From c2c2e1771bf9b747f38dc145b5201b45c579d465 Mon Sep 17 00:00:00 2001 From: _ov4 Date: Sun, 26 Jul 2026 18:10:10 +0000 Subject: fix: close type-safety holes found by adversarial review; update docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review findings (all reproduced, then fixed and re-verified): - '^x' leaked as a raw address into any builtin context (s <- ^x printed the variable's bytes as a C string; NOT ^x, '&', and ^x = ^x compiled). Address-of is now rejected everywhere except a pointer-typed target. - A whole-array variable passed the nominal gate as a value of its ELEMENT type (s <- arrayOfSeason stored the raw data pointer; = on it emitted invalid IR). Whole arrays are now rejected as operands and as coercion sources; array parameters are unaffected. - Enum values smuggled into INTEGER through array subscripts and DECLARE bounds (a[Autumn], ARRAY[Spring:Winter]); both now go through emitCoercedExpr like every other INTEGER context. - An array DECLAREd inside an IF/WHILE/REPEAT/FOR body and used after the block was a wild-pointer write (constant bounds) or a verifier dump (runtime bounds). Arrays are now block-scoped: control-flow bodies snapshot and restore the ArrayTable, so escape is a clean compile error. - Duplicate parameter names silently shadowed (BYREF write-back defeated); now a parse error. Trailing comma in parameter lists accepted; now a parse error consistent with every other list. - A variable/array/parameter/function could reuse a TYPE name; reserved. - RETURN with a value inside a PROCEDURE was silently discarded (control did not return); now an error, as is a bare RETURN in a FUNCTION. - INPUT r.f mis-parsed into a three-error cascade; now one clear error. - Assigning to an enum constant now says so instead of 'Unknown variable'. Docs: ARCH/CONVENTIONS/EXTENDING/SUBSYSTEMS/PITFALLS rewritten for the TYPE system (ABI additions, nominal-typing invariants, admission-gate doors, array-parameter ABI, new recipes, new sharp edges); README features/TODO updated — random files are unblocked. Co-Authored-By: Claude Fable 5 --- lib/CodeGen/CodeGen.cc | 50 +++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 47 insertions(+), 3 deletions(-) (limited to 'lib/CodeGen/CodeGen.cc') diff --git a/lib/CodeGen/CodeGen.cc b/lib/CodeGen/CodeGen.cc index 64e1b9f..0e372d0 100644 --- a/lib/CodeGen/CodeGen.cc +++ b/lib/CodeGen/CodeGen.cc @@ -402,6 +402,11 @@ void CodeGen::emitDeclareStmt(DeclareStmtAST *Stmt) { Stmt->getName().c_str()); return; } + if (Types->resolve(Stmt->getName())) { + reportError("'%s' is a type name and cannot be declared as a variable", + Stmt->getName().c_str()); + return; + } Function *TheFunction = Builder->GetInsertBlock()->getParent(); AllocaInst *Alloca = CreateEntryBlockAlloca(TheFunction, Info->LLVMType, Stmt->getName()); @@ -603,6 +608,18 @@ Value *CodeGen::emitExpr(ExprAST *Expr) { } if (auto *Bin = dynamic_cast(Expr)) { + // Whole arrays evaluate to raw data pointers and ^x to raw addresses; + // neither is a value any operator may consume. + if (isWholeArrayVar(Bin->getLHS()) || isWholeArrayVar(Bin->getRHS())) { + reportError("A whole array cannot be used as an operand; index it"); + return nullptr; + } + if (dynamic_cast(Bin->getLHS()) || + dynamic_cast(Bin->getRHS())) { + reportError("'^' (address-of) can only be used where a pointer type is expected"); + return nullptr; + } + // Enum/Record/Pointer operands never reach ArithmeticHandler or the // '&' path: their admissible operations are decided by name here. const TypeInfo *LT = getExprTypeInfo(Bin->getLHS()); @@ -825,13 +842,18 @@ void CodeGen::emitIfStmt(IfStmtAST *Stmt) { Builder->CreateCondBr(CondV, ThenBB, ElseBB); + // Arrays are block-scoped: metadata SSA values and the buffer setup live + // inside the branch, so a declaration must not survive it. + auto SavedArrays = Arrays->snapshotTable(); Builder->SetInsertPoint(ThenBB); for (const auto &S : Stmt->getThenStmts()) emitStmt(S.get()); if (!Builder->GetInsertBlock()->getTerminator()) Builder->CreateBr(MergeBB); + Arrays->exchangeTable(SavedArrays); Builder->SetInsertPoint(ElseBB); for (const auto &S : Stmt->getElseStmts()) emitStmt(S.get()); if (!Builder->GetInsertBlock()->getTerminator()) Builder->CreateBr(MergeBB); + Arrays->exchangeTable(std::move(SavedArrays)); Builder->SetInsertPoint(MergeBB); } @@ -851,8 +873,11 @@ void CodeGen::emitWhileStmt(WhileStmtAST *Stmt) { Builder->CreateCondBr(CondV, LoopBB, AfterBB); + // Arrays declared in the body are block-scoped (see emitIfStmt). + auto SavedArrays = Arrays->snapshotTable(); Builder->SetInsertPoint(LoopBB); for (const auto &S : Stmt->getBody()) emitStmt(S.get()); + Arrays->exchangeTable(std::move(SavedArrays)); if (!Builder->GetInsertBlock()->getTerminator()) Builder->CreateBr(CondBB); @@ -869,8 +894,11 @@ void CodeGen::emitRepeatStmt(RepeatStmtAST *Stmt) { Builder->CreateBr(LoopBB); + // Arrays declared in the body are block-scoped (see emitIfStmt). + auto SavedArrays = Arrays->snapshotTable(); Builder->SetInsertPoint(LoopBB); for (const auto &S : Stmt->getBody()) emitStmt(S.get()); + Arrays->exchangeTable(std::move(SavedArrays)); if (!Builder->GetInsertBlock()->getTerminator()) Builder->CreateBr(CondBB); @@ -934,8 +962,11 @@ void CodeGen::emitForStmt(ForStmtAST *Stmt) { Builder->CreateCondBr(CondV, LoopBB, AfterBB); + // Arrays declared in the body are block-scoped (see emitIfStmt). + auto SavedArrays = Arrays->snapshotTable(); Builder->SetInsertPoint(LoopBB); for (const auto &S : Stmt->getBody()) emitStmt(S.get()); + Arrays->exchangeTable(std::move(SavedArrays)); if (!Builder->GetInsertBlock()->getTerminator()) Builder->CreateBr(IncBB); @@ -984,10 +1015,19 @@ void CodeGen::emitStmt(StmtAST *Stmt) { } if (auto *Ret = dynamic_cast(Stmt)) { + Function *F = Builder->GetInsertBlock()->getParent(); + const FuncSig *Sig = FuncGen->getSignature(F->getName().str()); + if (Sig && Sig->ReturnTypeName == "VOID" && Ret->getRetVal()) { + reportError("RETURN with a value is only allowed in a FUNCTION"); + return; + } + if (Sig && Sig->ReturnTypeName != "VOID" && !Ret->getRetVal()) { + reportError("RETURN in a FUNCTION requires a value"); + return; + } Value *RetVal = nullptr; if (Ret->getRetVal()) { - Function *F = Builder->GetInsertBlock()->getParent(); - if (const FuncSig *Sig = FuncGen->getSignature(F->getName().str())) { + if (Sig) { RetVal = emitCoercedExpr(Ret->getRetVal(), resolveType(Sig->ReturnTypeName)); } else { RetVal = emitExpr(Ret->getRetVal()); @@ -1006,7 +1046,11 @@ void CodeGen::emitStmt(StmtAST *Stmt) { if (auto *Assign = dynamic_cast(Stmt)) { const SymbolInfo *Info = getSymbolInfo(Assign->getName()); if (!Info) { - reportError("Unknown variable name %s", Assign->getName().c_str()); + if (Types->lookupEnumConstant(Assign->getName())) { + reportError("Enum value %s is not an assignable location", Assign->getName().c_str()); + } else { + reportError("Unknown variable name %s", Assign->getName().c_str()); + } return; } if (Info->IsArray) { -- cgit v1.3.1-4-g156e