#!/usr/bin/env python3
"""Deterministic malformed-source differential fuzzing for compiler hosts.

Usage: python3 tests/drivers/fuzz_malformed.py [native] [microcore]
"""
import random
import subprocess
import sys


bins = sys.argv[1:] or ["bin/zy", "bin/zym"]
if len(bins) == 1:
    bins.append(bins[0])
rng = random.Random(0xC0DE)
tokens = [
    b"fn", b"let", b"int", b"char*", b"word", b"return", b"if", b"else",
    b"while", b"for", b"include", b"std", b";", b"{", b"}", b"(", b")",
    b"[", b"]", b"=", b",", b".", b":", b"?", b"+", b"-", b"*", b"&",
    b"|", b"!", b"~", b'"text"', b"'x'", b"0", b"1", b"_", b"NIF",
    b"asm", b"unchecked", b"\x00", b"\xff", "λ".encode(),
]
cases = []
for i in range(256):
    words = [rng.choice(tokens) for _ in range(rng.randrange(1, 100))]
    cases.append(b" ".join(words) + b"\n")

# Mutate a small valid program around parser and analyzer boundaries. Keeping
# each mutation bounded makes a failing seed easy to reproduce and minimize.
base = b"include std;\nfn main() { let x = 1; return x; }\n"
for _ in range(64):
    data = bytearray(base)
    for __ in range(rng.randrange(1, 5)):
        at = rng.randrange(len(data))
        if rng.randrange(2):
            data[at:at + 1] = rng.choice(tokens)
        else:
            del data[at:at + 1]
    cases.append(bytes(data))


def run(binary, source):
    return subprocess.run(
        [binary], input=b"typecheck on;\n" + source, capture_output=True, timeout=3
    )


for i, source in enumerate(cases):
    results = []
    for binary in bins:
        try:
            result = run(binary, source)
        except subprocess.TimeoutExpired:
            raise SystemExit(f"{binary} timed out on malformed seed 0xC0DE case {i}: {source!r}")
        if result.returncode < 0:
            raise SystemExit(
                f"{binary} crashed on malformed seed 0xC0DE case {i}: "
                f"signal {-result.returncode}, source={source!r}, stderr={result.stderr!r}"
            )
        results.append((result.returncode, result.stdout, result.stderr))
    if any(result != results[0] for result in results[1:]):
        raise SystemExit(f"compiler hosts disagreed on malformed seed 0xC0DE case {i}: {source!r}")

print(f"ok   malformed-source fuzz: {len(cases)} bounded token and byte mutations agree on {len(bins)} compiler hosts")