Joseph Ferano
4c667cf062
The report was that handler-case segfaults in a top-level global
initialiser. It does not, and never did. What crashes is one frame
further down, in a position that has nothing to do with startup:
(defn read-file [path string] dyn
(let [src (slurp path (heap-allocator))]
(defer (free src))
(read (as-slice src))))
slurp signals FileError, a handler further out unwinds, and the
transfer leaves this frame through its defers -- all of them. But src
was never written: the form that would have written it is the form
that transferred. free then reads whatever the stack held under that
slot, which at -O0 in a small program is zero and at -O2 is a live
pointer, which is why the same program looked like an optimiser bug
from one direction and a startup bug from the other.
return never had this. The checker splices the defers registered above
it and no others, and says so where it does it. The transfer exit took
the whole list, because it is one landing block per function and
nothing in the IR said where each defer had come into being.
So the count is kept. The first defer in a function mints an i64 slot
zeroed at the top of the body; each defer leaves a store of its own
number where it was written; and fdefers -- the transfer path's copy,
and only that copy -- tests the count before running each one. The
normal paths are untouched and still need no test. It is all in the
checker: what reaches a backend is a slot, a store and an if, so
neither emitter learned anything and the x86 one needed no frame of
its own.
test/programs/init-conditions.flan is the survey. The top half is the
part of the report that was never true: handler-case with its
condition firing and with its body completing, handler-bind, and a
restart-case, all four in a global initialiser, all four answering
what they answer anywhere. The bottom half is the part that was: a
defer below the signalling form, which must not run, beside one above
it, which must -- a fix that took the unregistered one off by taking
them all off would have traded the crash for a leak, and 302/2 is the
line that would catch it. Three acceptance rows, LLVM, -O0 and --x86.
The detector was valgrind, not ASan: reading a stack slot nobody wrote
is not ASan's bug class and it reported nothing on the broken binary,
while memcheck named the conditional jump in flan_vec_free with the
unwinding frame directly above it. The program is in both lists --
test_valgrind.ml because that is what saw it, test_sanitize.ml because
that is where the transfer exit's frames are already watched.
spec-conditions.md section 5 now says which defers a transfer runs.
The author's (defvar game-data dyn (handler-case (edn/read-file ...)
[(FileError [c] nil)])) works.
430 lines
22 KiB
OCaml
430 lines
22 KiB
OCaml
(** The typed IR: what the checker produces and what every backend consumes.
|
||
|
||
Every backend shares this — the LLVM emitter and the hand-written x86-64
|
||
one, each of them under dev redefinition and under the release AOT build
|
||
(plan.org, Compilation) — so everything a backend would otherwise have to
|
||
re-derive is resolved here and nowhere else:
|
||
|
||
- names are gone. A local is a slot index into the frame, a global is a
|
||
name, and a call names its callee directly. No environment lookup.
|
||
- field access is an index, not a string, and any auto-deref the source
|
||
relied on is an explicit [Deref] node.
|
||
- literals have a machine type. There is no untyped 1 past this point.
|
||
- a struct literal lists every field in declaration order, with the omitted
|
||
ones filled in as [Zero] — ZII is settled here rather than at runtime.
|
||
- sugar is already gone from the AST; what is left is the small set below. *)
|
||
|
||
type prim =
|
||
(* arithmetic and comparison, per machine type — the operands carry their own
|
||
kind at runtime, so one constructor covers every width *)
|
||
| Add | Sub | Mul | Div | Rem
|
||
| Eq | Ne | Lt | Le | Gt | Ge
|
||
| Not
|
||
(* bitwise, integers only. [Shr] is arithmetic on a signed type and logical
|
||
on an unsigned one, which is what the operand's own kind already says. *)
|
||
| BitAnd | BitOr | BitXor | Shl | Shr
|
||
(* containers: fixed arrays and slices only at milestone 2 *)
|
||
| Len | At | Slice
|
||
(* (slice-from-ptr p n): a [T] made out of a (Ptr T) and a length the caller
|
||
supplies. It builds the same two words [Slice] builds and allocates
|
||
nothing — the storage stays whoever's it was, which in practice is C's.
|
||
The one thing the compiler cannot check is whether n is the truth; see
|
||
check.ml's "slice-from-ptr" case for what it can. *)
|
||
| SliceFromPtr
|
||
(* the milestone-2 host primitives, plan.org. The four conversions are
|
||
*text*: bytes->f64 parses "12.5", f64->bytes renders it — that is what
|
||
calc-me's tokenizer and the prelude's printers each need. *)
|
||
| Bytes | BytesToF64 | BytesToI64 | F64ToBytes | I64ToBytes
|
||
(* (string b): the other direction of [Bytes], and the same non-instruction.
|
||
See check.ml's "string" case for why it is unchecked. *)
|
||
| StrOfBytes
|
||
(* No surface name: the structural printer is the only thing that builds
|
||
these. U64ToBytes because u64 is not i64 with a flag, EscapeBytes for a
|
||
string nested inside a printed structure. *)
|
||
| U64ToBytes | EscapeBytes
|
||
| WriteStdout | Exit | Argv
|
||
(* A call into the runtime's C, named by symbol. The argument and result
|
||
LLVM types come off the expression nodes themselves, so one constructor
|
||
covers every entry point the allocator and container runtime has and the
|
||
backend grows one arm rather than one per operation — which matters
|
||
because spec-memory.md's runtime is type-erased and therefore *is* a list
|
||
of C entry points. A string or slice argument crosses as ptr+len, the
|
||
same rule as every other shim here. No transfer guard follows one: a
|
||
transfer cannot cross a C frame. *)
|
||
| Rt of string
|
||
(* spec-memory.md, "Alignment": a property of the type, computed at the call
|
||
site, passed as a parameter to the type-erased allocator — all three, and
|
||
they are not alternatives. The checker builds these at the site where the
|
||
concrete element type is known and the backend fills in the number from
|
||
the same layout calculator DWARF uses. *)
|
||
| SizeOf of Types.t
|
||
| AlignOf of Types.t
|
||
(* The address of any expression, not only of a place: the element a [push]
|
||
copies may be a computed value, and the runtime takes it by pointer
|
||
because it is type-erased. The backend already spills a non-place to a
|
||
temporary for exactly this. *)
|
||
| AddrOf
|
||
| Cast of Types.t
|
||
|
||
type expr = { e : expr_kind; ty : Types.t; loc : Loc.t }
|
||
|
||
and expr_kind =
|
||
| Int of int64 * Types.ikind
|
||
| Float of float * Types.fkind
|
||
| Bool of bool
|
||
| Str of string
|
||
| Unit
|
||
| Zero of Types.t (* ZII: all-bytes-zero of this type *)
|
||
| Uninit of Types.t (* the explicit opt-out *)
|
||
| Local of int (* slot index into the frame *)
|
||
| Global of string
|
||
| Prim of prim * expr list
|
||
| Call of string * expr list (* a call naming its callee *)
|
||
(* The address of a function the compiler emitted, by symbol. Which symbol
|
||
table, and whether the surface language can see it, is [fnref]'s job.
|
||
|
||
Two unrelated consumers, and the difference between them is the whole
|
||
reason [fnref] has three cases rather than two. The compiler's own uses —
|
||
the Map's hash and equality pair (Odin's [Map_Info] is two contextless
|
||
[proc] fields reached exactly this way) and a handler-bind clause's
|
||
symbol — want the *symbol*, always, and carry the Flan type [Alloc]. A
|
||
function *value* someone wrote wants the body that is current, which in a
|
||
dev build is not the symbol but whatever the indirection cell holds, and
|
||
carries the Flan type [Fn]. *)
|
||
| FnAddr of fnref
|
||
(* A call through a function value: the callee is an expression of type
|
||
[Fn], not a name. Its own node rather than a [Call] with an expression in
|
||
the name slot, because everything that walks this IR treats [Call]'s
|
||
string as a *link-time* edge — [Reach] roots the callee, [Dev] finds the
|
||
cell to redefine, [Emit] may load that cell — and none of those are
|
||
questions an indirect call can answer. Keeping them apart means each of
|
||
those readers keeps working on the direct case unchanged and says
|
||
explicitly what it does with the indirect one. *)
|
||
| CallPtr of expr * expr list
|
||
| Do of expr list
|
||
| Let of (int * expr) list * expr list
|
||
| If of expr * expr * expr
|
||
(* condition, body, and the *latch*: forms that run after the body and before
|
||
the condition is tested again. [dotimes] folds its increment in there
|
||
rather than onto the end of the body, because a [continue] branches to the
|
||
latch and a step written in the body would be skipped — the loop would
|
||
never advance and would hang. A [while] has an empty latch. *)
|
||
| While of expr * expr list * expr list
|
||
| Return of expr option
|
||
(* Leaving a loop, and jumping to its latch. The int is how many loops out
|
||
the target is, innermost first: 0 is the loop this is directly inside.
|
||
A *relative* depth rather than a name or an id because it is exactly what
|
||
each backend already has — [emit] keeps one entry per [While] it is inside
|
||
and indexes it. The invariant that makes it sound: the checker mints these
|
||
only from its own loop stack, and both stacks are pushed once per [While].
|
||
A [While] the checker *invents* (alloc_guard, the file-failure retry) is
|
||
built directly and never contains one of these, so the entry it pushes in
|
||
[emit] matches nothing and is harmless — keep it that way.
|
||
|
||
[check_loop]'s [While] is the one exception and the exception proves the
|
||
rule: it *is* pushed on [ctx.loops], so the [Break 0] that leaves it and
|
||
every [Continue] a [recur] mints are counted against the same stack [emit]
|
||
indexes. Invented is not the property that matters; being on the stack
|
||
is. *)
|
||
| Break of int
|
||
| Continue of int
|
||
| Set of place * expr
|
||
| Field of expr * int (* target is already a struct value *)
|
||
| Addr of place
|
||
| Deref of expr
|
||
| Make of string * expr list (* struct literal, every field, in order *)
|
||
(* A data type value: the data type's name, the case's name, and every
|
||
field of that case in declaration order with the omitted ones filled in
|
||
as [Zero] — the
|
||
same ZII rule [Make] carries, and settled here for the same reason. It is
|
||
its own node rather than a [Make] over a synthesised struct because the
|
||
value's *type* is the data type and its payload is a byte blob the case is
|
||
reinterpreted into; a backend that saw only [Make] would have to rederive
|
||
which of the two it was looking at. *)
|
||
| MakeCase of string * string * expr list
|
||
(* One field of one case of a data type value, by index. The case name is on the
|
||
node because the payload is untyped bytes: [Field]'s index alone cannot
|
||
say which case struct the blob is being read as. [match] is the only thing
|
||
that proves the case, so this is only ever built under an arm that
|
||
checked the tag — and by [Render], which reads a field only after the same
|
||
comparison. One node, so the payload layout is known in exactly one place
|
||
in each backend rather than once per reader. *)
|
||
| CaseField of expr * string * int
|
||
| Arr of expr list (* fixed-array literal *)
|
||
| Some_ of expr
|
||
| None_
|
||
| Match of expr * arm list
|
||
(* (some x): unwrap Some, else early-return None from the enclosing function.
|
||
An early return, not an expression that can fail — hence its own node. *)
|
||
| UnwrapSome of expr
|
||
(* Conditions, spec-conditions.md. [Signal] walks the handler stack and
|
||
returns Unit whatever it finds — with nothing matching it is a no-op, so
|
||
nothing here alters control flow. [HandlerBind] pushes one frame per
|
||
clause, runs its body, and pops them; each clause was lifted into its own
|
||
function by the checker, so what is left is the frame and the call. *)
|
||
| Signal of sigkind * int * expr (* how, the type id, the condition *)
|
||
| Handled of hframe list * expr list
|
||
(* The transfer, spec-conditions.md §3–§6. [RestartCase] pushes one frame per
|
||
clause, runs its body, and pops them; if a transfer arrives naming one of
|
||
*its* frames it runs that clause instead, and the whole form yields either
|
||
way. [InvokeRestart] looks the name up on the restart stack, writes the
|
||
frame it found into the transfer channel and leaves — it has type Never,
|
||
so nothing follows it.
|
||
|
||
[InvokeRestart]'s arguments are already evaluated: the checker binds each
|
||
to a slot and wraps the node in a [Let], so what is left here is a list of
|
||
locals to copy into the frame. Two reasons, and both matter. An argument
|
||
that transfers on its own must be guarded before this one aims the
|
||
channel; and a call written in an argument has to be on the walk [Reach]
|
||
and [Load] already do, which a list hanging off a node they treat as a
|
||
leaf would not be. [rsig] is the argument types as written, and [rsig_id]
|
||
their hash — §3's run-time check, since the name is resolved on a stack
|
||
nothing static can see.
|
||
|
||
Not every one of these was written as a [restart-case]. A [handler-case]
|
||
is a [Handled] whose clause invokes a restart, wrapped in one of these to
|
||
catch it — see [Check.check_handler_case] — so the unwinding handler
|
||
reaches a backend as this node and needs nothing of its own. A clause
|
||
whose name begins with [handler-case/] is one the checker made up for
|
||
that. *)
|
||
| RestartCase of rclause list * expr
|
||
(* (with-allocator A BODY...) — spec-memory.md. It rebinds the current
|
||
allocator for its dynamic extent and releases nothing. Its own node
|
||
because the restore has to happen on the *transfer* path too: a body that
|
||
errors, or a restart taken from inside it, must not leave the context
|
||
allocator pointing at a region the handler knows nothing about. *)
|
||
| WithAlloc of expr * expr list
|
||
(* name id, name, arguments, their spelling, its hash, where *)
|
||
| InvokeRestart of int * string * expr list * string * int * Loc.t
|
||
|
||
(* [Serror] is §2's diverging variant: the same lookup, type Never, and with
|
||
nothing transferring the program stops rather than carrying on. *)
|
||
(* Which symbol table the address comes out of. [Flanfn] is a function this
|
||
compiler emitted and is therefore name-mangled and reachability-tracked;
|
||
[Rtfn] is a C entry point in flan_rt.c, spelled as written. The two are
|
||
interchangeable at the call site because a Flan function's emitted signature
|
||
is its parameters followed by the transfer channel, and the runtime's
|
||
matching typedef spells that last pointer out. *)
|
||
(* [Flanfn] is a function this compiler emitted, named by its mangled symbol,
|
||
and always the symbol itself. [Rtfn] is a C entry point in flan_rt.c, spelled
|
||
as written. [Fnval] is also a Flan function this compiler emitted, but as a
|
||
*value* someone asked for by writing its name — and it is a separate case
|
||
because a dev build must answer it with the current body rather than with the
|
||
original symbol, which means a load from the indirection cell. The first two
|
||
must never take that path: a lifted handler clause and a hash pair have no
|
||
cell to load from. The three are interchangeable at a call site, because a
|
||
Flan function's emitted signature is its parameters followed by the transfer
|
||
channel and the runtime's matching typedef spells that last pointer out. *)
|
||
and fnref = Flanfn of string | Rtfn of string | Fnval of string
|
||
|
||
and sigkind = Ssignal | Serror
|
||
|
||
and place =
|
||
| Plocal of int
|
||
| Pglobal of string
|
||
| Pfield of expr * int
|
||
| Pindex of expr * expr list
|
||
| Pderef of expr
|
||
|
||
(* A pushed handler: which condition type it matches, and the lifted function
|
||
that runs when one is signalled. *)
|
||
and hframe = { htype : int; hfn : string }
|
||
|
||
(* A restart clause. [rname_id] is what [invoke-restart] matches by name; the
|
||
body is a branch in the function that wrote it, because unlike a handler a
|
||
clause runs at the restart-case, which is where it was written.
|
||
|
||
[rparams] are the slots §3's parameters are bound to, in order, with their
|
||
types; the invoker stores into a buffer this frame owns and the clause loads
|
||
them from it. [rsig] is how those types are spelled and [rsig_id] its hash:
|
||
what the two ends compare, since neither can see the other. *)
|
||
and rclause =
|
||
{ rname_id : int; rname : string; rparams : (int * Types.t) list;
|
||
rsig : string; rsig_id : int; rbody : expr list }
|
||
|
||
(* [binds] are the slots the pattern's fields are bound to, in field order. *)
|
||
and arm = { acase : string option; binds : int list; abody : expr list }
|
||
|
||
type field = { fname : string; fty : Types.t }
|
||
|
||
type structure = { sname : string; fields : field list }
|
||
|
||
type variant = { vname : string; vfields : field list }
|
||
|
||
type data = { dname : string; cases : variant list }
|
||
|
||
type fn = {
|
||
name : string;
|
||
params : Types.t list; (* bound to slots 0 .. n-1, in order *)
|
||
slots : Types.t array; (* the frame: one entry per slot *)
|
||
(* What the source called each slot, parallel to [slots]. [None] is a slot
|
||
the compiler made up and no one wrote a name for -- [dotimes]'s hidden
|
||
bound, the pair (min) and (max) evaluate their operands into, the slot a
|
||
tail expression goes through. Names are otherwise gone from this IR (see
|
||
the header); this is the one exception, and it exists so a debug build can
|
||
emit a [!DILocalVariable] that says [lo] where the source said [lo]. A
|
||
backend is free to ignore it entirely -- nothing is *resolved* through it,
|
||
and a slot is still only ever referred to by index. *)
|
||
snames : string option array;
|
||
ret : Types.t;
|
||
body : expr list;
|
||
(* The defers again, innermost first. [body] already has them spliced onto
|
||
the normal exit path; this is the same list for the *transfer* exit path,
|
||
which leaves through a landing block the backend builds and no form in
|
||
[body] can reach. spec-conditions.md §5: they run, and errdefer does not.
|
||
|
||
Not quite the same list: each one here is wrapped in a test of the
|
||
counter [Check.register_defer] stores into, because a transfer can start
|
||
above a defer the text has not reached — in the initialiser of the very
|
||
[let] whose body it is written in, which is [slurp]'s shape — and a
|
||
cleanup over a binding nothing wrote is not cleanup. The normal paths
|
||
need no test: falling off the end is below every defer, and a [return]
|
||
carries only the ones above it. A backend runs this list as it stands. *)
|
||
fdefers : expr list;
|
||
(* Set on a function the checker made up rather than one anyone wrote: a
|
||
handler-bind clause, lifted out of the function named here. It is reached
|
||
by address from that function's body and from nowhere else, so it needs no
|
||
cell and no registry slot, and a redefinition of the parent carries its
|
||
own copy. *)
|
||
fparent : string option;
|
||
floc : Loc.t;
|
||
}
|
||
|
||
(* [gfolded] is the difference between a constant whose value the *checker*
|
||
consumed — an array length, decided before any type resolves — and one that
|
||
is only ever read at run time. The first is in the program's shape and can
|
||
never be reloaded; the second is just bytes in memory and can. Nothing else
|
||
can tell them apart afterwards, so it is recorded here. *)
|
||
type global = {
|
||
gname : string;
|
||
gty : Types.t;
|
||
ginit : expr;
|
||
gconst : bool;
|
||
gfolded : bool;
|
||
}
|
||
|
||
(* A foreign function: no body, and [esym] is the symbol the linker sees. The
|
||
aggregate calling convention is not modelled here — a C shim flattens every
|
||
struct that crosses the boundary, so clang classifies it per target and
|
||
nothing in the backend has to know x86-64 from arm64 from wasm32. *)
|
||
type extern = {
|
||
ename : string; (* the Flan name, e.g. rl/init-window *)
|
||
esym : string; (* the C symbol *)
|
||
eparams : Types.t list;
|
||
eret : Types.t;
|
||
}
|
||
|
||
type program = {
|
||
structs : structure list;
|
||
datas : data list;
|
||
(* The untagged unions, carried as [structure] values: a union's members are
|
||
a field list whose every offset is zero, so the record a struct uses says
|
||
all of it. Which list a name came out of is what a backend reads to know
|
||
whether to accumulate the offsets or not. *)
|
||
unions : structure list;
|
||
globals : global list; (* in declaration order *)
|
||
externs : extern list;
|
||
fns : fn list;
|
||
(* The C the program's own (declare-c ...) forms generated, if any: one
|
||
translation unit, compiled into the build like a package's hand-written
|
||
.c file. It is on the program rather than beside it so that every driver
|
||
— the CLI, the REPL, the acceptance table — carries it without knowing
|
||
it exists. See [Shim]. *)
|
||
(* The generated FFI shim, in parts keyed by the declaration each serves,
|
||
with "" for the shared preamble. Parts rather than one string so that
|
||
[Reach.link] can drop a wrapper whose binding nothing reachable calls. *)
|
||
cshim : (string * string) list;
|
||
}
|
||
|
||
(* ── Walking an expression ─────────────────────────────────────────── *)
|
||
|
||
(* Every node of an expression, outermost first, the ones hanging off a [place]
|
||
included. One traversal in the IR's own file rather than one per reader:
|
||
three passes ask structural questions of a body — what names it refers to
|
||
([Reach]), whether a global's initialiser can transfer, and which globals it
|
||
reads ([Check]) — and each of them that spelled the traversal out again was
|
||
a place a new constructor could be forgotten in. What differs between those
|
||
readers is the question, which is [f]. The shape of the IR is not theirs to
|
||
restate.
|
||
|
||
A lifted clause's body is not in here: it is a function of its own, and this
|
||
walks one expression. A reader that wants it follows [hfn], the way [Reach]
|
||
does. *)
|
||
let rec walk (f : expr -> unit) (e : expr) =
|
||
f e;
|
||
let go = walk f in
|
||
let gos = List.iter go in
|
||
match e.e with
|
||
| Int _ | Float _ | Bool _ | Str _ | Unit | Zero _ | Uninit _ | Local _
|
||
| Global _ | None_ | FnAddr _ | Break _ | Continue _ -> ()
|
||
| Prim (_, es) | Call (_, es) | Do es | Make (_, es) | MakeCase (_, _, es)
|
||
| Arr es | InvokeRestart (_, _, es, _, _, _) -> gos es
|
||
| CallPtr (c, es) -> go c; gos es
|
||
| Let (bs, body) -> List.iter (fun (_, v) -> go v) bs; gos body
|
||
| If (a, b, c) -> go a; go b; go c
|
||
| While (c, body, latch) -> go c; gos body; gos latch
|
||
| Return v -> Option.iter go v
|
||
| Set (p, v) -> walk_place f p; go v
|
||
| Addr p -> walk_place f p
|
||
| Field (t, _) | Deref t | CaseField (t, _, _) | Some_ t | UnwrapSome t
|
||
| Signal (_, _, t) -> go t
|
||
| Match (sc, arms) -> go sc; List.iter (fun a -> gos a.abody) arms
|
||
| Handled (_, body) -> gos body
|
||
| RestartCase (cs, body) -> List.iter (fun c -> gos c.rbody) cs; go body
|
||
| WithAlloc (a, body) -> go a; gos body
|
||
|
||
and walk_place f (p : place) =
|
||
match p with
|
||
| Plocal _ | Pglobal _ -> ()
|
||
| Pfield (t, _) | Pderef t -> walk f t
|
||
| Pindex (t, idx) -> walk f t; List.iter (walk f) idx
|
||
|
||
(* ── What the object image can hold ─────────────────────────────────── *)
|
||
|
||
(* Whether an initialiser is a value a linker can write into the program's
|
||
image: a literal, a zero, an aggregate of those. It is [Emit.const]'s
|
||
accepted set asked as a question rather than answered as a string, and the
|
||
two have to stay the same set — [const] spells the value, this decides who
|
||
is allowed to ask it to.
|
||
|
||
Everything else is *computed*, which used to be the end of the road and is
|
||
now a fork: [Check] lifts a computed initialiser into a function of its own
|
||
and the program calls it at startup. So this is no longer "what a global may
|
||
be", only "what needs no code" — which is why a [MakeCase] is false here
|
||
rather than an error. A data type case written into the image would need a
|
||
byte-level encoder that could not encode a string field at all; written as a
|
||
store at startup it needs nothing. *)
|
||
let rec const_init (e : expr) =
|
||
match e.e with
|
||
| Int _ | Float _ | Bool _ | Str _ | Unit | Zero _ | Uninit _ | None_ -> true
|
||
| Make (_, es) | Arr es -> List.for_all const_init es
|
||
| Some_ v -> const_init v
|
||
| _ -> false
|
||
|
||
(* The declared position of a case, which is its tag, and the case itself. Tags
|
||
are declaration order from zero, so an all-bytes-zero data type is the first
|
||
case with a zeroed payload — the same rule that makes an [Option]'s zero a
|
||
[None], and the reason case order is part of a data type's contract. *)
|
||
let case_index (u : data) name =
|
||
let rec go i = function
|
||
| [] -> None
|
||
| (c : variant) :: rest ->
|
||
if String.equal c.vname name then Some (i, c) else go (i + 1) rest
|
||
in
|
||
go 0 u.cases
|
||
|
||
let vfield_index (c : variant) name =
|
||
let rec go i = function
|
||
| [] -> None
|
||
| (f : field) :: rest ->
|
||
if String.equal f.fname name then Some i else go (i + 1) rest
|
||
in
|
||
go 0 c.vfields
|
||
|
||
let field_index (s : structure) name =
|
||
let rec go i = function
|
||
| [] -> None
|
||
| f :: rest -> if String.equal f.fname name then Some i else go (i + 1) rest
|
||
in
|
||
go 0 s.fields
|