Files
AILang/crates/ailang-core/tests/hash_pin.rs
T
Brummel 76b21c00eb feat(lang): eliminate the Implicit ownership default — totality + the drop-soundness it demasks (#55)
Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`:
every fn-type slot on every signature carries an explicit `own` or
`borrow`, no defaulted position survives anywhere (model 0008 §2,
spec 0062). The parser rejects a bare fn-type slot; `borrow-return`
and `borrow-over-value` reject at the signature; the corpus is
migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap
⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode
leak is fixed: an owned heap return now drops exactly once (live=0,
acceptance criterion 5).

This was the easy half. Removing the default ACTIVATED a family of
drop paths that `Implicit` had silently skipped — the pre-cutover
language was leaking (and in places mis-dropping) here rather than
crashing, because an Implicit scrutinee turned the drop off. Making
the modes explicit (Own) turned those paths on and exposed two
latent-bug clusters, all fixed RED-first as part of this cutover:

Drop-soundness family (four legs):
  A. lit-sub-pattern double-free — the desugar re-matched the same
     owned scrutinee in the lit fall-through; fixed by grouping
     consecutive same-ctor arms into one match (bind fields once),
     in ailang-core desugar.
  B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern
     desugar rebound the owned scrutinee via `Let $mp = xs`, which
     bumped consume_count and suppressed the existing fn-return
     partial_drop. Fixed by not rebinding a bare-Var scrutinee
     (one husk-freeing mechanism, not two).
  C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields —
     the per-ADT drop fn was emitted once from the polymorphic
     TypeDef, defaulting type-var fields to ptr and rc_dec'ing
     inline Ints (segfault). Fixed with per-monomorph drop
     functions (new ailang-codegen::dropmono): the drop set is
     collected from the lowered MIR, value-type fields are skipped,
     heap fields still freed once; monomorphic-concrete ADTs keep
     their byte-identical un-suffixed drop symbol.
  D. static Str literal passed to an `(own Str)` param — the
     literal lowers to a header-less rodata constant; the callee's
     now-active rc_dec read its length field as a refcount and
     freed a static address (segfault). Fixed with the missing
     fourth StrRep::Static→Heap promotion in lower_to_mir's App arm,
     gated on Own mode (borrow args stay static, no regression).

over-strict-mode lint over-fired: it suggested `(borrow V)` for
value-typed params (which `borrow-over-value` rejects — own is the
only legal mode there) and fired on `(intrinsic)` bodies (whose
consumption the linearity walk cannot observe). Tightened to skip
both; contract 0008 updated to the narrowed firing scope.

Irreversible step — canonical-form hash reset (model 0008 §6,
acceptance criterion 6). Every signature now carries explicit modes,
so the hashable canonical JSON changed for every module. RATIFY:
the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin,
mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the
ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot
golden were regenerated once, deliberately, as the intended one-time
consequence of removing the mode elision from the canonical form —
not a regression. Each regenerated hash verified deterministic across
two runs.

Also fixes a pre-existing latent failure surfaced by the verification
gate, unrelated to this cutover: the `every_contract_names_a_resolvable_
ratifying_test` resolver (design_index_pin) could not resolve the
" + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`)
that the #57 audit-close (dfdc65f) introduced — it shipped red on that
commit. Resolver taught the dual-link form, mirroring its sibling.

Verification: cargo test --workspace = 731 passed, 0 failed (twice,
stable); e2e 102 passed, no binary exits non-zero (corpus crash-free);
grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop
fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K,
head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first
husk-dec attempt, the over-strict derivation premise, the leg-B fix
direction) were each treated as a real design/spec gap and rediagnosed,
not patched over.

Supersedes #54 (return-position-only leak patch). Precondition #57
(linearity hardening) was already met. Spec docs/specs/0062, plan
docs/plans/0121.

closes #55
2026-06-02 00:03:46 +02:00

298 lines
12 KiB
Rust

//! Hash-pin integration tests, relocated from `ailang-core/src/hash.rs`
//! `#[cfg(test)] mod tests` to a `tests/*` integration crate in iter
//! form-a.1 Task 5. The relocation removes the production-source file's
//! ad-hoc `examples/<stem>.ail.json` reads in favour of loading the
//! `.ail` siblings via `ailang_surface::load_module`, mirroring the
//! Form-A authoring discipline of the form-a-default-authoring
//! milestone. Hash assertions are unchanged: post-form-a the canonical
//! JSON-AST is still the hashable representation, derived in-process
//! from `.ail` by the surface loader.
//!
//! The `examples/<stem>.ail.json` fixtures that backed the original
//! tests are deleted in Task 8; the `.ail` siblings rendered in Task 2
//! are the authored form going forward. The four schema-stability pins
//! (iter13a / iter19b / iter22b1 / ct4) plus the two structural pins
//! (hash_is_stable / hash_changes_with_content / classdef-empty-optionals
//! / forall-without-constraints) all keep their assertion shape.
use ailang_core::ast::*;
use ailang_core::canonical;
use ailang_core::hash::def_hash;
fn examples_dir() -> std::path::PathBuf {
let manifest_dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
manifest_dir.parent().unwrap().parent().unwrap().join("examples")
}
fn sample_fn() -> Def {
Def::Fn(FnDef {
name: "add".into(),
ty: Type::Fn {
params: vec![Type::int(), Type::int()],
ret: Box::new(Type::int()),
effects: vec![],
param_modes: vec![ParamMode::Own, ParamMode::Own],
ret_mode: ParamMode::Own,
},
params: vec!["a".into(), "b".into()],
body: Term::App {
callee: Box::new(Term::Var { name: "+".into() }),
args: vec![
Term::Var { name: "a".into() },
Term::Var { name: "b".into() },
],
tail: false,
},
suppress: vec![],
doc: None,
export: None,
})
}
#[test]
fn hash_is_stable() {
let h1 = def_hash(&sample_fn());
let h2 = def_hash(&sample_fn());
assert_eq!(h1, h2);
assert_eq!(h1.len(), 16);
}
#[test]
fn hash_changes_with_content() {
let mut def = sample_fn();
let h1 = def_hash(&def);
if let Def::Fn(ref mut f) = def {
f.name = "mul".into();
}
let h2 = def_hash(&def);
assert_ne!(h1, h2);
}
/// adding `vars` to TypeDef and `args` to
/// `Type::Con` must NOT change canonical-JSON hashes of any pre-13a
/// definition. Recorded hashes were captured from on-disk modules
/// before the schema extension; if this fires, a
/// `skip_serializing_if` is missing or wrong.
///
/// 2026-05-21 operator-routing-eq-ord re-pinned (prior:
/// db33f57cb329935e): sum.ail's body migrates `(app == n 0)` →
/// `(app eq n 0)` per the operator-name deletion; hash follows the
/// content change. Pin remains a schema-extension guard against
/// future drift from the new content baseline.
#[test]
fn iter13a_schema_extension_preserves_pre_13a_hashes() {
let examples = examples_dir();
let sum_mod = ailang_surface::load_module(&examples.join("sum.ail"))
.expect("examples/sum.ail loads");
let sum_def = sum_mod.defs.iter().find(|d| d.name() == "sum").unwrap();
assert_eq!(def_hash(sum_def), "19920ec4123d35d6");
let list_mod = ailang_surface::load_module(&examples.join("list.ail"))
.expect("examples/list.ail loads");
let int_list_def = list_mod.defs.iter().find(|d| d.name() == "IntList").unwrap();
assert_eq!(def_hash(int_list_def), "b082192bd0c99202");
}
/// loop-recur iter 1 regression: adding `Term::Loop` / `Term::Recur`
/// (and `struct LoopBinder`) must NOT change canonical-JSON hashes
/// of any pre-loop-recur definition. The additive variant carries a
/// new `"t"` tag absent from every pre-existing fixture, so the
/// recorded hashes below must stay byte-identical. If this fires,
/// the extension is non-additive (a `skip_serializing_if` is missing
/// or an existing variant's shape drifted).
#[test]
fn loop_recur_schema_extension_preserves_pre_loop_recur_hashes() {
let examples = examples_dir();
let sum_mod = ailang_surface::load_module(&examples.join("sum.ail"))
.expect("examples/sum.ail loads");
let sum_def = sum_mod.defs.iter().find(|d| d.name() == "sum").unwrap();
assert_eq!(def_hash(sum_def), "19920ec4123d35d6");
let list_mod = ailang_surface::load_module(&examples.join("list.ail"))
.expect("examples/list.ail loads");
let int_list_def = list_mod.defs.iter().find(|d| d.name() == "IntList").unwrap();
assert_eq!(def_hash(int_list_def), "b082192bd0c99202");
}
/// adding `suppress` to FnDef must NOT change
/// canonical-JSON hashes of any pre-19b fn whose `suppress` is empty.
/// The `skip_serializing_if = "Vec::is_empty"` predicate on the field
/// is what enforces this; if it is wrong, every existing fixture's
/// hash drifts and `ail diff` / `ail manifest` output breaks.
#[test]
fn iter19b_empty_suppress_preserves_pre_19b_hashes() {
let with_empty_suppress = sample_fn();
// Mutate the bare sample to set suppress explicitly to a
// non-empty Vec, then mutate it back to empty: two distinct
// construction paths that should still hash identically.
let mut with_explicit_empty = sample_fn();
if let Def::Fn(ref mut f) = with_explicit_empty {
f.suppress = vec![];
}
assert_eq!(
def_hash(&with_empty_suppress),
def_hash(&with_explicit_empty),
"two FnDefs with empty suppress must hash identically"
);
// And: a FnDef with a *non-empty* suppress hashes differently.
let mut with_suppress = sample_fn();
if let Def::Fn(ref mut f) = with_suppress {
f.suppress = vec![Suppress {
code: "over-strict-mode".into(),
because: "test reason".into(),
}];
}
assert_ne!(
def_hash(&with_empty_suppress),
def_hash(&with_suppress),
"non-empty suppress must produce a distinct hash"
);
}
/// an on-disk pre-19b fixture must still load cleanly
/// (no `suppress` field present in the JSON) and produce its
/// canonical-byte hash unchanged.
#[test]
fn iter19b_schema_extension_preserves_pre_19b_hashes() {
let examples = examples_dir();
let sum_mod = ailang_surface::load_module(&examples.join("sum.ail"))
.expect("examples/sum.ail loads");
let sum_def = sum_mod.defs.iter().find(|d| d.name() == "sum").unwrap();
assert_eq!(def_hash(sum_def), "19920ec4123d35d6");
}
/// adding `Def::Class` and `Def::Instance` must
/// NOT change canonical-JSON hashes of any pre-22b def. The new variants
/// are alternatives, not field additions — pre-22b fixtures simply do
/// not produce a `Class` / `Instance` `Def`, and the existing arms are
/// unchanged.
#[test]
fn iter22b1_schema_extension_preserves_pre_22b_hashes() {
let examples = examples_dir();
let sum_mod = ailang_surface::load_module(&examples.join("sum.ail"))
.expect("examples/sum.ail loads");
let sum_def = sum_mod.defs.iter().find(|d| d.name() == "sum").unwrap();
assert_eq!(def_hash(sum_def), "19920ec4123d35d6");
let list_mod = ailang_surface::load_module(&examples.join("list.ail"))
.expect("examples/list.ail loads");
let int_list_def = list_mod
.defs
.iter()
.find(|d| d.name() == "IntList")
.unwrap();
assert_eq!(def_hash(int_list_def), "b082192bd0c99202");
}
/// a ClassDef with no doc, no superclass, and an empty
/// methods list serialises to a stable canonical form. Two construction
/// paths (default-elided optionals vs. JSON without those keys at all)
/// hash bit-identically.
#[test]
fn iter22b1_classdef_empty_optionals_hash_stable() {
let bare = Def::Class(ClassDef {
name: "Empty".into(),
param: "a".into(),
superclass: None,
methods: vec![],
doc: None,
});
let json = r#"{"kind":"class","name":"Empty","param":"a","methods":[]}"#;
let parsed: Def = serde_json::from_str(json).unwrap();
assert_eq!(
def_hash(&bare),
def_hash(&parsed),
"ClassDef with elided optionals must hash identically to construction with explicit None"
);
}
/// adding `constraints` to `Type::Forall` must NOT alter
/// canonical-JSON bytes of any pre-22b.2 polymorphic type.
#[test]
fn forall_without_constraints_hashes_bit_identical_to_pre_22b2() {
let t = Type::Forall {
vars: vec!["a".into()],
constraints: vec![],
body: Box::new(Type::fn_owned(
vec![Type::Var { name: "a".into() }],
Type::Var { name: "a".into() },
vec![],
)),
};
let bytes = canonical::to_bytes(&t);
let s = std::str::from_utf8(&bytes).unwrap();
assert!(
!s.contains("constraints"),
"Type::Forall serialised must omit `constraints` when empty; got: {s}"
);
}
/// pin the
/// canonical-form hashes of the two cross-module fixtures migrated by
/// `ail migrate-canonical-types` in the canonical-form migration. These hashes are the
/// post-migration state.
#[test]
fn ct4_migrated_fixtures_have_canonical_form_hashes() {
let examples = examples_dir();
let ord_mod = ailang_surface::load_module(&examples.join("ordering_match.ail"))
.expect("examples/ordering_match.ail loads");
let main_def = ord_mod.defs.iter().find(|d| d.name() == "main").unwrap();
// The hash reflects two successive corpus migrations:
// (1) the per-type-print-retirement that moved the body from
// `(do io/print_int x)` to `(app print x)`;
// (2) the io/print_str byte-faithful-print fix (Gitea #29) that
// wrapped the `(app print x)` with an explicit
// `(seq ... (do io/print_str "\n"))` newline emission, because
// io/print_str no longer adds a trailing newline.
assert_eq!(
def_hash(main_def),
"602d7a6d6ba72bc4",
"ordering_match::main canonical hash must match captured post-fputs-swap value"
);
let dup_a_mod = ailang_surface::load_module(&examples.join("test_22b1_dup_a.ail"))
.expect("examples/test_22b1_dup_a.ail loads");
assert_eq!(dup_a_mod.defs.len(), 1, "test_22b1_dup_a expected to have exactly 1 def (the instance)");
assert_eq!(
def_hash(&dup_a_mod.defs[0]),
"392c247f07de6517",
"test_22b1_dup_a instance hash drifted; expected post-24.2 captured value"
);
let dup_classmod_mod = ailang_surface::load_module(&examples.join("test_22b1_dup_classmod.ail"))
.expect("examples/test_22b1_dup_classmod.ail loads");
assert_eq!(dup_classmod_mod.defs.len(), 1, "test_22b1_dup_classmod expected to have exactly 1 def (class TShow)");
assert_eq!(
def_hash(&dup_classmod_mod.defs[0]),
"4ca71c7d8212c96a",
"test_22b1_dup_classmod class TShow canonical hash; post-24.2 captured value"
);
}
/// re-assert that the canonical-form tightening did NOT
/// change hashes of intra-module-only fixtures.
#[test]
fn ct4_unmigrated_fixtures_remain_bit_identical() {
let examples = examples_dir();
let sum_mod = ailang_surface::load_module(&examples.join("sum.ail"))
.expect("examples/sum.ail loads");
let sum_def = sum_mod.defs.iter().find(|d| d.name() == "sum").unwrap();
assert_eq!(def_hash(sum_def), "19920ec4123d35d6",
"sum.sum hash drifted across canonical-form tightening — unexpected");
let list_mod = ailang_surface::load_module(&examples.join("list.ail"))
.expect("examples/list.ail loads");
let int_list_def = list_mod.defs.iter().find(|d| d.name() == "IntList").unwrap();
assert_eq!(def_hash(int_list_def), "b082192bd0c99202",
"list.IntList hash drifted across canonical-form tightening — unexpected");
}