Regarding CVE-2018-17144 and test cases
There are tests for that.  The specifically broken pattern was a block containing a single transaction spending the same output, which originated from an earlier block, twice. Testing it without putting it in a block, or splitting up the double spend across multiple transactions weren't sufficient tests.