Brummel
76b21c00eb
Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`:
every fn-type slot on every signature carries an explicit `own` or
`borrow`, no defaulted position survives anywhere (model 0008 §2,
spec 0062). The parser rejects a bare fn-type slot; `borrow-return`
and `borrow-over-value` reject at the signature; the corpus is
migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap
⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode
leak is fixed: an owned heap return now drops exactly once (live=0,
acceptance criterion 5).
This was the easy half. Removing the default ACTIVATED a family of
drop paths that `Implicit` had silently skipped — the pre-cutover
language was leaking (and in places mis-dropping) here rather than
crashing, because an Implicit scrutinee turned the drop off. Making
the modes explicit (Own) turned those paths on and exposed two
latent-bug clusters, all fixed RED-first as part of this cutover:
Drop-soundness family (four legs):
A. lit-sub-pattern double-free — the desugar re-matched the same
owned scrutinee in the lit fall-through; fixed by grouping
consecutive same-ctor arms into one match (bind fields once),
in ailang-core desugar.
B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern
desugar rebound the owned scrutinee via `Let $mp = xs`, which
bumped consume_count and suppressed the existing fn-return
partial_drop. Fixed by not rebinding a bare-Var scrutinee
(one husk-freeing mechanism, not two).
C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields —
the per-ADT drop fn was emitted once from the polymorphic
TypeDef, defaulting type-var fields to ptr and rc_dec'ing
inline Ints (segfault). Fixed with per-monomorph drop
functions (new ailang-codegen::dropmono): the drop set is
collected from the lowered MIR, value-type fields are skipped,
heap fields still freed once; monomorphic-concrete ADTs keep
their byte-identical un-suffixed drop symbol.
D. static Str literal passed to an `(own Str)` param — the
literal lowers to a header-less rodata constant; the callee's
now-active rc_dec read its length field as a refcount and
freed a static address (segfault). Fixed with the missing
fourth StrRep::Static→Heap promotion in lower_to_mir's App arm,
gated on Own mode (borrow args stay static, no regression).
over-strict-mode lint over-fired: it suggested `(borrow V)` for
value-typed params (which `borrow-over-value` rejects — own is the
only legal mode there) and fired on `(intrinsic)` bodies (whose
consumption the linearity walk cannot observe). Tightened to skip
both; contract 0008 updated to the narrowed firing scope.
Irreversible step — canonical-form hash reset (model 0008 §6,
acceptance criterion 6). Every signature now carries explicit modes,
so the hashable canonical JSON changed for every module. RATIFY:
the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin,
mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the
ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot
golden were regenerated once, deliberately, as the intended one-time
consequence of removing the mode elision from the canonical form —
not a regression. Each regenerated hash verified deterministic across
two runs.
Also fixes a pre-existing latent failure surfaced by the verification
gate, unrelated to this cutover: the `every_contract_names_a_resolvable_
ratifying_test` resolver (design_index_pin) could not resolve the
" + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`)
that the #57 audit-close (dfdc65f) introduced — it shipped red on that
commit. Resolver taught the dual-link form, mirroring its sibling.
Verification: cargo test --workspace = 731 passed, 0 failed (twice,
stable); e2e 102 passed, no binary exits non-zero (corpus crash-free);
grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop
fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K,
head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first
husk-dec attempt, the over-strict derivation premise, the leg-B fix
direction) were each treated as a real design/spec gap and rediagnosed,
not patched over.
Supersedes #54 (return-position-only leak patch). Precondition #57
(linearity hardening) was already met. Spec docs/specs/0062, plan
docs/plans/0121.
closes #55
197 lines
5.8 KiB
Plaintext
197 lines
5.8 KiB
Plaintext
; Iter 15b — second stdlib module: polymorphic singly-linked lists.
|
|
; Imports std_maybe so head/tail can return Maybe<a> / Maybe<List<a>>.
|
|
; prep.1 migration (kernel-extension-mechanics): bare `Maybe` at
|
|
; type-name slots (in scope via `(import std_maybe)`). Bare ctor
|
|
; names (`Just`, `Nothing`) stay unqualified — once the type is
|
|
; resolved the ctor lookup is unambiguous.
|
|
|
|
(module std_list
|
|
|
|
(import std_maybe)
|
|
|
|
(data List (vars a)
|
|
(doc "Polymorphic singly-linked list: Nil or Cons<a, List<a>>.")
|
|
(ctor Nil)
|
|
(ctor Cons a (con List a)))
|
|
|
|
(fn fold_left
|
|
(doc "Tail-recursive left fold. The recursive call is in tail position and is marked.")
|
|
(type
|
|
(forall (vars a b)
|
|
(fn-type
|
|
(params (borrow (fn-type (params (own b) (own a)) (ret (own b))))
|
|
(own b)
|
|
(own (con List a)))
|
|
(ret (own b)))))
|
|
(params f acc xs)
|
|
(body
|
|
(match xs
|
|
(case (pat-ctor Nil) acc)
|
|
(case (pat-ctor Cons h t)
|
|
(tail-app fold_left f (app f acc h) t)))))
|
|
|
|
(fn fold_right
|
|
(doc "Right fold. Constructor-blocked: the recursive call is the second arg of f, NOT a tail position.")
|
|
(type
|
|
(forall (vars a b)
|
|
(fn-type
|
|
(params (own (fn-type (params (own a) (own b)) (ret (own b))))
|
|
(own b)
|
|
(own (con List a)))
|
|
(ret (own b)))))
|
|
(params f acc xs)
|
|
(body
|
|
(match xs
|
|
(case (pat-ctor Nil) acc)
|
|
(case (pat-ctor Cons h t)
|
|
(app f h (app fold_right f acc t))))))
|
|
|
|
(fn length
|
|
(doc "Length via fold_left. The accumulating lambda ignores the element and increments the counter.")
|
|
(type
|
|
(forall (vars a)
|
|
(fn-type
|
|
(params (own (con List a)))
|
|
(ret (own (con Int))))))
|
|
(params xs)
|
|
(body
|
|
(app fold_left
|
|
(lam (params (typed c (con Int)) (typed _ a))
|
|
(ret (con Int))
|
|
(body (app + c 1)))
|
|
0
|
|
xs)))
|
|
|
|
(fn reverse
|
|
(doc "Reverse via fold_left with a flipping accumulator. Tail-recursive by virtue of the fold_left call.")
|
|
(type
|
|
(forall (vars a)
|
|
(fn-type
|
|
(params (own (con List a)))
|
|
(ret (own (con List a))))))
|
|
(params xs)
|
|
(body
|
|
(app fold_left
|
|
(lam (params (typed acc (con List a)) (typed h a))
|
|
(ret (con List a))
|
|
(body (term-ctor List Cons h acc)))
|
|
(term-ctor List Nil)
|
|
xs)))
|
|
|
|
(fn is_empty
|
|
(doc "True iff the list is Nil.")
|
|
(type
|
|
(forall (vars a)
|
|
(fn-type
|
|
(params (borrow (con List a)))
|
|
(ret (own (con Bool))))))
|
|
(params xs)
|
|
(body
|
|
(match xs
|
|
(case (pat-ctor Nil) true)
|
|
(case (pat-ctor Cons _ _) false))))
|
|
|
|
(fn head
|
|
(doc "Returns Just<a> of the first element, or Nothing for an empty list. Cross-module Maybe.")
|
|
(type
|
|
(forall (vars a)
|
|
(fn-type
|
|
(params (own (con List a)))
|
|
(ret (own (con Maybe a))))))
|
|
(params xs)
|
|
(body
|
|
(match xs
|
|
(case (pat-ctor Nil) (term-ctor Maybe Nothing))
|
|
(case (pat-ctor Cons h _) (term-ctor Maybe Just h)))))
|
|
|
|
(fn tail
|
|
(doc "Returns Just<List<a>> of the tail, or Nothing for an empty list.")
|
|
(type
|
|
(forall (vars a)
|
|
(fn-type
|
|
(params (own (con List a)))
|
|
(ret (own (con Maybe (con List a)))))))
|
|
(params xs)
|
|
(body
|
|
(match xs
|
|
(case (pat-ctor Nil) (term-ctor Maybe Nothing))
|
|
(case (pat-ctor Cons _ t) (term-ctor Maybe Just t)))))
|
|
|
|
(fn append
|
|
(doc "Concatenate two lists. Constructor-blocked recursion: the recursive call is inside Cons, NOT a tail.")
|
|
(type
|
|
(forall (vars a)
|
|
(fn-type
|
|
(params (own (con List a)) (own (con List a)))
|
|
(ret (own (con List a))))))
|
|
(params xs ys)
|
|
(body
|
|
(match xs
|
|
(case (pat-ctor Nil) ys)
|
|
(case (pat-ctor Cons h t)
|
|
(term-ctor List Cons h (app append t ys))))))
|
|
|
|
(fn map
|
|
(doc "Polymorphic map. Constructor-blocked recursion.")
|
|
(type
|
|
(forall (vars a b)
|
|
(fn-type
|
|
(params (own (fn-type (params (own a)) (ret (own b))))
|
|
(own (con List a)))
|
|
(ret (own (con List b))))))
|
|
(params f xs)
|
|
(body
|
|
(match xs
|
|
(case (pat-ctor Nil) (term-ctor List Nil))
|
|
(case (pat-ctor Cons h t)
|
|
(term-ctor List Cons (app f h) (app map f t))))))
|
|
|
|
(fn filter
|
|
(doc "Keep elements where p is true. Constructor-blocked when p holds; non-tail recursive call when p is false.")
|
|
(type
|
|
(forall (vars a)
|
|
(fn-type
|
|
(params (borrow (fn-type (params (borrow a)) (ret (own (con Bool)))))
|
|
(own (con List a)))
|
|
(ret (own (con List a))))))
|
|
(params p xs)
|
|
(body
|
|
(match xs
|
|
(case (pat-ctor Nil) (term-ctor List Nil))
|
|
(case (pat-ctor Cons h t)
|
|
(if (app p h)
|
|
(term-ctor List Cons h (app filter p t))
|
|
(app filter p t))))))
|
|
|
|
(fn take
|
|
(doc "First n elements of xs (or all of xs if it has fewer than n).")
|
|
(type
|
|
(forall (vars a)
|
|
(fn-type
|
|
(params (own (con Int)) (own (con List a)))
|
|
(ret (own (con List a))))))
|
|
(params n xs)
|
|
(body
|
|
(if (app le n 0)
|
|
(term-ctor List Nil)
|
|
(match xs
|
|
(case (pat-ctor Nil) (term-ctor List Nil))
|
|
(case (pat-ctor Cons h t)
|
|
(term-ctor List Cons h (app take (app - n 1) t)))))))
|
|
|
|
(fn drop
|
|
(doc "All elements of xs after the first n (or Nil if xs has fewer than n elements).")
|
|
(type
|
|
(forall (vars a)
|
|
(fn-type
|
|
(params (own (con Int)) (own (con List a)))
|
|
(ret (own (con List a))))))
|
|
(params n xs)
|
|
(body
|
|
(if (app le n 0)
|
|
xs
|
|
(match xs
|
|
(case (pat-ctor Nil) (term-ctor List Nil))
|
|
(case (pat-ctor Cons _ t)
|
|
(app drop (app - n 1) t)))))))
|