andrew/libakstdlib
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
125eeb2109c2cc3d730a8c7221d1b37a55ac5b9b
libakstdlib/tests/test_format.c

352 lines
11 KiB
C
Raw Normal View History

Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
/*
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
* Formatted-output wrappers: aksl_printf / aksl_fprintf / aksl_snprintf and
* their va_list forms.
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
*
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
* TODO.md section 1.3, now complete. Each happy path asserts both halves of the
* contract -- the byte count handed back through *count and the text that
* actually landed somewhere -- and every pointer argument is checked for its
* NULL guard.
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
*
* Readback goes through plain libc rather than aksl_fread so that a failure here
* points at the formatted-output wrapper under test and not at the stream
* wrappers, which tests/test_stream.c covers.
*
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
* aksl_sprintf is gone (TODO.md 2.2.4) and aksl_snprintf takes its place, so the
* destination-overflow case that could not previously be written is here: it is
* AKERR_OUTOFBOUNDS, not the short success snprintf(3) would have reported.
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
*/
#include "aksl_capture.h"
#include <errno.h>
/* Read a whole file into buf and NUL-terminate. Returns bytes read, or -1. */
static long read_file(const char *path, char *buf, size_t n)
{
FILE *fp = fopen(path, "r");
size_t got = 0;
if ( fp == NULL ) {
return -1;
}
got = fread(buf, 1, n - 1, fp);
buf[got] = '\0';
if ( ferror(fp) ) {
fclose(fp);
return -1;
}
fclose(fp);
return (long)got;
}
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
static int test_snprintf_writes_text_and_count(void)
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
{
char buf[64];
int count = -1;
memset(buf, 0x00, sizeof(buf));
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
AKSL_CHECK_OK(aksl_snprintf(&count, buf, sizeof(buf), "%s=%d", "x", 7));
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
AKSL_CHECK(count == 3);
AKSL_CHECK(strcmp(buf, "x=7") == 0);
return 0;
}
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
static int test_snprintf_empty_format_writes_nothing(void)
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
{
char buf[8] = { 'z', 'z', 'z', 'z', 'z', 'z', 'z', 'z' };
int count = -1;
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
AKSL_CHECK_OK(aksl_snprintf(&count, buf, sizeof(buf), "%s", ""));
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
AKSL_CHECK(count == 0);
AKSL_CHECK(buf[0] == '\0');
return 0;
}
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
/*
* The case that could not be written while the wrapper was aksl_sprintf: output
* longer than the destination. snprintf(3) would truncate, NUL-terminate and
* report the length it *would* have written, leaving the caller to notice; here
* it is an error, and *count is 0 rather than the would-have-been length.
*/
static int test_snprintf_truncation_is_an_error(void)
{
char buf[8];
int count = -1;
memset(buf, 0x00, sizeof(buf));
AKSL_CHECK_STATUS_MSG_CONTAINS(
aksl_snprintf(&count, buf, sizeof(buf), "%s", "far too long for eight bytes"),
AKERR_OUTOFBOUNDS, "truncated");
AKSL_CHECK(count == 0);
return 0;
}
/* Exactly filling the buffer is not truncation; one byte more is. */
static int test_snprintf_boundary_is_exact(void)
{
char buf[8];
int count = -1;
/* 7 characters plus the NUL is exactly sizeof(buf). */
AKSL_CHECK_OK(aksl_snprintf(&count, buf, sizeof(buf), "%s", "1234567"));
AKSL_CHECK(count == 7);
AKSL_CHECK(strcmp(buf, "1234567") == 0);
count = -1;
AKSL_CHECK_STATUS(aksl_snprintf(&count, buf, sizeof(buf), "%s", "12345678"),
AKERR_OUTOFBOUNDS);
AKSL_CHECK(count == 0);
return 0;
}
static int test_snprintf_rejects_null_arguments_and_zero_size(void)
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
{
char buf[8];
int count = 0;
memset(buf, 0x00, sizeof(buf));
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_snprintf(NULL, buf, sizeof(buf), "x"),
AKERR_NULLPOINTER, "count=");
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_snprintf(&count, NULL, 8, "x"),
AKERR_NULLPOINTER, "str=");
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_snprintf(&count, buf, sizeof(buf), NULL),
AKERR_NULLPOINTER, "format=");
/* size 0 leaves no room even for the terminator, so there is nothing to do. */
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_snprintf(&count, buf, 0, "x"),
AKERR_VALUE, "size=0");
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
return 0;
}
static int test_fprintf_writes_to_stream(void)
{
char path[AKSL_TMP_MAX];
char readback[64];
FILE *fp = NULL;
int count = -1;
AKSL_CHECK(aksl_temp_file(path, sizeof(path)) == 0);
AKSL_CHECK_OK(aksl_fopen(path, "w", &fp));
AKSL_CHECK_OK(aksl_fprintf(&count, fp, "%s %d", "value", 42));
AKSL_CHECK_OK(aksl_fclose(fp));
AKSL_CHECK(count == 8);
AKSL_CHECK(read_file(path, readback, sizeof(readback)) == 8);
AKSL_CHECK(strcmp(readback, "value 42") == 0);
AKSL_CHECK(unlink(path) == 0);
return 0;
}
/*
* vfprintf on a stream opened "r" fails outright, so the wrapper reports the
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
* errno it saw (EBADF on glibc). *count is 0 afterwards, not vfprintf's -1:
* TODO.md 1.3 recorded the negative count as a contract gap, and this is the
* assertion that closes it.
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
*/
static int test_fprintf_to_read_only_stream_reports_errno(void)
{
char path[AKSL_TMP_MAX];
FILE *fp = NULL;
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
int count = 99;
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
AKSL_CHECK(aksl_temp_file(path, sizeof(path)) == 0);
AKSL_CHECK_OK(aksl_fopen(path, "r", &fp));
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_fprintf(&count, fp, "%d", 1),
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
EBADF, "Short write");
AKSL_CHECK(count == 0);
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
AKSL_CHECK_OK(aksl_fclose(fp));
AKSL_CHECK(unlink(path) == 0);
return 0;
}
static int test_fprintf_rejects_null_arguments(void)
{
int count = 0;
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_fprintf(NULL, stdout, "x"),
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
AKERR_NULLPOINTER, "count=");
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_fprintf(&count, NULL, "x"),
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
AKERR_NULLPOINTER, "stream=");
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_fprintf(&count, stdout, NULL),
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
AKERR_NULLPOINTER, "format=");
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
return 0;
}
/*
* aksl_printf writes to stdout, so stdout is pointed at a temp file for the
* duration of the call and then restored through a dup of the original
* descriptor. Nothing between the freopen and the dup2 may return early: an
* assertion there would leave stdout attached to the temp file for the rest of
* the run, and the test report itself would vanish.
*/
static int test_printf_writes_to_stdout(void)
{
char path[AKSL_TMP_MAX];
char readback[64];
akerr_ErrorContext *err = NULL;
int count = -1;
int saved = -1;
int restored = -1;
AKSL_CHECK(aksl_temp_file(path, sizeof(path)) == 0);
fflush(stdout);
saved = dup(fileno(stdout));
AKSL_CHECK(saved >= 0);
if ( freopen(path, "w", stdout) == NULL ) {
close(saved);
AKSL_CHECK(0);
}
err = aksl_printf(&count, "%s#%d", "out", 5);
fflush(stdout);
restored = dup2(saved, fileno(stdout));
close(saved);
clearerr(stdout);
AKSL_CHECK(restored >= 0);
AKSL_CHECK(aksl_take(err) == 0);
AKSL_CHECK(count == 5);
AKSL_CHECK(read_file(path, readback, sizeof(readback)) == 5);
AKSL_CHECK(strcmp(readback, "out#5") == 0);
AKSL_CHECK(unlink(path) == 0);
return 0;
}
static int test_printf_rejects_null_arguments(void)
{
int count = 0;
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_printf(NULL, "x"),
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
AKERR_NULLPOINTER, "count=");
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_printf(&count, NULL),
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
AKERR_NULLPOINTER, "format=");
return 0;
}
Version at 0.2.0: complete the wishlist, document it, gate the docs Closes what was left of TODO.md sections 1, 2 and 3, and rewrites that file to hold outstanding items only. The API break gets a minor bump, because pre-1.0 the soname carries MAJOR.MINOR and 0.1 and 0.2 are therefore different ABIs. Five signatures changed and the ato* contract with them; UPGRADING.md is new and lists every one, with the before/after for the cases the compiler cannot warn about. Section 3.1 is finished: reallocarray with the multiplication checked, aligned_alloc and posix_memalign, asprintf/vasprintf, scanf/vscanf. Four functions on that list are deliberately absent rather than missing -- sprintf, strtok, setbuf and perror -- and TODO.md now says which and why, so nobody adds them thinking they were forgotten. Section 1.9, the cross-cutting tests: tests/test_pool.c drives every failure path AKERR_MAX_ARRAY_ERROR + 10 times and checks the pool after each round, because a wrapper that leaks a slot fails a hundred calls later in unrelated code. It also asserts that each error names the function and file it was raised from, which is what catches a FAIL that migrates into a helper during a refactor: status right, message right, origin quietly lying. tests/negative/ two sources that must FAIL to compile, built with -Werror and registered WILL_FAIL. AKERR_NOIGNORE and the format attributes are enforced by the compiler and by nothing else; drop either and every ordinary test still passes. Thread safety is answered rather than tested: the library is not thread-safe and cannot be made so from here, because libakerror's error pool is an unlocked process-global array. README.md says so plainly and TODO.md carries it as the item blocking any future pthread wrappers. Doxygen is configured and gated. All 147 public functions have @brief, a @param each, @throws per status and @return; EXTRACT_ALL is off and WARN_NO_PARAMDOC on, so `cmake --build build --target docs` fails on an undocumented entity. It ran to 0 warnings. The Doxyfile carries no version -- cmake/RunDoxygen.cmake feeds PROJECT_NUMBER in from project(), so that stays the one place a version is written. CI now builds against the submodule it pins instead of also installing libakerror@main and never linking it, adds -Werror, and gains a sanitizer job. The pre-push hook matches, and runs the docs check too. Coverage: 99.5% of lines (1643/1651), 100% of functions (147/147). The eight uncovered lines are each uncovered on purpose and TODO.md says which and why. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 08:00:16 -04:00
/*
* The allocating form. No fixed buffer means no truncation case, which is what
* makes it the right answer when the length is not knowable in advance and the
* result is too short-lived to want a whole aksl_StrBuf.
*/
static int test_asprintf_allocates_to_fit(void)
{
char *out = NULL;
int count = -1;
int i = 0;
AKSL_CHECK_OK(aksl_asprintf(&count, &out, "%s=%d", "key", 42));
AKSL_CHECK(out != NULL);
AKSL_CHECK(strcmp(out, "key=42") == 0);
AKSL_CHECK(count == 6);
AKSL_CHECK_OK(aksl_freep((void **)&out));
/* Far longer than any buffer a fixed-size wrapper would have used. */
AKSL_CHECK_OK(aksl_asprintf(&count, &out, "%01000d", 7));
AKSL_CHECK(count == 1000);
AKSL_CHECK(strlen(out) == 1000);
AKSL_CHECK_OK(aksl_freep((void **)&out));
/* An empty result is a valid empty string, not NULL. */
AKSL_CHECK_OK(aksl_asprintf(&count, &out, "%s", ""));
AKSL_CHECK(count == 0);
AKSL_CHECK(out != NULL && out[0] == '\0');
AKSL_CHECK_OK(aksl_freep((void **)&out));
/* Repeatedly, so a leak shows up under the sanitizer build. */
for ( i = 0; i < 256; i++ ) {
AKSL_CHECK_OK(aksl_asprintf(&count, &out, "iteration %d of %d", i, 256));
AKSL_CHECK((size_t)count == strlen(out));
AKSL_CHECK_OK(aksl_freep((void **)&out));
}
out = (char *)0x1;
AKSL_CHECK_STATUS(aksl_asprintf(NULL, &out, "x"), AKERR_NULLPOINTER);
AKSL_CHECK_STATUS(aksl_asprintf(&count, NULL, "x"), AKERR_NULLPOINTER);
AKSL_CHECK_STATUS(aksl_asprintf(&count, &out, NULL), AKERR_NULLPOINTER);
/* Cleared before the format is even looked at. */
AKSL_CHECK(out == NULL);
return 0;
}
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
/*
* The va_list forms are what the variadic ones are built on, and TODO.md 3.1
* wanted them exposed so consumers can write their own variadic wrappers. This
* is a consumer doing exactly that.
*/
static akerr_ErrorContext AKERR_NOIGNORE *consumer_wrapper(int *count, char *buf, size_t n,
const char *fmt, ...)
{
va_list args;
akerr_ErrorContext *raised = NULL;
va_start(args, fmt);
raised = aksl_vsnprintf(count, buf, n, fmt, args);
va_end(args);
return raised;
}
static int test_va_list_forms_are_usable_from_outside(void)
{
char buf[32];
int count = -1;
memset(buf, 0x00, sizeof(buf));
AKSL_CHECK_OK(consumer_wrapper(&count, buf, sizeof(buf), "%s/%d", "via", 3));
AKSL_CHECK(count == 5);
AKSL_CHECK(strcmp(buf, "via/3") == 0);
/* The error contract survives the extra layer intact. */
AKSL_CHECK_STATUS(consumer_wrapper(&count, buf, 4, "%s", "too long"),
AKERR_OUTOFBOUNDS);
AKSL_CHECK(count == 0);
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
return 0;
}
/*
* Regression cover for the missing va_end (TODO.md 2.1.4). Nothing here can
* assert on register-save state directly; the point is to run the variadic
* wrappers enough times, with enough arguments, that the sanitizer build has
* something to trip over.
*/
static int test_variadic_wrappers_survive_repeated_calls(void)
{
char buf[128];
int count = 0;
int i = 0;
for ( i = 0; i < 512; i++ ) {
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
AKSL_CHECK_OK(aksl_snprintf(&count, buf, sizeof(buf), "%d %s %ld %c %f",
i, "iteration", (long)i, 'x', (double)i));
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
AKSL_CHECK(count > 0);
AKSL_CHECK((size_t)count == strlen(buf));
}
return 0;
}
int main(void)
{
int failures = 0;
akerr_init();
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
AKSL_RUN(failures, test_snprintf_writes_text_and_count);
AKSL_RUN(failures, test_snprintf_empty_format_writes_nothing);
AKSL_RUN(failures, test_snprintf_truncation_is_an_error);
AKSL_RUN(failures, test_snprintf_boundary_is_exact);
AKSL_RUN(failures, test_snprintf_rejects_null_arguments_and_zero_size);
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
AKSL_RUN(failures, test_fprintf_writes_to_stream);
AKSL_RUN(failures, test_fprintf_to_read_only_stream_reports_errno);
AKSL_RUN(failures, test_fprintf_rejects_null_arguments);
AKSL_RUN(failures, test_printf_writes_to_stdout);
AKSL_RUN(failures, test_printf_rejects_null_arguments);
Version at 0.2.0: complete the wishlist, document it, gate the docs Closes what was left of TODO.md sections 1, 2 and 3, and rewrites that file to hold outstanding items only. The API break gets a minor bump, because pre-1.0 the soname carries MAJOR.MINOR and 0.1 and 0.2 are therefore different ABIs. Five signatures changed and the ato* contract with them; UPGRADING.md is new and lists every one, with the before/after for the cases the compiler cannot warn about. Section 3.1 is finished: reallocarray with the multiplication checked, aligned_alloc and posix_memalign, asprintf/vasprintf, scanf/vscanf. Four functions on that list are deliberately absent rather than missing -- sprintf, strtok, setbuf and perror -- and TODO.md now says which and why, so nobody adds them thinking they were forgotten. Section 1.9, the cross-cutting tests: tests/test_pool.c drives every failure path AKERR_MAX_ARRAY_ERROR + 10 times and checks the pool after each round, because a wrapper that leaks a slot fails a hundred calls later in unrelated code. It also asserts that each error names the function and file it was raised from, which is what catches a FAIL that migrates into a helper during a refactor: status right, message right, origin quietly lying. tests/negative/ two sources that must FAIL to compile, built with -Werror and registered WILL_FAIL. AKERR_NOIGNORE and the format attributes are enforced by the compiler and by nothing else; drop either and every ordinary test still passes. Thread safety is answered rather than tested: the library is not thread-safe and cannot be made so from here, because libakerror's error pool is an unlocked process-global array. README.md says so plainly and TODO.md carries it as the item blocking any future pthread wrappers. Doxygen is configured and gated. All 147 public functions have @brief, a @param each, @throws per status and @return; EXTRACT_ALL is off and WARN_NO_PARAMDOC on, so `cmake --build build --target docs` fails on an undocumented entity. It ran to 0 warnings. The Doxyfile carries no version -- cmake/RunDoxygen.cmake feeds PROJECT_NUMBER in from project(), so that stays the one place a version is written. CI now builds against the submodule it pins instead of also installing libakerror@main and never linking it, adds -Werror, and gains a sanitizer job. The pre-push hook matches, and runs the docs check too. Coverage: 99.5% of lines (1643/1651), 100% of functions (147/147). The eight uncovered lines are each uncovered on purpose and TODO.md says which and why. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 08:00:16 -04:00
AKSL_RUN(failures, test_asprintf_allocates_to_fit);
Fix the six confirmed defects and close the API contract gaps TODO.md section 2.1 recorded six defects reproduced against the built library, and section 2.2 seventeen contract gaps. Both are closed. The four tests registered in AKSL_KNOWN_FAILING_TESTS are folded back into the tests for the things they test, and that list is now empty. The defects: 2.1.1 aksl_list_append conflated Floyd cycle detection with finding the tail, so `tail` tracked the node behind the midpoint. Any append to a list of 2+ nodes silently dropped everything after it. Two separate walks now: Floyd to prove the list is finite, then a plain walk to the end. 2.1.2 aksl_list_iterate started visiting from Floyd's `slow` cursor, so the whole first half of the list -- head included -- was never passed to the callback. It starts at the head. 2.1.3 AKERR_ITERATOR_BREAK did not stop a tree traversal: the frame that raised it handled it and returned success, so the parent carried on into the sibling subtree. The recursion is split out and propagates the break; only the public entry swallows it. 2.1.4 va_end now matches every va_start on every path. 2.1.5 The ato* family had no error channel at all. Reimplemented over a new strto* family with errno cleared, an endptr check and a range check: AKERR_VALUE for junk, ERANGE for overflow. 2.1.6 aksl_realpath never checked resolved_path, could not be told the buffer size, and formatted an unspecified buffer with %s on its own error path. It takes a length; aksl_realpath_alloc is the allocating form. The contract gaps, in brief: errno is cleared before every wrapped call and read back through a fallback so no error can carry status 0; fopen validates pathname and mode; fread/fwrite report the transferred count through a required out-param and no longer call a short transfer a success; aksl_sprintf is gone in favour of aksl_snprintf, which treats truncation as an error; the variadic wrappers carry format attributes; djb2 reads bytes as unsigned; tree traversal is depth- and cycle-bounded and implements BFS, so lalloc/lfree are used rather than merely stored; an unknown searchmode is AKERR_VALUE rather than silent success; list_pop takes the head by reference; aksl_freep, the node initialisers and extern "C" are new. Build: -pg is out of the default build (it never reached the C compiler anyway, and it is what produced the stray gmon.out), -Wall -Wextra are in, and there is a .gitignore. Tests: 11 binaries, all green under the normal and sanitizer builds. Visit-order assertions replace the step counts that could not tell the three depth-first orders apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 07:14:11 -04:00
AKSL_RUN(failures, test_va_list_forms_are_usable_from_outside);
Test the libc wrappers: 52% -> 99% line coverage Every wrapper outside the list and tree code was untested. Six new test files close that, following the plan already written in TODO.md 1.2-1.6: test_stream.c fopen/fread/fwrite/fclose -- happy paths, the round trip, AKERR_EOF on a short read, AKERR_IO on a stream opened in the wrong mode, ENOENT, and the NULL guards test_format.c printf/fprintf/sprintf -- text *and* count asserted (stdout is pointed at a temp file to check aksl_printf), all eight NULL guards, EBADF on a read-only stream, and 512 variadic calls in a loop as sanitizer cover for the missing va_end test_convert.c ato{i,l,ll,f} happy paths, negatives, leading whitespace, NULL guards test_path.c realpath on a file and on a symlink, both compared against realpath(3) since TMPDIR may itself be a link; ENOENT, ENOTDIR, NULL path test_strhash.c djb2 known-answer vectors, len == 0, embedded NUL, stability, NULL guards test_convert_strict.c known-failing (2.1.5): the AKERR_VALUE / ERANGE contract the ato* family cannot express today test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments, and a callback error that is not AKERR_ITERATOR_BREAK propagating out. Tests deliberately say nothing about behaviour TODO.md records as defective -- unchecked ptr/mode/resolved_path, short transfers reported as success, *count left at -1, the djb2 sign extension -- so the eventual fix does not have to come with a test rewrite. Each failure case in test_path.c passes a zeroed buffer, because the wrapper's own error path formats resolved_path with %s (2.1.6). aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop. Without it every test that fails before its own unlink leaves temp files behind -- which is the normal case for a known-failing test, and happens 173 times over in a mutation run. Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% -> 51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL error context whose status is zero, the pathology 2.2.1 exists to remove. Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18 survivors are grouped by cause in TODO.md and README.md. A new CI coverage job gates at 90% lines / 45% branches. Verified: ctest --test-dir build # 12/12 ctest --test-dir build-asan # 12/12 under ASan + UBSan ctest --test-dir build-coverage # 14/14, report attached ctest --test-dir build -j8 --repeat until-fail:3 gcc -Wall -Wextra -c on all nine test files # no warnings python3 scripts/mutation_test.py --target src/stdlib.c # 89.6% No temp files left in /tmp after any of the above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 02:07:08 -04:00
AKSL_RUN(failures, test_variadic_wrappers_survive_repeated_calls);
AKSL_REPORT(failures);
}
Reference in New Issue Copy Permalink