Test the seven promises a mutation sweep found nothing was checking

[martinus]

Closes #191.

The full sweep in #191 killed 61% of mutants. Triaging the 360 survivors left a short list of things the suite believes without checking — this is that list. Each item is verified the same way the ticket asks for: the mutant that exposed it goes from survived to caught.

equal_range and count

Six of the eight equal_range overloads never had their it + 1 checked. equal_range.cpp does assert second == ++first, but only on the non-const exact-key overload — the const one was asked with a single element, where it + 1 and end() are the same iterator, so a second that is always end() passes it. The transparent and precomputed_hash forms were not asked at all. All eight are now asked with the key at begin(), where the two answers are as far apart as they get, and with a key that is absent, which is what tells ? 0 : 1 apart from ? 1 : 1 in count.

The hash's output

Nothing pinned it, so every constant in the secret, every mixing step and most of the length arithmetic could change with the whole suite green — 173 survivors in one function. hash_golden.cpp fixes the values at one length per branch and both sides of every bound, including the lengths that land a loop counter exactly on its limit (65, 192, 289), which is the only place a > that became >= differs.

This is not a promise that the values never change. Replacing wyhash is a legitimate thing to do; the file says so, says how to regenerate, and says the question to ask then is "did we mean to change the hash".

erase()'s return value

The erase-while-iterating loop erases from begin() every time — where begin() is also the correct answer, so a return value that is always begin() passed it. Erasing from the middle is what tells those apart, and it is the only case where the returned iterator has any work to do.

"Looks like a default constructed table"

Three routes reach that state — moved from, an assignment that threw, a copy of a cleared table — and the shift that decides how big an array the next insert asks for is not observable except through that insert. The shared fixture now makes that assertion, so all three routes are held to it, along with max_load_factor, which is carried by hand in three separate places.

segmented_vector

The map uses about a quarter of its iterator interface. Post-increment could have called operator--, -= could have added, and all four relational operators could have been each other. Plus back(), resize() growing a vector that is not empty (every existing case grows from zero, where the arithmetic cannot be wrong), and shrink_to_fit actually handing blocks back.

The bucket packing

As a static_assert in table rather than a test, so a user's own bucket type is held to it too: the fingerprint has to stay strictly below dist_inc, or hash bits add to the distance a bucket claims and silently reorder the probe sequence — correct answers, wrong shape, nothing notices. The bound is one-sided on purpose: fewer fingerprint bits than dist_inc allows is a weaker fingerprint, not a broken one.

mixed_hash's third branch

An avalanching hash narrower than 64 bits is multiplied up, because the table indexes with the top bits. Without it every key lands in bucket zero and the table still answers everything correctly, just by walking the array — so only a distribution check can see it. Nothing in the suite used a hasher that was both is_avalanching and 32 bit.

---

Not fixed, and worth recording rather than chasing: four of the ticket's eleven named bugs are equivalent mutants (a > that becomes >= inside the else of an == test is exactly >), and 36 wyhash survivors are in mum's long-hand branch, which is dead code wherever __uint128_t exists — the golden values do cover it on the 32-bit and MSVC legs.

Full suite green, and green under -Db_sanitize=address,undefined.

🤖 Generated with Claude Code

[martinus]

Verified: 61% → 81% killed, 33% → 51% by a test

Full run of bugs/invariants.txt plus a sweep of the whole header, before and after:

	mutants	caught by a test	compiler	hang	oom	survived
before (#191)	930	307	191	65	7	360
after	940	481	207	67	7	178

174 more mutants are now caught by a test, and the named bugs went from 11 survivors to 5.

The move-assignment case was a real gap this found: move construction and move assignment part with the source through different code — the constructor exchanges the members itself, the assignment goes through move_everything_from — and the first version of the test only exercised construction. Fixed in
the last commit, and that mutant is now caught.

What still survives, and why it should

• 47 std::enable_if_t<..., bool> = true → false — the value of a SFINAE dummy parameter is never read.
• 4 of the 5 remaining named bugs are equivalent mutants: a > that becomes >= inside the else of an == test is exactly >, and the "duplicate probe in the unrolled head" one just makes the unroll shorter. Taking the home bucket from the low bits instead of the high is a distribution property, not a correctness one — it is covered in spirit by the new spread check, but any consistent injection into [0, bucket_count) is correct.
• 35 of the 37 remaining wyhash survivors are in mum's long-hand branch, which is dead code wherever __uint128_t exists. The golden values do cover it — on the 32-bit and MSVC legs.

That leaves ~89 genuine sweep survivors, down from ~129, mostly one-off boundary conditions in paths the ticket ranked below these seven.

[martinus]

Two more clusters, two real bugs, and four tool changes

The two remaining clusters from #191 are covered. The transparent set emplace and replace(container): 35 mutants over those lines, 22 now caught by a test, 3 hang, 4 the compiler refuses, 6 survive (the != → == on the allocator comparison and the duplicate-index arithmetic, which are equivalent or need a stateful allocator to distinguish).

Writing the replace() boundary test found two real bugs

Both are fixed here, with the tests as regressions. Neither was found by a mutant — the surviving mutant pointed at the boundary, and the boundary had a bug.

rehash() could leave the table with a single bucket. calc_shifts_for_size() walks the shift down until the capacity covers the count, but calc_num_buckets() saturates at max_bucket_count() — so past max_bucket_count() * max_load_factor() the capacity stops growing while the walk carries on, all the way to zero. calc_num_buckets(0) then evaluates std::size_t{1} << 64, which is undefined and on x86 is one. Reachable on the default map<uint32_t, uint32_t>: map.rehash(3865470566) was enough — rehash() does not size the value container first, so there is no big allocation to fail before the bucket arithmetic runs.

replace() silently ignored a container of exactly max_size() elements. The loop counted in value_idx_type, and max_size() is exactly what that type can hold — so the cast wrapped to zero, the loop never ran once, and the table came back reporting size() elements with not one bucket pointing at any of them. size() said 256; every lookup said no. Needs a Bucket whose value index is narrower than the container, which is a supported thing to write and which the suite has.

Tool changes

• --diff is the everyday mode. Bare --diff means HEAD; lines come from the merge base, so a branch that has not caught up does not sweep what main moved on without it.
• Mutants that cannot have an effect are no longer generated. The 47 enable_if_t<..., bool> = true> survivors were the SFINAE idiom, whose parameter value is never read. Recognised by shape, not by looking for enable_if_t.
• Mutants in code this build does not compile are dropped, found by asking the preprocessor rather than matching #if in the text. That is the 35 in mum()'s long-hand branch. The run says which lines — staying quiet would read as "everything here is covered".
• --deletions removes whole statements. The operator the token sweep cannot express, and where the hand-written bugs actually live: nearly every block in invariants.txt is "the code forgot to do this". On the erase path it catches the missing move-of-the-last-element and hangs on six others.

A note on one thing the memory cap earned its keep on: my first version of the rehash regression test used the default map, where the correct answer is an array of 2^32 buckets — 32 GB. It had been passing only because the allocation happened to be refused. The cgroup cap killed the baseline and made it obvious. The test now asks the same arithmetic of bucket_micro, where the correct answer is 256 buckets.