76b21c00eb
Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`:
every fn-type slot on every signature carries an explicit `own` or
`borrow`, no defaulted position survives anywhere (model 0008 §2,
spec 0062). The parser rejects a bare fn-type slot; `borrow-return`
and `borrow-over-value` reject at the signature; the corpus is
migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap
⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode
leak is fixed: an owned heap return now drops exactly once (live=0,
acceptance criterion 5).
This was the easy half. Removing the default ACTIVATED a family of
drop paths that `Implicit` had silently skipped — the pre-cutover
language was leaking (and in places mis-dropping) here rather than
crashing, because an Implicit scrutinee turned the drop off. Making
the modes explicit (Own) turned those paths on and exposed two
latent-bug clusters, all fixed RED-first as part of this cutover:
Drop-soundness family (four legs):
A. lit-sub-pattern double-free — the desugar re-matched the same
owned scrutinee in the lit fall-through; fixed by grouping
consecutive same-ctor arms into one match (bind fields once),
in ailang-core desugar.
B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern
desugar rebound the owned scrutinee via `Let $mp = xs`, which
bumped consume_count and suppressed the existing fn-return
partial_drop. Fixed by not rebinding a bare-Var scrutinee
(one husk-freeing mechanism, not two).
C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields —
the per-ADT drop fn was emitted once from the polymorphic
TypeDef, defaulting type-var fields to ptr and rc_dec'ing
inline Ints (segfault). Fixed with per-monomorph drop
functions (new ailang-codegen::dropmono): the drop set is
collected from the lowered MIR, value-type fields are skipped,
heap fields still freed once; monomorphic-concrete ADTs keep
their byte-identical un-suffixed drop symbol.
D. static Str literal passed to an `(own Str)` param — the
literal lowers to a header-less rodata constant; the callee's
now-active rc_dec read its length field as a refcount and
freed a static address (segfault). Fixed with the missing
fourth StrRep::Static→Heap promotion in lower_to_mir's App arm,
gated on Own mode (borrow args stay static, no regression).
over-strict-mode lint over-fired: it suggested `(borrow V)` for
value-typed params (which `borrow-over-value` rejects — own is the
only legal mode there) and fired on `(intrinsic)` bodies (whose
consumption the linearity walk cannot observe). Tightened to skip
both; contract 0008 updated to the narrowed firing scope.
Irreversible step — canonical-form hash reset (model 0008 §6,
acceptance criterion 6). Every signature now carries explicit modes,
so the hashable canonical JSON changed for every module. RATIFY:
the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin,
mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the
ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot
golden were regenerated once, deliberately, as the intended one-time
consequence of removing the mode elision from the canonical form —
not a regression. Each regenerated hash verified deterministic across
two runs.
Also fixes a pre-existing latent failure surfaced by the verification
gate, unrelated to this cutover: the `every_contract_names_a_resolvable_
ratifying_test` resolver (design_index_pin) could not resolve the
" + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`)
that the #57 audit-close (dfdc65f) introduced — it shipped red on that
commit. Resolver taught the dual-link form, mirroring its sibling.
Verification: cargo test --workspace = 731 passed, 0 failed (twice,
stable); e2e 102 passed, no binary exits non-zero (corpus crash-free);
grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop
fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K,
head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first
husk-dec attempt, the over-strict derivation premise, the leg-B fix
direction) were each treated as a real design/spec gap and rediagnosed,
not patched over.
Supersedes #54 (return-position-only leak patch). Precondition #57
(linearity hardening) was already met. Spec docs/specs/0062, plan
docs/plans/0121.
closes #55
123 lines
5.1 KiB
Rust
123 lines
5.1 KiB
Rust
//! Regression pin for primitive Eq/Ord mono-symbol body hashes.
|
|
//!
|
|
//! Locks the six primitive mono symbols (`eq__Int`, `eq__Bool`, `eq__Str`,
|
|
//! `compare__Int`, `compare__Bool`, `compare__Str`) to their pre-iter-23.4
|
|
//! body hashes. The unified mono pass MUST produce bit-identical bodies.
|
|
|
|
use ailang_core::ast::Def;
|
|
use ailang_core::hash::def_hash;
|
|
use ailang_surface::load_workspace;
|
|
use std::path::PathBuf;
|
|
|
|
fn fixture_path() -> PathBuf {
|
|
let mut d = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
|
|
d.pop();
|
|
d.pop();
|
|
d.join("examples").join("mono_hash_pin_smoke.ail")
|
|
}
|
|
|
|
fn show_fixture_path() -> PathBuf {
|
|
let mut d = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
|
|
d.pop();
|
|
d.pop();
|
|
d.join("examples").join("show_mono_pin_smoke.ail")
|
|
}
|
|
|
|
#[test]
|
|
fn primitive_eq_ord_mono_symbol_hashes_stay_bit_identical() {
|
|
let ws = load_workspace(&fixture_path()).expect("workspace loads");
|
|
let diags = ailang_check::check_workspace(&ws);
|
|
assert!(diags.is_empty(), "typecheck diagnostics: {diags:?}");
|
|
let post_mono = ailang_check::monomorphise_workspace(&ws).expect("mono green");
|
|
|
|
// Mono symbols for class methods are appended to the instance's
|
|
// `defining_module` — i.e. the prelude module, since all six
|
|
// primitive Eq/Ord instances live there.
|
|
let prelude_mod = post_mono
|
|
.modules
|
|
.get("prelude")
|
|
.expect("prelude module present");
|
|
|
|
// 2026-05-14 bugfix-print-leak-show-ret-mode: hashes re-pinned
|
|
// after `substitute_rigids` started preserving `param_modes` and
|
|
// `ret_mode` through rigid substitution (was: hard-reset to
|
|
// Implicit / `[]`). Eq/Ord class methods declare
|
|
// `param_modes: ["borrow", "borrow"]` in `prelude.ail.json`, so
|
|
// the mono-synthesised `eq__T` / `compare__T` symbols now carry
|
|
// those modes in their `Type::Fn` — canonical-JSON bytes drift,
|
|
// bodies are semantically identical.
|
|
// 2026-05-21 operator-routing-eq-ord re-pinned the three `eq__*`
|
|
// hashes after the prelude reshape: the Eq Int/Bool/Str instance
|
|
// bodies became placeholder `false` lambdas (codegen intercept
|
|
// emits the actual `icmp` / `@ail_str_eq` call). The three
|
|
// `compare__*` hashes were unchanged — those bodies were already
|
|
// placeholder Ordering ctors.
|
|
// 2026-05-29 intrinsic-bodies.2 re-pinned all six: the prelude
|
|
// Eq/Ord instance-method bodies migrated from placeholder terms
|
|
// ((body false)/(body true)/(term-ctor Ordering EQ)) to
|
|
// Term::Intrinsic, so the mono-synthesised eq__T/compare__T body
|
|
// bytes flip. Behaviour is unchanged — codegen intercepts these
|
|
// by name; the body is signature-only. The four show__* pins
|
|
// below do NOT move (Show instance bodies are real, unchanged).
|
|
let pins: &[(&str, &str)] = &[
|
|
("eq__Int", "85be5c2de568b58d"),
|
|
("eq__Bool", "851b24fb1b513bf9"),
|
|
("eq__Str", "ead456ddde7c0cbd"),
|
|
("compare__Int", "f99b792409ee8417"),
|
|
("compare__Bool", "bdf90cb462351564"),
|
|
("compare__Str", "752b08fdd12c6a67"),
|
|
];
|
|
|
|
for (sym, pin) in pins {
|
|
let def = prelude_mod
|
|
.defs
|
|
.iter()
|
|
.find(|d| matches!(d, Def::Fn(f) if f.name == *sym))
|
|
.unwrap_or_else(|| panic!("mono symbol {sym} not found in prelude module"));
|
|
let h = def_hash(def);
|
|
assert_eq!(&h, pin, "{sym} body hash drifted; captured: {h}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn primitive_show_mono_symbol_hashes_stay_bit_identical() {
|
|
// 24.2 hash-stability pin for the four primitive `show__T` mono
|
|
// symbols synthesised from `prelude.Show {Int|Bool|Str|Float}`
|
|
// instance bodies. Loaded from a separate fixture
|
|
// (`show_mono_pin_smoke.ail.json`) so the Eq/Ord pin above stays
|
|
// structurally isolated.
|
|
let ws = load_workspace(&show_fixture_path()).expect("workspace loads");
|
|
let diags = ailang_check::check_workspace(&ws);
|
|
assert!(diags.is_empty(), "typecheck diagnostics: {diags:?}");
|
|
let post_mono = ailang_check::monomorphise_workspace(&ws).expect("mono green");
|
|
|
|
let prelude_mod = post_mono
|
|
.modules
|
|
.get("prelude")
|
|
.expect("prelude module present");
|
|
|
|
// 2026-05-14 bugfix-print-leak-show-ret-mode: hashes re-pinned
|
|
// after the Show class method declaration in `prelude.ail.json`
|
|
// added `ret_mode: "own"` AND `substitute_rigids` started
|
|
// preserving `param_modes`/`ret_mode`. The mono-synthesised
|
|
// `show__T` symbols now carry `param_modes: ["borrow"]` and
|
|
// `ret_mode: Own` in their `Type::Fn` — bodies are semantically
|
|
// identical.
|
|
let pins: &[(&str, &str)] = &[
|
|
("show__Int", "9229ce65fdf11f61"),
|
|
("show__Bool", "ade621119184351f"),
|
|
("show__Str", "93fb52834427598c"),
|
|
("show__Float", "49874c7ed31c9d15"),
|
|
];
|
|
|
|
for (sym, pin) in pins {
|
|
let def = prelude_mod
|
|
.defs
|
|
.iter()
|
|
.find(|d| matches!(d, Def::Fn(f) if f.name == *sym))
|
|
.unwrap_or_else(|| panic!("mono symbol {sym} not found in prelude module"));
|
|
let h = def_hash(def);
|
|
assert_eq!(&h, pin, "{sym} body hash drifted; captured: {h}");
|
|
}
|
|
}
|