Joseph Ferano
a5980734dc
From a mutation-testing pass: about sixty small, plausible changes to the compiler and runtime, each applied, run and restored. Nineteen of them left the whole suite green. The compiler was right in every case - what was missing was anything that looked. The two programs here close the severe cluster. cleanup.flan covers six claims: an early return runs the defers registered above it, and runs them innermost first; a defer that calls something, which is what puts a guard inside a defer on the transfer path; a transfer out of a handler-bind pops its frames; a two-clause handler-bind pops both; and a signal stops once a handler has answered it by transferring. The numbers differ per failure, so a wrong answer names its own cause rather than just being wrong. signedness.flan covers the ashr/lshr and slt/ult choices. Either could have been hardcoded to one arm and nothing would have noticed, because no program in the corpus shifted a negative integer right or compared an unsigned value above 2^31 - where a signed compare answers the other way on every operator. Each was verified able to fail, with the numbers the report predicted: hardcode lshr and -4 becomes 9223372036854775804; drop the defers from the return path and 21 becomes 0; reverse them and it becomes 12; let the signal walk continue past a handler that transferred and the outer handler runs too. The ones left open are recorded for the next pass: Reach's walk of index expressions, addr places and restart clause bodies; the dev registry's size-change guard; a local shadowing an imported name; and the 4K result cap, which has no coverage at all rather than a missing assertion.
62 lines
2.2 KiB
Plaintext
62 lines
2.2 KiB
Plaintext
;;;; The cleanup paths nothing was watching.
|
|
;;;;
|
|
;;;; Found by mutation testing: each of the six claims below could be broken in
|
|
;;;; lib/check.ml, lib/emit.ml or runtime/flan_rt.c and the whole suite stayed
|
|
;;;; green. Every case here is one a plausible wrong version gets wrong, and
|
|
;;;; the numbers differ per failure so a single wrong answer names its cause.
|
|
(defstruct Missing [id i32])
|
|
(defstruct Other [id i32])
|
|
|
|
(defvar log i64)
|
|
(defvar order i64)
|
|
(defvar seen i64)
|
|
|
|
(defn note [n i64] (set order (+ (* order 10) n)))
|
|
|
|
;;; (1) An early return must run the defers registered above it, and (2) it
|
|
;;; must run them innermost-first. A defer that (8) *calls* something is the
|
|
;;; case that puts a guard inside the defer, on the transfer path.
|
|
(defn early [] i64
|
|
(defer (note 1))
|
|
(defer (note 2))
|
|
(return 7)
|
|
0)
|
|
|
|
;;; (5) A transfer out of a handler-bind has to pop its frames on the way past,
|
|
;;; and (6) a handler-bind with two clauses has to pop both, innermost-first.
|
|
;;; If either leaks, the stack keeps a frame pointing into a function that has
|
|
;;; gone, and the next signal calls into it.
|
|
(defn deep [] i32 (signal (Missing {:id 1})) 0)
|
|
|
|
(defn leaky [] i32
|
|
(restart-case
|
|
(handler-bind [(Other [c] (set seen (+ seen 1000)))
|
|
(Missing [c] (invoke-restart 'skip))]
|
|
(deep))
|
|
(skip [] 42)))
|
|
|
|
;;; (7) Once a handler has answered a signal by transferring, the walk stops:
|
|
;;; an outer handler of the same type must not also run.
|
|
(defn nested [] i32
|
|
(restart-case
|
|
(handler-bind [(Missing [c] (set seen (+ seen 100)))]
|
|
(handler-bind [(Missing [c] (invoke-restart 'stop))]
|
|
(deep)))
|
|
(stop [] 5)))
|
|
|
|
(defn main [] i32
|
|
(print-i64 (early)) (newline) ; 7
|
|
(print-i64 order) (newline) ; 21 — innermost first, both ran
|
|
|
|
(print-i64 (i64 (leaky))) (newline) ; 42
|
|
;; The handler stack must be empty again. If a frame leaked, this signal
|
|
;; reaches it and seen moves.
|
|
(deep)
|
|
(print-i64 seen) (newline) ; 0
|
|
|
|
(set seen 0)
|
|
(print-i64 (i64 (nested))) (newline) ; 5
|
|
(print-i64 seen) (newline) ; 0 — the outer handler did not run
|
|
(print-i64 log) (newline) ; 0
|
|
0)
|