Files
AILang/crates/ail/tests/eq_ord_e2e.rs
T
Brummel 76b21c00eb feat(lang): eliminate the Implicit ownership default — totality + the drop-soundness it demasks (#55)
Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`:
every fn-type slot on every signature carries an explicit `own` or
`borrow`, no defaulted position survives anywhere (model 0008 §2,
spec 0062). The parser rejects a bare fn-type slot; `borrow-return`
and `borrow-over-value` reject at the signature; the corpus is
migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap
⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode
leak is fixed: an owned heap return now drops exactly once (live=0,
acceptance criterion 5).

This was the easy half. Removing the default ACTIVATED a family of
drop paths that `Implicit` had silently skipped — the pre-cutover
language was leaking (and in places mis-dropping) here rather than
crashing, because an Implicit scrutinee turned the drop off. Making
the modes explicit (Own) turned those paths on and exposed two
latent-bug clusters, all fixed RED-first as part of this cutover:

Drop-soundness family (four legs):
  A. lit-sub-pattern double-free — the desugar re-matched the same
     owned scrutinee in the lit fall-through; fixed by grouping
     consecutive same-ctor arms into one match (bind fields once),
     in ailang-core desugar.
  B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern
     desugar rebound the owned scrutinee via `Let $mp = xs`, which
     bumped consume_count and suppressed the existing fn-return
     partial_drop. Fixed by not rebinding a bare-Var scrutinee
     (one husk-freeing mechanism, not two).
  C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields —
     the per-ADT drop fn was emitted once from the polymorphic
     TypeDef, defaulting type-var fields to ptr and rc_dec'ing
     inline Ints (segfault). Fixed with per-monomorph drop
     functions (new ailang-codegen::dropmono): the drop set is
     collected from the lowered MIR, value-type fields are skipped,
     heap fields still freed once; monomorphic-concrete ADTs keep
     their byte-identical un-suffixed drop symbol.
  D. static Str literal passed to an `(own Str)` param — the
     literal lowers to a header-less rodata constant; the callee's
     now-active rc_dec read its length field as a refcount and
     freed a static address (segfault). Fixed with the missing
     fourth StrRep::Static→Heap promotion in lower_to_mir's App arm,
     gated on Own mode (borrow args stay static, no regression).

over-strict-mode lint over-fired: it suggested `(borrow V)` for
value-typed params (which `borrow-over-value` rejects — own is the
only legal mode there) and fired on `(intrinsic)` bodies (whose
consumption the linearity walk cannot observe). Tightened to skip
both; contract 0008 updated to the narrowed firing scope.

Irreversible step — canonical-form hash reset (model 0008 §6,
acceptance criterion 6). Every signature now carries explicit modes,
so the hashable canonical JSON changed for every module. RATIFY:
the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin,
mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the
ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot
golden were regenerated once, deliberately, as the intended one-time
consequence of removing the mode elision from the canonical form —
not a regression. Each regenerated hash verified deterministic across
two runs.

Also fixes a pre-existing latent failure surfaced by the verification
gate, unrelated to this cutover: the `every_contract_names_a_resolvable_
ratifying_test` resolver (design_index_pin) could not resolve the
" + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`)
that the #57 audit-close (dfdc65f) introduced — it shipped red on that
commit. Resolver taught the dual-link form, mirroring its sibling.

Verification: cargo test --workspace = 731 passed, 0 failed (twice,
stable); e2e 102 passed, no binary exits non-zero (corpus crash-free);
grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop
fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K,
head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first
husk-dec attempt, the over-strict derivation premise, the leg-B fix
direction) were each treated as a real design/spec gap and rediagnosed,
not patched over.

Supersedes #54 (return-position-only leak patch). Precondition #57
(linearity hardening) was already met. Spec docs/specs/0062, plan
docs/plans/0121.

closes #55
2026-06-02 00:03:46 +02:00

143 lines
6.0 KiB
Rust

//! End-to-end tests for the Eq/Ord prelude shipped in milestone 23.
//!
//! These tests compile a `.ail.json` workspace via the `ail build`
//! subcommand, run the resulting native binary, and assert on stdout.
//! Together they protect:
//!
//! 1. Polymorphic-helper composition over the prelude free fns at
//! three primitive types (`eq_ord_polymorphic_runs_end_to_end`).
//! Property: a user-defined `forall a. Ord a => …` helper that
//! calls `gt`/`not` is monomorphised correctly at Int / Bool / Str.
//! 2. User-ADT integration with the unified mono pass
//! (`eq_ord_user_adt_runs_end_to_end`). Property: `instance Eq T`
//! plus `instance Ord T` for a user-defined `T` produces working
//! mono symbols when invoked through the prelude.
//! 3. Mono-symbol body-hash stability for `eq__IntBox`
//! (`eq_ord_user_adt_eq_intbox_hash_stable`). Property: the user
//! instance body that the unified pass emits for IntBox is
//! bit-stable across refactors; drift here means either a
//! legitimate emission change (re-record) or a regression
//! (investigate). Mirrors `crates/ail/tests/mono_hash_stability.rs`.
use ailang_check::{check_workspace, monomorphise_workspace};
use ailang_core::ast::Def;
use ailang_core::hash::def_hash;
use ailang_surface::load_workspace;
use std::path::PathBuf;
use std::process::Command;
fn fixture_path(name: &str) -> PathBuf {
PathBuf::from(env!("CARGO_MANIFEST_DIR"))
.join("../../examples")
.join(name)
}
fn build_and_run(fixture: &str) -> String {
let src = fixture_path(fixture);
let out = std::env::temp_dir().join(format!("ail_{}.bin", fixture.replace('.', "_")));
let build = Command::new(env!("CARGO_BIN_EXE_ail"))
.args(["build", src.to_str().unwrap(), "-o", out.to_str().unwrap()])
.output()
.expect("ail build");
assert!(
build.status.success(),
"ail build failed:\nstdout: {}\nstderr: {}",
String::from_utf8_lossy(&build.stdout),
String::from_utf8_lossy(&build.stderr),
);
let run = Command::new(&out).output().expect("run binary");
assert!(
run.status.success(),
"binary exited non-zero:\nstdout: {}\nstderr: {}",
String::from_utf8_lossy(&run.stdout),
String::from_utf8_lossy(&run.stderr),
);
String::from_utf8_lossy(&run.stdout).trim().to_string()
}
#[test]
fn eq_ord_polymorphic_runs_end_to_end() {
let stdout = build_and_run("eq_ord_polymorphic.ail");
// Helper `at_most(3, 5)` at Int = true → 1
// `at_most(true, false)` at Bool = false → 0
// `at_most("abc", "abd")` at Str = true → 1
// Polymorphic `print` for Int routes through `show` + `io/print_str`,
// emitting one int per line, so stdout is "1\n0\n1" after `.trim()`
// strips the trailing newline.
assert_eq!(stdout, "1\n0\n1", "expected 1\\n0\\n1, got {stdout:?}");
}
#[test]
fn eq_ord_user_adt_runs_end_to_end() {
let stdout = build_and_run("eq_ord_user_adt.ail");
// eq(MkIntBox 3, MkIntBox 3) = true → 1
// eq(MkIntBox 3, MkIntBox 5) = false → 0
// Polymorphic `print` for Int emits one int per line; trimmed stdout is "1\n0".
assert_eq!(stdout, "1\n0", "expected 1\\n0, got {stdout:?}");
}
#[test]
fn eq_ord_user_adt_eq_intbox_hash_stable() {
let ws = load_workspace(&fixture_path("eq_ord_user_adt.ail")).expect("load");
let diags = check_workspace(&ws);
assert!(diags.is_empty(), "typecheck failed: {diags:#?}");
let mono = monomorphise_workspace(&ws).expect("mono");
// The mono symbol for `eq` at a user-defined ADT uses the
// `<method>__<8-hex-prefix>` mangling (mangling is code-SoT —
// see the `mangling` row in design/INDEX.md / the
// crates/ailang-codegen/src/lib.rs //! header) (primitives use
// the bare type name; compound
// / user-defined types use the 8-hex BLAKE3 prefix of the
// canonical type bytes). We look up the single `eq__` symbol
// synthesised at `IntBox` — there is only one user instance,
// so the find-by-prefix is unambiguous in this fixture.
let eq_intbox = mono
.modules
.values()
.flat_map(|m| m.defs.iter())
.find_map(|d| match d {
Def::Fn(f) if f.name.starts_with("eq__") && f.name != "eq__Int"
&& f.name != "eq__Bool" && f.name != "eq__Str" =>
{
Some(f)
}
_ => None,
})
.expect("eq__<IntBox-hash> not synthesised");
// The 8-hex-prefix in the mono-symbol name is the BLAKE3 prefix
// of the canonical IntBox type bytes (mangling is code-SoT — see
// the `mangling` row in design/INDEX.md). Drift here means either
// the canonical-form encoding
// changed or the type's canonical bytes changed — both warrant
// investigation before re-pinning.
assert_eq!(
eq_intbox.name, "eq__cde77856",
"eq__IntBox mono-symbol name drifted — type-mangling regression?"
);
// The body hash pins the unified mono pass's IntBox eq emission.
// Drift means either a legitimate refactor (re-record) or a
// regression in user-instance body propagation (investigate).
//
// 2026-05-14 bugfix-print-leak-show-ret-mode: hash re-pinned
// (from `9daaffa7528d2a1c` to `3c4cf040cb4e8bb2`) because
// `substitute_rigids` now preserves `param_modes`/`ret_mode`
// through rigid substitution. Eq's class method declares
// `param_modes: ["borrow", "borrow"]` — the user-instance
// mono synthesis used to silently strip those.
//
// 2026-05-21 operator-routing-eq-ord re-pinned (prior:
// 3c4cf040cb4e8bb2): the user-instance body's inner `(app == ai bi)`
// migrates to `(app eq ai bi)` per the operator-name deletion
// sweep — the call site symbol name shifts, body hash follows.
let h = def_hash(&Def::Fn(eq_intbox.clone()));
assert_eq!(
h, "e639d41fc49b1524",
"eq__IntBox body hash drifted — see mono_hash_stability.rs for the resolution pattern; captured: {h}"
);
}