Joseph Ferano
b93b6120d1
The lo <= hi test in check_slice and slice-from-ptr's n >= 0 sat behind --no-bounds-checks in both backends, while the comment beside each said they could not be dropped. They are not bounds checks: hi <= len asks whether a range fits inside a length, and lo <= hi asks whether the word about to be written into a %slice's length field is a count at all. The first stays behind the flag, the second is now emitted everywhere, the way flan_vec_as_slice has always validated its own l > h in plain C. emit.ml emits two signal blocks rather than one and i1, so an unchecked build carries one compare. x86.ml keeps all three frame temporaries stored outside the flag and gates only the second compare, because the third is the length the message prints. The IR assertion in test_acceptance now says the two slice calls are present under --no-bounds-checks rather than absent, and the same build is run: case 2 and case -2 of bounds.flan must still die.
132 lines
8.7 KiB
Markdown
132 lines
8.7 KiB
Markdown
# Bug hunt, 2026-09-18
|
||
|
||
Five search agents swept the runtime, checker, backends, dev loop, and Emacs client.
|
||
Everything below was either executed to failure or traced to the exact line. The five
|
||
marked **DISPATCHED** have fix lanes; the rest are recorded here and wait.
|
||
|
||
## Dispatched
|
||
|
||
### 1. `borrowed` grants the borrow flag to whole subtrees — moves inside container targets vanish
|
||
`lib/check.ml:2062-2076`. The flag gates both `moved` (2003) and `global_borrow` (2033),
|
||
and is set across the entire checking of the target: the index argument of `at`, the base
|
||
of any `Field`. A move nested there is never recorded.
|
||
|
||
Confirmed by execution, two programs:
|
||
- `(println (at rows (eat w)))` then `(free w)` — double free, exit 134.
|
||
- Same shape with a move-only global `g`: accepted, `g` freed, `(len g)` reads a freed
|
||
header, exit 0 silent. Defeats the rule test/test_flan.ml:1067-1068 pins.
|
||
|
||
Fix direction: narrow the flag to the target's own read — restore `ctx.borrow` for the
|
||
index of `at`; treat `Field` as simple only when its base chain bottoms out at a `Var`.
|
||
|
||
### 2. A `while` condition is move-checked outside `in_loop` — double free on iteration two
|
||
`lib/check.ml:1688-1691`. The condition is checked before `in_loop` is entered, but
|
||
emit re-runs it every trip (`emit.ml:1838`). A condition that moves a local frees it
|
||
once per iteration. Confirmed: glibc double-free abort, exit 134.
|
||
`dotimes`' count (2504) and `loop`'s inits (2561) are also outside but evaluate once — correct.
|
||
Fix: check the condition inside `in_loop`.
|
||
|
||
### 3. A checked declaration that fails to build or deliver leaves a NULL cell the session will call
|
||
`lib/session.ml:601` commits `t.program` before `Dev.eval` builds (`dev.ml:603` can raise)
|
||
or delivers (`dev.ml:596` can refuse — e.g. queue full at `vendor/agent/flan_agent.c:1186`,
|
||
which a parked program guarantees after 64 installs since nothing drains the ring while
|
||
parked). The session keeps the declaration; the process never got the body; the next
|
||
thunk's install prologue interns the name with `cell = NULL` (`runtime/flan_dev.c:65`)
|
||
and `body_of` calls through it with no null test (`emit.ml:1472`) — jump to address 0
|
||
on the game thread. Nearest reachable mechanism to FIX.org's transient SIGSEGV; the
|
||
stranded-Vec hypothesis there was read out and refuted (reloads never redefine a host
|
||
global; storage addresses are stable; `global_borrow` holds).
|
||
Related, same lane: the queue-full refusal says "the program is not calling agent/poll",
|
||
which is the wrong cause for a parked program.
|
||
|
||
### 4. The merged build never drains the program's stdout pipe while serving a request
|
||
fd 1 is a 64K pipe whose only reader is `accept_loop`'s select (`lib/dev.ml:2739`), not
|
||
running while `serve` handles a request. `eval_expr`'s wait (664-672) and
|
||
`run_render_thunk`'s wait (1026-1036) poll for five seconds and never drain, so a
|
||
program that prints (sand.flan does) blocks in `flan_write_stdout`, stalls the frame
|
||
thread for the whole timeout, and gets the false diagnostic "is it calling (agent/poll)?".
|
||
Same root on the exit path: `flan_merged_exit`/`park` `fflush(NULL)` before
|
||
`program_state = PROGRAM_PARKED` (dev.ml:3000/3017/3024), so a full pipe delays the park
|
||
and `rerun` refuses a finished program as "already running".
|
||
Also same family: `rt_die` (`runtime/flan_rt.c:384-388`) starts with `fflush(stdout)` —
|
||
a bounds trap can hang on the full pipe — and calls `exit(134)`, the route `die_now`
|
||
documents as unsafe (atexit/ELF destructors want the loader lock a dlopening thread may
|
||
hold); it should `_exit` like the break loop does.
|
||
|
||
### 5. x86 shifts are always 64-bit, so the count is masked to 63 instead of width−1
|
||
`lib/x86.ml:2530-2534` / `shift_cl` at 369 (`rex ~w:true` unconditionally). The comment
|
||
claims the hardware masks to operand width; it masks to 63. `emit.ml:2041` masks to
|
||
`bits-1` explicitly (NEXT.md "Sharp edges" records this as the language's rule). Six
|
||
confirmed divergences, e.g. `(<< x 32)` on i32: LLVM 1, x86 0; `(>> i8min 8)`: LLVM
|
||
-128, x86 -1. Invisible because `spike/x86/survey.sh:80` never globs `spike/js/*.flan`,
|
||
where `p1-int-semantics.flan` already catches it — widen the glob in the same lane.
|
||
Same wide-compute root, second divergence: float→int overflow under `--no-bounds-checks`
|
||
gives 0 on x86 (64-bit `cvttsd2si` then truncate) vs INT_MIN on LLVM. Acknowledged-UB
|
||
territory; fix or record, the lane's call.
|
||
|
||
## Recorded, not scheduled
|
||
|
||
- **Region guard never asks about elements** (`lib/check.ml:1272`, refusals 4092/4165):
|
||
a heap-backed inner Vec pushed into an arena-backed outer passes the guard; `at` then
|
||
hands out an owning header, `free` accepts it, and the later read is a confirmed UAF
|
||
(printed garbage). Breaks the premise stated in the clone note at check.ml:4152.
|
||
Candidate fixes: refuse `free` of a non-binding target, or region-check the element at
|
||
`push`/`put`. Sixth on the list; needs a deliberate mixed-allocator construction.
|
||
- **Reversed slice under `--no-bounds-checks`** — **fixed**. The `lo <= hi` test is a
|
||
representation invariant, not a bounds check, but sat behind `if f.md.checks` in both
|
||
backends (`emit.ml:1037`, `x86.ml:2164`; same for SliceFromPtr's `n >= 0`), so a
|
||
negative-length slice reached user code. Split in both backends: `hi <= len` stays
|
||
behind the flag, `lo <= hi` and `n >= 0` are now emitted in every build, through the
|
||
same slice-failure path. `flan_vec_as_slice` was the model. See "A slice's length word
|
||
is a count" in docs/BUILT.md.
|
||
- **`reg leaks` lies at >3072 live blocks** (`runtime/flan_dev.c:1521`): compaction then
|
||
fires on every allocation, the epoch stays odd, all 8 scan retries fail, and
|
||
`flan_dev_reg_by_type` returns 0 — measured 198/200 wrong answers on a full table.
|
||
Plus `flan_reg_snap` failure is `continue`d past, contradicting its own contract.
|
||
- **Emacs framing**: a truncated frame raises wrong-type instead of the timeout message
|
||
and leaves the partial frame in the buffer, desyncing every later request by one frame
|
||
(`flan-dev.el:220`); `extract-reply` reads before it deletes, so an unreadable payload
|
||
wedges the connection permanently (:187). One ordering fix covers both.
|
||
- **Emacs poll vs watch**: `flan-dev--poll` bypasses `flan-dev-settle-hook` and consumes
|
||
the watch's reply; the two consumers stay swapped for the session (`flan-dev.el:406`).
|
||
Also `request` reconnects before running the settle hook — 30s freeze after a daemon
|
||
restart with the watch armed.
|
||
- **C-x C-e at point-min** installs an empty declaration (`flan-dev.el:1745`
|
||
`backward-sexp` no-op unchecked); same predicate fires inside strings and misjudges
|
||
narrowed buffers.
|
||
- **`flan-connect` + `flan-dev-quit` kill two sessions** (`flan-dev.el:721`): quit sends
|
||
`close` down the current connection and kills the daemon it started for another program.
|
||
- **`reg at` TOCTOU** (`dev.ml:1488`): the stopped-only gate is checked three round trips
|
||
before the render thunk runs; a `restart` in between lets the thunk chase freed memory
|
||
with the gate's blessing.
|
||
- **defenum values never range-checked to i32** (`parse.ml:994`, `check.ml:1666`): the
|
||
collision rule compares i64s, so `[A 0 B 4294967296]` passes and both are 0 at runtime;
|
||
autoincrement can overflow silently on --x86.
|
||
- **NaN sign**: LLVM constant-folds `0.0/0.0` to `nan`, x86 computes `-nan` — a stdout
|
||
DIFFER on a two-line program. Runtime paths agree (`-nan` both).
|
||
- **`emit.ml:3369` transient test ignores `new_globals`**: on the `retains=false` path a
|
||
module first to intern a global gets dlclosed; zero-init makes it moot today, a literal
|
||
init would dangle.
|
||
- **x86 to-bytes helper-return clobber**: `(defn numstr [n] (string (i64->bytes n)))`
|
||
works on LLVM, garbage on x86 — documented caller's-problem UB, but the divergence
|
||
makes the documented edge invisible.
|
||
- **map-grow at log2cap>=40 quotes a stale failure** (`flan_rt.c:2438`, pre-dates
|
||
yesterday).
|
||
|
||
## JS backend (deprioritised 2026-09-18, do not schedule)
|
||
|
||
- `lib/js.ml:889` still matches 1-arg `*ToBytes`; commit 81b807f made them 2-arg, so
|
||
every number-printing program is refused — JS corpus MATCH went 24 → 3 and `@js`
|
||
stays green because a refusal counts as success. Needs a MATCH floor in strict mode.
|
||
- f32 literals keep double precision (`js.ml:671` discards the fkind; `Math.fround` it).
|
||
- The cast-range trap quotes the cast's column, not the operand's (`js.ml:1077`).
|
||
|
||
## Verified clean, don't re-hunt
|
||
|
||
`flan_map_remove` (two randomized ASan harnesses incl. non-power-of-two cells, zero
|
||
mismatches), the grow-path overflow guards, the seqlock protocol itself, the park/rerun
|
||
condvar, `to_bytes`'s 64-byte slot arithmetic, elisp multibyte framing (unibyte
|
||
throughout, tested), JS struct value semantics and 64-bit integer semantics (broad
|
||
probes), division sign/INT_MIN traps at all widths, `if`/`match` dead-set joins,
|
||
`defer`'s kill-at-registration, index widening rules.
|