feat: mutate lists using user-provided dictionaries

Author: oetr

src/main/java/com/code_intelligence/jazzer/mutation/mutator/collection/ListMutatorFactory.java

@@ -27,10 +27,13 @@
 import static com.code_intelligence.jazzer.mutation.mutator.collection.ChunkMutations.mutateRandomChunk;
 import static com.code_intelligence.jazzer.mutation.support.Preconditions.require;
 import static com.code_intelligence.jazzer.mutation.support.PropertyConstraintSupport.propagatePropertyConstraints;
+import static com.code_intelligence.jazzer.mutation.support.TypeSupport.canBeAssignedTo;
 import static com.code_intelligence.jazzer.mutation.support.TypeSupport.parameterTypeIfParameterized;
 import static java.lang.Math.min;
 import static java.lang.String.format;
 
+import com.code_intelligence.jazzer.mutation.annotation.DictionaryObject;
+import com.code_intelligence.jazzer.mutation.annotation.DictionaryProvider;
 import com.code_intelligence.jazzer.mutation.annotation.WithSize;
 import com.code_intelligence.jazzer.mutation.api.Debuggable;
 import com.code_intelligence.jazzer.mutation.api.ExtendedMutatorFactory;
@@ -44,10 +47,12 @@
 import java.io.IOException;
 import java.lang.reflect.AnnotatedType;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.List;
 import java.util.Optional;
 import java.util.function.Predicate;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 final class ListMutatorFactory implements MutatorFactory {
   @Override
@@ -61,7 +66,7 @@ public Optional<SerializingMutator<?>> tryCreate(
               Optional<WithSize> withSize = Optional.ofNullable(type.getAnnotation(WithSize.class));
               int minSize = withSize.map(WithSize::min).orElse(ListMutator.DEFAULT_MIN_SIZE);
               int maxSize = withSize.map(WithSize::max).orElse(ListMutator.DEFAULT_MAX_SIZE);
-              return new ListMutator<>(elementMutator, minSize, maxSize);
+              return new ListMutator<>(type, elementMutator, minSize, maxSize);
             });
   }
 
@@ -72,8 +77,10 @@ private static final class ListMutator<T> extends SerializingInPlaceMutator<List
     private final SerializingMutator<T> elementMutator;
     private final int minSize;
     private final int maxSize;
+    public final List<List<T>> dictionaryValues;
 
-    ListMutator(SerializingMutator<T> elementMutator, int minSize, int maxSize) {
+    ListMutator(
+        AnnotatedType type, SerializingMutator<T> elementMutator, int minSize, int maxSize) {
       this.elementMutator = elementMutator;
       this.minSize = minSize;
       this.maxSize = maxSize;
@@ -84,6 +91,29 @@ private static final class ListMutator<T> extends SerializingInPlaceMutator<List
           format(
               "WithSize#min=%d needs to be smaller or equal than WithSize#max=%d",
               minSize, maxSize));
+
+      DictionaryObject[] dictObj = type.getAnnotationsByType(DictionaryObject.class);
+      System.out.println(
+          "DICT OBJECTS for List : " + type + "     ------ " + Arrays.toString(dictObj));
+
+      dictionaryValues =
+          (List<List<T>>)
+              Arrays.stream(dictObj)
+                  .flatMap(
+                      o -> {
+                        Class<? extends DictionaryProvider> providerClass = o.value();
+                        try {
+                          DictionaryProvider provider =
+                              providerClass.getDeclaredConstructor().newInstance();
+                          return provider.value();
+                        } catch (ReflectiveOperationException e) {
+                          return Stream.empty();
+                        }
+                      })
+                  .filter(v -> canBeAssignedTo(v, type))
+                  .toList();
+
+      System.out.println(" ------ " + this.dictionaryValues);
     }
 
     @Override
@@ -120,6 +150,17 @@ public void initInPlace(List<T> list, PseudoRandom prng) {
 
     @Override
     public void mutateInPlace(List<T> list, PseudoRandom prng) {
+
+      // With a small probability, replace the entire list with a dictionary value
+      if (!dictionaryValues.isEmpty() && prng.indexIn(20) == 0) {
+        list.clear();
+        // copy the list from the dictionary to avoid mutating the dictionary itself
+        List<T> ref = dictionaryValues.get(prng.indexIn(dictionaryValues.size()));
+        list.addAll(ref);
+        System.out.println("LIST MUTATE IN PLACE - DICTIONARY VALUE: " + ref);
+        return;
+      }
+
       switch (pickRandomMutationAction(list, minSize, maxSize, prng)) {
         case DELETE_CHUNK:
           deleteRandomChunk(list, minSize, prng, elementMutator.hasFixedSize());

src/main/java/com/code_intelligence/jazzer/mutation/support/TypeSupport.java

@@ -42,9 +42,11 @@
 import java.lang.reflect.Type;
 import java.util.ArrayDeque;
 import java.util.Arrays;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 import java.util.function.BiConsumer;
@@ -154,6 +156,88 @@ public boolean equals(Object obj) {
     };
   }
 
+  public static boolean canBeAssignedTo(Object obj, AnnotatedType annotatedType) {
+    if (obj == null) {
+      return true; // null can be assigned to any reference type
+    }
+
+    return isAssignableFrom(obj, annotatedType);
+  }
+
+  private static boolean isAssignableFrom(Object obj, AnnotatedType targetType) {
+    Type type = targetType.getType();
+
+    if (type instanceof Class<?>) {
+      Class<?> targetClass = (Class<?>) type;
+      return targetClass.isInstance(obj);
+    } else if (type instanceof ParameterizedType) {
+      ParameterizedType parameterizedType = (ParameterizedType) type;
+      Class<?> rawType = (Class<?>) parameterizedType.getRawType();
+
+      // First check if the raw type matches
+      if (!rawType.isInstance(obj)) {
+        return false;
+      }
+
+      // For collections, try to check the element types
+      if (targetType instanceof AnnotatedParameterizedType) {
+        return checkParameterizedType(obj, (AnnotatedParameterizedType) targetType);
+      }
+    }
+
+    return false;
+  }
+
+  private static boolean checkParameterizedType(
+      Object obj, AnnotatedParameterizedType annotatedParamType) {
+    ParameterizedType paramType = (ParameterizedType) annotatedParamType.getType();
+    Class<?> rawType = (Class<?>) paramType.getRawType();
+    AnnotatedType[] typeArguments = annotatedParamType.getAnnotatedActualTypeArguments();
+
+    // Handle common collection types
+    if (Collection.class.isAssignableFrom(rawType) && obj instanceof Collection<?>) {
+      return checkCollection((Collection<?>) obj, typeArguments);
+    } else if (Map.class.isAssignableFrom(rawType) && obj instanceof Map<?, ?>) {
+      return checkMap((Map<?, ?>) obj, typeArguments);
+    }
+
+    // For other parameterized types, we can't easily check at runtime
+    // This is a limitation of type erasure
+    return true; // Assume compatible if we can't check
+  }
+
+  private static boolean checkCollection(Collection<?> collection, AnnotatedType[] typeArguments) {
+    if (typeArguments.length != 1) {
+      return false; // Collections should have exactly one type parameter
+    }
+
+    AnnotatedType elementType = typeArguments[0];
+
+    // Check a sample of elements (checking all could be expensive for large collections)
+    int sampleSize = Math.min(10, collection.size());
+    return collection.stream()
+        .limit(sampleSize)
+        .allMatch(element -> canBeAssignedTo(element, elementType));
+  }
+
+  private static boolean checkMap(Map<?, ?> map, AnnotatedType[] typeArguments) {
+    if (typeArguments.length != 2) {
+      return false; // Maps should have exactly two type parameters
+    }
+
+    AnnotatedType keyType = typeArguments[0];
+    AnnotatedType valueType = typeArguments[1];
+
+    // Check a sample of entries
+    int sampleSize = Math.min(10, map.size());
+    return map.entrySet().stream()
+        .limit(sampleSize)
+        .allMatch(
+            entry ->
+                canBeAssignedTo(entry.getKey(), keyType)
+                    && canBeAssignedTo(entry.getValue(), valueType));
+  }
+
   /**
    * Visits the individual classes and their directly present annotations that make up the given
    * type.