The test suite has no fuzzing or property-based testing, no assertions on error offset values, and no tests exercising concurrent use of the parser/backends. These are the kind of gaps that tend to surface exactly the class of bugs found in this audit (buffer bounds, shared mutable state, tape reuse).
Worth adding at least one property-based/fuzz pass over the JSON grammar and a basic concurrent-use test.
The test suite has no fuzzing or property-based testing, no assertions on error offset values, and no tests exercising concurrent use of the parser/backends. These are the kind of gaps that tend to surface exactly the class of bugs found in this audit (buffer bounds, shared mutable state, tape reuse).
Worth adding at least one property-based/fuzz pass over the JSON grammar and a basic concurrent-use test.