foxhunt/ml/tests/unsafe_validation_tests.rs

//! Comprehensive Unsafe Code Validation Tests for ML Package
//!
//! This test module provides 100% coverage for all unsafe blocks in the ML package,
//! with miri validation to detect undefined behavior. Tests cover:
//!
//! 1. Hot-swap atomic pointer manipulation (ml/src/deployment/hot_swap.rs)
//! 2. SIMD batch processing unsafe slice access (ml/src/batch_processing.rs)
//! 3. Send/Sync trait implementations (ml/src/inference.rs)
//!
//! Run with miri: cargo +nightly miri test --package ml unsafe_validation
//! Run coverage: cargo llvm-cov --package ml --tests unsafe_validation

use std::sync::Arc;
use std::time::Duration;

use ml::deployment::hot_swap::{AtomicModelContainer, HotSwapEngine, HotSwapConfig};
use ml::batch_processing::{AlignedBuffer, MemoryPool, MemoryPoolConfig};
use ml::{ModelType, ModelVersion, MLError};

// ==============================================================================
// HOT-SWAP UNSAFE BLOCK TESTS (6 unsafe blocks)
// ==============================================================================

/// Test 1: Unsafe block at line 175-177 - Arc::from_raw for model snapshot
/// Risk: HIGH - double-free potential if reference count mismanaged
#[tokio::test]
async fn test_hot_swap_arc_reconstruction_no_double_free() {
    // This test validates that Arc reconstruction in swap_model doesn't cause double-free
    let model1 = ml::model_factory::create_dqn_wrapper().unwrap();
    let model1_arc = Arc::from(model1);
    let version1 = ModelVersion::new(1, 0, 0);

    let container = AtomicModelContainer::new(
        model1_arc.clone(),
        ModelType::DQN,
        version1.clone(),
        5,
    );

    // Perform swap - internally uses unsafe Arc::from_raw at line 175
    let model2 = ml::model_factory::create_dqn_wrapper().unwrap();
    let model2_arc = Arc::from(model2);
    let version2 = ModelVersion::new(1, 1, 0);

    let result = container.swap_model(
        model2_arc,
        version2.clone(),
        Duration::from_secs(30),
    ).await;

    assert!(result.is_ok(), "Swap failed: {:?}", result.err());

    // Verify Arc refcount is correct
    let metadata = container.get_metadata().await;
    assert_eq!(metadata.current_version, version2);
    assert_eq!(metadata.total_swaps, 1);

    // If double-free occurred, this would crash or be detected by miri
    drop(container);
}

/// Test 2: Unsafe block at line 214 - Arc::from_raw cleanup after failed CAS
/// Risk: MEDIUM - cleanup path, must only run if CAS truly failed
#[tokio::test]
async fn test_hot_swap_failed_cas_cleanup() {
    // This test validates cleanup of new model pointer after failed compare-and-swap
    let model1 = ml::model_factory::create_dqn_wrapper().unwrap();
    let container = Arc::new(AtomicModelContainer::new(
        Arc::from(model1),
        ModelType::DQN,
        ModelVersion::new(1, 0, 0),
        5,
    ));

    // Perform concurrent swaps to trigger CAS failure
    let container_clone1 = Arc::clone(&container);
    let container_clone2 = Arc::clone(&container);

    let handle1 = tokio::spawn(async move {
        let model = ml::model_factory::create_dqn_wrapper().unwrap();
        container_clone1.swap_model(
            Arc::from(model),
            ModelVersion::new(1, 1, 0),
            Duration::from_secs(30),
        ).await
    });

    let handle2 = tokio::spawn(async move {
        let model = ml::model_factory::create_dqn_wrapper().unwrap();
        container_clone2.swap_model(
            Arc::from(model),
            ModelVersion::new(1, 2, 0),
            Duration::from_secs(30),
        ).await
    });

    let result1 = handle1.await.expect("Task panicked");
    let result2 = handle2.await.expect("Task panicked");

    // One should succeed, one may fail due to concurrent modification
    assert!(result1.is_ok() || result2.is_ok());

    // Miri will detect if cleanup path has double-free
}

/// Test 3: Unsafe block at line 326 - Arc::from_raw cleanup after failed rollback CAS
/// Risk: HIGH - double rollback failure is critical state
#[tokio::test]
async fn test_rollback_failed_cas_cleanup() {
    let model1 = ml::model_factory::create_dqn_wrapper().unwrap();
    let container = Arc::new(AtomicModelContainer::new(
        Arc::from(model1),
        ModelType::DQN,
        ModelVersion::new(1, 0, 0),
        5,
    ));

    // Perform swap to create rollback snapshot
    let model2 = ml::model_factory::create_dqn_wrapper().unwrap();
    container.swap_model(
        Arc::from(model2),
        ModelVersion::new(1, 1, 0),
        Duration::from_secs(30),
    ).await.expect("Initial swap should succeed");

    // Try concurrent rollbacks to trigger CAS failure
    let container_clone1 = Arc::clone(&container);
    let container_clone2 = Arc::clone(&container);

    let handle1 = tokio::spawn(async move {
        container_clone1.rollback(Duration::from_secs(15)).await
    });

    let handle2 = tokio::spawn(async move {
        container_clone2.rollback(Duration::from_secs(15)).await
    });

    let result1 = handle1.await.expect("Task panicked");
    let result2 = handle2.await.expect("Task panicked");

    // One should succeed, one should fail (no rollback snapshot available)
    assert!(result1.is_ok() || result2.is_ok());

    // Miri will detect if cleanup has issues
}

/// Test 4: Unsafe block at line 349 - Arc::from_raw cleanup of failed model after rollback
/// Risk: MEDIUM - assumes rollback succeeded and ptr not aliased
#[tokio::test]
async fn test_rollback_success_old_model_cleanup() {
    let model1 = ml::model_factory::create_dqn_wrapper().unwrap();
    let model1_arc = Arc::from(model1);
    let version1 = ModelVersion::new(1, 0, 0);

    let container = AtomicModelContainer::new(
        model1_arc.clone(),
        ModelType::DQN,
        version1.clone(),
        5,
    );

    // Swap to version 2
    let model2 = ml::model_factory::create_dqn_wrapper().unwrap();
    container.swap_model(
        Arc::from(model2),
        ModelVersion::new(1, 1, 0),
        Duration::from_secs(30),
    ).await.expect("Swap should succeed");

    // Rollback to version 1 - triggers cleanup at line 349
    let rollback_result = container.rollback(Duration::from_secs(15)).await;
    assert!(rollback_result.is_ok(), "Rollback failed: {:?}", rollback_result.err());

    // Verify we're back to version 1
    let metadata = container.get_metadata().await;
    assert_eq!(metadata.current_version, version1);

    // Miri will detect if old model cleanup has issues
    drop(container);
}

/// Test 5: Unsafe block at line 391-398 - Arc temporary reconstruction in get_current_model
/// Risk: MEDIUM - temporary Arc ownership, must not leak or double-free
#[tokio::test]
async fn test_get_current_model_arc_safety() {
    let model1 = ml::model_factory::create_dqn_wrapper().unwrap();
    let container = AtomicModelContainer::new(
        Arc::from(model1),
        ModelType::DQN,
        ModelVersion::new(1, 0, 0),
        5,
    );

    // Call get_current_model multiple times - triggers unsafe at line 391
    for _ in 0..100 {
        let model = container.get_current_model().await;
        assert!(model.is_ready());
    }

    // Verify no reference count issues
    let final_model = container.get_current_model().await;
    assert_eq!(final_model.name(), "DQN");

    // Miri will detect reference counting errors
    drop(container);
}

/// Test 6: Unsafe block at line 542-545 - Arc cleanup in Drop implementation
/// Risk: LOW - standard cleanup pattern, protected by null check
#[tokio::test]
async fn test_container_drop_cleanup() {
    let model1 = ml::model_factory::create_dqn_wrapper().unwrap();
    let container = AtomicModelContainer::new(
        Arc::from(model1),
        ModelType::DQN,
        ModelVersion::new(1, 0, 0),
        5,
    );

    // Perform several operations
    let model2 = ml::model_factory::create_dqn_wrapper().unwrap();
    container.swap_model(
        Arc::from(model2),
        ModelVersion::new(1, 1, 0),
        Duration::from_secs(30),
    ).await.expect("Swap should succeed");

    let _ = container.get_current_model().await;

    // Drop container - triggers unsafe cleanup at line 542
    drop(container);

    // Miri will detect if Drop has double-free or other issues
}

/// Test 7: Hot-swap stress test - rapid swaps with concurrent access
#[tokio::test]
async fn test_hot_swap_concurrent_access_stress() {
    let model1 = ml::model_factory::create_dqn_wrapper().unwrap();
    let container = Arc::new(AtomicModelContainer::new(
        Arc::from(model1),
        ModelType::DQN,
        ModelVersion::new(1, 0, 0),
        10,
    ));

    // Spawn readers
    let mut reader_handles = vec![];
    for _ in 0..10 {
        let container_clone = Arc::clone(&container);
        let handle = tokio::spawn(async move {
            for _ in 0..50 {
                let _ = container_clone.get_current_model().await;
                tokio::time::sleep(Duration::from_micros(100)).await;
            }
        });
        reader_handles.push(handle);
    }

    // Spawn writers
    let mut writer_handles = vec![];
    for i in 1..=5 {
        let container_clone = Arc::clone(&container);
        let handle = tokio::spawn(async move {
            let model = ml::model_factory::create_dqn_wrapper().unwrap();
            let version = ModelVersion::new(1, i, 0);
            container_clone.swap_model(
                Arc::from(model),
                version,
                Duration::from_secs(30),
            ).await
        });
        writer_handles.push(handle);
    }

    // Wait for all tasks
    for handle in reader_handles {
        handle.await.expect("Reader task panicked");
    }
    for handle in writer_handles {
        let _ = handle.await.expect("Writer task panicked");
    }

    // Verify container is still consistent
    let metadata = container.get_metadata().await;
    assert!(metadata.total_swaps <= 5);
}

// ==============================================================================
// BATCH PROCESSING UNSAFE BLOCK TESTS (2 unsafe blocks)
// ==============================================================================

/// Test 8: Unsafe block at line 174-176 - as_slice() unsafe slice access
/// Risk: MEDIUM - uninitialized data read if len > initialized region
#[test]
fn test_aligned_buffer_as_slice_initialized_data() {
    let mut buffer = AlignedBuffer::new(1024, 32).expect("Buffer creation should succeed");

    // Set length and initialize data
    buffer.set_len(512);

    // SAFETY: We must initialize data before calling as_slice()
    unsafe {
        let slice_mut = buffer.as_mut_slice();
        for i in 0..slice_mut.len() {
            slice_mut[i] = i as f64;
        }
    }

    // Now safe to read
    unsafe {
        let slice = buffer.as_slice();
        assert_eq!(slice.len(), 512);
        assert_eq!(slice[0], 0.0);
        assert_eq!(slice[511], 511.0);
    }

    // Miri will detect if we read uninitialized memory
}

/// Test 9: Unsafe block at line 184-186 - as_mut_slice() unsafe mutable access
/// Risk: MEDIUM - caller must maintain slice bounds during use
#[test]
fn test_aligned_buffer_as_mut_slice_bounds() {
    let mut buffer = AlignedBuffer::new(1024, 32).expect("Buffer creation should succeed");

    // Set length within capacity
    buffer.set_len(256);

    // Write to mutable slice
    unsafe {
        let slice_mut = buffer.as_mut_slice();
        assert_eq!(slice_mut.len(), 256);

        for i in 0..slice_mut.len() {
            slice_mut[i] = (i * 2) as f64;
        }
    }

    // Verify writes
    unsafe {
        let slice = buffer.as_slice();
        assert_eq!(slice[0], 0.0);
        assert_eq!(slice[128], 256.0);
        assert_eq!(slice[255], 510.0);
    }
}

/// Test 10: Memory pool buffer reuse with unsafe access
#[test]
fn test_memory_pool_buffer_reuse_safe_access() {
    let config = MemoryPoolConfig::default();
    let mut pool = MemoryPool::new(config).expect("Pool creation should succeed");

    // Get buffer and initialize
    let mut buffer1 = pool.get_buffer(512).expect("Buffer allocation should succeed");
    buffer1.set_len(512);

    unsafe {
        let slice_mut = buffer1.as_mut_slice();
        for i in 0..slice_mut.len() {
            slice_mut[i] = i as f64;
        }
    }

    // Return buffer to pool
    pool.return_buffer(buffer1);

    // Get buffer again - should reuse
    let mut buffer2 = pool.get_buffer(512).expect("Buffer reuse should succeed");
    buffer2.set_len(512);

    // Initialize new data (overwrite old data)
    unsafe {
        let slice_mut = buffer2.as_mut_slice();
        for i in 0..slice_mut.len() {
            slice_mut[i] = (i * 3) as f64;
        }
    }

    // Verify new data
    unsafe {
        let slice = buffer2.as_slice();
        assert_eq!(slice[0], 0.0);
        assert_eq!(slice[100], 300.0);
    }

    // Miri will detect if reused buffer has stale data issues
}

/// Test 11: Aligned buffer capacity enforcement
#[test]
fn test_aligned_buffer_capacity_enforcement() {
    let mut buffer = AlignedBuffer::new(256, 32).expect("Buffer creation should succeed");

    // Try to set length beyond capacity - should be clamped
    buffer.set_len(512); // Exceeds capacity of 256
    assert!(buffer.len() <= buffer.capacity());

    // Set valid length
    buffer.set_len(128);
    assert_eq!(buffer.len(), 128);

    unsafe {
        let slice = buffer.as_slice();
        assert_eq!(slice.len(), 128);
    }
}

/// Test 12: Aligned buffer invalid alignment detection
#[test]
fn test_aligned_buffer_invalid_alignment() {
    // Non-power-of-two alignment
    let result = AlignedBuffer::new(1024, 31);
    assert!(matches!(result, Err(MLError::ConfigError { .. })));

    // Zero alignment
    let result = AlignedBuffer::new(1024, 0);
    assert!(matches!(result, Err(MLError::ConfigError { .. })));

    // Valid power-of-two alignments
    for alignment in [1, 2, 4, 8, 16, 32, 64, 128] {
        let result = AlignedBuffer::new(1024, alignment);
        assert!(result.is_ok(), "Alignment {} should be valid", alignment);
    }
}

// ==============================================================================
// INTEGRATION TESTS - UNSAFE BLOCKS IN REALISTIC SCENARIOS
// ==============================================================================

/// Test 13: Hot-swap engine with multiple model types
#[tokio::test]
async fn test_hot_swap_engine_multi_type() {
    let config = HotSwapConfig::default();
    let engine = HotSwapEngine::new(config);

    // Register DQN container
    let model_dqn = ml::model_factory::create_dqn_wrapper().unwrap();
    let container_dqn = Arc::new(AtomicModelContainer::new(
        Arc::from(model_dqn),
        ModelType::DQN,
        ModelVersion::new(1, 0, 0),
        5,
    ));
    engine.register_container(ModelType::DQN, container_dqn).await.expect("Registration should succeed");

    // Hot-swap DQN model
    let new_model_dqn = ml::model_factory::create_dqn_wrapper().unwrap();
    let swap_result = engine.hot_swap(
        ModelType::DQN,
        Arc::from(new_model_dqn),
        ModelVersion::new(1, 1, 0),
    ).await;

    assert!(swap_result.is_ok(), "Hot-swap failed: {:?}", swap_result.err());

    // Get model and verify
    let model = engine.get_model(ModelType::DQN).await.expect("Should retrieve model");
    assert!(model.is_ready());
}

/// Test 14: Rollback queue management under stress
#[tokio::test]
async fn test_rollback_queue_management() {
    let model1 = ml::model_factory::create_dqn_wrapper().unwrap();
    let max_history = 3;

    let container = AtomicModelContainer::new(
        Arc::from(model1),
        ModelType::DQN,
        ModelVersion::new(1, 0, 0),
        max_history,
    );

    // Perform more swaps than max_history
    for i in 1..=10 {
        let model = ml::model_factory::create_dqn_wrapper().unwrap();
        let version = ModelVersion::new(1, i, 0);
        container.swap_model(
            Arc::from(model),
            version,
            Duration::from_secs(30),
        ).await.expect("Swap should succeed");
    }

    // Verify rollback queue is limited
    let rollback_status = container.get_rollback_status().await;
    assert!(rollback_status.available_snapshots <= max_history,
        "Rollback queue exceeded max: {} > {}",
        rollback_status.available_snapshots,
        max_history
    );
}

/// Test 15: Batch processing with unsafe slice under high throughput
#[test]
fn test_batch_processing_high_throughput() {
    let config = MemoryPoolConfig {
        initial_capacity: 4096,
        max_pools: 8,
        alignment: 64,
    };

    let mut pool = MemoryPool::new(config).expect("Pool creation should succeed");

    // Simulate high throughput batch processing
    for batch_idx in 0..100 {
        let mut buffer = pool.get_buffer(1024).expect("Buffer allocation should succeed");
        buffer.set_len(1024);

        // Process batch with unsafe slice access
        unsafe {
            let slice_mut = buffer.as_mut_slice();
            for i in 0..slice_mut.len() {
                slice_mut[i] = (batch_idx * 1000 + i) as f64;
            }

            // Read and validate
            let slice = buffer.as_slice();
            assert_eq!(slice.len(), 1024);
            assert_eq!(slice[0], (batch_idx * 1000) as f64);
        }

        pool.return_buffer(buffer);
    }

    let stats = pool.get_stats();
    assert_eq!(stats.total_allocations, 100);
    assert_eq!(stats.total_deallocations, 100);
}

#[cfg(test)]
mod miri_specific_tests {
    //! Tests specifically designed for miri undefined behavior detection
    //! Run with: cargo +nightly miri test --package ml miri_specific

    use super::*;

    /// Miri test: Detect stacked borrows violations in Arc reconstruction
    #[tokio::test]
    async fn miri_test_arc_stacked_borrows() {
        let model = ml::model_factory::create_dqn_wrapper().unwrap();
        let container = AtomicModelContainer::new(
            Arc::from(model),
            ModelType::DQN,
            ModelVersion::new(1, 0, 0),
            5,
        );

        // Rapidly access current model to stress Arc reconstruction
        for _ in 0..1000 {
            let _ = container.get_current_model().await;
        }
    }

    /// Miri test: Detect uninitialized memory reads in AlignedBuffer
    #[test]
    fn miri_test_uninitialized_read_detection() {
        let mut buffer = AlignedBuffer::new(256, 32).expect("Buffer creation should succeed");
        buffer.set_len(256);

        // Initialize only half the buffer
        unsafe {
            let slice_mut = buffer.as_mut_slice();
            for i in 0..128 {
                slice_mut[i] = i as f64;
            }
            // Leave slice_mut[128..256] uninitialized
        }

        // Read initialized portion - OK
        unsafe {
            let slice = buffer.as_slice();
            assert_eq!(slice[0], 0.0);
            assert_eq!(slice[127], 127.0);
        }

        // Reading uninitialized portion would be UB - miri would catch this
        // (Not testing this intentionally as it's UB)
    }

    /// Miri test: Detect data races in concurrent hot-swap
    #[tokio::test]
    async fn miri_test_concurrent_swap_data_races() {
        let model = ml::model_factory::create_dqn_wrapper().unwrap();
        let container = Arc::new(AtomicModelContainer::new(
            Arc::from(model),
            ModelType::DQN,
            ModelVersion::new(1, 0, 0),
            5,
        ));

        // Concurrent reads and writes
        let mut handles = vec![];

        for i in 0..5 {
            let container_clone = Arc::clone(&container);
            let handle = tokio::spawn(async move {
                if i % 2 == 0 {
                    // Reader
                    let _ = container_clone.get_current_model().await;
                } else {
                    // Writer
                    let model = ml::model_factory::create_dqn_wrapper().unwrap();
                    let _ = container_clone.swap_model(
                        Arc::from(model),
                        ModelVersion::new(1, i, 0),
                        Duration::from_secs(30),
                    ).await;
                }
            });
            handles.push(handle);
        }

        for handle in handles {
            let _ = handle.await;
        }
    }
}