Joseph Ferano
6cc94e00d6
The name freed up by the rename now means what C means by it: the members overlay one storage, the size is the largest of them, the alignment the strictest, and nothing anywhere records which one was written. It serves two things that wanted it. Binding a C header means holding the union the library holds and reading whichever member the library's own tag says is live -- a tag Flan cannot see, because the rule relating them is prose in a manual. Overlaying an f32 on a u32 to look at its bits is the other, and it is the same read. So that read is defined rather than refused. This is the one place in the checker where bytes win over safety on purpose, and the alternative was not a safer language, it was no feature: type punning *is* reading the member that was not written. The promise is the one C's implementations make and C's standard does not -- the layout is the target's, the bytes are the bytes, a read is a reinterpretation of them -- and what is not promised is anything about bytes nobody wrote, where a member wider than the one last stored reads a tail that is indeterminate exactly as a struct's padding is. ZII narrows that to almost nothing: a union starts all-bytes-zero unless uninit says otherwise. uninit on one is allowed, unlike on a defdata. The refusal there was never about garbage; it is that a tag steers, and a tag no case names falls past every comparison in a match into a block LLVM may treat as unreachable. An untagged union steers nothing. Which is also why three things are refused, each for a reason that does not expire with a milestone. No move-only member: nothing knows which member is live, so nothing can tear one down, and unlike the struct and defdata refusals this is not waiting on recursive teardown -- there is no fact for teardown to read. No bool at any depth: an i1 loaded from a byte that is neither 0 nor 1 is a value the optimiser may assume cannot exist, and a union is the only type that can produce one. No defdata at any depth, for the reason uninit gives, arriving the other way round. An Option member is fine and the walk says why: its match is a tag test and a branch, not a chain with an unreachable tail. Two members in one literal, a match on a union, a union map key and a member written into a global initialiser are each refused by name. A union is a field list whose every offset is zero, so it travels as a Tast.structure and the checker, the emitter and the x86 backend each grow one table rather than one shape. A value is a zeroed temporary and a store -- Set over Pfield, which every backend already has -- so there is no new IR node and no layout rule spelled out a second time per backend. The LLVM type is the blob clang gives a union, the DWARF is DW_TAG_union_type with every member at zero, and the printer names the type and does not walk it: it cannot know which member is live, and one of them may be a pointer. cimport can now check what it could not. A C record holding a union member was not recorded at all, so the defstruct beside it went unchecked rather than checked wrongly; a named union member resolves to a defunion now and the whole record is compared field by field. The defunion itself is compared against the header's union as a set and not in order -- every member is at offset zero, so a permuted one is the same type and reporting it would be a finding that is not one -- while a member the header has and Flan lacks is reported, because that is what changes the size. A defunion against a C struct, or a defstruct against a C union, is reported in both directions. An anonymous union member is still skipped, and the comment now says that the gap is on the Flan side: there is nothing to declare.
350 lines
18 KiB
OCaml
350 lines
18 KiB
OCaml
(** The typed IR: what the checker produces and what every backend consumes.
|
||
|
||
Every backend shares this — the LLVM emitter and the hand-written x86-64
|
||
one, each of them under dev redefinition and under the release AOT build
|
||
(plan.org, Compilation) — so everything a backend would otherwise have to
|
||
re-derive is resolved here and nowhere else:
|
||
|
||
- names are gone. A local is a slot index into the frame, a global is a
|
||
name, and a call names its callee directly. No environment lookup.
|
||
- field access is an index, not a string, and any auto-deref the source
|
||
relied on is an explicit [Deref] node.
|
||
- literals have a machine type. There is no untyped 1 past this point.
|
||
- a struct literal lists every field in declaration order, with the omitted
|
||
ones filled in as [Zero] — ZII is settled here rather than at runtime.
|
||
- sugar is already gone from the AST; what is left is the small set below. *)
|
||
|
||
type prim =
|
||
(* arithmetic and comparison, per machine type — the operands carry their own
|
||
kind at runtime, so one constructor covers every width *)
|
||
| Add | Sub | Mul | Div | Rem
|
||
| Eq | Ne | Lt | Le | Gt | Ge
|
||
| Not
|
||
(* bitwise, integers only. [Shr] is arithmetic on a signed type and logical
|
||
on an unsigned one, which is what the operand's own kind already says. *)
|
||
| BitAnd | BitOr | BitXor | Shl | Shr
|
||
(* containers: fixed arrays and slices only at milestone 2 *)
|
||
| Len | At | Slice
|
||
(* (slice-from-ptr p n): a [T] made out of a (Ptr T) and a length the caller
|
||
supplies. It builds the same two words [Slice] builds and allocates
|
||
nothing — the storage stays whoever's it was, which in practice is C's.
|
||
The one thing the compiler cannot check is whether n is the truth; see
|
||
check.ml's "slice-from-ptr" case for what it can. *)
|
||
| SliceFromPtr
|
||
(* the milestone-2 host primitives, plan.org. The four conversions are
|
||
*text*: bytes->f64 parses "12.5", f64->bytes renders it — that is what
|
||
calc-me's tokenizer and the prelude's printers each need. *)
|
||
| Bytes | BytesToF64 | BytesToI64 | F64ToBytes | I64ToBytes
|
||
(* (string b): the other direction of [Bytes], and the same non-instruction.
|
||
See check.ml's "string" case for why it is unchecked. *)
|
||
| StrOfBytes
|
||
(* No surface name: the structural printer is the only thing that builds
|
||
these. U64ToBytes because u64 is not i64 with a flag, EscapeBytes for a
|
||
string nested inside a printed structure. *)
|
||
| U64ToBytes | EscapeBytes
|
||
| WriteStdout | Exit | Argv
|
||
(* A call into the runtime's C, named by symbol. The argument and result
|
||
LLVM types come off the expression nodes themselves, so one constructor
|
||
covers every entry point the allocator and container runtime has and the
|
||
backend grows one arm rather than one per operation — which matters
|
||
because spec-memory.md's runtime is type-erased and therefore *is* a list
|
||
of C entry points. A string or slice argument crosses as ptr+len, the
|
||
same rule as every other shim here. No transfer guard follows one: a
|
||
transfer cannot cross a C frame. *)
|
||
| Rt of string
|
||
(* spec-memory.md, "Alignment": a property of the type, computed at the call
|
||
site, passed as a parameter to the type-erased allocator — all three, and
|
||
they are not alternatives. The checker builds these at the site where the
|
||
concrete element type is known and the backend fills in the number from
|
||
the same layout calculator DWARF uses. *)
|
||
| SizeOf of Types.t
|
||
| AlignOf of Types.t
|
||
(* The address of any expression, not only of a place: the element a [push]
|
||
copies may be a computed value, and the runtime takes it by pointer
|
||
because it is type-erased. The backend already spills a non-place to a
|
||
temporary for exactly this. *)
|
||
| AddrOf
|
||
| Cast of Types.t
|
||
|
||
type expr = { e : expr_kind; ty : Types.t; loc : Loc.t }
|
||
|
||
and expr_kind =
|
||
| Int of int64 * Types.ikind
|
||
| Float of float * Types.fkind
|
||
| Bool of bool
|
||
| Str of string
|
||
| Unit
|
||
| Zero of Types.t (* ZII: all-bytes-zero of this type *)
|
||
| Uninit of Types.t (* the explicit opt-out *)
|
||
| Local of int (* slot index into the frame *)
|
||
| Global of string
|
||
| Prim of prim * expr list
|
||
| Call of string * expr list (* a call naming its callee *)
|
||
(* The address of a function the compiler emitted, by symbol. Which symbol
|
||
table, and whether the surface language can see it, is [fnref]'s job.
|
||
|
||
Two unrelated consumers, and the difference between them is the whole
|
||
reason [fnref] has three cases rather than two. The compiler's own uses —
|
||
the Map's hash and equality pair (Odin's [Map_Info] is two contextless
|
||
[proc] fields reached exactly this way) and a handler-bind clause's
|
||
symbol — want the *symbol*, always, and carry the Flan type [Alloc]. A
|
||
function *value* someone wrote wants the body that is current, which in a
|
||
dev build is not the symbol but whatever the indirection cell holds, and
|
||
carries the Flan type [Fn]. *)
|
||
| FnAddr of fnref
|
||
(* A call through a function value: the callee is an expression of type
|
||
[Fn], not a name. Its own node rather than a [Call] with an expression in
|
||
the name slot, because everything that walks this IR treats [Call]'s
|
||
string as a *link-time* edge — [Reach] roots the callee, [Dev] finds the
|
||
cell to redefine, [Emit] may load that cell — and none of those are
|
||
questions an indirect call can answer. Keeping them apart means each of
|
||
those readers keeps working on the direct case unchanged and says
|
||
explicitly what it does with the indirect one. *)
|
||
| CallPtr of expr * expr list
|
||
| Do of expr list
|
||
| Let of (int * expr) list * expr list
|
||
| If of expr * expr * expr
|
||
(* condition, body, and the *latch*: forms that run after the body and before
|
||
the condition is tested again. [dotimes] folds its increment in there
|
||
rather than onto the end of the body, because a [continue] branches to the
|
||
latch and a step written in the body would be skipped — the loop would
|
||
never advance and would hang. A [while] has an empty latch. *)
|
||
| While of expr * expr list * expr list
|
||
| Return of expr option
|
||
(* Leaving a loop, and jumping to its latch. The int is how many loops out
|
||
the target is, innermost first: 0 is the loop this is directly inside.
|
||
A *relative* depth rather than a name or an id because it is exactly what
|
||
each backend already has — [emit] keeps one entry per [While] it is inside
|
||
and indexes it. The invariant that makes it sound: the checker mints these
|
||
only from its own loop stack, and both stacks are pushed once per [While].
|
||
A [While] the checker *invents* (alloc_guard, the file-failure retry) is
|
||
built directly and never contains one of these, so the entry it pushes in
|
||
[emit] matches nothing and is harmless — keep it that way.
|
||
|
||
[check_loop]'s [While] is the one exception and the exception proves the
|
||
rule: it *is* pushed on [ctx.loops], so the [Break 0] that leaves it and
|
||
every [Continue] a [recur] mints are counted against the same stack [emit]
|
||
indexes. Invented is not the property that matters; being on the stack
|
||
is. *)
|
||
| Break of int
|
||
| Continue of int
|
||
| Set of place * expr
|
||
| Field of expr * int (* target is already a struct value *)
|
||
| Addr of place
|
||
| Deref of expr
|
||
| Make of string * expr list (* struct literal, every field, in order *)
|
||
(* A data type value: the data type's name, the case's name, and every
|
||
field of that case in declaration order with the omitted ones filled in
|
||
as [Zero] — the
|
||
same ZII rule [Make] carries, and settled here for the same reason. It is
|
||
its own node rather than a [Make] over a synthesised struct because the
|
||
value's *type* is the data type and its payload is a byte blob the case is
|
||
reinterpreted into; a backend that saw only [Make] would have to rederive
|
||
which of the two it was looking at. *)
|
||
| MakeCase of string * string * expr list
|
||
(* One field of one case of a data type value, by index. The case name is on the
|
||
node because the payload is untyped bytes: [Field]'s index alone cannot
|
||
say which case struct the blob is being read as. [match] is the only thing
|
||
that proves the case, so this is only ever built under an arm that
|
||
checked the tag — and by [Render], which reads a field only after the same
|
||
comparison. One node, so the payload layout is known in exactly one place
|
||
in each backend rather than once per reader. *)
|
||
| CaseField of expr * string * int
|
||
| Arr of expr list (* fixed-array literal *)
|
||
| Some_ of expr
|
||
| None_
|
||
| Match of expr * arm list
|
||
(* (some x): unwrap Some, else early-return None from the enclosing function.
|
||
An early return, not an expression that can fail — hence its own node. *)
|
||
| UnwrapSome of expr
|
||
(* Conditions, spec-conditions.md. [Signal] walks the handler stack and
|
||
returns Unit whatever it finds — with nothing matching it is a no-op, so
|
||
nothing here alters control flow. [HandlerBind] pushes one frame per
|
||
clause, runs its body, and pops them; each clause was lifted into its own
|
||
function by the checker, so what is left is the frame and the call. *)
|
||
| Signal of sigkind * int * expr (* how, the type id, the condition *)
|
||
| Handled of hframe list * expr list
|
||
(* The transfer, spec-conditions.md §3–§6. [RestartCase] pushes one frame per
|
||
clause, runs its body, and pops them; if a transfer arrives naming one of
|
||
*its* frames it runs that clause instead, and the whole form yields either
|
||
way. [InvokeRestart] looks the name up on the restart stack, writes the
|
||
frame it found into the transfer channel and leaves — it has type Never,
|
||
so nothing follows it.
|
||
|
||
[InvokeRestart]'s arguments are already evaluated: the checker binds each
|
||
to a slot and wraps the node in a [Let], so what is left here is a list of
|
||
locals to copy into the frame. Two reasons, and both matter. An argument
|
||
that transfers on its own must be guarded before this one aims the
|
||
channel; and a call written in an argument has to be on the walk [Reach]
|
||
and [Load] already do, which a list hanging off a node they treat as a
|
||
leaf would not be. [rsig] is the argument types as written, and [rsig_id]
|
||
their hash — §3's run-time check, since the name is resolved on a stack
|
||
nothing static can see. *)
|
||
| RestartCase of rclause list * expr
|
||
(* (with-allocator A BODY...) — spec-memory.md. It rebinds the current
|
||
allocator for its dynamic extent and releases nothing. Its own node
|
||
because the restore has to happen on the *transfer* path too: a body that
|
||
errors, or a restart taken from inside it, must not leave the context
|
||
allocator pointing at a region the handler knows nothing about. *)
|
||
| WithAlloc of expr * expr list
|
||
(* name id, name, arguments, their spelling, its hash, where *)
|
||
| InvokeRestart of int * string * expr list * string * int * Loc.t
|
||
|
||
(* [Serror] is §2's diverging variant: the same lookup, type Never, and with
|
||
nothing transferring the program stops rather than carrying on. *)
|
||
(* Which symbol table the address comes out of. [Flanfn] is a function this
|
||
compiler emitted and is therefore name-mangled and reachability-tracked;
|
||
[Rtfn] is a C entry point in flan_rt.c, spelled as written. The two are
|
||
interchangeable at the call site because a Flan function's emitted signature
|
||
is its parameters followed by the transfer channel, and the runtime's
|
||
matching typedef spells that last pointer out. *)
|
||
(* [Flanfn] is a function this compiler emitted, named by its mangled symbol,
|
||
and always the symbol itself. [Rtfn] is a C entry point in flan_rt.c, spelled
|
||
as written. [Fnval] is also a Flan function this compiler emitted, but as a
|
||
*value* someone asked for by writing its name — and it is a separate case
|
||
because a dev build must answer it with the current body rather than with the
|
||
original symbol, which means a load from the indirection cell. The first two
|
||
must never take that path: a lifted handler clause and a hash pair have no
|
||
cell to load from. The three are interchangeable at a call site, because a
|
||
Flan function's emitted signature is its parameters followed by the transfer
|
||
channel and the runtime's matching typedef spells that last pointer out. *)
|
||
and fnref = Flanfn of string | Rtfn of string | Fnval of string
|
||
|
||
and sigkind = Ssignal | Serror
|
||
|
||
and place =
|
||
| Plocal of int
|
||
| Pglobal of string
|
||
| Pfield of expr * int
|
||
| Pindex of expr * expr list
|
||
| Pderef of expr
|
||
|
||
(* A pushed handler: which condition type it matches, and the lifted function
|
||
that runs when one is signalled. *)
|
||
and hframe = { htype : int; hfn : string }
|
||
|
||
(* A restart clause. [rname_id] is what [invoke-restart] matches by name; the
|
||
body is a branch in the function that wrote it, because unlike a handler a
|
||
clause runs at the restart-case, which is where it was written.
|
||
|
||
[rparams] are the slots §3's parameters are bound to, in order, with their
|
||
types; the invoker stores into a buffer this frame owns and the clause loads
|
||
them from it. [rsig] is how those types are spelled and [rsig_id] its hash:
|
||
what the two ends compare, since neither can see the other. *)
|
||
and rclause =
|
||
{ rname_id : int; rname : string; rparams : (int * Types.t) list;
|
||
rsig : string; rsig_id : int; rbody : expr list }
|
||
|
||
(* [binds] are the slots the pattern's fields are bound to, in field order. *)
|
||
and arm = { acase : string option; binds : int list; abody : expr list }
|
||
|
||
type field = { fname : string; fty : Types.t }
|
||
|
||
type structure = { sname : string; fields : field list }
|
||
|
||
type variant = { vname : string; vfields : field list }
|
||
|
||
type data = { dname : string; cases : variant list }
|
||
|
||
type fn = {
|
||
name : string;
|
||
params : Types.t list; (* bound to slots 0 .. n-1, in order *)
|
||
slots : Types.t array; (* the frame: one entry per slot *)
|
||
(* What the source called each slot, parallel to [slots]. [None] is a slot
|
||
the compiler made up and no one wrote a name for -- [dotimes]'s hidden
|
||
bound, the pair (min) and (max) evaluate their operands into, the slot a
|
||
tail expression goes through. Names are otherwise gone from this IR (see
|
||
the header); this is the one exception, and it exists so a debug build can
|
||
emit a [!DILocalVariable] that says [lo] where the source said [lo]. A
|
||
backend is free to ignore it entirely -- nothing is *resolved* through it,
|
||
and a slot is still only ever referred to by index. *)
|
||
snames : string option array;
|
||
ret : Types.t;
|
||
body : expr list;
|
||
(* The defers again, innermost first. [body] already has them spliced onto
|
||
the normal exit path; this is the same list for the *transfer* exit path,
|
||
which leaves through a landing block the backend builds and no form in
|
||
[body] can reach. spec-conditions.md §5: they run, and errdefer does not. *)
|
||
fdefers : expr list;
|
||
(* Set on a function the checker made up rather than one anyone wrote: a
|
||
handler-bind clause, lifted out of the function named here. It is reached
|
||
by address from that function's body and from nowhere else, so it needs no
|
||
cell and no registry slot, and a redefinition of the parent carries its
|
||
own copy. *)
|
||
fparent : string option;
|
||
floc : Loc.t;
|
||
}
|
||
|
||
(* [gfolded] is the difference between a constant whose value the *checker*
|
||
consumed — an array length, decided before any type resolves — and one that
|
||
is only ever read at run time. The first is in the program's shape and can
|
||
never be reloaded; the second is just bytes in memory and can. Nothing else
|
||
can tell them apart afterwards, so it is recorded here. *)
|
||
type global = {
|
||
gname : string;
|
||
gty : Types.t;
|
||
ginit : expr;
|
||
gconst : bool;
|
||
gfolded : bool;
|
||
}
|
||
|
||
(* A foreign function: no body, and [esym] is the symbol the linker sees. The
|
||
aggregate calling convention is not modelled here — a C shim flattens every
|
||
struct that crosses the boundary, so clang classifies it per target and
|
||
nothing in the backend has to know x86-64 from arm64 from wasm32. *)
|
||
type extern = {
|
||
ename : string; (* the Flan name, e.g. rl/init-window *)
|
||
esym : string; (* the C symbol *)
|
||
eparams : Types.t list;
|
||
eret : Types.t;
|
||
}
|
||
|
||
type program = {
|
||
structs : structure list;
|
||
datas : data list;
|
||
(* The untagged unions, carried as [structure] values: a union's members are
|
||
a field list whose every offset is zero, so the record a struct uses says
|
||
all of it. Which list a name came out of is what a backend reads to know
|
||
whether to accumulate the offsets or not. *)
|
||
unions : structure list;
|
||
globals : global list; (* in declaration order *)
|
||
externs : extern list;
|
||
fns : fn list;
|
||
(* The C the program's own (declare-c ...) forms generated, if any: one
|
||
translation unit, compiled into the build like a package's hand-written
|
||
.c file. It is on the program rather than beside it so that every driver
|
||
— the CLI, the REPL, the acceptance table — carries it without knowing
|
||
it exists. See [Shim]. *)
|
||
(* The generated FFI shim, in parts keyed by the declaration each serves,
|
||
with "" for the shared preamble. Parts rather than one string so that
|
||
[Reach.link] can drop a wrapper whose binding nothing reachable calls. *)
|
||
cshim : (string * string) list;
|
||
}
|
||
|
||
(* The declared position of a case, which is its tag, and the case itself. Tags
|
||
are declaration order from zero, so an all-bytes-zero data type is the first
|
||
case with a zeroed payload — the same rule that makes an [Option]'s zero a
|
||
[None], and the reason case order is part of a data type's contract. *)
|
||
let case_index (u : data) name =
|
||
let rec go i = function
|
||
| [] -> None
|
||
| (c : variant) :: rest ->
|
||
if String.equal c.vname name then Some (i, c) else go (i + 1) rest
|
||
in
|
||
go 0 u.cases
|
||
|
||
let vfield_index (c : variant) name =
|
||
let rec go i = function
|
||
| [] -> None
|
||
| (f : field) :: rest ->
|
||
if String.equal f.fname name then Some i else go (i + 1) rest
|
||
in
|
||
go 0 c.vfields
|
||
|
||
let field_index (s : structure) name =
|
||
let rec go i = function
|
||
| [] -> None
|
||
| f :: rest -> if String.equal f.fname name then Some i else go (i + 1) rest
|
||
in
|
||
go 0 s.fields
|