memscope_rs/analysis/

unknown_memory_regions.rs

//! Unknown Memory Regions Analysis
//!
//! This module analyzes and categorizes the "unknown" 5% of memory regions
//! that cannot be precisely classified as stack or heap allocations.

use crate::core::types::{AllocationInfo, ImplementationDifficulty};
use serde::{Deserialize, Serialize};
use std::collections::HashMap;

/// Detailed analysis of unknown memory regions
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct UnknownMemoryRegionAnalysis {
    /// Total size of unknown regions
    pub total_unknown_bytes: usize,
    /// Percentage of total memory that is unknown
    pub unknown_percentage: f64,
    /// Categorized unknown regions
    pub unknown_categories: Vec<UnknownMemoryCategory>,
    /// Potential causes for unknown regions
    pub potential_causes: Vec<UnknownMemoryCause>,
    /// Recommendations to reduce unknown regions
    pub reduction_strategies: Vec<UnknownRegionReductionStrategy>,
}

/// Categories of unknown memory regions
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct UnknownMemoryCategory {
    /// Type of unknown memory region
    pub category_type: UnknownRegionType,
    /// Description of this category of unknown memory
    pub description: String,
    /// Estimated size of this memory category in bytes
    pub estimated_size: usize,
    /// Confidence level in the identification (0.0-1.0)
    pub confidence_level: f64,
    /// Examples of memory regions in this category
    pub examples: Vec<UnknownMemoryExample>,
}

/// Types of unknown memory regions
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum UnknownRegionType {
    /// Memory-mapped files and shared memory
    MemoryMappedRegions,
    /// Thread-local storage areas
    ThreadLocalStorage,
    /// Dynamic library code and data sections
    DynamicLibraryRegions,
    /// Kernel/system reserved areas
    SystemReservedRegions,
    /// JIT compiled code regions
    JitCodeRegions,
    /// Memory allocated by external C libraries
    ExternalLibraryAllocations,
    /// Guard pages and memory protection regions
    GuardPages,
    /// VDSO (Virtual Dynamic Shared Object) regions
    VdsoRegions,
    /// Anonymous memory mappings
    AnonymousMappings,
    /// Shared memory segments
    SharedMemorySegments,
    /// Memory allocated before tracking started
    PreTrackingAllocations,
    /// Memory with corrupted or missing metadata
    CorruptedMetadata,
}

/// Specific examples of unknown memory
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct UnknownMemoryExample {
    /// Address range of this unknown memory region (start, end)
    pub address_range: (usize, usize),
    /// Size of this memory region in bytes
    pub size: usize,
    /// Suspected origin or source of this memory allocation
    pub suspected_origin: String,
    /// Observed pattern of memory access for this region
    pub access_pattern: MemoryAccessPattern,
}

/// Causes for unknown memory regions
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum UnknownMemoryCause {
    /// FFI calls to C/C++ libraries
    ForeignFunctionInterface {
        /// Name of the library containing the FFI function
        library_name: String,
        /// Name of the specific function if known
        function_name: Option<String>,
    },
    /// Memory mapping operations
    MemoryMapping {
        /// Type of memory mapping
        mapping_type: MappingType,
        /// Path to the file if mapped from a file
        file_path: Option<String>,
    },
    /// System-level allocations
    SystemAllocations {
        /// Type of system allocation
        allocation_type: SystemAllocationType,
    },
    /// Threading-related memory
    ThreadingMemory {
        /// Thread ID if known
        thread_id: Option<u64>,
        /// Type of threading memory
        memory_type: ThreadMemoryType,
    },
    /// Dynamic loading of libraries
    DynamicLoading {
        /// Path to the library
        library_path: String,
        /// Time when the library was loaded
        load_time: u64,
    },
    /// Instrumentation limitations
    InstrumentationGaps {
        /// Type of instrumentation gap
        gap_type: InstrumentationGapType,
        /// Description of the gap
        description: String,
    },
}

#[derive(Debug, Clone, Serialize, Deserialize)]
/// Types of memory mappings
pub enum MappingType {
    /// Memory mapped from a file
    FileMapping,
    /// Anonymous memory mapping not backed by a file
    AnonymousMapping,
    /// Shared memory mapping accessible by multiple processes
    SharedMapping,
    /// Memory mapped from a device
    DeviceMapping,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
/// Types of system-level memory allocations
pub enum SystemAllocationType {
    /// Memory buffers used by the kernel
    KernelBuffers,
    /// Memory allocated for device drivers
    DriverMemory,
    /// System-level caches
    SystemCaches,
    /// Memory reserved for hardware use
    HardwareReserved,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
/// Types of memory associated with threads
pub enum ThreadMemoryType {
    /// Thread stack memory
    ThreadStack,
    /// Thread-local storage areas
    ThreadLocalStorage,
    /// Thread control block structures
    ThreadControlBlock,
    /// Memory used for thread synchronization primitives
    ThreadSynchronization,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
/// Types of gaps in memory instrumentation coverage
pub enum InstrumentationGapType {
    /// Memory allocated during early program bootstrap before instrumentation is active
    EarlyBootstrap,
    /// Memory used by signal handlers that may bypass normal allocation paths
    SignalHandlers,
    /// Memory used by interrupt handlers
    InterruptHandlers,
    /// Memory operations performed atomically that might be missed by instrumentation
    AtomicOperations,
    /// Memory optimizations performed by the compiler that bypass instrumentation
    CompilerOptimizations,
}

/// Strategies to reduce unknown memory regions
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct UnknownRegionReductionStrategy {
    /// Type of strategy to reduce unknown memory regions
    pub strategy_type: ReductionStrategyType,
    /// Description of the strategy
    pub description: String,
    /// Steps to implement this strategy
    pub implementation_steps: Vec<String>,
    /// Expected percentage improvement in unknown region reduction
    pub expected_improvement: f64,
    /// Difficulty level of implementing this strategy
    pub implementation_difficulty: ImplementationDifficulty,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
/// Types of strategies to reduce unknown memory regions
pub enum ReductionStrategyType {
    /// Improve instrumentation to capture more memory operations
    EnhancedInstrumentation,
    /// Better resolution of symbols and debug information
    BetterSymbolResolution,
    /// Track memory mapping operations more comprehensively
    MemoryMappingTracking,
    /// Intercept and track foreign function interface calls
    FfiCallInterception,
    /// Monitor system calls related to memory operations
    SystemCallMonitoring,
    /// Implement thread-aware memory tracking
    ThreadAwareTracking,
}

/// Unknown memory region analyzer
pub struct UnknownMemoryAnalyzer {
    known_system_regions: HashMap<(usize, usize), SystemRegionInfo>,
    library_mappings: HashMap<String, LibraryMappingInfo>,
    thread_memory_ranges: HashMap<u64, Vec<(usize, usize)>>,
}

impl Default for UnknownMemoryAnalyzer {
    fn default() -> Self {
        Self::new()
    }
}

impl UnknownMemoryAnalyzer {
    /// Creates a new instance of UnknownMemoryAnalyzer with empty collections
    pub fn new() -> Self {
        Self {
            known_system_regions: HashMap::new(),
            library_mappings: HashMap::new(),
            thread_memory_ranges: HashMap::new(),
        }
    }

    /// Analyze unknown memory regions in detail
    pub fn analyze_unknown_regions(
        &mut self,
        allocations: &[AllocationInfo],
    ) -> UnknownMemoryRegionAnalysis {
        let total_memory: usize = allocations.iter().map(|a| a.size).sum();
        let unknown_allocations = self.identify_unknown_allocations(allocations);
        let total_unknown: usize = unknown_allocations.iter().map(|a| a.size).sum();
        let unknown_percentage = (total_unknown as f64 / total_memory as f64) * 100.0;

        // Categorize unknown regions
        let unknown_categories = self.categorize_unknown_regions(&unknown_allocations);

        // Identify potential causes
        let potential_causes = self.identify_potential_causes(&unknown_allocations);

        // Generate reduction strategies
        let reduction_strategies = self.generate_reduction_strategies(&unknown_categories);

        UnknownMemoryRegionAnalysis {
            total_unknown_bytes: total_unknown,
            unknown_percentage,
            unknown_categories,
            potential_causes,
            reduction_strategies,
        }
    }

    /// Identify allocations that cannot be classified
    fn identify_unknown_allocations<'a>(
        &self,
        allocations: &'a [AllocationInfo],
    ) -> Vec<&'a AllocationInfo> {
        allocations
            .iter()
            .filter(|alloc| self.is_unknown_allocation(alloc))
            .collect()
    }

    /// Check if an allocation is in an unknown region
    fn is_unknown_allocation(&self, allocation: &AllocationInfo) -> bool {
        // Check if allocation is in known stack or heap regions
        if self.is_in_stack_region(allocation.ptr) || self.is_in_heap_region(allocation.ptr) {
            return false;
        }

        // Check if it's a known system region
        if self.is_known_system_region(allocation.ptr) {
            return false;
        }

        // If we can't classify it, it's unknown
        true
    }

    /// Categorize unknown memory regions
    fn categorize_unknown_regions(
        &self,
        unknown_allocations: &[&AllocationInfo],
    ) -> Vec<UnknownMemoryCategory> {
        let mut categories = Vec::new();

        // Memory-mapped regions
        let mmap_allocations = self.identify_memory_mapped_regions(unknown_allocations);
        if !mmap_allocations.is_empty() {
            categories.push(UnknownMemoryCategory {
                category_type: UnknownRegionType::MemoryMappedRegions,
                description: "Memory-mapped files, shared memory, and anonymous mappings"
                    .to_string(),
                estimated_size: mmap_allocations.iter().map(|a| a.size).sum(),
                confidence_level: 0.8,
                examples: self.generate_examples(&mmap_allocations, "Memory mapping"),
            });
        }

        // Thread-local storage
        let tls_allocations = self.identify_thread_local_storage(unknown_allocations);
        if !tls_allocations.is_empty() {
            categories.push(UnknownMemoryCategory {
                category_type: UnknownRegionType::ThreadLocalStorage,
                description: "Thread-local storage and thread control blocks".to_string(),
                estimated_size: tls_allocations.iter().map(|a| a.size).sum(),
                confidence_level: 0.7,
                examples: self.generate_examples(&tls_allocations, "Thread-local storage"),
            });
        }

        // Dynamic library regions
        let lib_allocations = self.identify_library_regions(unknown_allocations);
        if !lib_allocations.is_empty() {
            categories.push(UnknownMemoryCategory {
                category_type: UnknownRegionType::DynamicLibraryRegions,
                description: "Code and data sections of dynamically loaded libraries".to_string(),
                estimated_size: lib_allocations.iter().map(|a| a.size).sum(),
                confidence_level: 0.9,
                examples: self.generate_examples(&lib_allocations, "Dynamic library"),
            });
        }

        // External library allocations (FFI)
        let ffi_allocations = self.identify_ffi_allocations(unknown_allocations);
        if !ffi_allocations.is_empty() {
            categories.push(UnknownMemoryCategory {
                category_type: UnknownRegionType::ExternalLibraryAllocations,
                description: "Memory allocated by external C/C++ libraries through FFI".to_string(),
                estimated_size: ffi_allocations.iter().map(|a| a.size).sum(),
                confidence_level: 0.6,
                examples: self.generate_examples(&ffi_allocations, "FFI allocation"),
            });
        }

        // System reserved regions
        let system_allocations = self.identify_system_regions(unknown_allocations);
        if !system_allocations.is_empty() {
            categories.push(UnknownMemoryCategory {
                category_type: UnknownRegionType::SystemReservedRegions,
                description: "Kernel buffers, driver memory, and system caches".to_string(),
                estimated_size: system_allocations.iter().map(|a| a.size).sum(),
                confidence_level: 0.5,
                examples: self.generate_examples(&system_allocations, "System region"),
            });
        }

        // Pre-tracking allocations
        let pre_tracking = self.identify_pre_tracking_allocations(unknown_allocations);
        if !pre_tracking.is_empty() {
            categories.push(UnknownMemoryCategory {
                category_type: UnknownRegionType::PreTrackingAllocations,
                description: "Memory allocated before tracking was initialized".to_string(),
                estimated_size: pre_tracking.iter().map(|a| a.size).sum(),
                confidence_level: 0.9,
                examples: self.generate_examples(&pre_tracking, "Pre-tracking"),
            });
        }

        categories
    }

    /// Identify potential causes for unknown regions
    fn identify_potential_causes(
        &self,
        unknown_allocations: &[&AllocationInfo],
    ) -> Vec<UnknownMemoryCause> {
        let mut causes = Vec::new();

        // Check for FFI-related allocations
        for allocation in unknown_allocations {
            if self.is_likely_ffi_allocation(allocation) {
                causes.push(UnknownMemoryCause::ForeignFunctionInterface {
                    library_name: self
                        .guess_library_name(allocation)
                        .unwrap_or_else(|| "unknown".to_string()),
                    function_name: None,
                });
            }
        }

        // Check for memory mapping
        if self.has_memory_mapping_pattern(unknown_allocations) {
            causes.push(UnknownMemoryCause::MemoryMapping {
                mapping_type: MappingType::AnonymousMapping,
                file_path: None,
            });
        }

        // Check for threading-related memory
        if self.has_threading_pattern(unknown_allocations) {
            causes.push(UnknownMemoryCause::ThreadingMemory {
                thread_id: None,
                memory_type: ThreadMemoryType::ThreadStack,
            });
        }

        // Instrumentation gaps
        causes.push(UnknownMemoryCause::InstrumentationGaps {
            gap_type: InstrumentationGapType::EarlyBootstrap,
            description: "Memory allocated during early program initialization".to_string(),
        });

        causes
    }

    /// Generate strategies to reduce unknown regions
    fn generate_reduction_strategies(
        &self,
        _categories: &[UnknownMemoryCategory],
    ) -> Vec<UnknownRegionReductionStrategy> {
        let strategies = vec![
            // Enhanced instrumentation
            UnknownRegionReductionStrategy {
                strategy_type: ReductionStrategyType::EnhancedInstrumentation,
                description: "Implement more comprehensive memory tracking hooks".to_string(),
                implementation_steps: vec![
                    "Hook into mmap/munmap system calls".to_string(),
                    "Intercept malloc/free in all loaded libraries".to_string(),
                    "Track thread creation and destruction".to_string(),
                    "Monitor dynamic library loading".to_string(),
                ],
                expected_improvement: 60.0,
                implementation_difficulty: ImplementationDifficulty::Hard,
            },
            // FFI call interception
            UnknownRegionReductionStrategy {
                strategy_type: ReductionStrategyType::FfiCallInterception,
                description: "Intercept and track FFI calls to external libraries".to_string(),
                implementation_steps: vec![
                    "Wrap all extern function calls".to_string(),
                    "Track memory allocations in C libraries".to_string(),
                    "Monitor shared library symbol resolution".to_string(),
                ],
                expected_improvement: 25.0,
                implementation_difficulty: ImplementationDifficulty::Medium,
            },
            // Memory mapping tracking
            UnknownRegionReductionStrategy {
                strategy_type: ReductionStrategyType::MemoryMappingTracking,
                description: "Track memory mapping operations comprehensively".to_string(),
                implementation_steps: vec![
                    "Monitor /proc/self/maps changes".to_string(),
                    "Track mmap/mprotect/munmap calls".to_string(),
                    "Analyze virtual memory layout".to_string(),
                ],
                expected_improvement: 20.0,
                implementation_difficulty: ImplementationDifficulty::Medium,
            },
        ];

        strategies
    }

    // Helper methods for region identification
    fn is_in_stack_region(&self, _ptr: usize) -> bool {
        // Check against known stack boundaries
        // This would use actual stack detection logic
        false // Placeholder
    }

    fn is_in_heap_region(&self, _ptr: usize) -> bool {
        // Check against known heap boundaries
        // This would use actual heap detection logic
        false // Placeholder
    }

    fn is_known_system_region(&self, ptr: usize) -> bool {
        self.known_system_regions
            .iter()
            .any(|((start, end), _)| ptr >= *start && ptr < *end)
    }

    fn identify_memory_mapped_regions<'a>(
        &self,
        allocations: &[&'a AllocationInfo],
    ) -> Vec<&'a AllocationInfo> {
        allocations
            .iter()
            .filter(|alloc| self.is_likely_mmap_allocation(alloc))
            .copied()
            .collect()
    }

    fn identify_thread_local_storage<'a>(
        &self,
        allocations: &[&'a AllocationInfo],
    ) -> Vec<&'a AllocationInfo> {
        allocations
            .iter()
            .filter(|alloc| self.is_likely_tls_allocation(alloc))
            .copied()
            .collect()
    }

    fn identify_library_regions<'a>(
        &self,
        allocations: &[&'a AllocationInfo],
    ) -> Vec<&'a AllocationInfo> {
        allocations
            .iter()
            .filter(|alloc| self.is_likely_library_allocation(alloc))
            .copied()
            .collect()
    }

    fn identify_ffi_allocations<'a>(
        &self,
        allocations: &[&'a AllocationInfo],
    ) -> Vec<&'a AllocationInfo> {
        allocations
            .iter()
            .filter(|alloc| self.is_likely_ffi_allocation(alloc))
            .copied()
            .collect()
    }

    fn identify_system_regions<'a>(
        &self,
        allocations: &[&'a AllocationInfo],
    ) -> Vec<&'a AllocationInfo> {
        allocations
            .iter()
            .filter(|alloc| self.is_likely_system_allocation(alloc))
            .copied()
            .collect()
    }

    fn identify_pre_tracking_allocations<'a>(
        &self,
        allocations: &[&'a AllocationInfo],
    ) -> Vec<&'a AllocationInfo> {
        allocations
            .iter()
            .filter(|alloc| self.is_likely_pre_tracking_allocation(alloc))
            .copied()
            .collect()
    }

    // Pattern detection methods
    fn is_likely_mmap_allocation(&self, allocation: &AllocationInfo) -> bool {
        // Large, page-aligned allocations are often mmap
        allocation.size >= 4096 && allocation.ptr % 4096 == 0
    }

    fn is_likely_tls_allocation(&self, allocation: &AllocationInfo) -> bool {
        // Small allocations in thread-specific ranges
        allocation.size < 1024 && self.is_in_thread_range(allocation.ptr)
    }

    fn is_likely_library_allocation(&self, allocation: &AllocationInfo) -> bool {
        // Check if address is in known library ranges
        self.library_mappings
            .values()
            .any(|lib| lib.contains_address(allocation.ptr))
    }

    fn is_likely_ffi_allocation(&self, allocation: &AllocationInfo) -> bool {
        // Heuristics for FFI allocations
        allocation.type_name.is_none() && allocation.var_name.is_none()
    }

    fn is_likely_system_allocation(&self, allocation: &AllocationInfo) -> bool {
        // Very high or very low addresses often indicate system allocations
        allocation.ptr < 0x1000 || allocation.ptr > 0x7fff_0000_0000
    }

    fn is_likely_pre_tracking_allocation(&self, allocation: &AllocationInfo) -> bool {
        // Allocations with very early timestamps
        allocation.timestamp_alloc < 1000 // Very early timestamp
    }

    fn is_in_thread_range(&self, ptr: usize) -> bool {
        self.thread_memory_ranges.values().any(|ranges| {
            ranges
                .iter()
                .any(|(start, end)| ptr >= *start && ptr < *end)
        })
    }

    fn has_memory_mapping_pattern(&self, allocations: &[&AllocationInfo]) -> bool {
        // Check for patterns typical of memory mapping
        allocations
            .iter()
            .any(|alloc| self.is_likely_mmap_allocation(alloc))
    }

    fn has_threading_pattern(&self, allocations: &[&AllocationInfo]) -> bool {
        // Check for patterns typical of threading
        allocations
            .iter()
            .any(|alloc| self.is_likely_tls_allocation(alloc))
    }

    fn guess_library_name(&self, allocation: &AllocationInfo) -> Option<String> {
        // Try to guess which library an allocation belongs to
        for (name, info) in &self.library_mappings {
            if info.contains_address(allocation.ptr) {
                return Some(name.to_string());
            }
        }
        None
    }

    fn generate_examples(
        &self,
        allocations: &[&AllocationInfo],
        origin: &str,
    ) -> Vec<UnknownMemoryExample> {
        allocations
            .iter()
            .take(3) // Limit to 3 examples
            .map(|alloc| UnknownMemoryExample {
                address_range: (alloc.ptr, alloc.ptr + alloc.size),
                size: alloc.size,
                suspected_origin: origin.to_string(),
                access_pattern: MemoryAccessPattern::Unknown, // Would be determined by analysis
            })
            .collect()
    }
}

// Supporting types
#[derive(Debug, Clone, Serialize, Deserialize)]
/// Information about a system memory region
pub struct SystemRegionInfo {
    /// Type of system region (e.g., "kernel", "driver", "cache")
    pub region_type: String,
    /// Description of the region's purpose
    pub description: String,
    /// Whether the region is read-only
    pub read_only: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
/// Information about a mapped library in memory
pub struct LibraryMappingInfo {
    /// Starting address of the library mapping
    pub start_address: usize,
    /// Ending address of the library mapping
    pub end_address: usize,
    /// Memory permissions for this mapping (e.g., "r-x", "rw-")
    pub permissions: String,
    /// Path to the library file on disk
    pub file_path: String,
}

impl LibraryMappingInfo {
    /// Checks if the given address is within this library's memory mapping
    pub fn contains_address(&self, addr: usize) -> bool {
        addr >= self.start_address && addr < self.end_address
    }
}

#[derive(Debug, Clone, Serialize, Deserialize)]
/// Patterns of memory access observed in memory regions
pub enum MemoryAccessPattern {
    /// Memory is accessed sequentially from start to end
    Sequential,
    /// Memory is accessed in a random, non-sequential pattern
    Random,
    /// Memory is accessed sparsely with large gaps between accesses
    Sparse,
    /// Memory access pattern is unknown or cannot be determined
    Unknown,
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::core::types::{AllocationInfo, ImplementationDifficulty};

    /// Helper function to create test allocation info
    fn create_test_allocation(
        ptr: usize,
        size: usize,
        timestamp: u64,
        type_name: Option<String>,
        var_name: Option<String>,
    ) -> AllocationInfo {
        AllocationInfo {
            ptr,
            size,
            timestamp_alloc: timestamp,
            timestamp_dealloc: None,
            type_name,
            var_name,
            scope_name: Some("test_scope".to_string()),
            thread_id: "test_thread".to_string(),
            borrow_count: 0,
            stack_trace: Some(vec!["test_function".to_string()]),
            is_leaked: false,
            lifetime_ms: None,
            borrow_info: None,
            clone_info: None,
            ownership_history_available: false,
            smart_pointer_info: None,
            memory_layout: None,
            generic_info: None,
            dynamic_type_info: None,
            runtime_state: None,
            stack_allocation: None,
            temporary_object: None,
            fragmentation_analysis: None,
            generic_instantiation: None,
            type_relationships: None,
            type_usage: None,
            function_call_tracking: None,
            lifecycle_tracking: None,
            access_tracking: None,
            drop_chain_analysis: None,
        }
    }

    /// Helper function to create test allocations with various patterns
    fn create_test_allocations() -> Vec<AllocationInfo> {
        vec![
            // Large page-aligned allocation (likely mmap)
            create_test_allocation(0x7f0000000000, 8192, 1000, None, None),
            // Small allocation in thread range
            create_test_allocation(
                0x7fff00000100,
                512,
                2000,
                Some("ThreadLocal".to_string()),
                None,
            ),
            // Library allocation
            create_test_allocation(
                0x7f8000000000,
                4096,
                3000,
                Some("LibCode".to_string()),
                Some("lib_var".to_string()),
            ),
            // FFI allocation (no type/var names)
            create_test_allocation(0x6000_0000_0000, 1024, 4000, None, None),
            // System allocation (very high address)
            create_test_allocation(0x7fff_ffff_0000, 256, 5000, None, None),
            // Pre-tracking allocation (early timestamp)
            create_test_allocation(0x4000_0000_0000, 2048, 100, Some("Early".to_string()), None),
            // Regular heap allocation (should not be unknown)
            create_test_allocation(
                0x5555_5555_0000,
                128,
                6000,
                Some("HeapData".to_string()),
                Some("heap_var".to_string()),
            ),
        ]
    }

    #[test]
    fn test_unknown_memory_analyzer_creation() {
        let analyzer = UnknownMemoryAnalyzer::new();
        assert!(analyzer.known_system_regions.is_empty());
        assert!(analyzer.library_mappings.is_empty());
        assert!(analyzer.thread_memory_ranges.is_empty());
    }

    #[test]
    fn test_unknown_memory_analyzer_default() {
        let analyzer = UnknownMemoryAnalyzer::default();
        assert!(analyzer.known_system_regions.is_empty());
        assert!(analyzer.library_mappings.is_empty());
        assert!(analyzer.thread_memory_ranges.is_empty());
    }

    #[test]
    fn test_analyze_unknown_regions_basic() {
        let mut analyzer = UnknownMemoryAnalyzer::new();
        let allocations = create_test_allocations();

        let analysis = analyzer.analyze_unknown_regions(&allocations);

        // Verify basic structure
        assert!(analysis.total_unknown_bytes > 0);
        assert!(analysis.unknown_percentage >= 0.0 && analysis.unknown_percentage <= 100.0);
        assert!(!analysis.unknown_categories.is_empty());
        assert!(!analysis.potential_causes.is_empty());
        assert!(!analysis.reduction_strategies.is_empty());
    }

    #[test]
    fn test_identify_unknown_allocations() {
        let analyzer = UnknownMemoryAnalyzer::new();
        let allocations = create_test_allocations();

        let unknown = analyzer.identify_unknown_allocations(&allocations);

        // Most allocations should be identified as unknown since we don't have
        // stack/heap detection configured
        assert!(!unknown.is_empty());
        assert!(unknown.len() <= allocations.len());
    }

    #[test]
    fn test_is_unknown_allocation_logic() {
        let analyzer = UnknownMemoryAnalyzer::new();

        // Test with various allocation patterns
        let mmap_alloc = create_test_allocation(0x7f0000000000, 8192, 1000, None, None);
        let small_alloc =
            create_test_allocation(0x7fff00000100, 512, 2000, Some("Test".to_string()), None);

        // Since we don't have stack/heap detection configured, these should be unknown
        assert!(analyzer.is_unknown_allocation(&mmap_alloc));
        assert!(analyzer.is_unknown_allocation(&small_alloc));
    }

    #[test]
    fn test_categorize_unknown_regions() {
        let analyzer = UnknownMemoryAnalyzer::new();
        let allocations = create_test_allocations();
        let unknown_refs: Vec<&AllocationInfo> = allocations.iter().collect();

        let categories = analyzer.categorize_unknown_regions(&unknown_refs);

        // Verify categories are created
        assert!(!categories.is_empty());

        // Check that each category has valid data
        for category in &categories {
            assert!(category.estimated_size > 0);
            assert!(category.confidence_level >= 0.0 && category.confidence_level <= 1.0);
            assert!(!category.description.is_empty());
            assert!(!category.examples.is_empty());
        }
    }

    #[test]
    fn test_identify_potential_causes() {
        let analyzer = UnknownMemoryAnalyzer::new();
        let allocations = create_test_allocations();
        let unknown_refs: Vec<&AllocationInfo> = allocations.iter().collect();

        let causes = analyzer.identify_potential_causes(&unknown_refs);

        // Should identify various causes
        assert!(!causes.is_empty());

        // Check for expected cause types
        let has_ffi_cause = causes
            .iter()
            .any(|cause| matches!(cause, UnknownMemoryCause::ForeignFunctionInterface { .. }));
        let has_instrumentation_gap = causes
            .iter()
            .any(|cause| matches!(cause, UnknownMemoryCause::InstrumentationGaps { .. }));

        assert!(has_ffi_cause || has_instrumentation_gap);
    }

    #[test]
    fn test_generate_reduction_strategies() {
        let analyzer = UnknownMemoryAnalyzer::new();
        let categories = vec![]; // Empty categories for this test

        let strategies = analyzer.generate_reduction_strategies(&categories);

        // Should always generate some strategies
        assert!(!strategies.is_empty());

        // Verify strategy structure
        for strategy in &strategies {
            assert!(!strategy.description.is_empty());
            assert!(!strategy.implementation_steps.is_empty());
            assert!(strategy.expected_improvement >= 0.0);
            assert!(strategy.expected_improvement <= 100.0);
        }

        // Check for expected strategy types
        let has_enhanced_instrumentation = strategies.iter().any(|s| {
            matches!(
                s.strategy_type,
                ReductionStrategyType::EnhancedInstrumentation
            )
        });
        let has_ffi_interception = strategies
            .iter()
            .any(|s| matches!(s.strategy_type, ReductionStrategyType::FfiCallInterception));

        assert!(has_enhanced_instrumentation);
        assert!(has_ffi_interception);
    }

    #[test]
    fn test_memory_pattern_detection() {
        let analyzer = UnknownMemoryAnalyzer::new();

        // Test mmap pattern detection
        let mmap_alloc = create_test_allocation(0x7f0000000000, 8192, 1000, None, None);
        assert!(analyzer.is_likely_mmap_allocation(&mmap_alloc));

        // Test small allocation (not mmap)
        let small_alloc =
            create_test_allocation(0x7fff00000100, 512, 2000, Some("Test".to_string()), None);
        assert!(!analyzer.is_likely_mmap_allocation(&small_alloc));

        // Test FFI allocation detection
        let ffi_alloc = create_test_allocation(0x600000000000, 1024, 4000, None, None);
        assert!(analyzer.is_likely_ffi_allocation(&ffi_alloc));

        // Test non-FFI allocation
        let typed_alloc = create_test_allocation(
            0x600000000000,
            1024,
            4000,
            Some("Type".to_string()),
            Some("var".to_string()),
        );
        assert!(!analyzer.is_likely_ffi_allocation(&typed_alloc));
    }

    #[test]
    fn test_system_allocation_detection() {
        let analyzer = UnknownMemoryAnalyzer::new();

        // Test very high address (system allocation)
        let high_addr_alloc = create_test_allocation(0x7fff_ffff_0000, 256, 5000, None, None);
        assert!(analyzer.is_likely_system_allocation(&high_addr_alloc));

        // Test very low address (system allocation)
        let low_addr_alloc = create_test_allocation(0x500, 256, 5000, None, None);
        assert!(analyzer.is_likely_system_allocation(&low_addr_alloc));

        // Test normal address (not system allocation)
        let normal_alloc = create_test_allocation(0x5555_5555_0000, 256, 5000, None, None);
        assert!(!analyzer.is_likely_system_allocation(&normal_alloc));
    }

    #[test]
    fn test_pre_tracking_allocation_detection() {
        let analyzer = UnknownMemoryAnalyzer::new();

        // Test early timestamp (pre-tracking)
        let early_alloc =
            create_test_allocation(0x4000_0000_0000, 2048, 100, Some("Early".to_string()), None);
        assert!(analyzer.is_likely_pre_tracking_allocation(&early_alloc));

        // Test normal timestamp (not pre-tracking)
        let normal_alloc = create_test_allocation(
            0x4000_0000_0000,
            2048,
            5000,
            Some("Normal".to_string()),
            None,
        );
        assert!(!analyzer.is_likely_pre_tracking_allocation(&normal_alloc));
    }

    #[test]
    fn test_library_mapping_info() {
        let lib_info = LibraryMappingInfo {
            start_address: 0x7f80_0000_0000,
            end_address: 0x7f80_0001_0000,
            permissions: "r-x".to_string(),
            file_path: "/lib/x86_64-linux-gnu/libc.so.6".to_string(),
        };

        // Test address containment
        assert!(lib_info.contains_address(0x7f80_0000_5000));
        assert!(!lib_info.contains_address(0x7f80_0001_5000));
        assert!(!lib_info.contains_address(0x7f70_0000_0000));
    }

    #[test]
    fn test_unknown_memory_example_creation() {
        let analyzer = UnknownMemoryAnalyzer::new();
        let allocations = vec![
            create_test_allocation(0x7f00_0000_0000, 8192, 1000, None, None),
            create_test_allocation(0x7f00_0000_2000, 4096, 1100, None, None),
        ];
        let alloc_refs: Vec<&AllocationInfo> = allocations.iter().collect();

        let examples = analyzer.generate_examples(&alloc_refs, "Test origin");

        assert!(!examples.is_empty());
        assert!(examples.len() <= 3); // Limited to 3 examples

        for example in &examples {
            assert!(example.size > 0);
            assert!(example.address_range.1 > example.address_range.0);
            assert_eq!(example.suspected_origin, "Test origin");
        }
    }

    #[test]
    fn test_unknown_region_types_serialization() {
        // Test that all enum variants can be serialized/deserialized
        let region_types = vec![
            UnknownRegionType::MemoryMappedRegions,
            UnknownRegionType::ThreadLocalStorage,
            UnknownRegionType::DynamicLibraryRegions,
            UnknownRegionType::SystemReservedRegions,
            UnknownRegionType::JitCodeRegions,
            UnknownRegionType::ExternalLibraryAllocations,
            UnknownRegionType::GuardPages,
            UnknownRegionType::VdsoRegions,
            UnknownRegionType::AnonymousMappings,
            UnknownRegionType::SharedMemorySegments,
            UnknownRegionType::PreTrackingAllocations,
            UnknownRegionType::CorruptedMetadata,
        ];

        for region_type in region_types {
            let serialized = serde_json::to_string(&region_type).expect("Failed to serialize");
            let _deserialized: UnknownRegionType =
                serde_json::from_str(&serialized).expect("Failed to deserialize");
        }
    }

    #[test]
    fn test_memory_access_pattern_serialization() {
        let patterns = vec![
            MemoryAccessPattern::Sequential,
            MemoryAccessPattern::Random,
            MemoryAccessPattern::Sparse,
            MemoryAccessPattern::Unknown,
        ];

        for pattern in patterns {
            let serialized = serde_json::to_string(&pattern).expect("Failed to serialize");
            let _deserialized: MemoryAccessPattern =
                serde_json::from_str(&serialized).expect("Failed to deserialize");
        }
    }

    #[test]
    fn test_reduction_strategy_difficulty_levels() {
        let analyzer = UnknownMemoryAnalyzer::new();
        let strategies = analyzer.generate_reduction_strategies(&[]);

        // Verify that strategies have appropriate difficulty levels
        for strategy in &strategies {
            match strategy.strategy_type {
                ReductionStrategyType::EnhancedInstrumentation => {
                    assert_eq!(
                        strategy.implementation_difficulty,
                        ImplementationDifficulty::Hard
                    );
                }
                ReductionStrategyType::FfiCallInterception
                | ReductionStrategyType::MemoryMappingTracking => {
                    assert_eq!(
                        strategy.implementation_difficulty,
                        ImplementationDifficulty::Medium
                    );
                }
                _ => {
                    // Other strategies can have various difficulties
                }
            }
        }
    }

    #[test]
    fn test_comprehensive_analysis_workflow() {
        let mut analyzer = UnknownMemoryAnalyzer::new();
        let allocations = create_test_allocations();

        // Run full analysis
        let analysis = analyzer.analyze_unknown_regions(&allocations);

        // Verify comprehensive results
        assert!(analysis.total_unknown_bytes > 0);
        assert!(analysis.unknown_percentage > 0.0);
        assert!(!analysis.unknown_categories.is_empty());
        assert!(!analysis.potential_causes.is_empty());
        assert!(!analysis.reduction_strategies.is_empty());

        // Verify data consistency - categories may overlap, so total can exceed
        // but each category should have reasonable size
        for category in &analysis.unknown_categories {
            assert!(category.estimated_size > 0);
            assert!(category.confidence_level >= 0.0);
            assert!(category.confidence_level <= 1.0);
            assert!(!category.examples.is_empty());
            assert!(!category.description.is_empty());
        }

        // Verify potential causes have meaningful content
        for cause in &analysis.potential_causes {
            match cause {
                UnknownMemoryCause::ForeignFunctionInterface { library_name, .. } => {
                    assert!(!library_name.is_empty());
                }
                UnknownMemoryCause::InstrumentationGaps { description, .. } => {
                    assert!(!description.is_empty());
                }
                _ => {
                    // Other cause types are valid
                }
            }
        }

        // Verify reduction strategies are meaningful
        for strategy in &analysis.reduction_strategies {
            assert!(!strategy.description.is_empty());
            assert!(!strategy.implementation_steps.is_empty());
            assert!(strategy.expected_improvement >= 0.0);
            assert!(strategy.expected_improvement <= 100.0);
        }
    }
}