evilution 1.3.0 → 1.5.0

data/lib/evilution/mutator/operator/rational_literal.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+
+# Replace a rational literal (`5r`, `1.5r`) with `0r`, `1r`, its two
+# neighbours (`value + 1r`, `value - 1r`) and `nil`.
+class Evilution::Mutator::Operator::RationalLiteral < Evilution::Mutator::Base
+  extend Evilution::Mutator::ConstantValueSubjects
+
+  def visit_rational_node(node)
+    replacements_for(node.value).each { |value| add_mutation_with_replacement(node, literal_for(value)) }
+    add_mutation_with_replacement(node, "nil")
+
+    super
+  end
+
+  # A complex literal (`3ri`) is replaced as a whole by ComplexLiteral. Its
+  # rational part is not a literal of its own: `nili` is not a value.
+  def visit_imaginary_node(_node); end
+
+  private
+
+  def replacements_for(value)
+    [0r, 1r, value + 1, value - 1].uniq - [value]
+  end
+
+  # A rational literal is an integer or a decimal, so its value and both
+  # neighbours always have a finite decimal form.
+  def literal_for(value)
+    return "#{value.numerator}r" if value.denominator == 1
+
+    digits = (1..).find { |count| ((10**count) % value.denominator).zero? }
+    whole, fraction = (value.abs * (10**digits)).to_i.divmod(10**digits)
+    "#{"-" if value.negative?}#{whole}.#{fraction.to_s.rjust(digits, "0")}r"
+  end
+
+  def add_mutation_with_replacement(node, replacement)
+    add_mutation(offset: node.location.start_offset, length: node.location.length, replacement:, node:)
+  end
+end

data/lib/evilution/mutator/operator/reduce_to_sum.rb

@@ -39,7 +39,7 @@ class Evilution::Mutator::Operator::ReduceToSum < Evilution::Mutator::Base
   # The arguments besides the `+` operand — at most an initial value — when
   # the call is a `+` reduction; nil otherwise.
   def initial_arguments(node)
-    arguments = node.arguments ? node.arguments.arguments : []
+    arguments = argument_nodes(node)
 
     if plus_block_pass?(node.block)
       arguments unless plus_symbol?(arguments.last)

data/lib/evilution/mutator/operator/regex_simplification.rb

@@ -1,164 +1,85 @@
 # frozen_string_literal: true
 
 require_relative "../operator"
-
+require_relative "../../ast/regexp_pattern"
+
+# Simplify a regexp literal one piece at a time: remove a quantifier
+# (`/a+/` -> `/a/`), remove an anchor (`/^a$/` -> `/a$/`), or drop the dash of
+# a character-class range (`/[a-z]/` -> `/[az]/`).
+#
+# The pattern is read with regexp_parser, so only real quantifiers, anchors and
+# ranges are touched: the `?` of a group opener (`(?:`, `(?<name>`, `(?=`), the
+# inside of a `(?#...)` comment, a property's negation (`\p{^Alpha}`) and the
+# comments of an extended pattern contain the same characters without being
+# any of them. Each edit is made in place in the source and kept only if the
+# pattern still compiles.
 class Evilution::Mutator::Operator::RegexSimplification < Evilution::Mutator::Base
-  def visit_regular_expression_node(node)
-    content = node.content
-    return super if content.empty?
-
-    content_offset = node.content_loc.start_offset
+  # Line and string anchors. Word boundaries and `\G` are assertions of a
+  # different kind and are left alone.
+  REMOVABLE_ANCHORS = %i[bol eol bos eos eos_ob_eol].freeze
 
-    remove_quantifiers(node, content, content_offset)
-    remove_anchors(node, content, content_offset)
-    remove_character_class_ranges(node, content, content_offset)
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node)
+    if pattern
+      remove_quantifiers(node, pattern)
+      remove_anchors(node, pattern)
+      remove_class_ranges(node, pattern)
+    end
 
     super
   end
 
   private
 
-  def remove_quantifiers(node, content, content_offset)
-    scan_regex_positions(content) do |kind, i|
-      case kind
-      when :backslash then 2
-      when :class_open then class_skip(content, i)
-      when :char then emit_quantifier_at(node, content, content_offset, i)
-      end
-    end
-  end
-
-  def emit_quantifier_at(node, content, content_offset, i)
-    match = match_quantifier(content, i)
-    return 1 if match.nil?
-
-    add_mutation(offset: content_offset + i, length: match.length, replacement: "", node: node)
-    match.length
-  end
-
-  def match_quantifier(content, pos)
-    case content[pos]
-    when "+", "*", "?"
-      content[pos]
-    when "{"
-      if (m = content[pos..].match(/\A\{\d+(?:,\d*)?\}/))
-        m[0]
-      end
+  def remove_quantifiers(node, pattern)
+    quantifier_spans(pattern.tokens).each do |start_offset, end_offset|
+      remove_span(node, pattern, start_offset, end_offset)
     end
   end
 
-  def remove_anchors(node, content, content_offset)
-    scan_regex_positions(content) do |kind, i|
-      case kind
-      when :backslash then try_emit_backslash_anchor(node, content, content_offset, i)
-      when :class_open then class_skip(content, i)
-      when :char
-        try_emit_caret_dollar(node, content, content_offset, i)
-        1
+  # Ruby reads `{2,}?` as one lazy interval, while regexp_parser reports an
+  # interval followed by a `?` quantifier. The two are joined so the lazy
+  # marker is removed with its interval instead of becoming a quantifier of
+  # its own.
+  def quantifier_spans(tokens)
+    quantifiers = tokens.select { |token| token.type == :quantifier }
+    spans = []
+    quantifiers.each do |token|
+      previous = spans.last
+      if lazy_marker_of?(token, previous)
+        previous[1] = token.end_offset
+      else
+        spans << [token.start_offset, token.end_offset, token]
       end
     end
+    spans.map { |start_offset, end_offset, _token| [start_offset, end_offset] }
   end
 
-  def try_emit_backslash_anchor(node, content, content_offset, i)
-    anchor = match_backslash_anchor(content, i)
-    return 2 if anchor.nil?
+  def lazy_marker_of?(token, previous)
+    return false if previous.nil?
 
-    add_mutation(offset: content_offset + i, length: anchor.length, replacement: "", node: node)
-    anchor.length
+    previous.last.text.start_with?("{") && token.text == "?" && previous[1] == token.start_offset
   end
 
-  def try_emit_caret_dollar(node, content, content_offset, i)
-    return unless %w[^ $].include?(content[i])
+  def remove_anchors(node, pattern)
+    pattern.tokens.each do |token|
+      next unless token.type == :anchor && REMOVABLE_ANCHORS.include?(token.token)
 
-    add_mutation(offset: content_offset + i, length: 1, replacement: "", node: node)
-  end
-
-  def match_backslash_anchor(content, pos)
-    return nil unless content[pos] == "\\"
-
-    two_char = content[pos, 2]
-    return two_char if %w[\\A \\z \\Z].include?(two_char)
-
-    nil
-  end
-
-  def remove_character_class_ranges(node, content, content_offset)
-    scan_regex_positions(content) do |kind, i|
-      case kind
-      when :backslash then 2
-      when :class_open
-        scan_ranges_in_class(node, content, content_offset, i)
-        class_skip(content, i)
-      when :char then 1
-      end
+      remove_span(node, pattern, token.start_offset, token.end_offset)
     end
   end
 
-  def scan_ranges_in_class(node, content, content_offset, class_start)
-    first_item = skip_class_prefix(content, class_start)
-    i = first_item
+  def remove_class_ranges(node, pattern)
+    pattern.tokens.each do |token|
+      next unless token.type == :set && token.token == :range
 
-    while i < content.length && content[i] != "]"
-      if content[i] == "\\"
-        i += 2
-        next
-      end
-
-      emit_range_removal(node, content, content_offset, first_item, i) if content[i] == "-"
-      i += 1
+      remove_span(node, pattern, token.start_offset, token.end_offset)
     end
   end
 
-  def skip_class_prefix(content, class_start)
-    i = class_start + 1
-    i += 1 if i < content.length && content[i] == "^"
-    i += 1 if i < content.length && content[i] == "]"
-    i
-  end
+  def remove_span(node, pattern, start_offset, end_offset)
+    return unless pattern.compiles?(start_offset, end_offset, "")
 
-  def emit_range_removal(node, content, content_offset, first_item, pos)
-    return unless pos > first_item && pos + 1 < content.length && content[pos + 1] != "]"
-
-    add_mutation(
-      offset: content_offset + pos,
-      length: 1,
-      replacement: "",
-      node: node
-    )
-  end
-
-  # Walks `content` yielding (kind, position) for each significant token:
-  # :backslash for an escape sequence, :class_open for `[`, :char for any
-  # other byte. The block returns the number of characters to advance from
-  # `position` — callers decide how to handle each case (skip, emit a
-  # mutation, descend into a character class, etc.).
-  def scan_regex_positions(content)
-    i = 0
-    while i < content.length
-      advance = case content[i]
-                when "\\" then yield(:backslash, i)
-                when "[" then yield(:class_open, i)
-                else yield(:char, i)
-                end
-      i += advance
-    end
-  end
-
-  def class_skip(content, pos)
-    skip_character_class(content, pos) - pos
-  end
-
-  def skip_character_class(content, pos)
-    scan_to_class_close(content, skip_class_prefix(content, pos))
-  end
-
-  def scan_to_class_close(content, start)
-    i = start
-    while i < content.length
-      return i + 1 if content[i] == "]"
-
-      i += content[i] == "\\" ? 2 : 1
-    end
-    i
+    add_mutation(offset: start_offset, length: end_offset - start_offset, replacement: "", node: node)
   end
 end

data/lib/evilution/mutator/operator/regexp_alternation_branch_deletion.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../../ast/regexp_pattern"
+
+# Delete one branch of a regexp alternation at a time: `/cat|dog/` becomes
+# `/dog/` and `/cat/`.
+#
+# A survivor means no example feeds the pattern input that only that branch
+# accepts, so the branch could go without any test noticing.
+#
+# Alternations of more than ten branches are skipped: those are lookup tables
+# (generated keyword or emoji lists, for instance), where a deletion per entry
+# floods the report with survivors nobody acts on. Deleting a branch can remove
+# a group that a backreference or a `\g<name>` call elsewhere in the pattern
+# needs, so each mutant is compiled first and dropped if it no longer does.
+class Evilution::Mutator::Operator::RegexpAlternationBranchDeletion < Evilution::Mutator::Base
+  MAX_BRANCHES = 10
+
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node)
+    if pattern
+      pattern.each_expression do |expression, *|
+        delete_branches(node, pattern, expression) if expression.is_a?(Regexp::Expression::Alternation)
+      end
+    end
+
+    super
+  end
+
+  private
+
+  def delete_branches(node, pattern, alternation)
+    branches = alternation.expressions
+    return if branches.length > MAX_BRANCHES
+
+    branches.each_index do |index|
+      start_offset, end_offset = deletion_span(pattern, branches, index)
+      next unless pattern.compiles?(start_offset, end_offset, "")
+
+      add_mutation(offset: start_offset, length: end_offset - start_offset, replacement: "", node: node)
+    end
+  end
+
+  # A branch goes with one neighbouring `|`: the one after it for the first
+  # branch, the one before it for every other.
+  def deletion_span(pattern, branches, index)
+    if index.zero?
+      [pattern.offsets(branches[0]).first, pattern.offsets(branches[1]).first]
+    else
+      [pattern.offsets(branches[index - 1]).last, pattern.offsets(branches[index]).last]
+    end
+  end
+end

data/lib/evilution/mutator/operator/regexp_anchor_promotion.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../../ast/regexp_pattern"
+
+# Promote a line anchor to the matching string anchor: `^` becomes `\A`, `$`
+# becomes `\z`, and `\Z`, which still allows a trailing newline, becomes `\z`.
+#
+# A line anchor also matches around every newline in the input, so `/^admin$/`
+# accepts "evil\nadmin" while `/\Aadmin\z/` does not — the classic multiline
+# injection gap. A survivor means no example feeds the pattern multi-line
+# input, or the anchor should have been a string anchor all along.
+#
+# Unlike RegexSimplification, which removes anchors, this keeps the pattern
+# anchored and only narrows what the anchor accepts. The pattern is read with
+# regexp_parser, so `^` and `$` inside a character class, escaped, or in an
+# extended-mode comment are left alone. Swapping one anchor for another cannot
+# touch a group or a reference, so no compile check is needed.
+class Evilution::Mutator::Operator::RegexpAnchorPromotion < Evilution::Mutator::Base
+  PROMOTIONS = { bol: "\\A", eol: "\\z", eos_ob_eol: "\\z" }.freeze
+
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node)
+    pattern.tokens.each { |token| promote(node, token) } if pattern
+    super
+  end
+
+  private
+
+  def promote(node, token)
+    return unless token.type == :anchor
+
+    promotion = PROMOTIONS[token.token]
+    return if promotion.nil?
+
+    add_mutation(
+      offset: token.start_offset,
+      length: token.end_offset - token.start_offset,
+      replacement: promotion,
+      node: node
+    )
+  end
+end

data/lib/evilution/mutator/operator/regexp_capture_to_passive.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../../ast/regexp_pattern"
+
+# Turn a regexp capture group into a passive group: `/id=(\d+)/` becomes
+# `/id=(?:\d+)/`.
+#
+# The pattern matches the same text but no longer captures, so `$1`, `m[1]`,
+# a `scan` result or a `\1` in a replacement loses its value. A survivor means
+# nothing downstream reads the capture.
+#
+# Only mutants that can change something are emitted:
+# - a regexp passed straight to `match?` or `!~` never exposes its captures;
+# - with a named group present Ruby keeps only named captures, so a plain
+#   group captures nothing to begin with;
+# - a numbered reference inside the pattern (`\2`, `\k<1>`, `\g<1>`) would be
+#   renumbered by the passive group and quietly point elsewhere, which tests
+#   the pattern rather than whether the capture is used.
+#
+# With named groups and numbered references ruled out, nothing else in the
+# pattern can refer to a plain group, so turning it passive always compiles
+# and needs no check.
+class Evilution::Mutator::Operator::RegexpCaptureToPassive < Evilution::Mutator::Base
+  CAPTURE_FREE_CALLS = %i[match? !~].freeze
+  NAMED_GROUP_TOKENS = %i[named_ab named_sq].freeze
+
+  def initialize(**options)
+    super
+    @capture_free = Set.new.compare_by_identity
+  end
+
+  def visit_call_node(node)
+    if CAPTURE_FREE_CALLS.include?(node.name)
+      @capture_free << node.receiver
+      @capture_free.merge(node.arguments.arguments) if node.arguments
+    end
+    super
+  end
+
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node) unless @capture_free.include?(node)
+    pattern.tokens.each { |token| make_passive(node, token) } if pattern && plain_captures_matter?(pattern)
+    super
+  end
+
+  private
+
+  def plain_captures_matter?(pattern)
+    pattern.tokens.none? do |token|
+      (token.type == :group && NAMED_GROUP_TOKENS.include?(token.token)) ||
+        (token.type == :backref && token.token.to_s.start_with?("number"))
+    end
+  end
+
+  def make_passive(node, token)
+    return unless token.type == :group && token.token == :capture
+
+    add_mutation(offset: token.start_offset, length: token.end_offset - token.start_offset, replacement: "(?:", node: node)
+  end
+end

data/lib/evilution/mutator/operator/regexp_character_type_complement.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../../ast/regexp_pattern"
+
+# Flip a character type of a regexp to its complement: `\d` becomes `\D`,
+# `\w` becomes `\W`, `\b` becomes `\B`, and back.
+#
+# The pattern keeps its shape but accepts the opposite characters, so a
+# survivor means the suite never feeds the pattern both input it should match
+# and input it should reject at that position.
+#
+# `\X` (grapheme cluster) and `\R` (line break) are not complements — `\X`
+# matches a line break too — so they are left alone, as are Unicode
+# properties. The pattern is read with regexp_parser, so escaped backslashes
+# and extended-mode comments are not mistaken for character types.
+#
+# Unlike the structural regexp edits, a flip needs no compile check: it swaps
+# one escape for another of the same kind and cannot touch a group or a
+# reference. Across 37,840 flips in real code, every mutant compiled.
+class Evilution::Mutator::Operator::RegexpCharacterTypeComplement < Evilution::Mutator::Base
+  # Complements by the scanner's token kind and name rather than by text:
+  # inside a character class `\b` scans as a backspace escape, and `\p{Digit}`
+  # shares the `digit` name under the property kind.
+  COMPLEMENTS = {
+    type: {
+      digit: "\\D", nondigit: "\\d",
+      space: "\\S", nonspace: "\\s",
+      word: "\\W", nonword: "\\w",
+      hex: "\\H", nonhex: "\\h"
+    },
+    anchor: { word_boundary: "\\B", nonword_boundary: "\\b" }
+  }.freeze
+
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node)
+    pattern.tokens.each { |token| flip(node, token) } if pattern
+    super
+  end
+
+  private
+
+  def flip(node, token)
+    complement = COMPLEMENTS.fetch(token.type, {})[token.token]
+    return if complement.nil?
+
+    add_mutation(
+      offset: token.start_offset,
+      length: token.end_offset - token.start_offset,
+      replacement: complement,
+      node: node
+    )
+  end
+end

data/lib/evilution/mutator/operator/regexp_named_group_rename.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../../ast/regexp_pattern"
+
+# Rename a named regexp group: `/(?<user>\w+)@/` becomes `/(?<_user>\w+)@/`.
+#
+# The pattern still matches and still captures, but `m[:user]`, `$~[:user]` or
+# the local variable that `/(?<user>...)/ =~ s` binds no longer find it. A survivor
+# means nothing outside the pattern reads the named capture.
+#
+# References inside the pattern (`\k<user>`, `\g<user>`, `\k<user+1>`) are
+# renamed along with the group, as is every group sharing the name, so the
+# pattern itself stays valid and only outside references break; with every
+# occurrence renamed together it always compiles. The new name is the old one
+# with an underscore in front, more if that name is taken. As with
+# RegexpCaptureToPassive, a regexp passed straight to `match?` or `!~` exposes
+# no captures and is skipped.
+class Evilution::Mutator::Operator::RegexpNamedGroupRename < Evilution::Mutator::Base
+  CAPTURE_FREE_CALLS = %i[match? !~].freeze
+  NAMED_GROUP_TOKENS = %i[named_ab named_sq].freeze
+
+  # `(?<name>` / `(?'name'`, and `\k<name>`, `\g'name'`, `\k<name+1>`.
+  GROUP_NAME = /\A(\(\?[<'])([^>']+)([>'])\z/
+  REFERENCE_NAME = /\A(\\[kg][<'])([^>'+-]+)(.*)\z/m
+
+  def initialize(**options)
+    super
+    @capture_free = Set.new.compare_by_identity
+  end
+
+  def visit_call_node(node)
+    if CAPTURE_FREE_CALLS.include?(node.name)
+      @capture_free << node.receiver
+      @capture_free.merge(node.arguments.arguments) if node.arguments
+    end
+    super
+  end
+
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node) unless @capture_free.include?(node)
+    rename_groups(node, pattern) if pattern
+    super
+  end
+
+  private
+
+  def rename_groups(node, pattern)
+    occurrences = name_occurrences(pattern.tokens)
+    group_names = occurrences.filter_map { |_token, name, kind| name if kind == :group }.uniq
+
+    group_names.each do |name|
+      renamed = free_name(name, group_names)
+      edits = occurrences.select { |_token, other, _kind| other == name }
+      emit_rename(node, edits, renamed)
+    end
+  end
+
+  # Every group opener and named reference, with the name it carries.
+  def name_occurrences(tokens)
+    tokens.filter_map do |token|
+      if token.type == :group && NAMED_GROUP_TOKENS.include?(token.token)
+        [token, token.text[GROUP_NAME, 2], :group]
+      elsif token.type == :backref && token.token.to_s.start_with?("name")
+        [token, token.text[REFERENCE_NAME, 2], :reference]
+      end
+    end
+  end
+
+  def free_name(name, taken)
+    candidate = "_#{name}"
+    candidate = "_#{candidate}" while taken.include?(candidate)
+    candidate
+  end
+
+  # The occurrences are spread through the pattern, while a mutation replaces
+  # one contiguous range, so the range runs from the first to the last and is
+  # rewritten with every occurrence renamed.
+  def emit_rename(node, edits, renamed)
+    start_offset = edits.first.first.start_offset
+    length = edits.last.first.end_offset - start_offset
+
+    add_mutation(
+      offset: start_offset,
+      length: length,
+      replacement: apply_renames(byteslice_source(start_offset, length), edits, start_offset, renamed),
+      node: node
+    )
+  end
+
+  # Applied last to first, so a rename never shifts the offsets of those still
+  # to come.
+  def apply_renames(text, edits, base_offset, renamed)
+    edits.reverse_each do |token, _name, kind|
+      relative = token.start_offset - base_offset
+      text = text.byteslice(0, relative) + renamed_text(token.text, kind, renamed) +
+             text.byteslice((relative + token.text.bytesize)..)
+    end
+    text
+  end
+
+  def renamed_text(text, kind, renamed)
+    pattern = kind == :group ? GROUP_NAME : REFERENCE_NAME
+    text.sub(pattern) { "#{Regexp.last_match(1)}#{renamed}#{Regexp.last_match(3)}" }
+  end
+end

data/lib/evilution/mutator/operator/regexp_option_removal.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require_relative "../operator"
+require_relative "../../ast/regexp_pattern"
+
+# Drop the `i` or `m` option of a regexp literal: `/admin/i` becomes `/admin/`,
+# `/a.b/m` becomes `/a.b/`.
+#
+# Without `i` the pattern matches only the letter case it is written in;
+# without `m` a `.` no longer matches a newline. A survivor means no example
+# feeds the pattern input in another case, or a newline where a `.` stands.
+#
+# A flag is only dropped where it changes something: `i` needs a cased letter
+# written in the pattern (escapes such as `\d` and `\w` do not count), and `m`
+# needs a `.` outside a character class. Other options (`x`, `o`, encodings)
+# are left alone.
+class Evilution::Mutator::Operator::RegexpOptionRemoval < Evilution::Mutator::Base
+  def visit_regular_expression_node(node)
+    pattern = Evilution::AST::RegexpPattern.parse(node)
+    if pattern
+      drop_option(node, "i") if node.ignore_case? && cased_letter?(pattern)
+      drop_option(node, "m") if node.multi_line? && dot?(pattern)
+    end
+
+    super
+  end
+
+  private
+
+  def cased_letter?(pattern)
+    pattern.tokens.any? do |token|
+      token.type == :literal && token.text.each_char.any? { |char| char.swapcase != char }
+    end
+  end
+
+  def dot?(pattern)
+    pattern.tokens.any? { |token| token.type == :meta && token.token == :dot }
+  end
+
+  # The options follow the closing delimiter: `/im`, `}mi`.
+  def drop_option(node, option)
+    closing = node.closing_loc
+
+    add_mutation(
+      offset: closing.start_offset + closing.slice.index(option),
+      length: 1,
+      replacement: "",
+      node: node
+    )
+  end
+end