|
| 1 | +//! Property-based panic test for the Andy C++ lexer. |
| 2 | +//! |
| 3 | +//! Generates random `String` inputs and pushes them through `Lexer::new(...)`, |
| 4 | +//! draining the iterator. Errors are expected and ignored; only panics, |
| 5 | +//! `unwrap`s, `expect`s, and `unreachable!`s count as failures. |
| 6 | +//! |
| 7 | +//! Each generated input runs in a worker thread with a 500ms timeout. The |
| 8 | +//! lexer always advances by at least one character per `next()` call, so a |
| 9 | +//! genuine hang would indicate a regression — the timeout exists as a |
| 10 | +//! safety net rather than because we expect to hit it. |
| 11 | +//! |
| 12 | +//! Two test functions share `lexer_panic.regressions`: |
| 13 | +//! |
| 14 | +//! * `known_regressions_do_not_panic` runs by default — it generates 0 fresh |
| 15 | +//! cases and only replays seeds saved in the regressions file, guarding |
| 16 | +//! against future commits that resurrect a known panic. |
| 17 | +//! * `fuzz_random_strings` is `#[ignore]`d. Opt in with: |
| 18 | +//! |
| 19 | +//! ```sh |
| 20 | +//! cargo test -p proptest_tests -- --ignored # fuzz only |
| 21 | +//! cargo test -p proptest_tests -- --include-ignored # regressions + fuzz |
| 22 | +//! PROPTEST_CASES=100000 cargo test -p proptest_tests -- --ignored |
| 23 | +//! ``` |
| 24 | +
|
| 25 | +use ndc_analyser as _; |
| 26 | +use ndc_core as _; |
| 27 | +use ndc_lexer::{Lexer, SourceId}; |
| 28 | +use ndc_parser as _; |
| 29 | +use ndc_stdlib as _; |
| 30 | +use ndc_vm as _; |
| 31 | +use num as _; |
| 32 | +use proptest::prelude::*; |
| 33 | +use proptest::test_runner::FileFailurePersistence; |
| 34 | +use std::fmt; |
| 35 | +use std::panic::{self, AssertUnwindSafe}; |
| 36 | +use std::sync::Once; |
| 37 | +use std::sync::mpsc; |
| 38 | +use std::thread; |
| 39 | +use std::time::Duration; |
| 40 | + |
| 41 | +const PER_CASE_TIMEOUT: Duration = Duration::from_millis(500); |
| 42 | +const MAX_INPUT_LEN: usize = 200; |
| 43 | + |
| 44 | +/// Wrapper around the generated input with a compact `Debug` impl that |
| 45 | +/// shows byte length plus the escaped input, so a failure prints |
| 46 | +/// `[12B] "0r\"\\#"` instead of a wall of escapes. |
| 47 | +#[derive(Clone)] |
| 48 | +struct Source(String); |
| 49 | + |
| 50 | +impl fmt::Debug for Source { |
| 51 | + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { |
| 52 | + write!(f, "[{}B] {:?}", self.0.len(), self.0) |
| 53 | + } |
| 54 | +} |
| 55 | + |
| 56 | +const WORKER_THREAD_NAME: &str = "proptest-lexer-fuzz-worker"; |
| 57 | + |
| 58 | +/// Replace the default panic hook with one that stays silent on the named |
| 59 | +/// worker thread but delegates to the original hook everywhere else. |
| 60 | +/// Without this, every shrinking attempt floods stderr with the same |
| 61 | +/// panic message; with it, only the final shrunk failure (resumed on the |
| 62 | +/// test thread) is printed. |
| 63 | +fn install_quiet_panic_hook() { |
| 64 | + static HOOK: Once = Once::new(); |
| 65 | + HOOK.call_once(|| { |
| 66 | + let default_hook = panic::take_hook(); |
| 67 | + panic::set_hook(Box::new(move |info| { |
| 68 | + if thread::current().name() != Some(WORKER_THREAD_NAME) { |
| 69 | + default_hook(info); |
| 70 | + } |
| 71 | + })); |
| 72 | + }); |
| 73 | +} |
| 74 | + |
| 75 | +/// Single character drawn from a weighted union biased toward bytes that |
| 76 | +/// exercise lexer branches: |
| 77 | +/// - delimiters and escape: `"`, `\`, `#` |
| 78 | +/// - raw-string starter and number suffixes: `r`, `i`, `j` |
| 79 | +/// - number prefixes/separators: digits, `0`, `b`, `x`, `o`, `_`, `.` |
| 80 | +/// - identifier and operator chars |
| 81 | +/// - comment starts: `/`, `#`, `!` |
| 82 | +/// - whitespace incl. `\r` and `\n` |
| 83 | +/// |
| 84 | +/// The other arms add general ASCII printable and full-range unicode so |
| 85 | +/// multi-byte offset arithmetic gets exercised too. |
| 86 | +fn arb_char() -> impl Strategy<Value = char> { |
| 87 | + let high_signal: Vec<char> = vec![ |
| 88 | + '"', '\\', '#', 'r', '.', '_', '?', '+', '-', '*', '/', '%', '=', '<', '>', '!', '&', '|', |
| 89 | + '^', '~', '(', ')', '[', ']', '{', '}', ',', ';', ':', ' ', '\t', '\n', '\r', 'a', 'b', |
| 90 | + 'c', 'f', 'g', 'i', 'j', 'n', 'o', 'x', 'z', '0', '1', '2', '7', '9', |
| 91 | + ]; |
| 92 | + |
| 93 | + prop_oneof![ |
| 94 | + 20 => prop::sample::select(high_signal), |
| 95 | + // Any ASCII printable, to widen coverage of the single-char token try-from path. |
| 96 | + 4 => (32u32..=126u32).prop_filter_map("ascii printable", char::from_u32), |
| 97 | + // Full unicode range minus surrogates and out-of-range codepoints. |
| 98 | + 1 => (0u32..=0x10_FFFF).prop_filter_map("valid scalar value", char::from_u32), |
| 99 | + ] |
| 100 | +} |
| 101 | + |
| 102 | +fn arb_source() -> impl Strategy<Value = Source> { |
| 103 | + prop::collection::vec(arb_char(), 0..=MAX_INPUT_LEN) |
| 104 | + .prop_map(|chars| Source(chars.into_iter().collect())) |
| 105 | +} |
| 106 | + |
| 107 | +/// Drain the lexer over `input`. Returns `()` on any error because the |
| 108 | +/// test only cares about panics, not error variants. |
| 109 | +fn run_lexer(input: &str) { |
| 110 | + for token in Lexer::new(input, SourceId::new(0)) { |
| 111 | + let _ = token; |
| 112 | + } |
| 113 | +} |
| 114 | + |
| 115 | +/// Run the lexer in a worker thread with a hard timeout. Both genuine |
| 116 | +/// panics and timeouts propagate to the proptest harness so it can shrink |
| 117 | +/// them. |
| 118 | +fn run_with_timeout(source: Source) { |
| 119 | + install_quiet_panic_hook(); |
| 120 | + let (tx, rx) = mpsc::channel(); |
| 121 | + thread::Builder::new() |
| 122 | + .name(WORKER_THREAD_NAME.into()) |
| 123 | + .spawn(move || { |
| 124 | + let result = panic::catch_unwind(AssertUnwindSafe(|| run_lexer(&source.0))); |
| 125 | + let _ = tx.send(result); |
| 126 | + }) |
| 127 | + .expect("spawn worker thread"); |
| 128 | + |
| 129 | + match rx.recv_timeout(PER_CASE_TIMEOUT) { |
| 130 | + Err(mpsc::RecvTimeoutError::Timeout) => panic!( |
| 131 | + "lexer did not terminate within {} ms", |
| 132 | + PER_CASE_TIMEOUT.as_millis() |
| 133 | + ), |
| 134 | + Ok(Err(payload)) => panic::resume_unwind(payload), |
| 135 | + Ok(Ok(())) | Err(mpsc::RecvTimeoutError::Disconnected) => {} |
| 136 | + } |
| 137 | +} |
| 138 | + |
| 139 | +fn persistence_config(cases: u32, max_shrink_iters: u32) -> ProptestConfig { |
| 140 | + ProptestConfig { |
| 141 | + cases, |
| 142 | + max_shrink_iters, |
| 143 | + failure_persistence: Some(Box::new(FileFailurePersistence::WithSource("regressions"))), |
| 144 | + ..ProptestConfig::default() |
| 145 | + } |
| 146 | +} |
| 147 | + |
| 148 | +proptest! { |
| 149 | + // cases=0 skips fresh generation; proptest still replays every seed in |
| 150 | + // `lexer_panic.regressions` before checking the case count, so this |
| 151 | + // acts as a regression test for known panics. |
| 152 | + #![proptest_config(persistence_config(0, 0))] |
| 153 | + |
| 154 | + #[test] |
| 155 | + fn known_regressions_do_not_panic(source in arb_source()) { |
| 156 | + run_with_timeout(source); |
| 157 | + } |
| 158 | +} |
| 159 | + |
| 160 | +proptest! { |
| 161 | + #![proptest_config(persistence_config(1024, 4096))] |
| 162 | + |
| 163 | + #[test] |
| 164 | + #[ignore = "fuzz test; opt-in via `cargo test ... -- --ignored`"] |
| 165 | + fn fuzz_random_strings(source in arb_source()) { |
| 166 | + run_with_timeout(source); |
| 167 | + } |
| 168 | +} |
0 commit comments