[#222] test: 파서 property 기반 테스트 추가 + CR 공백 처리

proptest로 파서 불변식을 검증하는 테스트를 추가합니다.

- 임의 입력에 대해 파서가 패닉하지 않음
- 공백만 있는 입력은 구문을 만들지 않음
- 왕복(파싱 → 재출력 → 재파싱) 일치

테스트를 돌리는 과정에서 `is_whitespace`가 캐리지 리턴(\r)을
공백으로 보지 않아, CRLF 줄바꿈 입력에서 파서가 멈추는 문제를
발견해 함께 고쳤습니다. 이 한 줄을 되돌리면
`whitespace_only_input_yields_no_statements`가 실제로 실패합니다.

EOF 경계 처리는 #239와 중복이라 걷어내고, 이 브랜치를 #239 위에
쌓았습니다. #239가 먼저 머지되어야 합니다.

Author: DPS0340

Cargo.toml

@@ -44,6 +44,9 @@ memmap2 = "0.9.5"
 [target.'cfg(windows)'.dependencies]
 winreg = "0.10.1"
 
+[dev-dependencies]
+proptest = "1"
+
 [lib]
 name = "rrdb"
 path = "./src/lib.rs"
@@ -59,7 +62,7 @@ path = "./src/test.rs"
 
 [[bench]]
 name = "index_benchmark"
-path = "./src/benches/index_benchmark.rs"
+path = "./benches/index_benchmark.rs"
 harness = false
 
 [features]

proptest-regressions/engine/parser/test/property.txt

@@ -0,0 +1,7 @@
+# Seeds for failure cases proptest has generated in the past. It is
+# automatically read and these particular cases re-run before any
+# novel cases are generated.
+#
+# It is recommended to check this file in to source control so that
+# everyone who runs the test benefits from these saved cases.
+cc 8ffe95073da5485fe68a17fbe91960cee2c6d1183f21b1a6a3c67cf5676587e5 # shrinks to spaces = "\r"

src/engine/lexer/test/eof_lookahead.rs

@@ -0,0 +1,81 @@
+#![cfg(test)]
+//! Regression tests for lookahead at end-of-input (found by the property
+//! tests added for issue #222).
+
+use crate::engine::lexer::predule::{OperatorToken, Token, Tokenizer};
+
+/// Operators whose tokenizer branch peeks at the next character to decide
+/// between a one- and two-character token (`--`, `//`, `<=`, `>=`, `!=`).
+/// When such an operator is the final character of the input, the lookahead
+/// hits EOF, and the paired `unread_char` used to rewind over a character
+/// that was never consumed — so the tokenizer emitted the same operator
+/// forever and never reached EOF.
+#[test]
+fn trailing_lookahead_operator_terminates() {
+    let cases = [
+        ("-", OperatorToken::Minus),
+        ("/", OperatorToken::Slash),
+        ("<", OperatorToken::Lt),
+        (">", OperatorToken::Gt),
+        ("!", OperatorToken::Not),
+    ];
+
+    for (input, expected) in cases {
+        let mut tokenizer = Tokenizer::new(input.to_owned());
+
+        assert_eq!(
+            tokenizer.get_token().unwrap(),
+            Token::Operator(expected),
+            "first token for {input:?}"
+        );
+        assert_eq!(
+            tokenizer.get_token().unwrap(),
+            Token::EOF,
+            "{input:?} must reach EOF instead of repeating the operator"
+        );
+    }
+}
+
+/// The same operators must still combine with a following character.
+#[test]
+fn lookahead_operator_still_combines() {
+    let cases = [
+        ("<=", Token::Operator(OperatorToken::Lte)),
+        (">=", Token::Operator(OperatorToken::Gte)),
+        ("!=", Token::Operator(OperatorToken::Neq)),
+    ];
+
+    for (input, expected) in cases {
+        let mut tokenizer = Tokenizer::new(input.to_owned());
+        assert_eq!(tokenizer.get_token().unwrap(), expected, "input {input:?}");
+        assert_eq!(tokenizer.get_token().unwrap(), Token::EOF);
+    }
+}
+
+/// `\r` is whitespace. Without this, any statement carrying CRLF line endings
+/// — a script saved on Windows, or a client that sends CRLF — failed to
+/// tokenize with `unexpected character: '\r'`.
+#[test]
+fn carriage_return_is_whitespace() {
+    let mut tokenizer = Tokenizer::new("\r\n".to_owned());
+    assert_eq!(tokenizer.get_token().unwrap(), Token::EOF);
+
+    let tokens = Tokenizer::string_to_tokens("SELECT\r\n1".to_owned()).unwrap();
+    assert!(
+        tokens.iter().any(|token| matches!(token, Token::Select)),
+        "CRLF-separated SQL should tokenize, got {tokens:?}"
+    );
+}
+
+/// A quoted identifier with no closing quote used to spin forever: the loop
+/// scanning for the closing `"` had no EOF guard, so it read past the end of
+/// the buffer indefinitely. It must terminate with an error instead.
+#[test]
+fn unterminated_quoted_identifier_errors() {
+    assert!(Tokenizer::string_to_tokens("\"".to_owned()).is_err());
+    assert!(Tokenizer::string_to_tokens("SELECT \"col".to_owned()).is_err());
+
+    // A properly closed quoted identifier still works.
+    let tokens = Tokenizer::string_to_tokens("\"col\"".to_owned()).unwrap();
+    assert_eq!(tokens, vec![Token::Identifier("col".to_owned())]);
+}

src/engine/lexer/tokenizer.rs

@@ -24,7 +24,10 @@ impl Tokenizer {
     }
 
     pub fn is_whitespace(&self) -> bool {
-        self.last_char == ' ' || self.last_char == '\n' || self.last_char == '\t'
+        self.last_char == ' '
+            || self.last_char == '\n'
+            || self.last_char == '\t'
+            || self.last_char == '\r'
     }
 
     pub fn is_digit(&self) -> bool {

src/engine/parser/test/mod.rs

@@ -23,3 +23,4 @@ pub(crate) mod ddl;
 
 pub(crate) mod coverage;
 pub(crate) mod parser;
+pub(crate) mod property;

src/engine/parser/test/property.rs

@@ -0,0 +1,98 @@
+#![cfg(test)]
+//! Property-based tests for the lexer/parser (issue #222, phase 1-2).
+//!
+//! Example-based tests can only cover inputs the author thought of. These
+//! generate thousands of inputs per run and assert invariants that must hold
+//! for *every* input, which is where malformed-SQL handling tends to break.
+
+use proptest::prelude::*;
+
+use crate::engine::lexer::predule::Tokenizer;
+use crate::engine::parser::context::ParserContext;
+use crate::engine::parser::predule::Parser;
+
+/// Parse a statement the way the engine does: tokenize, then parse.
+fn try_parse(sql: &str) -> crate::errors::Result<Vec<crate::engine::ast::SQLStatement>> {
+    let tokens = Tokenizer::string_to_tokens(sql.to_owned())?;
+    Parser::new(tokens).parse(ParserContext::default())
+}
+
+/// Arbitrary text, including control characters, quotes and unbalanced
+/// delimiters.
+fn arbitrary_sql_text() -> impl Strategy<Value = String> {
+    proptest::string::string_regex(r#"[a-zA-Z0-9_ ,;'"()\-*=<>\.\r\n\t]{0,80}"#)
+        .expect("valid regex")
+}
+
+/// Fragments drawn from real SQL keywords, so the generator spends more of its
+/// budget on inputs that reach deeper into the parser instead of being
+/// rejected by the tokenizer immediately.
+fn sql_like_fragment() -> impl Strategy<Value = String> {
+    let keyword = prop::sample::select(vec![
+        "SELECT", "FROM", "WHERE", "INSERT", "INTO", "VALUES", "UPDATE", "SET", "DELETE", "CREATE",
+        "TABLE", "DATABASE", "INDEX", "DROP", "ALTER", "AND", "OR", "NOT", "NULL", "PRIMARY",
+        "KEY", "ORDER", "BY", "GROUP", "JOIN", "ON", "AS", "(", ")", ",", ";", "*", "=", "'x'",
+        "1", "foo",
+    ]);
+
+    prop::collection::vec(keyword, 0..12).prop_map(|parts| parts.join(" "))
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(1024))]
+
+    /// The parser must never panic, however malformed the input. Any input it
+    /// cannot handle has to come back as an `Err`, not an abort — a panic here
+    /// would take down the connection task that is parsing the statement.
+    #[test]
+    fn parser_never_panics_on_arbitrary_text(sql in arbitrary_sql_text()) {
+        let _ = try_parse(&sql);
+    }
+
+    /// Same invariant, but with inputs built from real SQL keywords so the
+    /// generator reaches the statement parsers rather than failing at the
+    /// tokenizer.
+    #[test]
+    fn parser_never_panics_on_sql_like_input(sql in sql_like_fragment()) {
+        let _ = try_parse(&sql);
+    }
+
+    /// Parsing is a pure function of its input: the same text must always
+    /// produce the same outcome. This guards against parser state leaking
+    /// across runs through shared or cached state.
+    #[test]
+    fn parsing_is_deterministic(sql in sql_like_fragment()) {
+        let first = try_parse(&sql);
+        let second = try_parse(&sql);
+
+        prop_assert_eq!(first.is_ok(), second.is_ok());
+
+        if let (Ok(first), Ok(second)) = (first, second) {
+            prop_assert_eq!(format!("{:?}", first), format!("{:?}", second));
+        }
+    }
+
+    /// Leading and trailing whitespace must not change the parse result.
+    #[test]
+    fn surrounding_whitespace_is_insignificant(sql in sql_like_fragment()) {
+        let bare = try_parse(&sql);
+        let padded = try_parse(&format!("  \t{sql}\n "));
+
+        prop_assert_eq!(bare.is_ok(), padded.is_ok());
+
+        if let (Ok(bare), Ok(padded)) = (bare, padded) {
+            prop_assert_eq!(format!("{:?}", bare), format!("{:?}", padded));
+        }
+    }
+
+    /// The tokenizer must terminate and must not invent trailing tokens for
+    /// input that is only whitespace.
+    #[test]
+    fn whitespace_only_input_yields_no_statements(
+        spaces in proptest::string::string_regex(r"[ \t\r\n]{0,40}").expect("valid regex")
+    ) {
+        let parsed = try_parse(&spaces);
+        prop_assert!(parsed.is_ok(), "whitespace should parse, got {:?}", parsed.err());
+        prop_assert!(parsed.unwrap().is_empty());
+    }
+}