@amritk/nish-x86_64-linux 0.18.0 → 0.21.0

package/runtime/runtime.c

@@ -18,6 +18,7 @@
  * both use `-flto`, and the cold paths that lost the inlining are cold.
  */
 #define _POSIX_C_SOURCE 200809L
+#include <errno.h>
 #include <inttypes.h>
 #include <math.h>
 #include <stddef.h>
@@ -40,6 +41,25 @@ int __main_argc_argv(int argc, char **argv) { return nish_c_main(argc, argv); }
 
 #define NISH_COLD __attribute__((noreturn, cold, noinline))
 
+/* ---- AddressSanitizer build (`-DNISH_ASAN`, tests/differential/asan.js)
+   A bump arena hides every overflow from ASan: one 64 KB malloc holds many
+   blocks, so a read past one block lands in the next and nothing is poisoned.
+   Under `NISH_ASAN` each arena block is a malloc of its own (`nish_asan_alloc`,
+   which asan.js also points compiled code's inline bump at), so a read one past
+   it hits ASan's redzone; the bytes the 8-byte rounding adds, an array's spare
+   capacity and an array's block left behind by growth are poisoned by hand.
+   Off, the macro is empty and the file compiles to the same object code it
+   always did. What it cannot see: a `pop` leaves the popped element
+   addressable below `cap` (the pop is inline IR), and a string's NUL is one
+   addressable byte past its `length`. `nish_arena_used` reads differently
+   under ASan, since every block is a chunk of its own. */
+#ifdef NISH_ASAN
+#include <sanitizer/asan_interface.h>
+#define NISH_POISON(p, n) __asan_poison_memory_region((p), (n))
+#else
+#define NISH_POISON(p, n) ((void)0)
+#endif
+
 /* ---- Thread-local state (WP20 T0)
    The arena and the RNG seed are the only mutable process-wide objects here,
    and both are a data race the moment a second thread runs compiled code. With
@@ -69,6 +89,11 @@ int __main_argc_argv(int argc, char **argv) { return nish_c_main(argc, argv); }
    allocates from compiled code. The asserts below are the contract, checked
    wherever this file is compiled. */
 typedef struct nish_chunk { struct nish_chunk *next; uint64_t cap; } nish_chunk;
+/* runtime-cross.c walks the chunks through a copy of this definition, which
+   asserts the same three facts. */
+_Static_assert(sizeof(nish_chunk) == 16, "runtime-cross.c's nish_xchunk: { next, cap }, the bytes after it");
+_Static_assert(offsetof(nish_chunk, next) == 0, "runtime-cross.c's nish_xchunk: next first");
+_Static_assert(offsetof(nish_chunk, cap) == 8, "runtime-cross.c's nish_xchunk: cap second");
 struct nish_arena { char *buf; uint64_t off; uint64_t cap; nish_chunk *chunks; };
 /* One per thread under -DNISH_THREADS, one per process otherwise; the layout is
    the same either way, which is why nothing else in this file has to know. */
@@ -79,14 +104,68 @@ _Static_assert(offsetof(struct nish_arena, off) == 8, "the inlined allocator bum
 _Static_assert(offsetof(struct nish_arena, cap) == 16, "the inlined allocator reads field 2");
 _Static_assert(offsetof(struct nish_arena, chunks) == 24, "arena layout is ABI");
 
-/* `fputs` rather than one `write`: libc's own loop finishes a short write,
-   which a bare `write` would cut off (docs/security/runtime.md, RT-11), and
-   stderr is unbuffered, so the message leaves before `_exit`. A C host that
-   gives stderr a buffer of its own would lose it here. */
-static NISH_COLD void nish_die(const char *msg) {
-  fputs(msg, stderr);
+/* ---- Panics: the first one wins.
+
+   Every way a program fails -- a failed check, `panic`, out of memory -- calls
+   `nish_panic_claim` before it prints. Two tasks of a scope, or two workers of
+   a parallel map, can fail at once, and without the claim both messages would
+   reach stderr interleaved and both threads would race to the exit. The first
+   to claim prints its whole message and exits; any later one parks until
+   that exit ends the process, so exactly one message is printed and the exit
+   code is the first panic's. How each path exits is unchanged by the claim:
+   `panic`, `expect` and a failed range entry (`nish_panic`) call `exit(1)`, as
+   they did through `nish_exit`, so atexit handlers run and stdio is flushed;
+   a failed check and out of memory call `_exit(1)`, as they always have. Only
+   one thread can reach either exit, because the claim comes first. Only a
+   threads build (`-DNISH_THREADS`) can have two threads panic, so only it
+   pays for the claim; everywhere else it is an empty inline function. Under wasi with threads, the trap is the
+   defensive answer: no host there gives a parked thread a way to wait. */
+#ifdef NISH_THREADS
+static int nish_panicked;
+void nish_panic_claim(void) {
+  if (__atomic_exchange_n(&nish_panicked, 1, __ATOMIC_ACQ_REL)) {
+#if defined(__wasi__)
+    __builtin_trap();
+#else
+    for (;;) pause();
+#endif
+  }
+}
+#else
+static inline void nish_panic_claim(void) {}
+#endif
+
+/* How a panic that skips atexit ends: `_exit(1)`, after `nish_fatal_hook` when
+   it is set. `setRawMode(true)` and `setTerminalRestore` (runtime-term.c) set
+   the hook to the terminal's restore, and without it a failed bounds check
+   would leave the shell in raw mode. Each
+   panic path calls this where it called `_exit(1)`, so a call site costs no
+   more than it did; `exit(1)` paths need nothing, since the restore is also an
+   atexit handler. Built with `-DNISH_FUZZ_ABORT` (scripts/fuzz.sh), this and
+   `nish_panic` end in `abort()` instead, so libFuzzer records a panic, a failed
+   bounds or division check and an out-of-memory as a crash; the default build
+   compiles neither. */
+__attribute__((noreturn)) void nish_fatal_exit(void);
+void (*nish_fatal_hook)(void);
+void nish_fatal_exit(void) {
+  void (*hook)(void) = __atomic_load_n(&nish_fatal_hook, __ATOMIC_ACQUIRE);
+  if (hook) hook();
+#ifdef NISH_FUZZ_ABORT
+  abort();
+#endif
   _exit(1);
 }
+
+/* The message goes out through `nish_write_all`, below, which finishes a
+   short write and retries one a signal interrupts (docs/security/runtime.md,
+   RT-11); it is unbuffered, so the message leaves before `_exit`. It used
+   `fputs`, whose libc loop finishes a short write but gives up on `EINTR`. */
+static void nish_write_all(int fd, const char *p, uint64_t n);
+static NISH_COLD void nish_die(const char *msg) {
+  nish_panic_claim();
+  nish_write_all(2, msg, strlen(msg));
+  nish_fatal_exit();
+}
 /* A function rather than a macro around `nish_die`: seven call sites each
    loading the message's address cost more than one more symbol does. */
 static NISH_COLD void nish_oom(void) { nish_die("nish: out of memory\n"); }
@@ -97,7 +176,13 @@ static NISH_COLD void nish_oom(void) { nish_die("nish: out of memory\n"); }
 
 /* Slow path (size 8-byte rounded): push a chunk (>= 64 KB), bump from it. */
 void *nish_arena_grow(uint64_t size) {
+#ifdef NISH_ASAN
+  /* An exact chunk leaves off == cap, so the inline bump never fits again and
+     every block comes through here: one malloc, one redzone, per block. */
+  uint64_t cap = size;
+#else
   uint64_t cap = size > 65536 ? size : 65536;
+#endif
   /* A 64-bit request cannot always be asked for: wasm32's `size_t` is 32 bits,
      and malloc would silently take the low half of a chunk nobody can address. */
   if (cap > (uint64_t)(SIZE_MAX - sizeof(nish_chunk))) nish_oom();
@@ -112,8 +197,22 @@ void *nish_arena_grow(uint64_t size) {
   return nish_arena.buf;
 }
 
+#ifdef NISH_ASAN
+/* An instrumented program's every arena block: an exact chunk, so the inline
+   bump never fits again, with the bytes the rounding adds poisoned. */
+void *nish_asan_alloc(uint64_t size) {
+  uint64_t rounded = (size + 7) & ~(uint64_t)7;
+  char *p = nish_arena_grow(rounded);
+  NISH_POISON(p + size, rounded - size);
+  return p;
+}
+#endif
+
 /* Bump allocation, 8-byte rounded/aligned, uninitialised; the compiler inlines it. */
 void *nish_alloc_struct(uint64_t size) {
+#ifdef NISH_ASAN
+  return nish_asan_alloc(size);
+#endif
   size = (size + 7) & ~(uint64_t)7;
   if (nish_arena.off + size <= nish_arena.cap) {
     void *p = nish_arena.buf + nish_arena.off;
@@ -123,12 +222,91 @@ void *nish_alloc_struct(uint64_t size) {
   return nish_arena_grow(size);
 }
 
+#ifdef NISH_ASAN
+/* The capacity a normal build would give each array `nish_array_grow` grew.
+   `cap` stays `len + 1`, since the push writes `data[len]` inline and spare
+   capacity would be addressable, but growing one slot at a time copies the
+   whole array on every push. So a block is allocated at the capacity a normal
+   build would choose, its tail poisoned, and each later grow of the same array
+   unpoisons one more slot in place until that capacity is used up. The block
+   then moves at exactly the push where a normal build reallocates, so a
+   pointer kept across that push reads poison.
+   The table is keyed by the grown block and loses an entry only when that
+   block dies: the grow that moves it, or `nish_free_until` freeing its chunk
+   (every ASan block is a chunk of its own). It is one table for every thread,
+   behind a spin lock, so an array grown on one thread and pushed on another
+   still hits. A miss is therefore an array no grow has moved yet, whose `cap`
+   is the one a normal build gave it, so the block never moves late. Open
+   addressing, linear probes, a tombstone for a dead entry, rebuilt at half
+   full. */
+#define NISH_GROWN_DEAD ((char *)1)
+static struct nish_grown { char *data; const void *owner; uint64_t native; } *nish_grown;
+static uint64_t nish_grown_cap, nish_grown_used, nish_grown_live; /* used = live + tombstones */
+static int nish_grown_lock;
+
+static void nish_grown_enter(void) {
+  while (__atomic_exchange_n(&nish_grown_lock, 1, __ATOMIC_ACQUIRE)) {}
+}
+static void nish_grown_leave(void) { __atomic_store_n(&nish_grown_lock, 0, __ATOMIC_RELEASE); }
+
+static uint64_t nish_grown_hash(const char *data) {
+  return ((uintptr_t)data * 0x9E3779B97F4A7C15ull >> 32) & (nish_grown_cap - 1);
+}
+
+static struct nish_grown *nish_grown_find(const char *data) {
+  if (!nish_grown_cap || !data) return 0;
+  for (uint64_t i = nish_grown_hash(data);; i = (i + 1) & (nish_grown_cap - 1)) {
+    if (nish_grown[i].data == data) return &nish_grown[i];
+    if (!nish_grown[i].data) return 0;
+  }
+}
+
+static void nish_grown_drop(const char *data) {
+  struct nish_grown *g = nish_grown_find(data);
+  if (g) g->data = NISH_GROWN_DEAD, nish_grown_live--;
+}
+
+static void nish_grown_put(char *data, const void *owner, uint64_t native) {
+  if ((nish_grown_used + 1) * 2 > nish_grown_cap) {
+    struct nish_grown *old = nish_grown;
+    uint64_t n = nish_grown_cap, cap = 64;
+    while (cap < (nish_grown_live + 1) * 4) cap *= 2;
+    nish_grown = calloc(cap, sizeof *nish_grown);
+    if (!nish_grown) nish_oom();
+    nish_grown_cap = cap, nish_grown_used = nish_grown_live = 0;
+    for (uint64_t i = 0; i < n; i++)
+      if (old[i].data > NISH_GROWN_DEAD) nish_grown_put(old[i].data, old[i].owner, old[i].native);
+    free(old);
+  }
+  uint64_t i = nish_grown_hash(data);
+  while (nish_grown[i].data > NISH_GROWN_DEAD) i = (i + 1) & (nish_grown_cap - 1);
+  if (!nish_grown[i].data) nish_grown_used++;
+  nish_grown[i] = (struct nish_grown){ data, owner, native };
+  nish_grown_live++;
+}
+#endif
+#ifdef NISH_ASAN
+void nish_free_arena(void);
+#endif
 static void nish_free_until(nish_chunk *c, const nish_chunk *end) {
+#ifdef NISH_ASAN
+  /* A freed block's address comes back from malloc: forget the grown ones. */
+  if (nish_grown_live) {
+    nish_grown_enter();
+    for (nish_chunk *d = c; d != end; d = d->next) nish_grown_drop((char *)(d + 1));
+    nish_grown_leave();
+  }
+#endif
   while (c != end) { nish_chunk *n = c->next; free(c); c = n; }
 }
 
 /* O(1) recycle: keep the newest chunk, free the rest. */
 void nish_reset_arena(void) {
+#ifdef NISH_ASAN
+  /* Free everything, so a value read after the reset is a use after free. */
+  nish_free_arena();
+  return;
+#endif
   nish_chunk *keep = nish_arena.chunks;
   if (!keep) return;
   nish_free_until(keep->next, 0);
@@ -283,19 +461,38 @@ int64_t nish_str_index_of(const nish_str *s, const nish_str *sub) { return nish_
    does the same. So the bytes are written until all of them are out, or until
    a write fails (docs/security/runtime.md, RT-11). A failure still ends the
    output, `EAGAIN` on a non-blocking stdout included, since spinning on it
-   would burn a core. `EINTR` is not retried here: it needs a handler
-   installed without `SA_RESTART`, and the only one this runtime installs
-   (runtime-host.c) has it, so an interrupted write either restarts in the
-   kernel or comes back short. The newline needs no loop: one byte is never
-   written in part. */
-void nish_write(const nish_str *s, int32_t fd, _Bool newline) {
+   would burn a core. `EINTR` is retried, the newline's included: the only
+   handlers this runtime installs that return (runtime-host.c's and
+   runtime-term.c's SIGTSTP) have `SA_RESTART`, but a C host may install one
+   without it. `panic`'s message, `expect`'s, and the
+   arithmetic and out-of-memory panics (`nish_die`) are written here. The
+   index and slice panics and the file and entropy failures use `dprintf`, and
+   runtime-parallel.c's out of memory one `write`: neither retries `EINTR`. */
+static void nish_write_all(int fd, const char *p, uint64_t n) {
   uint64_t done = 0;
   ssize_t k;
-  while (done < s->len && (k = write(fd, s->data + done, s->len - done)) > 0) done += k;
-  if (newline) (void)!write(fd, "\n", 1);
+  while (done < n) {
+    k = write(fd, p + done, n - done);
+    if (k > 0) done += k;
+    else if (k == 0 || errno != EINTR) break;
+  }
+}
+void nish_write(const nish_str *s, int32_t fd, _Bool newline) {
+  nish_write_all(fd, s->data, s->len);
+  if (newline) nish_write_all(fd, "\n", 1);
 }
 /* console.log(s) */
 void nish_print(const nish_str *s) { nish_write(s, 1, 1); }
+/* `panic(message)`, `r.expect(message)` and a failed range entry: the message
+   and a newline on stderr, then `exit(1)`, the first panic only. */
+__attribute__((noreturn)) void nish_panic(const nish_str *s) {
+  nish_panic_claim();
+  nish_write(s, 2, 1);
+#ifdef NISH_FUZZ_ABORT
+  abort();
+#endif
+  exit(1);
+}
 
 /* Decimal digits of `u`, with a '-' in front when `neg`. 20 digits is the
    widest a uint64_t can be, plus the sign. */
@@ -1165,10 +1362,18 @@ nish_array *nish_alloc_array(uint64_t elem_size, uint64_t len) {
    this first. */
 nish_array *nish_argv;
 
+/* The key of every `Map` and `Set` string hash (docs/security/json.md, JSON-13):
+   SipHash-1-3's 128 bits, zero until the constructor each module that hashes
+   a string registers fills it from `getentropy` before `main`. Data, not code,
+   so it costs this file's `.text` budget nothing, and not NISH_TLS, for the
+   reason `nish_argv` is not: it is written once before any thread exists, and
+   a table one thread fills is probed by another under the same key. */
+uint64_t nish_hash_key[2];
+
 void nish_argv_init(int32_t argc, char **argv) {
   nish_array *a = malloc(sizeof *a + argc * sizeof(nish_str *));
-  nish_str **d = (nish_str **)(a + 1);
   if (!a) nish_oom();
+  nish_str **d = (nish_str **)(a + 1);
   *a = (nish_array){ argc, argc, (char *)d };
   nish_argv = a;
   while (argc-- > 0) {
@@ -1219,13 +1424,46 @@ double nish_parse_number(const nish_str *s, int32_t mode) {
  * line, every one of those rows runs fewer instructions than it did before, and
  * the call costs nothing on a path that runs once per doubling. */
 __attribute__((noinline)) void nish_array_grow(nish_array *a, uint64_t elem_size) {
+#ifdef NISH_ASAN
+  /* One more slot, not double (see `nish_grown`): in place while a normal build
+     would still have room, moved where it would reallocate. */
+  uint64_t native = a->cap, cap = a->len + 1;
+  nish_grown_enter();
+  struct nish_grown *g = nish_grown_find(a->data);
+  if (g && g->owner == a) native = g->native;
+  else g = 0;
+  if (g && cap <= native) {
+    nish_grown_leave();
+    __asan_unpoison_memory_region(a->data + a->len * elem_size, elem_size);
+    a->cap = cap;
+    return;
+  }
+  uint64_t room = native ? native * 2 : 4;
+  if (room > NISH_ARRAY_MAX) room = NISH_ARRAY_MAX;
+#else
   uint64_t cap = a->cap ? a->cap * 2 : 4;
+#endif
   if (cap > NISH_ARRAY_MAX) {
     if (a->len >= NISH_ARRAY_MAX) nish_oom();
     cap = NISH_ARRAY_MAX;
   }
+#ifdef NISH_ASAN
+  if (room < cap) room = cap;
+  char *data = nish_alloc_struct(room * elem_size);
+  NISH_POISON(data + cap * elem_size, (room - cap) * elem_size);
+#else
   char *data = nish_alloc_struct(cap * elem_size);
+#endif
   if (a->len) memcpy(data, a->data, a->len * elem_size);
+#ifdef NISH_ASAN
+  /* The old block is dead: a pointer kept across the push now reads poison.
+     Only a heap block, as a literal's may be on the stack or a constant. */
+  const char *kind = a->cap ? __asan_locate_address(a->data, 0, 0, 0, 0) : 0;
+  if (kind && !strcmp(kind, "heap")) NISH_POISON(a->data, (g ? native : a->cap) * elem_size);
+  if (g) nish_grown_drop(a->data);
+  nish_grown_put(data, a, room);
+  nish_grown_leave();
+#endif
   a->data = data;
   a->cap = cap;
 }
@@ -1245,8 +1483,9 @@ __attribute__((noinline)) void nish_wipe(nish_array *bytes) {
 }
 
 void nish_panic_index(uint64_t idx, uint64_t len) {
+  nish_panic_claim();
   dprintf(2, "index out of range: %" PRIu64 " >= %" PRIu64 "\n", idx, len);
-  _exit(1);
+  nish_fatal_exit();
 }
 
 /* `s.slice(start, end)` (WP15 section 4) with a range the string does not
@@ -1258,8 +1497,9 @@ void nish_panic_index(uint64_t idx, uint64_t len) {
    a reader who wrote `s.slice(i - 1)` wants to be told `-1` rather than
    18446744073709551615. The length cannot be negative either way. */
 void nish_panic_slice(int64_t start, int64_t end, int64_t len) {
+  nish_panic_claim();
   dprintf(2, "slice out of range: [%" PRId64 ", %" PRId64 ") of length %" PRId64 "\n", start, end, len);
-  _exit(1);
+  nish_fatal_exit();
 }
 
 /* ---- Checked arithmetic (Rust semantics): the failed-check paths. One table