AILang

Brummel/AILang

Fork 0

Commit Graph

Author	SHA1	Message	Date
Brummel	50b68267fe	check: mode-strict-because suppression (iter 19b) Closes the 19a/19a.1/19b arc. Corpus signal from 19a.1 (5/65 fixtures fire over-strict-mode, all deliberate RC codegen-test fixtures) justified shipping the suppress mechanism end-to-end. Schema: Suppress { code, because } on FnDef. Pre-19b hashes bit-identical via skip_serializing_if. Typechecker drops matching diagnostics; empty 'because' is Error severity; wrong codes are silent no-ops (open-set registry). Form-A: (suppress (code "...") (because "...")) clause, parser + printer round-trip clean. Form-B: '// @suppress <code>: <reason>' above the doc string, lossless contract metadata. 5 RC fixtures migrated (.ail.json + .ailx + .prose.txt). Corpus signal: 5/65 -> 0/65. Lint still fires on any future fn that's accidentally over-strict without an authored reason. Test counts: ailang-check 55->61, ailang-core 26->28, ailang-surface 21->26, ailang-prose 49->52, e2e 70 unchanged. Known debt: .ailx comment headers lost on regen (ail render's contract excludes comments); parse_suppress_attr accepts duplicate code/because attrs without diagnose (bounded by canonical print order).	2026-05-08 19:36:04 +02:00
Brummel	ce6ab8ee44	Iter 18e: (drop-iterative) annotation + worklist allocator Closes the 18-arc's stack-recursion limit. Recursive drop cascades from 18c.4 overflow on long ADT chains (Linux's 8 MB default stack maxes out around 1M cells of List). The new opt-in (drop-iterative) annotation on a Def::Type switches the synthesised drop_<m>_<T> body from recursive to iterative-with- explicit-worklist for that type. Schema: - TypeDef.drop_iterative: bool. Default false; serde-skip when false so existing fixtures' canonical JSON hashes stay stable. - Form-A: (drop-iterative) clause inside (data T ...). Worklist runtime (4 new ABI symbols in runtime/rc.c): - ailang_drop_worklist_new(initial_capacity) - ailang_drop_worklist_push(wl, ptr) - ailang_drop_worklist_pop(wl) -> ptr - ailang_drop_worklist_free(wl) Heap stretchy buffer, doubling on overflow, null-filtering on push. Lean 4 / Roc precedent documented in the runtime; the slot-repurposing strategy was considered and rejected because not every box has a free pointer-typed slot to thread the worklist through (Cons head is i64, slot 1 is ptr but it's the field we're following — no free slot). Codegen (emit_iterative_drop_fn_for_type): for a drop_iterative type, drop_<m>_<T>(ptr %p) emits a worklist loop. Fields of the SAME annotated type push onto the worklist (mono-typed); fields of DIFFERENT types call their own drop fn directly (recursive on those, but only if THEY are themselves recursive — i.e. one level of cascade jump maximum). Mono-typed-worklist is sound for the deep-self- recursion case the iter targets (List of List of T just needs the spine flattened). Tests: - examples/rc_drop_iterative_long_list — 1M-cell List of Int with (drop-iterative) annotation. - alloc_rc_drop_iterative_handles_million_cell_list E2E — builds + runs under --alloc=rc, asserts clean exit. With annotation: exits 0. Without annotation (control): SIGSEGV at exit code 139 (verified by hand). Worklist is load- bearing. - iter18e_drop_iterative_emits_worklist_body_no_self_recursion IR-shape: worklist body has br to loop_head AND no direct recursive call into drop_<m>_<T>. - iter18e_no_annotation_keeps_recursive_drop_body — control: unannotated variant still emits the 18c.4 recursive shape. - 3 surface parse-tests for the annotation round-trip. Test deltas: e2e 58 -> 61 (+3), surface 18 -> 21 (+3). All other buckets unchanged. cargo test --workspace green. Known debt (deliberate): - Mono-typed worklist: cross-type drop-iterative fields call the other type's drop fn directly. A heterogeneous worklist would be more general but adds tag tracking complexity for a case (drop-iterative T containing drop-iterative T') that's narrower than the deep-self- recursion target. Documented in emit_iterative_drop_fn_for_type's doc. - Closure / Type::Var / Type::Forall fields fall back to shallow ailang_rc_dec via field_drop_call — same as the recursive variant. - Dynamic-tag partial-drop fallback (head_or_zero epilogue shallow dec when moved_slots non-empty) — out of scope per brief.	2026-05-08 12:53:09 +02:00
Brummel	73545ab086	Iter 18d.2: codegen reuse-as in-place rewrite under --alloc=rc Lowers Term::ReuseAs { source, body=Term::Ctor } under --alloc=rc to a runtime refcount-1 dispatch. At the reuse-as site: %hdr_ptr = getelementptr i8, ptr %src, i64 -8 %refcnt = load i64, ptr %hdr_ptr %is_one = icmp eq i64 %refcnt, 1 br i1 %is_one, label %reuse, label %fresh The reuse arm overwrites the source's box in place: stores the new tag at offset 0 and the new field values at offsets 8, 16, ... — no malloc, no outer drop. The fresh arm allocates a brand- new box via ailang_rc_alloc, stores tag and fields, then shallow- dec's the source. Both arms phi-join to the same `ptr` result. Other allocators (gc, bump) keep 18d.1's identity behaviour unchanged. Static shape compatibility is enforced by a new pre-codegen pass crates/ailang-check/src/reuse_shape.rs. It tracks the path-resolved ctor of every let-bound and pattern-matched binder, then checks each Term::ReuseAs site against the body's ctor. Mismatches emit reuse-as-shape-mismatch with stable ctx.reason sub-codes (field-count-mismatch, field-type-mismatch, indeterminate-source-ctor, cross-module-body-ctor, ctor-not-in- module) and a drop-the-wrapper SuggestedRewrite. Build fails on mismatch — the structured diagnostic tells the author whether to fix the shapes or remove the hint. Field-cleanup design — deliberate scope cut: The reuse arm does NOT dec the old pointer-typed field values before overwriting them. Doing so on the canonical fixture `(reuse-as xs (Cons (+h 1) (map_inc t)))` causes use-after-free: the recursive map_inc(t) returns t's in-place-rewritten box, so the "new tail" being stored is the same pointer as the "old tail". A dec-old-then-store-new schedule would dec the box (to zero, free), then store the freed pointer. The root cause is upstream: 18c.4 doesn't yet null-out pattern- moved field slots, so codegen can't statically distinguish "old field still owned" from "already moved out". The chosen trade-off: skip the field dec entirely; pattern-wildcarded fields (rare in shipping fixtures) leak; pattern-moved fields are the body's responsibility (consistent with the 18c.4 leak baseline — Own params still leak today). 18d.2 ships zero regression vs 18c.4, plus the perf win on the alloc + outer cascade. Closing the leak is the move-aware-pattern story queued for 18d.3 / 18e. Tests: - e2e reuse_as_demo_under_rc_uses_inplace_rewrite — runs examples/reuse_as_demo.ail.json under --alloc=rc, asserts stdout 9 and locks in the IR shape (icmp eq i64 ..., 1; the reuse arm has no @ailang_rc_alloc call). - workspace reuse_as_shape_mismatch_is_reported_on_cons_to_nil — happy negative for the new diagnostic. - 3 unit tests in reuse_shape::tests covering same-ctor-clean, cons-to-nil-reject, and indeterminate-source-ctor-reject. Test deltas: e2e 56, ailang-check unit 46 -> 49 (+3), workspace 9 -> 10 (+1). cargo test --workspace green. Hand-verified --alloc=rc binary on reuse_as_demo: stdout 9, exit 0.	2026-05-08 11:21:02 +02:00

Author

SHA1

Message

Date

Brummel

50b68267fe

check: mode-strict-because suppression (iter 19b)

Closes the 19a/19a.1/19b arc. Corpus signal from 19a.1 (5/65
fixtures fire over-strict-mode, all deliberate RC codegen-test
fixtures) justified shipping the suppress mechanism end-to-end.

Schema: Suppress { code, because } on FnDef. Pre-19b hashes
bit-identical via skip_serializing_if. Typechecker drops matching
diagnostics; empty 'because' is Error severity; wrong codes are
silent no-ops (open-set registry).

Form-A: (suppress (code "...") (because "...")) clause, parser
+ printer round-trip clean. Form-B: '// @suppress <code>: <reason>'
above the doc string, lossless contract metadata.

5 RC fixtures migrated (.ail.json + .ailx + .prose.txt). Corpus
signal: 5/65 -> 0/65. Lint still fires on any future fn that's
accidentally over-strict without an authored reason.

Test counts: ailang-check 55->61, ailang-core 26->28, ailang-surface
21->26, ailang-prose 49->52, e2e 70 unchanged.

Known debt: .ailx comment headers lost on regen (ail render's
contract excludes comments); parse_suppress_attr accepts
duplicate code/because attrs without diagnose (bounded by canonical
print order).

2026-05-08 19:36:04 +02:00

Brummel

ce6ab8ee44

Iter 18e: (drop-iterative) annotation + worklist allocator

Closes the 18-arc's stack-recursion limit. Recursive drop
cascades from 18c.4 overflow on long ADT chains (Linux's 8 MB
default stack maxes out around 1M cells of List). The new
opt-in (drop-iterative) annotation on a Def::Type switches the
synthesised drop_<m>_<T> body from recursive to iterative-with-
explicit-worklist for that type.

Schema:
- TypeDef.drop_iterative: bool. Default false; serde-skip
  when false so existing fixtures' canonical JSON hashes stay
  stable.
- Form-A: (drop-iterative) clause inside (data T ...).

Worklist runtime (4 new ABI symbols in runtime/rc.c):
- ailang_drop_worklist_new(initial_capacity)
- ailang_drop_worklist_push(wl, ptr)
- ailang_drop_worklist_pop(wl) -> ptr
- ailang_drop_worklist_free(wl)

Heap stretchy buffer, doubling on overflow, null-filtering on
push. Lean 4 / Roc precedent documented in the runtime; the
slot-repurposing strategy was considered and rejected because
not every box has a free pointer-typed slot to thread the
worklist through (Cons head is i64, slot 1 is ptr but it's
the field we're following — no free slot).

Codegen (emit_iterative_drop_fn_for_type): for a
drop_iterative type, drop_<m>_<T>(ptr %p) emits a worklist
loop. Fields of the SAME annotated type push onto the
worklist (mono-typed); fields of DIFFERENT types call their
own drop fn directly (recursive on those, but only if THEY
are themselves recursive — i.e. one level of cascade jump
maximum). Mono-typed-worklist is sound for the deep-self-
recursion case the iter targets (List of List of T just
needs the spine flattened).

Tests:
- examples/rc_drop_iterative_long_list — 1M-cell List of Int
  with (drop-iterative) annotation.
- alloc_rc_drop_iterative_handles_million_cell_list E2E —
  builds + runs under --alloc=rc, asserts clean exit. With
  annotation: exits 0. Without annotation (control): SIGSEGV
  at exit code 139 (verified by hand). Worklist is load-
  bearing.
- iter18e_drop_iterative_emits_worklist_body_no_self_recursion
  IR-shape: worklist body has br to loop_head AND no direct
  recursive call into drop_<m>_<T>.
- iter18e_no_annotation_keeps_recursive_drop_body — control:
  unannotated variant still emits the 18c.4 recursive shape.
- 3 surface parse-tests for the annotation round-trip.

Test deltas: e2e 58 -> 61 (+3), surface 18 -> 21 (+3). All
other buckets unchanged. cargo test --workspace green.

Known debt (deliberate):
- Mono-typed worklist: cross-type drop-iterative fields call
  the other type's drop fn directly. A heterogeneous
  worklist would be more general but adds tag tracking
  complexity for a case (drop-iterative T containing
  drop-iterative T') that's narrower than the deep-self-
  recursion target. Documented in
  emit_iterative_drop_fn_for_type's doc.
- Closure / Type::Var / Type::Forall fields fall back to
  shallow ailang_rc_dec via field_drop_call — same as the
  recursive variant.
- Dynamic-tag partial-drop fallback (head_or_zero epilogue
  shallow dec when moved_slots non-empty) — out of scope per
  brief.

2026-05-08 12:53:09 +02:00

Brummel

73545ab086

Iter 18d.2: codegen reuse-as in-place rewrite under --alloc=rc

Lowers Term::ReuseAs { source, body=Term::Ctor } under
--alloc=rc to a runtime refcount-1 dispatch. At the reuse-as
site:

  %hdr_ptr = getelementptr i8, ptr %src, i64 -8
  %refcnt  = load i64, ptr %hdr_ptr
  %is_one  = icmp eq i64 %refcnt, 1
  br i1 %is_one, label %reuse, label %fresh

The reuse arm overwrites the source's box in place: stores the
new tag at offset 0 and the new field values at offsets 8, 16,
... — no malloc, no outer drop. The fresh arm allocates a brand-
new box via ailang_rc_alloc, stores tag and fields, then shallow-
dec's the source. Both arms phi-join to the same `ptr` result.

Other allocators (gc, bump) keep 18d.1's identity behaviour
unchanged.

Static shape compatibility is enforced by a new pre-codegen
pass crates/ailang-check/src/reuse_shape.rs. It tracks the
path-resolved ctor of every let-bound and pattern-matched
binder, then checks each Term::ReuseAs site against the body's
ctor. Mismatches emit reuse-as-shape-mismatch with stable
ctx.reason sub-codes (field-count-mismatch, field-type-mismatch,
indeterminate-source-ctor, cross-module-body-ctor, ctor-not-in-
module) and a drop-the-wrapper SuggestedRewrite. Build fails on
mismatch — the structured diagnostic tells the author whether
to fix the shapes or remove the hint.

Field-cleanup design — deliberate scope cut:

The reuse arm does NOT dec the old pointer-typed field values
before overwriting them. Doing so on the canonical fixture
`(reuse-as xs (Cons (+h 1) (map_inc t)))` causes use-after-free:
the recursive map_inc(t) returns t's in-place-rewritten box, so
the "new tail" being stored is the same pointer as the "old
tail". A dec-old-then-store-new schedule would dec the box (to
zero, free), then store the freed pointer.

The root cause is upstream: 18c.4 doesn't yet null-out pattern-
moved field slots, so codegen can't statically distinguish
"old field still owned" from "already moved out". The chosen
trade-off: skip the field dec entirely; pattern-wildcarded
fields (rare in shipping fixtures) leak; pattern-moved fields
are the body's responsibility (consistent with the 18c.4 leak
baseline — Own params still leak today). 18d.2 ships zero
regression vs 18c.4, plus the perf win on the alloc + outer
cascade. Closing the leak is the move-aware-pattern story
queued for 18d.3 / 18e.

Tests:
- e2e reuse_as_demo_under_rc_uses_inplace_rewrite — runs
  examples/reuse_as_demo.ail.json under --alloc=rc, asserts
  stdout 9 and locks in the IR shape (icmp eq i64 ..., 1; the
  reuse arm has no @ailang_rc_alloc call).
- workspace reuse_as_shape_mismatch_is_reported_on_cons_to_nil
  — happy negative for the new diagnostic.
- 3 unit tests in reuse_shape::tests covering same-ctor-clean,
  cons-to-nil-reject, and indeterminate-source-ctor-reject.

Test deltas: e2e 56, ailang-check unit 46 -> 49 (+3), workspace
9 -> 10 (+1). cargo test --workspace green. Hand-verified
--alloc=rc binary on reuse_as_demo: stdout 9, exit 0.

2026-05-08 11:21:02 +02:00

3 Commits