node.body.last] },
+    Prism::ParenthesesNode => ->(node) { [node.body] },
+    Prism::ElseNode => ->(node) { [node.statements] },
+    Prism::IfNode => ->(node) { [node.statements, node.subsequent] },
+    Prism::UnlessNode => ->(node) { [node.statements, node.else_clause] },
+    Prism::CaseNode => ->(node) { [*node.conditions.map(&:statements), node.else_clause] },
+    Prism::CaseMatchNode => ->(node) { [*node.conditions.map(&:statements), node.else_clause] },
+    Prism::BeginNode => lambda { |node|
+      [node.else_clause || node.statements, *Evilution::Mutator::RescueHandlers.new(node).clauses.map(&:statements)]
+    }
+  }.freeze
+
+  def initialize(**options)
+    super
+    @tail_returns = Set.new.compare_by_identity
+  end
+
+  def visit_def_node(node)
+    @tail_returns.merge(tail_returns(node.body))
+    super
+  end
+
+  def visit_lambda_node(node)
+    @tail_returns.merge(tail_returns(node.body))
+    super
+  end
+
+  def visit_return_node(node)
+    drop_keyword(node) if node.arguments && !@tail_returns.include?(node)
+    super
+  end
+
+  private
+
+  def drop_keyword(node)
+    arguments = node.arguments.arguments
+    value = if arguments.length == 1 && !arguments.first.is_a?(Prism::SplatNode)
+              arguments.first.slice
+            else
+              "[#{arguments.map(&:slice).join(", ")}]"
+            end
+
+    add_mutation(offset: node.location.start_offset, length: node.location.length, replacement: value, node: node)
+  end
+
+  # The returns whose value is the value of `node` itself.
+  def tail_returns(node)
+    return [node] if node.is_a?(Prism::ReturnNode)
+
+    parts = TAIL_PARTS[node.class]
+    return [] if parts.nil?
+
+    parts.call(node).compact.flat_map { |part| tail_returns(part) }
+  end
+end

data/lib/evilution/mutator/operator/rightward_assignment.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Turn a rightward pattern match into a pattern predicate: `value => [a, b]`
+# becomes `value in [a, b]`.
+#
+# On a mismatch the original raises NoMatchingPatternError, while the predicate
+# returns false and leaves the pattern's variables nil. A survivor means no
+# example feeds the match a value it rejects, so the failure mode is untested.
+class Evilution::Mutator::Operator::RightwardAssignment < Evilution::Mutator::Base
+  def visit_match_required_node(node)
+    replace_operator(node) unless irrefutable?(node.pattern)
+    super
+  end
+
+  private
+
+  def replace_operator(node)
+    location = node.operator_loc
+
+    add_mutation(
+      offset: location.start_offset,
+      length: location.length,
+      replacement: keyword_for(node),
+      node: node
+    )
+  end
+
+  # `=>` is punctuation and may touch its neighbours (`value=>Integer`), but
+  # `in` is a word: written flush against them it would merge into a single
+  # name. A space is added on each side that has none.
+  def keyword_for(node)
+    location = node.operator_loc
+    before = node.value.location.end_offset == location.start_offset ? " " : ""
+    after = node.pattern.location.start_offset == location.end_offset ? " " : ""
+
+    "#{before}in#{after}"
+  end
+
+  # A bare name (`value => captured`, `value => _`) captures any value, so the
+  # match can never raise and the predicate form would behave the same.
+  def irrefutable?(pattern)
+    pattern.is_a?(Prism::LocalVariableTargetNode)
+  end
+end

data/lib/evilution/mutator/operator/send_mutation.rb

@@ -43,6 +43,8 @@ class Evilution::Mutator::Operator::SendMutation < Evilution::Mutator::Base
     end_with?: [:start_with?],
     ceil: [:floor],
     floor: [:ceil],
+    round: %i[floor ceil],
+    truncate: [:floor],
     transform_keys: [:transform_values],
     transform_values: [:transform_keys],
     append: [:prepend],

data/lib/evilution/mutator/operator/splat_operator.rb

@@ -4,7 +4,7 @@ require_relative "../operator"
 
 class Evilution::Mutator::Operator::SplatOperator < Evilution::Mutator::Base
   def visit_splat_node(node)
-    mutate_remove_splat(node) if node.expression
+    mutate_remove_splat(node) if node.expression && !pattern_rests.include?(node)
 
     super
   end
@@ -14,20 +14,40 @@ class Evilution::Mutator::Operator::SplatOperator < Evilution::Mutator::Base
     super
   end
 
+  # The rest of a pattern binds what is left over; it is not a splat in a
+  # call or a literal, so these splats are skipped. Dropping `**` from
+  # `{ key:, **opts }` is a syntax error. Dropping `*` from `[a, *rest]`
+  # parses, but it narrows the pattern to a fixed length. That mutant is
+  # deliberately not emitted, and the pattern operators keep a binding rest
+  # (`*rest`, `**opts`) as written. The rest of a multiple assignment
+  # (`a, *b = x`) is still mutated: `a, b = x` parses and changes what `b`
+  # binds.
+  def visit_hash_pattern_node(node)
+    pattern_rests.add(node.rest) if node.rest
+    super
+  end
+
+  def visit_array_pattern_node(node)
+    pattern_rests.add(node.rest) if node.rest
+    super
+  end
+
+  def visit_find_pattern_node(node)
+    pattern_rests.add(node.left)
+    pattern_rests.add(node.right)
+    super
+  end
+
   # KeywordHashNode wraps call-arg kwargs + `**splat`. When an explicit
-  # `k: v` precedes a `**opts` splat in the same call, demoting `**opts` to
-  # bare `opts` puts a positional after a keyword and Ruby rejects it
-  # (`bar(k: v, opts)` is a syntax error). Mark such splats so
-  # `visit_assoc_splat_node` skips them. Splats that come BEFORE any kwarg
-  # (`bar(**opts, k: v)`) are still safe — positional-before-keyword is fine.
+  # `k: v` or another `**splat` precedes a `**opts` splat in the same call,
+  # demoting `**opts` to bare `opts` puts a positional after a keyword
+  # argument and Ruby rejects it (`bar(k: v, opts)` and `bar(**a, opts)` are
+  # syntax errors). Mark such splats so `visit_assoc_splat_node` skips them.
+  # A splat that comes first (`bar(**opts, k: v)`) is still safe —
+  # positional-before-keyword is fine.
   def visit_keyword_hash_node(node)
-    seen_kwarg = false
-    node.elements.each do |el|
-      if el.is_a?(Prism::AssocSplatNode) && seen_kwarg
-        kwarg_preceded_splats.add(el)
-      elsif el.is_a?(Prism::AssocNode)
-        seen_kwarg = true
-      end
+    node.elements.drop(1).each do |el|
+      kwarg_preceded_splats.add(el) if el.is_a?(Prism::AssocSplatNode)
     end
 
     super
@@ -37,6 +57,7 @@ class Evilution::Mutator::Operator::SplatOperator < Evilution::Mutator::Base
     return super if node.value.nil?
     return super if hash_elements.include?(node)
     return super if kwarg_preceded_splats.include?(node)
+    return super if pattern_rests.include?(node)
 
     mutate_remove_double_splat(node)
 
@@ -53,6 +74,10 @@ class Evilution::Mutator::Operator::SplatOperator < Evilution::Mutator::Base
     @kwarg_preceded_splats ||= Set.new.compare_by_identity
   end
 
+  def pattern_rests
+    @pattern_rests ||= Set.new.compare_by_identity
+  end
+
   def mutate_remove_splat(node)
     add_mutation(
       offset: node.location.start_offset,