From 46ed71235278c2bba46fb0c25ebc2461b1dc2042 Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Sun, 14 Jun 2026 23:18:28 +0900 Subject: [PATCH] lib/math+encoding: restore Hare loud preconditions (F-Q) Three lib functions had lost their Hare loud-abort preconditions, so an out-of-domain argument silently returned garbage instead of aborting: random.u32n / random.u64n assert(n != 0) ref/hare/math/random/random.ha:26,42 base64.decodedsize assert(sz%4 == 0) ref/hare/encoding/base64/base64.ha:597 Source-bundled lib change, identical on both stages (byte-id neutral). 989_libprecond_abort pins each precondition: n=0 / sz%4!=0 abort (rc!=0), valid args return 0, run on cstage and wwstage. --- Makefile | 8 ++ lib/encoding/base64/base64.ww | 1 + lib/math/random/random.ww | 2 + test/wcc/989_libprecond_abort.c | 202 ++++++++++++++++++++++++++++++++ 4 files changed, 213 insertions(+) create mode 100644 test/wcc/989_libprecond_abort.c diff --git a/Makefile b/Makefile index 879f418a..a9d0c970 100644 --- a/Makefile +++ b/Makefile @@ -259,6 +259,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_nullableglobal_reject \ $(BIN)/test_taggedcompoundderef_reject \ $(BIN)/test_taggedcompoundplace_reject \ + $(BIN)/test_libprecond_abort \ $(BIN)/test_idxarg_run \ $(BIN)/test_chainidx_run \ $(BIN)/test_tupfieldsize_run \ @@ -766,6 +767,13 @@ $(BIN)/test_taggedcompoundderef_reject: test/wcc/989_taggedcompoundderef_reject. $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +$(BIN)/test_libprecond_abort: test/wcc/989_libprecond_abort.c \ + $(BIN)/ww $(BIN)/ww_ww \ + $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + # 989_taggedcompoundplace_reject (#20/#21, last two members of the # compound-OP-on-tagged-place reject class): `gs[i] OP= v` / `a[i] OP= v` # (INDEX, #20) and `g OP= v` (IDENT, #21) on a tagged-union place are diff --git a/lib/encoding/base64/base64.ww b/lib/encoding/base64/base64.ww index 44e5a3a5..ad26322c 100644 --- a/lib/encoding/base64/base64.ww +++ b/lib/encoding/base64/base64.ww @@ -413,5 +413,6 @@ export fn encodedsize(sz: i32) i32 = { // length is up to 2 bytes shorter, depending on padding). `sz` must be a // multiple of 4. ref/hare/encoding/base64/base64.ha:596-599. export fn decodedsize(sz: i32) i32 = { + assert(sz % 4i32 == 0i32); // ref/hare/encoding/base64/base64.ha:597 return sz / 4 * 3; }; diff --git a/lib/math/random/random.ww b/lib/math/random/random.ww index 5c6af3cc..dd315f06 100644 --- a/lib/math/random/random.ww +++ b/lib/math/random/random.ww @@ -28,6 +28,7 @@ export fn next(r: *random) u64 = { // fast unbiased mapping (mulhi-then-leftover-reject). Mirrors Hare's // random::u32n. export fn u32n(r: *random, n: u32) u32 = { + assert(n != 0u32); // ref/hare/math/random/random.ha:26 let x: u32 = next(r): u32; let prod: u64 = (x: u64) * (n: u64); let leftover: u32 = prod: u32; @@ -48,6 +49,7 @@ export fn u32n(r: *random, n: u32) u32 = { // path; otherwise rejection-sample to avoid modulo bias. Mirrors // Hare's random::u64n. export fn u64n(r: *random, n: u64) u64 = { + assert(n != 0u64); // ref/hare/math/random/random.ha:42 if ((n & (n - 1u64)) == 0u64) { return next(r) & (n - 1u64); }; // max = U64_MAX - (U64_MAX+1) % n = -1 - (-n % n) let neg: u64 = (0u64 - n); diff --git a/test/wcc/989_libprecond_abort.c b/test/wcc/989_libprecond_abort.c new file mode 100644 index 00000000..f0a131f8 --- /dev/null +++ b/test/wcc/989_libprecond_abort.c @@ -0,0 +1,202 @@ +/* + * 989_libprecond_abort (F-Q) — three lib functions had lost their Hare + * loud-abort PRECONDITIONS, so an out-of-domain argument silently returned + * garbage instead of aborting. This pins the restored asserts: + * + * lib/math/random/random.ww u32n assert(n != 0) ref/hare/.../random.ha:26 + * lib/math/random/random.ww u64n assert(n != 0) ref/hare/.../random.ha:42 + * lib/encoding/base64/... decodedsize assert(sz % 4 == 0) base64.ha:597 + * + * Pre-fix every abort row BUILT rc=0 and RAN rc=0 (the precondition was + * absent — silent garbage). The fix is a lib source change, source-bundled + * into each build, so it takes effect identically on both stages with no + * codegen change (byte-id NEUTRAL). + * + * row | call | result (cs == ww) + * --------------------------+-----------------------+------------------- + * u32n_zero_abort | u32n(&g, 0) | run aborts (rc!=0) + * u32n_valid_ok | u32n(&g, 10) in [0,10)| run rc == 0 + * u32n_one_ok | u32n(&g, 1) in [0,1) | run rc == 0 + * u64n_zero_abort | u64n(&g, 0) | run aborts (rc!=0) + * u64n_valid_ok | u64n(&g, 10) in [0,10)| run rc == 0 + * u64n_one_ok | u64n(&g, 1) in [0,1) | run rc == 0 + * decodedsize_unalign_abort | decodedsize(5) | run aborts (rc!=0) + * decodedsize_align_ok | decodedsize(8) == 6 | run rc == 0 + * + * The abort rows BUILD clean and abort at RUNTIME (unlike a reject row, + * which fails the build) — this harness builds then runs each fixture and + * checks the run exit, not the build exit. Rows run on cstage `ww` and, + * when present, wwstage `ww_ww`; both must agree. Sibling idiom: + * 989_taggedcompoundderef_reject.c (driver loop, /tmp fixture scaffolding). + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { + const char *label; + const char *src; + int want_abort; /* 1 = run must abort (rc!=0); 0 = run rc==want_exit */ + int want_exit; +}; + +#define RNG_HDR \ + "package main;\n" \ + "import random;\n" \ + "export fn main() int = {\n" \ + "\tlet g: random.random = random.init(1u64);\n" + +#define B64_HDR \ + "package main;\n" \ + "import base64;\n" \ + "export fn main() int = {\n" + +static const struct row rows[] = { + { "u32n_zero_abort", + RNG_HDR "\tlet x: u32 = random.u32n(&g, 0u32);\n\treturn 0;\n};\n", + 1, 0 }, + { "u32n_valid_ok", + RNG_HDR "\tlet x: u32 = random.u32n(&g, 10u32);\n" + "\tif (x >= 10u32) { return 1; };\n\treturn 0;\n};\n", + 0, 0 }, + { "u32n_one_ok", /* boundary: n=1 is the smallest VALID arg */ + RNG_HDR "\tlet x: u32 = random.u32n(&g, 1u32);\n" + "\tif (x >= 1u32) { return 1; };\n\treturn 0;\n};\n", + 0, 0 }, + { "u64n_zero_abort", + RNG_HDR "\tlet x: u64 = random.u64n(&g, 0u64);\n\treturn 0;\n};\n", + 1, 0 }, + { "u64n_valid_ok", + RNG_HDR "\tlet x: u64 = random.u64n(&g, 10u64);\n" + "\tif (x >= 10u64) { return 1; };\n\treturn 0;\n};\n", + 0, 0 }, + { "u64n_one_ok", /* boundary: n=1 is the smallest VALID arg */ + RNG_HDR "\tlet x: u64 = random.u64n(&g, 1u64);\n" + "\tif (x >= 1u64) { return 1; };\n\treturn 0;\n};\n", + 0, 0 }, + { "decodedsize_unalign_abort", + B64_HDR "\tlet c: i32 = base64.decodedsize(5i32);\n\treturn 0;\n};\n", + 1, 0 }, + { "decodedsize_align_ok", + B64_HDR "\tlet c: i32 = base64.decodedsize(8i32);\n" + "\tif (c != 6i32) { return 1; };\n\treturn 0;\n};\n", + 0, 0 }, +}; + +/* Build `r->src` with `driver`, then run it. Returns the RUN exit code, or + * -1 if the build failed (the harness treats a build miss as a hard error: + * every row here must build clean — only the RUN may abort). `incs` is the + * colon-free `-I a -I b ...` include flag string already composed by main. */ +static int +build_and_run(const char *driver, const char *incs, const struct row *r, int i) +{ + char src[64], tmpdir[64], cmd[2048]; + snprintf(src, sizeof src, "/tmp/lpc_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/lpc_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -2; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s %s 2>/dev/null", + tmpdir, driver, incs, src); + int brc = runwait(cmd); + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[160]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + + int got = (brc == 0) ? runwait(outbin) : -1; + + unlink(src); unlink(outbin); rmdir(tmpdir); + return brc == 0 ? got : -1; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char cwd[1024]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + char absbin[1024]; + if (bin[0] != '/') { + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + /* random lives at lib/math/random, base64 at lib/encoding/base64; + * the leaf-only imports resolve via these -I dirs (base64's own + * bytes/io/... deps resolve via the driver's default lib srcdir). + * Absolute so the per-row `cd ` does not break resolution. */ + char incs[1024]; + snprintf(incs, sizeof incs, "-I %s/lib -I %s/lib/math -I %s/lib/encoding", + cwd, cwd, cwd); + + char cdrv[1024], wdrv[1024]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *drv; int gated; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated && access(drivers[d].drv, X_OK) != 0) { + fprintf(stderr, "libprecond_abort: skip %s (no %s)\n", + drivers[d].name, drivers[d].drv); + continue; + } + for (int i = 0; i < n; i++) { + total++; + int got = build_and_run(drivers[d].drv, incs, &rows[i], i); + if (rows[i].want_abort) { + if (got == 0 || got < 0) { + fprintf(stderr, "libprecond_abort[%s][%s]: run rc=%d, " + "expected a loud abort (rc!=0)%s\n", + drivers[d].name, rows[i].label, got, + got < 0 ? " [build failed]" : ""); + fail++; + } + } else { + if (got != rows[i].want_exit) { + fprintf(stderr, "libprecond_abort[%s][%s]: run rc=%d " + "want=%d\n", drivers[d].name, rows[i].label, got, + rows[i].want_exit); + fail++; + } + } + } + } + + if (fail) { + fprintf(stderr, "libprecond_abort: %d/%d fixtures failed\n", + fail, total); + return 1; + } + printf("libprecond_abort: %d/%d ok\n", total, total); + return 0; +}