evilution 1.3.0 → 1.4.0

data/lib/evilution/mutator/operator/off_by_one_boundary.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Shift a count held in a variable down by one: `n.times` becomes
+# `(n - 1).times`, `items.first(n)` becomes `items.first(n - 1)`.
+#
+# A survivor means no example checks the last iteration or the last element,
+# the classic fencepost slip. A literal count is left to IntegerLiteral, which
+# already shifts it; this operator reaches the counts that have no literal.
+class Evilution::Mutator::Operator::OffByOneBoundary < Evilution::Mutator::Base
+  # Methods whose receiver is the count.
+  RECEIVER_COUNT_METHODS = %i[times].freeze
+
+  # Methods whose single argument is the count or the bound.
+  ARGUMENT_COUNT_METHODS = %i[upto downto take first last drop each_slice each_cons].freeze
+
+  # Arguments that stand in the list without being a value: a splat,
+  # keywords, forwarded arguments. Subtracting from them would not parse.
+  NON_VALUE_ARGUMENT_TYPES = [
+    Prism::SplatNode, Prism::KeywordHashNode, Prism::ForwardingArgumentsNode
+  ].freeze
+
+  def visit_call_node(node)
+    shift_count(node) unless node.safe_navigation?
+    super
+  end
+
+  private
+
+  def shift_count(node)
+    count = count_of(node)
+    return if count.nil? || count.is_a?(Prism::IntegerNode)
+
+    add_mutation(
+      offset: count.location.start_offset,
+      length: count.location.length,
+      replacement: lowered(node, count),
+      node: node
+    )
+  end
+
+  def count_of(node)
+    if RECEIVER_COUNT_METHODS.include?(node.name)
+      node.receiver if node.arguments.nil?
+    elsif ARGUMENT_COUNT_METHODS.include?(node.name)
+      single_argument(node)
+    end
+  end
+
+  def single_argument(node)
+    return nil if node.arguments.nil?
+
+    arguments = node.arguments.arguments
+    return nil unless arguments.length == 1
+    return nil if NON_VALUE_ARGUMENT_TYPES.include?(arguments.first.class)
+
+    arguments.first
+  end
+
+  # A receiver is followed by `.method`, so the subtraction is grouped; an
+  # argument stands on its own and only needs grouping when it is not a
+  # primary expression.
+  def lowered(node, count)
+    subtraction = "#{receiver_source(count)} - 1"
+    count.equal?(node.receiver) ? "(#{subtraction})" : subtraction
+  end
+end

data/lib/evilution/mutator/operator/optional_parameter_to_required.rb

@@ -12,21 +12,32 @@ require_relative "../operator"
 # that pass the argument are unaffected, which is what separates this from a
 # mutation that breaks every call site.
 #
-# Ruby allows a required parameter to follow an optional one, so each optional
-# is mutated on its own and the rest of the signature stays as written.
+# Optional parameters have to sit side by side, so only the ends of a run of
+# them are mutated; a required parameter in the middle would split it in two.
+# The first can always join the required parameters before it. The last can
+# join those after it, unless a rest parameter follows: a required parameter
+# cannot stand between an optional one and `*rest`. The rest of the signature
+# stays as written.
 # KeywordArgument owns optional keyword parameters. Blocks are left alone: a
 # block ignores arity, so a missing argument arrives as nil rather than raising,
 # and making its parameter required would change nothing.
 class Evilution::Mutator::Operator::OptionalParameterToRequired < Evilution::Mutator::Base
   def visit_def_node(node)
     parameters = node.parameters
-    parameters.optionals.each { |optional| require_parameter(optional) } if parameters
+    mutable_optionals(parameters).each { |optional| require_parameter(optional) } if parameters
 
     super
   end
 
   private
 
+  def mutable_optionals(parameters)
+    optionals = parameters.optionals
+    return optionals.first(1) if parameters.rest
+
+    [optionals.first, optionals.last].compact.uniq
+  end
+
   def require_parameter(node)
     location = node.location
     name_loc = node.name_loc

data/lib/evilution/mutator/operator/pattern_matching_array.rb

@@ -83,14 +83,25 @@ class Evilution::Mutator::Operator::PatternMatchingArray < Evilution::Mutator::B
   end
 
   def replace_pattern(node, parts)
+    constant = node.constant ? source_for(node.constant) : ""
+    opening, closing = delimiters(node)
+
     add_mutation(
       offset: node.location.start_offset,
       length: node.location.length,
-      replacement: "[#{parts.join(", ")}]",
+      replacement: "#{constant}#{opening}#{parts.join(", ")}#{closing}",
       node: node
     )
   end
 
+  # A pattern written without brackets (`in a, b`) has no delimiters of its
+  # own, so the mutant is given square ones.
+  def delimiters(node)
+    return ["[", "]"] if node.opening_loc.nil?
+
+    [node.opening_loc.slice, node.closing_loc.slice]
+  end
+
   def source_for(node)
     @file_source.byteslice(node.location.start_offset, node.location.length)
   end

data/lib/evilution/mutator/operator/pattern_wildcard_widening.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Widen a pattern so it accepts input the original rejects:
+#
+#   in [a, b]               ->  in [a, b, *]        longer arrays
+#   in { age: Integer }     ->  in { age: _ }       any value under the key
+#   in { name: String, age: Integer }
+#                           ->  in { name: String } hashes without the key
+#   in { kind: :a, **nil }  ->  in { kind: :a }     hashes with other keys
+#
+# A survivor means no example feeds the pattern one of the shapes it is written
+# to turn away.
+#
+# Elements of array and find patterns are widened by PatternMatchingArray. Here
+# the pattern itself is opened up, and every edit keeps the variables the
+# pattern binds, so the branch body still runs as written.
+class Evilution::Mutator::Operator::PatternWildcardWidening < Evilution::Mutator::Base
+  WILDCARD = "_"
+  UNWIDENABLE_VALUE_TYPES = [Prism::LocalVariableTargetNode, Prism::ImplicitNode].freeze
+
+  def visit_array_pattern_node(node)
+    append_rest(node)
+    super
+  end
+
+  def visit_hash_pattern_node(node)
+    widen_pairs(node)
+    drop_closing_rest(node)
+    super
+  end
+
+  private
+
+  # A pattern with a rest is open already, at whichever end the rest sits, and
+  # an empty one has no element to append after.
+  def append_rest(node)
+    return unless node.rest.nil?
+    return if node.requireds.empty?
+
+    add_mutation(
+      offset: node.requireds.last.location.end_offset,
+      length: 0,
+      replacement: ", *",
+      node: node
+    )
+  end
+
+  def widen_pairs(node)
+    node.elements.each_with_index do |pair, index|
+      next if binds_variable?(pair.value)
+
+      wildcard_value(node, pair)
+      # `in {}` matches the empty hash only, so dropping the last key would
+      # narrow the pattern rather than widen it.
+      drop_pair(node, index) if node.elements.length > 1
+    end
+  end
+
+  # A bare name reaching here is an underscore one, which already accepts any
+  # value; rewriting it to `_` would change nothing. A shorthand key
+  # (`_ignored:`) has no value pattern of its own: its implicit value spans the
+  # key, so writing a wildcard there would rename the key instead.
+  def wildcard_value(node, pair)
+    return if UNWIDENABLE_VALUE_TYPES.include?(pair.value.class)
+
+    location = pair.value.location
+
+    add_mutation(
+      offset: location.start_offset,
+      length: location.length,
+      replacement: WILDCARD,
+      node: node
+    )
+  end
+
+  def drop_pair(node, index)
+    remaining = node.elements.dup
+    remaining.delete_at(index)
+    replace_members(node, remaining + [node.rest].compact)
+  end
+
+  # `**nil` forbids keys the pattern does not name. On its own it leaves a
+  # pattern that matches the empty hash only, with or without it.
+  def drop_closing_rest(node)
+    return unless node.rest.is_a?(Prism::NoKeywordsParameterNode)
+    return if node.elements.empty?
+
+    replace_members(node, node.elements)
+  end
+
+  # Rewrites what sits between the delimiters, so braces, parentheses and a
+  # constant in front of them stay as written.
+  def replace_members(node, members)
+    all = node.elements + [node.rest].compact
+    start_offset = all.first.location.start_offset
+    end_offset = all.last.location.end_offset
+
+    add_mutation(
+      offset: start_offset,
+      length: end_offset - start_offset,
+      replacement: members.map(&:slice).join(", "),
+      node: node
+    )
+  end
+
+  # Whether the value pattern captures into a variable the branch body could
+  # read. Taking such a pair away, or widening it to a wildcard, would break
+  # the body on the missing name whatever the tests assert. An underscore name
+  # is a wildcard by convention and is not counted.
+  def binds_variable?(node)
+    return !node.name.start_with?(WILDCARD) if node.is_a?(Prism::LocalVariableTargetNode)
+
+    node.compact_child_nodes.any? { |child| binds_variable?(child) }
+  end
+end

data/lib/evilution/mutator/operator/pin_operator_removal.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Drop the pin of a pattern variable: `in ^expected` becomes `in expected`.
+#
+# A pinned variable compares the matched value against an existing binding;
+# without the pin the same name captures whatever is there, so the pattern
+# matches every value. A survivor means no example feeds the pattern a value
+# that differs from the pinned one.
+class Evilution::Mutator::Operator::PinOperatorRemoval < Evilution::Mutator::Base
+  def initialize(**options)
+    super
+    @alternation_depth = 0
+  end
+
+  # An alternative pattern (`^a | ^b`) may not capture, at any depth inside it,
+  # so no pin under one has an unpinned form. Tracked here rather than left to
+  # the parse check: older Prism releases accept the capture that Ruby rejects.
+  def visit_alternation_pattern_node(node)
+    @alternation_depth += 1
+    super
+  ensure
+    @alternation_depth -= 1
+  end
+
+  def visit_pinned_variable_node(node)
+    remove_pin(node) if @alternation_depth.zero?
+    super
+  end
+
+  private
+
+  # Other pins without an unpinned form are caught by the parse check. Only a
+  # local name can stand as a capturing pattern, so `^@expected` and
+  # `^$expected` have none, and neither does a numbered parameter (`^_1`).
+  # Those rewrites carry no signal, so they are dropped rather than reported
+  # as unparseable.
+  def remove_pin(node)
+    add_mutation(
+      offset: node.location.start_offset,
+      length: node.location.length,
+      replacement: node.variable.slice,
+      node: node,
+      skip_unparseable: true
+    )
+  end
+end

data/lib/evilution/mutator/operator/regex_simplification.rb

@@ -1,164 +1,85 @@
 # frozen_string_literal: true
 
 require_relative "../operator"
-
+require_relative "../../ast/regexp_pattern"
+
+# Simplify a regexp literal one piece at a time: remove a quantifier
+# (`/a+/` -> `/a/`), remove an anchor (`/^a$/` -> `/a$/`), or drop the dash of
+# a character-class range (`/[a-z]/` -> `/[az]/`).
+#
+# The pattern is read with regexp_parser, so only real quantifiers, anchors and
+# ranges are touched: the `?` of a group opener (`(?:`, `(?<name>`, `(?=`), the
+# inside of a `(?#...)` comment, a property's negation (`\p{^Alpha}`) and the
+# comments of an extended pattern contain the same characters without being
+# any of them. Each edit is made in place in the source and kept only if the
+# pattern still compiles.
 class Evilution::Mutator::Operator::RegexSimplification < Evilution::Mutator::Base
-  def visit_regular_expression_node(node)
-    content = node.content
-    return super if content.empty?
-
-    content_offset = node.content_loc.start_offset
+  # Line and string anchors. Word boundaries and `\G` are assertions of a
+  # different kind and are left alone.
+  REMOVABLE_ANCHORS = %i[bol eol bos eos eos_ob_eol].freeze
 
-    remove_quantifiers(node, content, content_offset)
-    remove_anchors(node, content, content_offset)
-    remove_character_class_ranges(node, content, content_offset)
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node)
+    if pattern
+      remove_quantifiers(node, pattern)
+      remove_anchors(node, pattern)
+      remove_class_ranges(node, pattern)
+    end
 
     super
   end
 
   private
 
-  def remove_quantifiers(node, content, content_offset)
-    scan_regex_positions(content) do |kind, i|
-      case kind
-      when :backslash then 2
-      when :class_open then class_skip(content, i)
-      when :char then emit_quantifier_at(node, content, content_offset, i)
-      end
-    end
-  end
-
-  def emit_quantifier_at(node, content, content_offset, i)
-    match = match_quantifier(content, i)
-    return 1 if match.nil?
-
-    add_mutation(offset: content_offset + i, length: match.length, replacement: "", node: node)
-    match.length
-  end
-
-  def match_quantifier(content, pos)
-    case content[pos]
-    when "+", "*", "?"
-      content[pos]
-    when "{"
-      if (m = content[pos..].match(/\A\{\d+(?:,\d*)?\}/))
-        m[0]
-      end
+  def remove_quantifiers(node, pattern)
+    quantifier_spans(pattern.tokens).each do |start_offset, end_offset|
+      remove_span(node, pattern, start_offset, end_offset)
     end
   end
 
-  def remove_anchors(node, content, content_offset)
-    scan_regex_positions(content) do |kind, i|
-      case kind
-      when :backslash then try_emit_backslash_anchor(node, content, content_offset, i)
-      when :class_open then class_skip(content, i)
-      when :char
-        try_emit_caret_dollar(node, content, content_offset, i)
-        1
+  # Ruby reads `{2,}?` as one lazy interval, while regexp_parser reports an
+  # interval followed by a `?` quantifier. The two are joined so the lazy
+  # marker is removed with its interval instead of becoming a quantifier of
+  # its own.
+  def quantifier_spans(tokens)
+    quantifiers = tokens.select { |token| token.type == :quantifier }
+    spans = []
+    quantifiers.each do |token|
+      previous = spans.last
+      if lazy_marker_of?(token, previous)
+        previous[1] = token.end_offset
+      else
+        spans << [token.start_offset, token.end_offset, token]
       end
     end
+    spans.map { |start_offset, end_offset, _token| [start_offset, end_offset] }
   end
 
-  def try_emit_backslash_anchor(node, content, content_offset, i)
-    anchor = match_backslash_anchor(content, i)
-    return 2 if anchor.nil?
+  def lazy_marker_of?(token, previous)
+    return false if previous.nil?
 
-    add_mutation(offset: content_offset + i, length: anchor.length, replacement: "", node: node)
-    anchor.length
+    previous.last.text.start_with?("{") && token.text == "?" && previous[1] == token.start_offset
   end
 
-  def try_emit_caret_dollar(node, content, content_offset, i)
-    return unless %w[^ $].include?(content[i])
+  def remove_anchors(node, pattern)
+    pattern.tokens.each do |token|
+      next unless token.type == :anchor && REMOVABLE_ANCHORS.include?(token.token)
 
-    add_mutation(offset: content_offset + i, length: 1, replacement: "", node: node)
-  end
-
-  def match_backslash_anchor(content, pos)
-    return nil unless content[pos] == "\\"
-
-    two_char = content[pos, 2]
-    return two_char if %w[\\A \\z \\Z].include?(two_char)
-
-    nil
-  end
-
-  def remove_character_class_ranges(node, content, content_offset)
-    scan_regex_positions(content) do |kind, i|
-      case kind
-      when :backslash then 2
-      when :class_open
-        scan_ranges_in_class(node, content, content_offset, i)
-        class_skip(content, i)
-      when :char then 1
-      end
+      remove_span(node, pattern, token.start_offset, token.end_offset)
     end
   end
 
-  def scan_ranges_in_class(node, content, content_offset, class_start)
-    first_item = skip_class_prefix(content, class_start)
-    i = first_item
+  def remove_class_ranges(node, pattern)
+    pattern.tokens.each do |token|
+      next unless token.type == :set && token.token == :range
 
-    while i < content.length && content[i] != "]"
-      if content[i] == "\\"
-        i += 2
-        next
-      end
-
-      emit_range_removal(node, content, content_offset, first_item, i) if content[i] == "-"
-      i += 1
+      remove_span(node, pattern, token.start_offset, token.end_offset)
     end
   end
 
-  def skip_class_prefix(content, class_start)
-    i = class_start + 1
-    i += 1 if i < content.length && content[i] == "^"
-    i += 1 if i < content.length && content[i] == "]"
-    i
-  end
+  def remove_span(node, pattern, start_offset, end_offset)
+    return unless pattern.compiles?(start_offset, end_offset, "")
 
-  def emit_range_removal(node, content, content_offset, first_item, pos)
-    return unless pos > first_item && pos + 1 < content.length && content[pos + 1] != "]"
-
-    add_mutation(
-      offset: content_offset + pos,
-      length: 1,
-      replacement: "",
-      node: node
-    )
-  end
-
-  # Walks `content` yielding (kind, position) for each significant token:
-  # :backslash for an escape sequence, :class_open for `[`, :char for any
-  # other byte. The block returns the number of characters to advance from
-  # `position` — callers decide how to handle each case (skip, emit a
-  # mutation, descend into a character class, etc.).
-  def scan_regex_positions(content)
-    i = 0
-    while i < content.length
-      advance = case content[i]
-                when "\\" then yield(:backslash, i)
-                when "[" then yield(:class_open, i)
-                else yield(:char, i)
-                end
-      i += advance
-    end
-  end
-
-  def class_skip(content, pos)
-    skip_character_class(content, pos) - pos
-  end
-
-  def skip_character_class(content, pos)
-    scan_to_class_close(content, skip_class_prefix(content, pos))
-  end
-
-  def scan_to_class_close(content, start)
-    i = start
-    while i < content.length
-      return i + 1 if content[i] == "]"
-
-      i += content[i] == "\\" ? 2 : 1
-    end
-    i
+    add_mutation(offset: start_offset, length: end_offset - start_offset, replacement: "", node: node)
   end
 end

data/lib/evilution/mutator/operator/regexp_alternation_branch_deletion.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../../ast/regexp_pattern"
+
+# Delete one branch of a regexp alternation at a time: `/cat|dog/` becomes
+# `/dog/` and `/cat/`.
+#
+# A survivor means no example feeds the pattern input that only that branch
+# accepts, so the branch could go without any test noticing.
+#
+# Alternations of more than ten branches are skipped: those are lookup tables
+# (generated keyword or emoji lists, for instance), where a deletion per entry
+# floods the report with survivors nobody acts on. Deleting a branch can remove
+# a group that a backreference or a `\g<name>` call elsewhere in the pattern
+# needs, so each mutant is compiled first and dropped if it no longer does.
+class Evilution::Mutator::Operator::RegexpAlternationBranchDeletion < Evilution::Mutator::Base
+  MAX_BRANCHES = 10
+
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node)
+    if pattern
+      pattern.each_expression do |expression, *|
+        delete_branches(node, pattern, expression) if expression.is_a?(Regexp::Expression::Alternation)
+      end
+    end
+
+    super
+  end
+
+  private
+
+  def delete_branches(node, pattern, alternation)
+    branches = alternation.expressions
+    return if branches.length > MAX_BRANCHES
+
+    branches.each_index do |index|
+      start_offset, end_offset = deletion_span(pattern, branches, index)
+      next unless pattern.compiles?(start_offset, end_offset, "")
+
+      add_mutation(offset: start_offset, length: end_offset - start_offset, replacement: "", node: node)
+    end
+  end
+
+  # A branch goes with one neighbouring `|`: the one after it for the first
+  # branch, the one before it for every other.
+  def deletion_span(pattern, branches, index)
+    if index.zero?
+      [pattern.offsets(branches[0]).first, pattern.offsets(branches[1]).first]
+    else
+      [pattern.offsets(branches[index - 1]).last, pattern.offsets(branches[index]).last]
+    end
+  end
+end

data/lib/evilution/mutator/operator/regexp_anchor_promotion.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../../ast/regexp_pattern"
+
+# Promote a line anchor to the matching string anchor: `^` becomes `\A`, `$`
+# becomes `\z`, and `\Z`, which still allows a trailing newline, becomes `\z`.
+#
+# A line anchor also matches around every newline in the input, so `/^admin$/`
+# accepts "evil\nadmin" while `/\Aadmin\z/` does not — the classic multiline
+# injection gap. A survivor means no example feeds the pattern multi-line
+# input, or the anchor should have been a string anchor all along.
+#
+# Unlike RegexSimplification, which removes anchors, this keeps the pattern
+# anchored and only narrows what the anchor accepts. The pattern is read with
+# regexp_parser, so `^` and `$` inside a character class, escaped, or in an
+# extended-mode comment are left alone. Swapping one anchor for another cannot
+# touch a group or a reference, so no compile check is needed.
+class Evilution::Mutator::Operator::RegexpAnchorPromotion < Evilution::Mutator::Base
+  PROMOTIONS = { bol: "\\A", eol: "\\z", eos_ob_eol: "\\z" }.freeze
+
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node)
+    pattern.tokens.each { |token| promote(node, token) } if pattern
+    super
+  end
+
+  private
+
+  def promote(node, token)
+    return unless token.type == :anchor
+
+    promotion = PROMOTIONS[token.token]
+    return if promotion.nil?
+
+    add_mutation(
+      offset: token.start_offset,
+      length: token.end_offset - token.start_offset,
+      replacement: promotion,
+      node: node
+    )
+  end
+end

data/lib/evilution/mutator/operator/regexp_capture_to_passive.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../../ast/regexp_pattern"
+
+# Turn a regexp capture group into a passive group: `/id=(\d+)/` becomes
+# `/id=(?:\d+)/`.
+#
+# The pattern matches the same text but no longer captures, so `$1`, `m[1]`,
+# a `scan` result or a `\1` in a replacement loses its value. A survivor means
+# nothing downstream reads the capture.
+#
+# Only mutants that can change something are emitted:
+# - a regexp passed straight to `match?` or `!~` never exposes its captures;
+# - with a named group present Ruby keeps only named captures, so a plain
+#   group captures nothing to begin with;
+# - a numbered reference inside the pattern (`\2`, `\k<1>`, `\g<1>`) would be
+#   renumbered by the passive group and quietly point elsewhere, which tests
+#   the pattern rather than whether the capture is used.
+#
+# With named groups and numbered references ruled out, nothing else in the
+# pattern can refer to a plain group, so turning it passive always compiles
+# and needs no check.
+class Evilution::Mutator::Operator::RegexpCaptureToPassive < Evilution::Mutator::Base
+  CAPTURE_FREE_CALLS = %i[match? !~].freeze
+  NAMED_GROUP_TOKENS = %i[named_ab named_sq].freeze
+
+  def initialize(**options)
+    super
+    @capture_free = Set.new.compare_by_identity
+  end
+
+  def visit_call_node(node)
+    if CAPTURE_FREE_CALLS.include?(node.name)
+      @capture_free << node.receiver
+      @capture_free.merge(node.arguments.arguments) if node.arguments
+    end
+    super
+  end
+
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node) unless @capture_free.include?(node)
+    pattern.tokens.each { |token| make_passive(node, token) } if pattern && plain_captures_matter?(pattern)
+    super
+  end
+
+  private
+
+  def plain_captures_matter?(pattern)
+    pattern.tokens.none? do |token|
+      (token.type == :group && NAMED_GROUP_TOKENS.include?(token.token)) ||
+        (token.type == :backref && token.token.to_s.start_with?("number"))
+    end
+  end
+
+  def make_passive(node, token)
+    return unless token.type == :group && token.token == :capture
+
+    add_mutation(offset: token.start_offset, length: token.end_offset - token.start_offset, replacement: "(?:", node: node)
+  end
+end