Joseph Ferano
b54f24873e
publish() wrote queue[head % QUEUE] without consulting tail, so the 65th module queued between two agent/poll calls landed on the slot the game thread was reading — twenty-four bytes of function pointers copied field by field with no atomic near them, so the consumer could take half of one job and half of another and call it. The comment claimed the overflow dropped the oldest request; nothing did that. A full ring is refused now, at the sender, before the dlopen. Dropping loses a reload the sender was told was ok, which is the same lie more quietly; blocking stalls the accept loop, which serves connections inline, so a program that had stopped polling would also stop answering status and abort — the dev loop would have no way to reach a program that had stopped listening to it. The check is separate from the store because there is one producer: room, once seen, cannot be taken away. Two smaller defects in the same file: A module with no flan_reload_install was refused and its handle dropped on the floor. Not an exception to "nothing is ever dlclosed" — that rule is about a module something points into, and this one installed nothing, so no cell names it. What leaked was the handle value rather than the mapping: dlopen refcounts by path, so re-sending the same bad file raised a count nothing could lower. exit(134) from the break loop runs the atexit chain and the ELF destructors, which want the loader lock the listener thread may be holding inside dlopen. A program asked to abort would hang instead of dying. _exit, with the streams flushed by hand at each call site. The deadlock itself is read rather than tested; what the tests pin is that the exit status is still 134. programs/agent-queue.flan blocks on stdin so the window is held open by the test rather than by a timer: it takes 64 modules, refuses the 65th with a reason, and installs 64 when it finally polls. noinstall.c's destructor prints while the program is still running, which is the only way to see the close — at exit the loader runs every destructor whether anything was closed or not. Both halves fail on the old code.
65 lines
3.0 KiB
Plaintext
65 lines
3.0 KiB
Plaintext
(tests
|
|
(names test_flan test_acceptance test_reload test_agent test_session test_dev test_emacs test_repl test_cider)
|
|
; Explicit because test_sanitize lives in this directory and is not one of
|
|
; these: two stanzas in one directory have to say which modules are whose.
|
|
(modules test_flan test_acceptance test_reload test_agent test_session
|
|
test_dev test_emacs test_repl test_cider)
|
|
(libraries flan unix)
|
|
; The acceptance programs are part of the test corpus: if the reader, the
|
|
; parser or the checker regresses on them we want to know here, not at the CLI.
|
|
(deps
|
|
(file %{workspace_root}/calc-me.flan)
|
|
(file %{workspace_root}/sand.flan)
|
|
; The raylib bindings, because sand.flan and the FFI case import them and an
|
|
; import reads the directory at build time. sand.flan itself is above: the
|
|
; headless case imports it as a single-file package.
|
|
(glob_files %{workspace_root}/vendor/raylib/*)
|
|
; The dev agent package: its Flan declarations and the C that implements them.
|
|
(glob_files %{workspace_root}/vendor/agent/*)
|
|
; The EDN tokenizer, which programs/edn.flan imports.
|
|
(glob_files %{workspace_root}/vendor/edn/*)
|
|
; The ported raylib examples. Only one of them has a headless acceptance
|
|
; case, but it imports its example as a package and that example imports
|
|
; examples/digits.flan, so the directory has to be here whole.
|
|
(glob_files %{workspace_root}/examples/*)
|
|
(glob_files programs/*.flan)
|
|
; The reload primitive's host: a C main that dlopens what Build.shared made.
|
|
(file reload_host.c)
|
|
; A shared object that is not a redefinition module, for the agent's refusal
|
|
; path. Its destructor is what proves the handle was closed rather than lost.
|
|
(file noinstall.c)
|
|
; test_dev runs the compiler itself: flan dev launches and owns a program.
|
|
(file %{workspace_root}/bin/main.exe)
|
|
; The Emacs client, which test_emacs drives against a real daemon.
|
|
(glob_files %{workspace_root}/emacs/*.el)
|
|
; The WASI host the wasm32 case runs its module under, when no wasmtime or
|
|
; wasmer is installed.
|
|
(file wasm-run.mjs)))
|
|
|
|
; The corpus a second time under ASan and UBSan. Its own alias and not part of
|
|
; `dune test`: a sanitized build is a statically linked 1.8MB binary that takes
|
|
; tens of seconds to produce, so the sweep is minutes against the existing
|
|
; suite's seconds, and a test nobody will wait for is a test nobody runs.
|
|
;
|
|
; dune build --root . @sanitize
|
|
; An executable plus a rule rather than a (test ...): a test stanza attaches
|
|
; to the @runtest alias and offers no way to be attached to another one, which
|
|
; is the whole point here.
|
|
(executable
|
|
(name test_sanitize)
|
|
(modules test_sanitize)
|
|
(libraries flan unix))
|
|
|
|
(rule
|
|
(alias sanitize)
|
|
(deps
|
|
test_sanitize.exe
|
|
(file %{workspace_root}/calc-me.flan)
|
|
(file %{workspace_root}/sand.flan)
|
|
(glob_files %{workspace_root}/vendor/raylib/*)
|
|
(glob_files %{workspace_root}/vendor/agent/*)
|
|
(glob_files %{workspace_root}/vendor/edn/*)
|
|
(glob_files %{workspace_root}/examples/*)
|
|
(glob_files programs/*.flan))
|
|
(action (run ./test_sanitize.exe)))
|