From d11dfd8a443b48e140797fa666d5b56e79e281e7 Mon Sep 17 00:00:00 2001 From: Joseph Ferano Date: Fri, 18 Sep 2026 07:59:41 +0700 Subject: [PATCH] The reversed slice the survey can reach bounds.flan covers this already and the x86 survey cannot see it: the program picks its case out of (at args 1) and survey.sh runs everything with no arguments, so re-gating x86's lo <= hi would have failed nothing. This probe reaches the reversed slice on its own, through (len args) so that neither optimiser can fold the branch and the checker has no literal to object to. It matches under the default sweep and under SURVEY_FLAGS=--no-bounds-checks, which is the claim. Also records what the same reading turned up and did not fix: x86 still reports a negative slice-from-ptr promise through flan_slice_error, so the two backends print different sentences for it, and no corpus program reaches that case without arguments. --- docs/BUGS-2026-09-18.md | 9 +++++++++ spike/x86/p11-reversed-slice.flan | 26 ++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) create mode 100644 spike/x86/p11-reversed-slice.flan diff --git a/docs/BUGS-2026-09-18.md b/docs/BUGS-2026-09-18.md index fb24cc4..ed21ee6 100644 --- a/docs/BUGS-2026-09-18.md +++ b/docs/BUGS-2026-09-18.md @@ -107,6 +107,15 @@ territory; fix or record, the lane's call. rather than the arithmetic: `flan_f64_to_bytes` and the two dev emitters render any NaN as unsigned `nan`, which is what `format-f64` in the prelude always did. Pinned in `test/programs/format.flan`. See docs/BUILT.md. +- **x86's slice-from-ptr refusal is the wrong sentence**: `x86.ml` still reports a + negative promise through `flan_slice_error` — "slice [0 -2) is out of bounds for + length 0", naming a range and a length the caller never wrote — where `emit.ml` has + its own `flan_slice_promise_error`. Same condition and same exit on both sides, only + the text differs. The survey cannot see it: `bounds.flan` picks its case out of + `(at args 1)` and `survey.sh` runs every program with no arguments, so nothing in the + corpus reaches the `n = -2` case on the x86 path. Noticed while making the check + unconditional (which did not change what it prints); the fix is one `bounds_call` with + one extra instead of three. - **`emit.ml:3369` transient test ignores `new_globals`**: on the `retains=false` path a module first to intern a global gets dlclosed; zero-init makes it moot today, a literal init would dangle. diff --git a/spike/x86/p11-reversed-slice.flan b/spike/x86/p11-reversed-slice.flan new file mode 100644 index 0000000..d276d4e --- /dev/null +++ b/spike/x86/p11-reversed-slice.flan @@ -0,0 +1,26 @@ +;;;; A slice built backwards, for the survey rather than for a person. +;;;; +;;;; test/programs/bounds.flan already covers this, and cannot cover it here: +;;;; it picks its case out of (at args 1) and survey.sh runs every program +;;;; with no arguments at all. So the one backend comparison that would catch +;;;; check_slice's lo <= hi being re-gated on --no-bounds-checks is a program +;;;; that reaches the reversed slice on its own. +;;;; +;;;; What it pins is that both backends die here in *every* build. lo <= hi is +;;;; not a bounds check — it is the claim that the length word of the %slice +;;;; this expression builds is a count, and hi - lo is -1 — so +;;;; --no-bounds-checks has nothing here to drop, and running this sweep with +;;;; SURVEY_FLAGS=--no-bounds-checks must report the same MATCH as without it. +;;;; A backend that quietly builds the slice exits 0 while the other exits 134 +;;;; and the survey says DIFFER. +;;;; +;;;; The two ends come from (len args), which is 1 for a program run with no +;;;; arguments and is not a number either optimiser can see, so the branch +;;;; cannot be folded away and the checker has no literal to object to. +(defn main [args [string]] i32 + (let [s (bytes "hello") + hi (i32 (len args)) + lo (+ hi 1)] + (print (slice s lo hi)) + (println "")) + 0)