andrew/libakstdlib
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Test the libc wrappers: 52% -> 99% line coverage

Browse Source 
Every wrapper outside the list and tree code was untested. Six new test
files close that, following the plan already written in TODO.md 1.2-1.6:

  test_stream.c   fopen/fread/fwrite/fclose -- happy paths, the round
                  trip, AKERR_EOF on a short read, AKERR_IO on a stream
                  opened in the wrong mode, ENOENT, and the NULL guards
  test_format.c   printf/fprintf/sprintf -- text *and* count asserted
                  (stdout is pointed at a temp file to check aksl_printf),
                  all eight NULL guards, EBADF on a read-only stream, and
                  512 variadic calls in a loop as sanitizer cover for the
                  missing va_end
  test_convert.c  ato{i,l,ll,f} happy paths, negatives, leading
                  whitespace, NULL guards
  test_path.c     realpath on a file and on a symlink, both compared
                  against realpath(3) since TMPDIR may itself be a link;
                  ENOENT, ENOTDIR, NULL path
  test_strhash.c  djb2 known-answer vectors, len == 0, embedded NUL,
                  stability, NULL guards
  test_convert_strict.c
                  known-failing (2.1.5): the AKERR_VALUE / ERANGE
                  contract the ato* family cannot express today

test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments,
and a callback error that is not AKERR_ITERATOR_BREAK propagating out.

Tests deliberately say nothing about behaviour TODO.md records as
defective -- unchecked ptr/mode/resolved_path, short transfers reported as
success, *count left at -1, the djb2 sign extension -- so the eventual fix
does not have to come with a test rewrite. Each failure case in
test_path.c passes a zeroed buffer, because the wrapper's own error path
formats resolved_path with %s (2.1.6).

aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop.
Without it every test that fails before its own unlink leaves temp files
behind -- which is the normal case for a known-failing test, and happens
173 times over in a mutation run.

Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% ->
51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are
both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with
the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL
error context whose status is zero, the pathology 2.2.1 exists to remove.

Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the
pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18
survivors are grouped by cause in TODO.md and README.md. A new CI
coverage job gates at 90% lines / 45% branches.

Verified:
  ctest --test-dir build            # 12/12
  ctest --test-dir build-asan       # 12/12 under ASan + UBSan
  ctest --test-dir build-coverage   # 14/14, report attached
  ctest --test-dir build -j8 --repeat until-fail:3
  gcc -Wall -Wextra -c on all nine test files  # no warnings
  python3 scripts/mutation_test.py --target src/stdlib.c  # 89.6%
No temp files left in /tmp after any of the above.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Andrew Kesterson
2026-07-30 02:07:08 -04:00
parent 82c47ed773
commit 437da2960b
14 changed files with 1138 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files

224
tests/test_format.c Normal file
View File

@@ -0,0 +1,224 @@
/*
* Formatted-output wrappers: aksl_printf / aksl_fprintf / aksl_sprintf.
*
* TODO.md section 1.3. Each happy path asserts both halves of the contract --
* the byte count handed back through *count and the text that actually landed
* somewhere -- and every pointer argument is checked for its NULL guard.
*
* Readback goes through plain libc rather than aksl_fread so that a failure here
* points at the formatted-output wrapper under test and not at the stream
* wrappers, which tests/test_stream.c covers.
*
* Not covered: the destination-overflow case, because aksl_sprintf wraps the
* unbounded vsprintf and there is no bounded entry point to test yet
* (TODO.md 2.2.4).
*/
#include "aksl_capture.h"
#include <errno.h>
/* Read a whole file into buf and NUL-terminate. Returns bytes read, or -1. */
static long read_file(const char *path, char *buf, size_t n)
{
FILE *fp = fopen(path, "r");
size_t got = 0;
if ( fp == NULL ) {
return -1;
}
got = fread(buf, 1, n - 1, fp);
buf[got] = '\0';
if ( ferror(fp) ) {
fclose(fp);
return -1;
}
fclose(fp);
return (long)got;
}
static int test_sprintf_writes_text_and_count(void)
{
char buf[64];
int count = -1;
memset(buf, 0x00, sizeof(buf));
AKSL_CHECK_OK(aksl_sprintf(&count, buf, "%s=%d", "x", 7));
AKSL_CHECK(count == 3);
AKSL_CHECK(strcmp(buf, "x=7") == 0);
return 0;
}
static int test_sprintf_empty_format_writes_nothing(void)
{
char buf[8] = { 'z', 'z', 'z', 'z', 'z', 'z', 'z', 'z' };
int count = -1;
AKSL_CHECK_OK(aksl_sprintf(&count, buf, "%s", ""));
AKSL_CHECK(count == 0);
AKSL_CHECK(buf[0] == '\0');
return 0;
}
static int test_sprintf_rejects_null_arguments(void)
{
char buf[8];
int count = 0;
memset(buf, 0x00, sizeof(buf));
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_sprintf(NULL, buf, "x"),
AKERR_NULLPOINTER, "count=");
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_sprintf(&count, NULL, "x"),
AKERR_NULLPOINTER, "str=");
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_sprintf(&count, buf, NULL),
AKERR_NULLPOINTER, "format=");
return 0;
}
static int test_fprintf_writes_to_stream(void)
{
char path[AKSL_TMP_MAX];
char readback[64];
FILE *fp = NULL;
int count = -1;
AKSL_CHECK(aksl_temp_file(path, sizeof(path)) == 0);
AKSL_CHECK_OK(aksl_fopen(path, "w", &fp));
AKSL_CHECK_OK(aksl_fprintf(&count, fp, "%s %d", "value", 42));
AKSL_CHECK_OK(aksl_fclose(fp));
AKSL_CHECK(count == 8);
AKSL_CHECK(read_file(path, readback, sizeof(readback)) == 8);
AKSL_CHECK(strcmp(readback, "value 42") == 0);
AKSL_CHECK(unlink(path) == 0);
return 0;
}
/*
* vfprintf on a stream opened "r" fails outright, so the wrapper reports the
* errno it saw (EBADF on glibc). *count is left holding -1 in this case, which
* TODO.md 1.3 flags as a contract gap -- the status is the assertion here.
*/
static int test_fprintf_to_read_only_stream_reports_errno(void)
{
char path[AKSL_TMP_MAX];
FILE *fp = NULL;
int count = 0;
AKSL_CHECK(aksl_temp_file(path, sizeof(path)) == 0);
AKSL_CHECK_OK(aksl_fopen(path, "r", &fp));
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_fprintf(&count, fp, "%d", 1),
EBADF, "Short write");
AKSL_CHECK_OK(aksl_fclose(fp));
AKSL_CHECK(unlink(path) == 0);
return 0;
}
static int test_fprintf_rejects_null_arguments(void)
{
int count = 0;
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_fprintf(NULL, stdout, "x"),
AKERR_NULLPOINTER, "count=");
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_fprintf(&count, NULL, "x"),
AKERR_NULLPOINTER, "stream=");
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_fprintf(&count, stdout, NULL),
AKERR_NULLPOINTER, "format=");
return 0;
}
/*
* aksl_printf writes to stdout, so stdout is pointed at a temp file for the
* duration of the call and then restored through a dup of the original
* descriptor. Nothing between the freopen and the dup2 may return early: an
* assertion there would leave stdout attached to the temp file for the rest of
* the run, and the test report itself would vanish.
*/
static int test_printf_writes_to_stdout(void)
{
char path[AKSL_TMP_MAX];
char readback[64];
akerr_ErrorContext *err = NULL;
int count = -1;
int saved = -1;
int restored = -1;
AKSL_CHECK(aksl_temp_file(path, sizeof(path)) == 0);
fflush(stdout);
saved = dup(fileno(stdout));
AKSL_CHECK(saved >= 0);
if ( freopen(path, "w", stdout) == NULL ) {
close(saved);
AKSL_CHECK(0);
}
err = aksl_printf(&count, "%s#%d", "out", 5);
fflush(stdout);
restored = dup2(saved, fileno(stdout));
close(saved);
clearerr(stdout);
AKSL_CHECK(restored >= 0);
AKSL_CHECK(aksl_take(err) == 0);
AKSL_CHECK(count == 5);
AKSL_CHECK(read_file(path, readback, sizeof(readback)) == 5);
AKSL_CHECK(strcmp(readback, "out#5") == 0);
AKSL_CHECK(unlink(path) == 0);
return 0;
}
static int test_printf_rejects_null_arguments(void)
{
int count = 0;
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_printf(NULL, "x"),
AKERR_NULLPOINTER, "count=");
AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_printf(&count, NULL),
AKERR_NULLPOINTER, "format=");
return 0;
}
/*
* Regression cover for the missing va_end (TODO.md 2.1.4). Nothing here can
* assert on register-save state directly; the point is to run the variadic
* wrappers enough times, with enough arguments, that the sanitizer build has
* something to trip over.
*/
static int test_variadic_wrappers_survive_repeated_calls(void)
{
char buf[128];
int count = 0;
int i = 0;
for ( i = 0; i < 512; i++ ) {
AKSL_CHECK_OK(aksl_sprintf(&count, buf, "%d %s %ld %c %f",
i, "iteration", (long)i, 'x', (double)i));
AKSL_CHECK(count > 0);
AKSL_CHECK((size_t)count == strlen(buf));
}
return 0;
}
int main(void)
{
int failures = 0;
akerr_init();
AKSL_RUN(failures, test_sprintf_writes_text_and_count);
AKSL_RUN(failures, test_sprintf_empty_format_writes_nothing);
AKSL_RUN(failures, test_sprintf_rejects_null_arguments);
AKSL_RUN(failures, test_fprintf_writes_to_stream);
AKSL_RUN(failures, test_fprintf_to_read_only_stream_reports_errno);
AKSL_RUN(failures, test_fprintf_rejects_null_arguments);
AKSL_RUN(failures, test_printf_writes_to_stdout);
AKSL_RUN(failures, test_printf_rejects_null_arguments);
AKSL_RUN(failures, test_variadic_wrappers_survive_repeated_calls);
AKSL_REPORT(failures);
}