evilution 1.3.0 → 1.5.0

data/lib/evilution/mutator/operator/forwarded_argument_drop.rb

@@ -0,0 +1,142 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Stop forwarding one part of the arguments a method passes through unnamed:
+# `target.call(*, **, &)` becomes `target.call(**, &)`, and so on for each part.
+#
+# A survivor means that part never reaches an assertion — nothing checks that
+# the positional arguments, the keywords or the block arrive at the other end.
+#
+# Two spellings are handled. Anonymous `*` and `**` are dropped from the
+# argument list they are written in. A `...` cannot be split where it stands,
+# because `*`, `**` and `&` may not be written under a `...` signature, so the
+# signature is spelled out as `(*, **, &)` along with every use, and one use
+# loses one part: `def f(...) = g(...)` becomes `def f(*, **, &) = g(**, &)`.
+#
+# Named splats are left to SplatOperator and KeywordArgument, and an anonymous
+# `&` written on its own to BlockPassRemoval.
+class Evilution::Mutator::Operator::ForwardedArgumentDrop < Evilution::Mutator::Base
+  PARTS = ["*", "**", "&"].freeze
+  ALL_PARTS = PARTS.join(", ").freeze
+
+  def visit_def_node(node)
+    drop_forwarded_parts(node)
+    super
+  end
+
+  def visit_call_node(node)
+    drop_anonymous_arguments(node)
+    super
+  end
+
+  def visit_super_node(node)
+    drop_anonymous_arguments(node)
+    super
+  end
+
+  def visit_yield_node(node)
+    drop_anonymous_arguments(node)
+    super
+  end
+
+  private
+
+  def drop_anonymous_arguments(node)
+    return if node.arguments.nil?
+
+    items = argument_items(node.arguments)
+    # Dropping the only argument leaves an empty list, which is the mutant
+    # ArgumentListRemoval already emits.
+    return if items.length < 2
+
+    items.each_index do |index|
+      emit_argument_drop(node, items, index) if anonymous?(items[index])
+    end
+  end
+
+  # Keywords sit together in one KeywordHashNode, `**` among them; they are
+  # listed individually so each can be dropped on its own.
+  def argument_items(arguments)
+    arguments.arguments.flat_map do |argument|
+      argument.is_a?(Prism::KeywordHashNode) ? argument.elements : [argument]
+    end
+  end
+
+  def anonymous?(item)
+    case item
+    when Prism::SplatNode then item.expression.nil?
+    when Prism::AssocSplatNode then item.value.nil?
+    else false
+    end
+  end
+
+  def emit_argument_drop(node, items, index)
+    remaining = items.map(&:slice)
+    remaining.delete_at(index)
+    location = node.arguments.location
+
+    add_mutation(
+      offset: location.start_offset,
+      length: location.length,
+      replacement: remaining.join(", "),
+      node: node
+    )
+  end
+
+  def drop_forwarded_parts(node)
+    return if node.body.nil?
+
+    uses = forwarding_uses(node.body)
+    uses.each do |target|
+      PARTS.each { |part| emit_part_drop(node, uses, target, part) }
+    end
+  end
+
+  # Every `...` the method forwards. A method defined in the body is not
+  # searched: its `...` forwards that method's own arguments.
+  def forwarding_uses(node)
+    return [] if node.is_a?(Prism::DefNode)
+    return [node] if node.is_a?(Prism::ForwardingArgumentsNode)
+
+    node.compact_child_nodes.flat_map { |child| forwarding_uses(child) }
+  end
+
+  # A `...` can only be forwarded by the method that declares it, so a use
+  # found in the body means the signature ends in the matching parameter.
+  def emit_part_drop(node, uses, target, part)
+    edits = uses.map do |use|
+      [use.location, use.equal?(target) ? (PARTS - [part]).join(", ") : ALL_PARTS]
+    end
+    edits << [node.parameters.keyword_rest.location, ALL_PARTS]
+
+    emit_rewrite(node, edits.sort_by { |location, _text| location.start_offset })
+  end
+
+  # The signature and the uses are apart in the source, while a mutation
+  # replaces one contiguous range, so the range runs from the first edit to
+  # the last and is rewritten with every edit applied.
+  def emit_rewrite(node, edits)
+    start_offset = edits.first.first.start_offset
+    length = edits.last.first.end_offset - start_offset
+
+    add_mutation(
+      offset: start_offset,
+      length: length,
+      replacement: apply_edits(byteslice_source(start_offset, length), edits, start_offset),
+      node: node
+    )
+  end
+
+  # Applied last to first, so an edit never shifts the offsets of those still
+  # to come.
+  def apply_edits(text, edits, base_offset)
+    edits.reverse_each do |location, replacement|
+      text = text.byteslice(0, location.start_offset - base_offset) +
+             replacement +
+             text.byteslice((location.end_offset - base_offset)..)
+    end
+
+    text
+  end
+end

data/lib/evilution/mutator/operator/freeze_removal.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../operator"
+require_relative "../../ast/class_body"
+
+# Drop the `freeze` of a constant defined in a class or module body:
+# `LIST = %w[a b].freeze` becomes `LIST = %w[a b]`.
+#
+# A survivor means no example tries to change the shared value, so nothing
+# shows that it has to stay as it is.
+#
+# A constant is defined in the class body, outside every method, where no
+# subject reaches it. The mutation is attributed to the method anchoring the
+# enclosing body (see Evilution::AST::ClassBody); a top-level constant has no
+# body to be attributed to. A `freeze` inside a method is left to the generic
+# call operators, which already drop it.
+class Evilution::Mutator::Operator::FreezeRemoval < Evilution::Mutator::Base
+  CONSTANT_WRITES = [Prism::ConstantWriteNode, Prism::ConstantPathWriteNode, Prism::ConstantOrWriteNode].freeze
+
+  # Values that are frozen whether or not `freeze` is called.
+  ALWAYS_FROZEN = [
+    Prism::SymbolNode, Prism::IntegerNode, Prism::FloatNode, Prism::RationalNode, Prism::ImaginaryNode,
+    Prism::NilNode, Prism::TrueNode, Prism::FalseNode, Prism::RangeNode, Prism::RegularExpressionNode
+  ].freeze
+
+  # The comments a file opens with, where the magic comment has to be.
+  LEADING_COMMENTS = /\A(?:[ \t]*(?:#.*)?\n)*/
+  FROZEN_STRING_LITERALS = /^[ \t]*#.*frozen[_-]string[_-]literal:[ \t]*true/i
+  private_constant :CONSTANT_WRITES, :ALWAYS_FROZEN, :LEADING_COMMENTS, :FROZEN_STRING_LITERALS
+
+  def call(subject, filter: nil)
+    @subject = subject
+    @file_source = File.read(subject.file_path)
+    @mutations = []
+    @filter = filter
+
+    constant_writes_for(subject).each { |write| freezes_in(write).each { |freeze_call| remove(freeze_call) } }
+    @mutations
+  end
+
+  private
+
+  def remove(freeze_call)
+    add_mutation(
+      offset: freeze_call.location.start_offset,
+      length: freeze_call.location.length,
+      replacement: freeze_call.receiver.slice,
+      node: freeze_call
+    )
+  end
+
+  def constant_writes_for(subject)
+    tree = self.class.parsed_tree_for(subject.file_path, @file_source)
+
+    Evilution::AST::ClassBody.anchored_at(tree, subject.line_number).flat_map do |body|
+      body.declarations { |node| CONSTANT_WRITES.include?(node.class) }
+    end
+  end
+
+  # Every `freeze` call under the node, outermost first.
+  def freezes_in(node)
+    nested = node.compact_child_nodes.flat_map { |child| freezes_in(child) }
+    removable_freeze?(node) ? [node, *nested] : nested
+  end
+
+  def removable_freeze?(node)
+    return false unless node.is_a?(Prism::CallNode) && node.name == :freeze
+    return false if node.receiver.nil? || node.arguments
+
+    !frozen_anyway?(node.receiver)
+  end
+
+  # A group has the value of its last expression: `(1..2)`.
+  def frozen_anyway?(receiver)
+    receiver = receiver.body.body.last while receiver.is_a?(Prism::ParenthesesNode) && receiver.body
+    return true if ALWAYS_FROZEN.include?(receiver.class)
+
+    receiver.is_a?(Prism::StringNode) && frozen_string_literals?
+  end
+
+  def frozen_string_literals?
+    @file_source[LEADING_COMMENTS].match?(FROZEN_STRING_LITERALS)
+  end
+end

data/lib/evilution/mutator/operator/hash_literal.rb

@@ -3,6 +3,10 @@
 require_relative "../operator"
 
 class Evilution::Mutator::Operator::HashLiteral < Evilution::Mutator::Base
+  extend Evilution::Mutator::ConstantValueSubjects
+
+  RENAMED_KEY = "__evilution_mutated__"
+
   def visit_hash_node(node)
     if node.elements.any?
       add_mutation(
@@ -18,8 +22,55 @@ class Evilution::Mutator::Operator::HashLiteral < Evilution::Mutator::Base
         replacement: "nil",
         node: node
       )
+
+      mutate_delete_pairs(node.elements)
+      mutate_rename_keys(node.elements)
     end
 
     super
   end
+
+  private
+
+  # Delete each key/value pair in turn: a survivor means no example checks
+  # that key. A single element is left to the `{}` replacement. A `**splat`
+  # is not a pair and stays. So does a pair holding a heredoc: its body sits
+  # after the closing brace, so one cut cannot take both, and the cut that
+  # does not parse is dropped.
+  def mutate_delete_pairs(elements)
+    return if elements.one?
+
+    elements.each_with_index do |element, index|
+      delete_element(elements, index) if element.is_a?(Prism::AssocNode)
+    end
+  end
+
+  # Rename each label key in turn (`a: 1`, `"a b": 1`): a survivor means no
+  # example reads the value by that name. A key written with a rocket
+  # (`:a => 1`, `"a" => 1`) is a literal of its own, and SymbolLiteral and
+  # StringLiteral already replace it.
+  def mutate_rename_keys(elements)
+    elements.each do |element|
+      rename_key(element) if element.is_a?(Prism::AssocNode) && label?(element.key)
+    end
+  end
+
+  def label?(key)
+    key.is_a?(Prism::SymbolNode) && !key.closing.nil? && key.closing.end_with?(":")
+  end
+
+  # A shorthand pair (`{ x: }`) reads its value from the key, so the value is
+  # written out to stay what it was.
+  def rename_key(pair)
+    key = pair.key
+    replacement = "#{RENAMED_KEY}:"
+    replacement += " #{key.unescaped}" if pair.value.is_a?(Prism::ImplicitNode)
+
+    add_mutation(
+      offset: key.location.start_offset,
+      length: key.location.length,
+      replacement: replacement,
+      node: key
+    )
+  end
 end

data/lib/evilution/mutator/operator/index_range_to_drop.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Take the tail of a list with `drop` instead of a range index:
+# `list[n..-1]` and the endless `list[n..]` / `list[n...]` become
+# `list.drop(n)`.
+#
+# The two differ only past the end: a start beyond the last element gives
+# `nil` from the index and an empty array from `drop`. A survivor means no
+# test reaches that boundary.
+#
+# A literal start of zero is skipped, never being out of range, and so is a
+# negative literal, which `drop` rejects with ArgumentError. A range that
+# stops short of the last element (`n...-1`, `n..-2`) is no tail at all. A
+# read in void statement position is left to statement_deletion, and index
+# writes are another method altogether.
+#
+# The receiver's type is unknown here: on a String the mutant raises
+# NoMethodError, which any test reaching the line kills.
+class Evilution::Mutator::Operator::IndexRangeToDrop < Evilution::Mutator::Base
+  LAST_INDEX = -1
+  private_constant :LAST_INDEX
+
+  def call(subject, **)
+    @void_statements = Set.new
+    super
+  end
+
+  def visit_statements_node(node)
+    @void_statements.merge(node.body[...-1])
+    super
+  end
+
+  def visit_call_node(node)
+    start = tail_start(node)
+    replace_span(node: node, target: node, replacement: drop_call(node, start)) if start
+    super
+  end
+
+  private
+
+  # Where the tail begins, when `node` reads from there to the last element.
+  # A beginless range has no start to hand to `drop`, and answers nil too.
+  def tail_start(node)
+    return unless node.name == :[] && !@void_statements.include?(node)
+    return unless node.arguments in Prism::ArgumentsNode[arguments: [Prism::RangeNode => range]]
+
+    range.left if to_the_end?(range) && droppable_start?(range.left)
+  end
+
+  def to_the_end?(range)
+    stop = range.right
+    return true if stop.nil?
+
+    !range.exclude_end? && stop.is_a?(Prism::IntegerNode) && stop.value == LAST_INDEX
+  end
+
+  def droppable_start?(start)
+    !start.is_a?(Prism::IntegerNode) || start.value.positive?
+  end
+
+  def drop_call(node, start)
+    operator = node.safe_navigation? ? "&." : "."
+    "#{source_of(node.receiver)}#{operator}drop(#{source_of(start)})"
+  end
+end

data/lib/evilution/mutator/operator/index_receiver_to_self.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Send an index read to `self` instead of its receiver: `hash[key]` becomes
+# `self[key]`, arguments untouched.
+#
+# The survivor it targets lives in a class that defines its own `#[]` — a
+# collection or a wrapper that also holds the thing it indexes — where the
+# tests never tell the two lookups apart. Anywhere else the mutant raises
+# NoMethodError, which any test reaching the line kills.
+#
+# Index writes are left alone: `a[b] = c` is a different method, and the
+# operator-write forms (`a[b] ||= c`) are not calls at all.
+class Evilution::Mutator::Operator::IndexReceiverToSelf < Evilution::Mutator::Base
+  def visit_call_node(node)
+    replace_span(node: node, target: node.receiver, replacement: "self") if node.name == :[]
+    super
+  end
+end

data/lib/evilution/mutator/operator/index_to_key_predicate.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Ask whether the key is there instead of reading it: `config[:size]`
+# becomes `config.key?(:size)`.
+#
+# The value turns into a boolean. A survivor means the tests only notice
+# that something came back — a condition taken, a truthy result — and never
+# what the lookup returned.
+#
+# Only a read with one plain argument qualifies, `key?` taking exactly one.
+# An integer or range index is skipped: it points at an Array or a String,
+# which has no `key?`, so the mutant would only raise NoMethodError. A read
+# in void statement position is left to statement_deletion, its value being
+# discarded either way. Index writes are another method altogether.
+class Evilution::Mutator::Operator::IndexToKeyPredicate < Evilution::Mutator::Base
+  # Argument shapes `key?` cannot take as its one key.
+  NON_KEY_ARGUMENTS = [
+    Prism::SplatNode,
+    Prism::KeywordHashNode,
+    Prism::BlockArgumentNode,
+    Prism::ForwardingArgumentsNode,
+    Prism::IntegerNode,
+    Prism::RangeNode
+  ].freeze
+  private_constant :NON_KEY_ARGUMENTS
+
+  def call(subject, **)
+    @void_statements = Set.new
+    super
+  end
+
+  def visit_statements_node(node)
+    @void_statements.merge(node.body[...-1])
+    super
+  end
+
+  def visit_call_node(node)
+    key = key_argument(node)
+    replace_span(node: node, target: node, replacement: key_predicate(node, key)) if key
+    super
+  end
+
+  private
+
+  def key_argument(node)
+    return unless node.name == :[] && !@void_statements.include?(node)
+    return unless node.arguments in Prism::ArgumentsNode[arguments: [argument]]
+
+    argument unless NON_KEY_ARGUMENTS.any? { |type| argument.is_a?(type) }
+  end
+
+  def key_predicate(node, key)
+    operator = node.safe_navigation? ? "&." : "."
+    "#{source_of(node.receiver)}#{operator}key?(#{source_of(key)})"
+  end
+end

data/lib/evilution/mutator/operator/index_write_to_value.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Replace an index write with the value it assigns: `cache[key] = value`
+# becomes `value`.
+#
+# An index write evaluates to the assigned value, so the mutant returns just
+# what the original did — only the store is gone. A survivor means the tests
+# check what was computed and never that it was kept. That is what sets it
+# apart from deleting the statement or turning it into `nil`, both of which
+# also change the result.
+#
+# The result is kept for the assignment syntax only. The method-call
+# spelling is mutated as well, but there it may change: `cache.[]=(key,
+# value)` returns whatever `[]=` returns, and `cache&.[]=(key, value)` is
+# `nil`, with `value` never evaluated, when the receiver is `nil`.
+#
+# A write in void statement position is skipped: with its value discarded,
+# the mutant is statement_deletion's. Operator writes (`a[b] ||= c`) and
+# index targets of a multiple assignment are not calls and are left alone.
+class Evilution::Mutator::Operator::IndexWriteToValue < Evilution::Mutator::Base
+  def call(subject, **)
+    @void_statements = Set.new
+    super
+  end
+
+  def visit_statements_node(node)
+    @void_statements.merge(node.body[...-1])
+    super
+  end
+
+  def visit_call_node(node)
+    promote_child(node, argument_nodes(node).last) if node.name == :[]= && !@void_statements.include?(node)
+    super
+  end
+end

data/lib/evilution/mutator/operator/integer_division_to_fdiv.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Turn a division into `fdiv`: `a / b` becomes `a.fdiv(b)`.
+#
+# Between integers `/` drops the remainder while `fdiv` keeps it as a float,
+# and for exact types such as Rational or BigDecimal `fdiv` falls back to
+# Float. A survivor means no example divides values that leave a remainder,
+# or none checks what happens to it.
+#
+# A float literal on either side is skipped: float division and `fdiv` give
+# the same answer, so the mutant would change nothing.
+class Evilution::Mutator::Operator::IntegerDivisionToFdiv < Evilution::Mutator::Base
+  # Receivers that `.fdiv` can follow directly. Anything else is an operator
+  # expression, which `.fdiv` would bind into, so it is grouped first.
+  SIMPLE_RECEIVER_TYPES = [
+    Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode, Prism::ClassVariableReadNode,
+    Prism::GlobalVariableReadNode, Prism::ConstantReadNode, Prism::ConstantPathNode,
+    Prism::IntegerNode, Prism::ParenthesesNode, Prism::SelfNode
+  ].freeze
+
+  # A method name, as opposed to an operator such as `*` or `-@`.
+  METHOD_NAME = /\A[a-zA-Z_]\w*[?!]?\z/
+
+  def visit_call_node(node)
+    replace_division(node) if division?(node)
+    super
+  end
+
+  private
+
+  # The explicit form (`a./(b)`) is left alone: it is rare, and rewriting it
+  # gains nothing over the operator form. The operator form always has a
+  # receiver and exactly one divisor.
+  def division?(node)
+    return false unless node.name == :/ && node.call_operator_loc.nil?
+
+    [node.receiver, *node.arguments.arguments].none?(Prism::FloatNode)
+  end
+
+  def replace_division(node)
+    divisor = node.arguments.arguments.first
+
+    add_mutation(
+      offset: node.location.start_offset,
+      length: node.location.length,
+      replacement: "#{receiver_text(node.receiver)}.fdiv(#{divisor.slice})",
+      node: node
+    )
+  end
+
+  def receiver_text(receiver)
+    simple_receiver?(receiver) ? receiver.slice : "(#{receiver.slice})"
+  end
+
+  def simple_receiver?(receiver)
+    return true if SIMPLE_RECEIVER_TYPES.include?(receiver.class)
+
+    receiver.is_a?(Prism::CallNode) && receiver.name.to_s.match?(METHOD_NAME)
+  end
+end

data/lib/evilution/mutator/operator/integer_literal.rb

@@ -3,23 +3,53 @@
 require_relative "../operator"
 
 class Evilution::Mutator::Operator::IntegerLiteral < Evilution::Mutator::Base
-  def visit_integer_node(node)
-    if node.value.zero?
-      add_mutation_with_replacement(node, "1")
-    elsif node.value == 1
-      add_mutation_with_replacement(node, "0")
-    else
-      add_mutation_with_replacement(node, "0")
-      add_mutation_with_replacement(node, (node.value + 1).to_s)
-    end
+  extend Evilution::Mutator::ConstantValueSubjects
+
+  # One value past each integer width, keyed by the boundary it crosses:
+  # int8, uint8, int16, uint16, int32, uint32, int64. A literal is replaced
+  # with the sentinel of the first boundary above its magnitude, so a
+  # survivor means nothing checks that the value still fits its width. The
+  # sentinels are safe primes: arithmetic, masking or shifting does not land
+  # on one by coincidence.
+  WIDTH_SENTINELS = {
+    2**7 => 167,
+    2**8 => 467,
+    2**15 => 55_487,
+    2**16 => 108_503,
+    2**31 => 2_667_278_543,
+    2**32 => 7_980_081_959,
+    2**63 => 15_508_464_536_481_899_903
+  }.freeze
 
+  def visit_integer_node(node)
+    replacements_for(node.value).each { |value| add_mutation_with_replacement(node, value.to_s) }
     add_mutation_with_replacement(node, "nil")
 
     super
   end
 
+  # A complex literal (`5i`) is replaced as a whole by ComplexLiteral. Its
+  # numeric part is not a literal of its own: `nili` is not a value.
+  def visit_imaginary_node(_node); end
+
   private
 
+  def replacements_for(value)
+    [*neighbours_of(value), width_sentinel_for(value)].compact
+  end
+
+  def neighbours_of(value)
+    return [1, -1] if value.zero?
+    return [0] if value == 1
+
+    [0, value + 1, value - 1].uniq
+  end
+
+  def width_sentinel_for(value)
+    _boundary, sentinel = WIDTH_SENTINELS.find { |boundary, _| boundary > value.abs }
+    sentinel
+  end
+
   def add_mutation_with_replacement(node, replacement)
     add_mutation(offset: node.location.start_offset, length: node.location.length, replacement:, node:)
   end

data/lib/evilution/mutator/operator/keyword_argument.rb

@@ -8,7 +8,7 @@ class Evilution::Mutator::Operator::KeywordArgument < Evilution::Mutator::Base
     if params
       mutate_optional_keyword_defaults(params)
       mutate_optional_keyword_removal(params)
-      mutate_keyword_rest_removal(params)
+      mutate_keyword_rest_removal(node)
     end
 
     super
@@ -51,9 +51,11 @@ class Evilution::Mutator::Operator::KeywordArgument < Evilution::Mutator::Base
     end
   end
 
-  def mutate_keyword_rest_removal(params)
+  def mutate_keyword_rest_removal(node)
+    params = node.parameters
     kr = params.keyword_rest
     return unless kr.is_a?(Prism::KeywordRestParameterNode)
+    return if anonymous_rest_used?(node.body)
 
     all_params = collect_all_params(params)
     if all_params.length < 2
@@ -63,6 +65,27 @@ class Evilution::Mutator::Operator::KeywordArgument < Evilution::Mutator::Base
     end
   end
 
+  # An anonymous `**` in the body (`bar(**)`, `{ ** }`) only parses while the
+  # signature declares one, so removing it there would leave the body
+  # unparseable. Finding one also tells the rest is anonymous: Ruby rejects it
+  # next to a named rest. A named rest is safe to remove: without it the body
+  # reads an undefined name, which parses and fails at runtime.
+  def anonymous_rest_used?(body)
+    return false if body.nil?
+
+    uses_anonymous_rest?(body)
+  end
+
+  # A nested def is not searched: an anonymous `**` inside it belongs to that
+  # method's own signature. Blocks and lambdas share the enclosing method's
+  # parameters, so they are.
+  def uses_anonymous_rest?(node)
+    return false if node.is_a?(Prism::DefNode)
+    return true if node.is_a?(Prism::AssocSplatNode) && node.value.nil?
+
+    node.compact_child_nodes.any? { |child| uses_anonymous_rest?(child) }
+  end
+
   def emit_remove_only_kr(kr)
     add_mutation(
       offset: kr.location.start_offset,