@tishlang/tish-format 3.7.0 → 3.8.6

package/crates/tish_compile/src/lib.rs

@@ -117,6 +117,7 @@ fn count(): number {
     for (let i: number = 0; i < 10; i = i + 1) { total = total + i }
     return total
 }
+console.log(count())
 "#;
         let program = parse(src_native).unwrap();
         let rust = compile(&program).unwrap();
@@ -124,9 +125,14 @@ fn count(): number {
             rust.contains("let mut total: f64"),
             "numeric-only reassignment keeps `total` native f64"
         );
+        // The boxing moved, it did not disappear. With the boxed wrapper elided for a fn every
+        // caller reaches directly, the f64 is wrapped at the CALL SITE
+        // (`Value::Number(count_native())`) instead of inside a wrapper's return. Either spelling
+        // satisfies what this is checking — that a native f64 crosses back to Value at the boundary
+        // — so accept both rather than pinning the assertion to one codegen shape.
         assert!(
-            rust.contains("Value::Number(total)"),
-            "f64 total is wrapped back to Value at the return boundary"
+            rust.contains("Value::Number(total)") || rust.contains("Value::Number(count_native())"),
+            "f64 total is wrapped back to Value at a boundary (wrapper return or call site)"
         );
     }
 

package/crates/tish_compile/tests/regr_655_gba_stack_guard.rs

@@ -0,0 +1,41 @@
+//! #655 — the stack-overflow guard must actually be emitted on the GBA target.
+//!
+//! The recursion guard was gated OFF for `NativeEmitMode::Gba` (the no_std runtime had no
+//! stack-pressure probe), and the boxed guard's floor fell back to "never trips". GBA is the one
+//! target where that is unrecoverable: 32 KB of IWRAM, no MMU, no guard page — an unguarded
+//! overflow grows down into agb's live data (the audio mixer's buffers among them) and surfaces
+//! frames later as an illegal opcode at an address that names nothing.
+//!
+//! `tishlang_runtime_gba` now derives a real floor from the link map (`__iwram_end`), so both the
+//! typed and boxed guards are emitted here exactly as they are on the host.
+
+use std::path::PathBuf;
+
+use tishlang_compile::{compile_project_full_emit, NativeEmitMode};
+
+fn gba_rust(fixture: &str) -> String {
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join(fixture);
+    compile_project_full_emit(&path, path.parent(), &[], true, NativeEmitMode::Gba, None)
+        .expect("compile for gba")
+        .0
+}
+
+/// A self-recursive typed fn opens with the stack check and bails through the NaN sentinel.
+#[test]
+fn gba_typed_recursion_emits_stack_guard() {
+    let rust = gba_rust("../../tests/perf/recursion_fib.tish");
+    let copy0 = rust
+        .split("fn fib_native(")
+        .nth(1)
+        .expect("fib_native must be lowered on gba")
+        .split("\nfn ")
+        .next()
+        .unwrap()
+        .to_string();
+    assert!(
+        copy0.contains("tishlang_runtime::stack_low()")
+            && copy0.contains("tishlang_runtime::recursion_tripped_f64()"),
+        "gba typed recursion must open with the stack check — without it an overflow silently \
+         overwrites IWRAM instead of raising a catchable RangeError:\n{copy0}"
+    );
+}

package/crates/tish_fmt/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tishlang_fmt"
-version = "3.7.0"
+version = "3.8.6"
 edition = "2021"
 description = "Opinionated formatter for Tish source (parse → pretty-print)"
 license-file = { workspace = true }

package/crates/tish_native/src/build.rs

@@ -350,15 +350,107 @@ fn read_facade_agb_version(facade_path: &Path) -> Option<String> {
     None
 }
 
-/// Build a Game Boy Advance ROM from generated `#![no_std]` Rust.
+/// Cargo `[profile.*]` blocks for the nested GBA crate.
 ///
-/// Emits an agb-style cargo project (nightly + build-std + `thumbv4t-none-eabi` +
-/// `gba.ld`) that links the `tishlang_runtime_gba` facade under the `tishlang_runtime`
-/// name (the `package =` rename), builds it, then runs `agb-gbafix` on the ELF.
+/// #581 — the default used to be `lto = "fat"` + `codegen-units = 1`, which dominates wall-clock on
+/// the ~20k-line `run()` a real game generates, and every `tish build --target gba` paid it. Thin
+/// LTO across 8 CGUs keeps most of the size/speed win and lets rustc parallelize; fat LTO stays one
+/// env var away for a ship build.
 ///
-/// Runs its own `cargo build` (NOT `run_cargo_build`) so the `.cargo/config.toml`
-/// rustflags (`-Tgba.ld`, `-Ctarget-cpu=arm7tdmi`) apply — `run_cargo_build` sets a
-/// `RUSTFLAGS` env that would shadow them.
+/// Env knobs (checked here, not by cargo):
+/// - `TISH_FAST_NATIVE_BUILD=1` — iteration profile: no LTO, opt-level 1, many codegen-units.
+///   Same flag as desktop native; use this for day-to-day GBA work.
+/// - `TISH_GBA_FAT_LTO=1` — old ship profile: fat LTO + single CGU (slow; smallest/fastest ROM).
+/// - default — thin LTO, opt-level 3, 8 CGUs, no debuginfo. Much faster than fat LTO while still
+///   producing a solid ROM.
+/// - `TISH_GBA_DEBUG=1` — keep debuginfo in the release profile (slower link; for mgba backtraces).
+fn gba_cargo_profiles_toml() -> String {
+    let debug = if std::env::var("TISH_GBA_DEBUG").as_deref() == Ok("1") {
+        "true"
+    } else {
+        "false"
+    };
+    if std::env::var("TISH_FAST_NATIVE_BUILD").as_deref() == Ok("1") {
+        return format!(
+            r#"[profile.dev]
+opt-level = 1
+debug = {debug}
+
+[profile.dev.build-override]
+opt-level = 1
+
+[profile.release]
+opt-level = 1
+lto = false
+codegen-units = 16
+incremental = true
+debug = {debug}
+panic = "abort"
+
+[profile.release.build-override]
+opt-level = 1
+"#
+        );
+    }
+    // ⚠️ THIN LTO IS OPT-IN, AND THE REASON IS STACK, NOT SPEED. Less inlining means bigger frames,
+    // and a GBA has 32 KB of IWRAM for the whole stack. Measured on tish-gba's examples/ffta, same
+    // source, cold build dir:
+    //
+    //     profile   run()     factory   combined   vs 32,512 B usable stack
+    //     fat       23,604 +   7,452  =  31,056    fits, 1,456 B spare
+    //     thin      25,436 +   9,068  =  34,504    OVER by 1,992 B
+    //
+    // And it does not trap. The deepest SP under thin is 0x02FFF838; the GBA mirrors EWRAM every
+    // 256 KB, so that aliases 0x0203F838 — the top of the heap. The stack writes into allocated
+    // memory and the ROM keeps running, which is far worse to diagnose than a crash.
+    //
+    // The build-time win thin was introduced for is real but example-dependent: on a small ROM
+    // (examples/ffta-hud) it was 70s vs 86s with a 37 KB smaller output and byte-identical frames;
+    // on ffta itself it was SLOWER, 148s vs 137s. So it is offered, not defaulted.
+    if std::env::var("TISH_GBA_THIN_LTO").as_deref() == Ok("1") {
+        return format!(
+            r#"[profile.dev]
+opt-level = 3
+debug = {debug}
+
+[profile.dev.build-override]
+opt-level = 3
+
+[profile.release]
+opt-level = 3
+lto = "thin"
+codegen-units = 8
+debug = {debug}
+panic = "abort"
+
+[profile.release.build-override]
+opt-level = 3
+"#
+        );
+    }
+    // Default: fat LTO, one codegen unit — the smallest frames, which is what fits in IWRAM.
+    // `TISH_GBA_FAT_LTO=1` is still accepted and is now a no-op, so existing scripts keep working.
+    format!(
+        r#"[profile.dev]
+opt-level = 3
+debug = {debug}
+
+[profile.dev.build-override]
+opt-level = 3
+
+[profile.release]
+opt-level = 3
+lto = "fat"
+codegen-units = 1
+debug = {debug}
+panic = "abort"
+
+[profile.release.build-override]
+opt-level = 3
+"#
+    )
+}
+
 /// Read `version = "…"` from the `[package]` section of a crate's `Cargo.toml`.
 fn read_crate_version(crate_dir: &Path) -> Option<String> {
     let toml = fs::read_to_string(crate_dir.join("Cargo.toml")).ok()?;
@@ -475,6 +567,17 @@ tishlang_runtime = {{ path = {runtime:?}{version}{features} }}
     Ok(())
 }
 
+/// Build a Game Boy Advance ROM from generated `#![no_std]` Rust.
+///
+/// Emits an agb-style cargo project (nightly + build-std + `thumbv4t-none-eabi` +
+/// `gba.ld`) that links the `tishlang_runtime_gba` facade under the `tishlang_runtime`
+/// name (the `package =` rename), builds it, then runs `agb-gbafix` on the ELF.
+///
+/// Runs its own `cargo build` (NOT `run_cargo_build`) so the `.cargo/config.toml`
+/// rustflags (`-Tgba.ld`, `-Ctarget-cpu=arm7tdmi`) apply — `run_cargo_build` sets a
+/// `RUSTFLAGS` env that would shadow them.
+///
+/// Profiles come from [`gba_cargo_profiles_toml`].
 fn build_gba_rom(
     rust_code: &str,
     native_modules: Vec<ResolvedNativeModule>,
@@ -543,6 +646,7 @@ fn build_gba_rom(
     }
 
     let facade = facade_path.display().to_string().replace('\\', "/");
+    let profiles = gba_cargo_profiles_toml();
     let cargo_toml = format!(
         r#"[package]
 name = "tish_output"
@@ -561,28 +665,29 @@ path = "src/main.rs"
 tishlang_runtime = {{ package = "tishlang_runtime_gba", path = {facade:?} }}
 agb = "{agb_version}"
 {more_deps}
-[profile.dev]
-opt-level = 3
-debug = true
-
-[profile.dev.build-override]
-opt-level = 3
-
-[profile.release]
-opt-level = 3
-lto = "fat"
-debug = true
-
-[profile.release.build-override]
-opt-level = 3
+{profiles}
 "#,
     );
     fs::write(build_dir.join("Cargo.toml"), cargo_toml)
         .map_err(|e| format!("Cannot write Cargo.toml: {}", e))?;
 
+    // Inherit the project's toolchain pin when it has one.
+    //
+    // rustup honours the `rust-toolchain.toml` NEAREST the directory cargo runs in, and this
+    // generated file sits in `.tish/gba/<name>/` — so it wins over the pin in the project's own
+    // checkout. Writing a bare `channel = "nightly"` here therefore made every GBA build float: the
+    // compiler could change under an unchanged checkout, and differ from CI or another machine, with
+    // nothing in the source to show it. Inheriting the project's channel makes the checkout the
+    // single source of truth; projects without a pin still get `nightly` exactly as before.
+    //
+    // Only the channel is inherited. `components` stays `rust-src` because that is what build-std
+    // needs — copying a project's `clippy`/`rustfmt` entries in would fail the ROM build whenever
+    // the pinned toolchain lacks a component the ROM never uses.
+    let channel =
+        find_project_toolchain_channel(&base).unwrap_or_else(|| "nightly".to_string());
     fs::write(
         build_dir.join("rust-toolchain.toml"),
-        "[toolchain]\nchannel = \"nightly\"\ncomponents = [\"rust-src\"]\n",
+        format!("[toolchain]\nchannel = \"{}\"\ncomponents = [\"rust-src\"]\n", channel),
     )
     .map_err(|e| format!("Cannot write rust-toolchain.toml: {}", e))?;
 
@@ -694,6 +799,45 @@ runner = ["mgba-qt", "-C", "logToStdout=1", "-C", "logLevel.gba.debug=127"]
     Ok(())
 }
 
+/// Find the toolchain channel the project pinned, searching `start` and its ancestors.
+///
+/// Mirrors rustup's own lookup: nearest ancestor wins, and both the TOML form and the legacy
+/// one-line `rust-toolchain` file are accepted. Returns `None` when no pin exists anywhere above the
+/// project, which is what keeps unpinned projects on plain `nightly`.
+///
+/// Deliberately a line scan rather than a TOML parse: this runs on every build, needs no new
+/// dependency, and a pin is always a single `channel = "…"` line in practice. Comment lines are
+/// skipped so prose mentioning a channel cannot be mistaken for the pin.
+fn find_project_toolchain_channel(start: &Path) -> Option<String> {
+    for dir in start.ancestors() {
+        for name in ["rust-toolchain.toml", "rust-toolchain"] {
+            let Ok(text) = fs::read_to_string(dir.join(name)) else {
+                continue;
+            };
+            for line in text.lines() {
+                let line = line.trim();
+                if line.starts_with('#') {
+                    continue;
+                }
+                if let Some(rest) = line.strip_prefix("channel") {
+                    if let Some(value) = rest.trim_start().strip_prefix('=') {
+                        let value = value.trim().trim_matches('"').trim_matches('\'');
+                        if !value.is_empty() {
+                            return Some(value.to_string());
+                        }
+                    }
+                }
+            }
+            // Legacy form: the entire file is the toolchain name (no table, no assignment).
+            let bare = text.trim();
+            if !bare.is_empty() && !bare.contains('[') && !bare.contains('=') {
+                return Some(bare.to_string());
+            }
+        }
+    }
+    None
+}
+
 /// Remove a finished build's per-PID source directory (#384). Called only on SUCCESS, after the
 /// binary is copied out — the dir is then disposable (it holds only the generated crate source;
 /// compiled artifacts live in the shared workspace `target/`). Left in place on any earlier error so a
@@ -871,6 +1015,44 @@ tishlang_runtime = {{ path = {:?}{} }}
 mod tests {
     use super::runtime_features_for_cargo;
 
+    /// The generated ROM crate must inherit the project's pin, or GBA builds float against whatever
+    /// nightly the machine last downloaded (see `find_project_toolchain_channel`).
+    #[test]
+    fn project_toolchain_channel_is_inherited_from_nearest_pin() {
+        use super::find_project_toolchain_channel;
+        use std::fs;
+        use std::path::PathBuf;
+        // Scratch under the workspace target/ (never /tmp), unique per case.
+        let base: PathBuf =
+            PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../target/tmp_toolchain_test");
+        let nested = base.join("examples").join("game");
+        let _ = fs::remove_dir_all(&base);
+        fs::create_dir_all(&nested).unwrap();
+
+        // No pin anywhere below the workspace: caller falls back to plain `nightly`.
+        assert_eq!(find_project_toolchain_channel(&nested), None);
+
+        // A pin several levels up is found, and prose in comments is not mistaken for it.
+        fs::write(
+            base.join("rust-toolchain.toml"),
+            "# do not use a bare channel = \"nightly\"\n[toolchain]\nchannel = \"nightly-2026-07-22\"\ncomponents = [\"rust-src\"]\n",
+        )
+        .unwrap();
+        assert_eq!(
+            find_project_toolchain_channel(&nested).as_deref(),
+            Some("nightly-2026-07-22")
+        );
+
+        // Nearest ancestor wins, matching rustup's own lookup.
+        fs::write(nested.join("rust-toolchain"), "nightly-2026-01-01\n").unwrap();
+        assert_eq!(
+            find_project_toolchain_channel(&nested).as_deref(),
+            Some("nightly-2026-01-01")
+        );
+
+        let _ = fs::remove_dir_all(&base);
+    }
+
     /// #384: `cleanup_build_dir` removes a finished build's dir by default, and preserves it under
     /// `TISH_KEEP_BUILD_DIR=1`.
     #[test]
@@ -915,4 +1097,87 @@ mod tests {
         assert_eq!(f.len(), super::RUNTIME_CARGO_FEATURES.len());
         assert_eq!(f.iter().filter(|x| *x == "http").count(), 1);
     }
+
+    // #581 — the GBA ROM profile policy. The default used to be fat LTO + 1 CGU, so every
+    // `tish build --target gba` paid a full fat-LTO link over the ~20k-line `run()` a real game
+    // generates. These assert the policy rather than the wall-clock (which is machine-dependent):
+    // thin by default, fat still reachable, and a genuinely fast iteration profile.
+    //
+    // Serialized because they mutate process-wide env; `gba_cargo_profiles_toml` reads it directly.
+    #[test]
+    fn gba_profiles_follow_581_policy() {
+        use std::sync::Mutex;
+        static ENV_LOCK: Mutex<()> = Mutex::new(());
+        let _g = ENV_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+
+        let restore = |k: &str, v: Option<String>| match v {
+            Some(v) => std::env::set_var(k, v),
+            None => std::env::remove_var(k),
+        };
+        let keys = [
+            "TISH_GBA_FAT_LTO",
+            "TISH_GBA_THIN_LTO",
+            "TISH_FAST_NATIVE_BUILD",
+            "TISH_GBA_DEBUG",
+        ];
+        let saved: Vec<_> = keys.iter().map(|k| (*k, std::env::var(k).ok())).collect();
+        for k in keys {
+            std::env::remove_var(k);
+        }
+
+        // ⚠️ FAT IS THE DEFAULT, AND THE CONSTRAINT IS STACK, NOT LINK TIME. #581 briefly made thin
+        // the default; it costs ~3.4 KB of stack frame on a real ROM (measured on tish-gba's
+        // examples/ffta: 31,056 B combined under fat vs 34,504 under thin, against 32,512 usable),
+        // and the overflow does not trap — it aliases into EWRAM through the GBA's 256 KB mirror and
+        // corrupts the heap silently. See docs/gba-target.md.
+        let default = super::gba_cargo_profiles_toml();
+        assert!(
+            default.contains(r#"lto = "fat""#) && default.contains("codegen-units = 1"),
+            "default ROM profile must be fat LTO + 1 CGU — smallest stack frames:\n{default}"
+        );
+        assert!(
+            !default.contains(r#"lto = "thin""#),
+            "thin LTO must be opt-in via TISH_GBA_THIN_LTO, not the default:\n{default}"
+        );
+        assert!(
+            default.contains("debug = false"),
+            "release debuginfo must be opt-in via TISH_GBA_DEBUG (#581)"
+        );
+
+        // Legacy: scripts that set TISH_GBA_FAT_LTO=1 still get fat (now a no-op, not an error).
+        std::env::set_var("TISH_GBA_FAT_LTO", "1");
+        let ship = super::gba_cargo_profiles_toml();
+        assert!(
+            ship.contains(r#"lto = "fat""#) && ship.contains("codegen-units = 1"),
+            "TISH_GBA_FAT_LTO=1 must keep working as a no-op:\n{ship}"
+        );
+        std::env::remove_var("TISH_GBA_FAT_LTO");
+
+        // The opt-in that #581 was really about: faster iteration where stack headroom allows.
+        std::env::set_var("TISH_GBA_THIN_LTO", "1");
+        let thin = super::gba_cargo_profiles_toml();
+        assert!(
+            thin.contains(r#"lto = "thin""#) && thin.contains("codegen-units = 8"),
+            "TISH_GBA_THIN_LTO=1 must select thin LTO across 8 CGUs:\n{thin}"
+        );
+        std::env::remove_var("TISH_GBA_THIN_LTO");
+
+        std::env::set_var("TISH_FAST_NATIVE_BUILD", "1");
+        let fast = super::gba_cargo_profiles_toml();
+        assert!(
+            fast.contains("lto = false") && fast.contains("opt-level = 1"),
+            "TISH_FAST_NATIVE_BUILD=1 is the iteration profile — no LTO, opt-level 1 (#581):\n{fast}"
+        );
+        std::env::remove_var("TISH_FAST_NATIVE_BUILD");
+
+        std::env::set_var("TISH_GBA_DEBUG", "1");
+        assert!(
+            super::gba_cargo_profiles_toml().contains("debug = true"),
+            "TISH_GBA_DEBUG=1 must keep release debuginfo (#581)"
+        );
+
+        for (k, v) in saved {
+            restore(k, v);
+        }
+    }
 }

package/crates/tish_runtime_gba/src/lib.rs

@@ -30,13 +30,62 @@ pub use tishlang_core::{
     has_pending_throw, set_pending_throw, stack_overflow_error, take_pending_throw, CallDepthGuard,
 };
 
-/// Enter a boxed user-fn call frame or trip the recursion guard. On GBA there is
-/// no stack-pressure probe (no `std`), so this is just the counted-depth guard.
+unsafe extern "C" {
+    /// End of the `.iwram` output section — provided by agb's `gba.ld`. IWRAM runs
+    /// 0x0300_0000..0x0300_8000; agb's code/data occupies the bottom and the user
+    /// stack grows DOWN from 0x0300_7F00 toward this address. Anything below it is
+    /// live agb data (the audio mixer's buffers among them), so this is the real
+    /// bottom of the stack.
+    static __iwram_end: u8;
+}
+
+/// Headroom kept above [`__iwram_end`] (#655): must cover the frames emitted between
+/// two guard checks plus the bail path that parks the `RangeError`. Boxed `Value`
+/// frames on GBA run a few hundred bytes each, and the total stack is under 32 KB,
+/// so this is deliberately small relative to the host's 256 KB margin.
+const GBA_STACK_MARGIN: usize = 2 * 1024;
+
+/// #655 — is the GBA stack nearly exhausted? The host probe (`stacker::remaining_stack`)
+/// needs `std` and reports no bounds here, so its `None → floor 1` fallback made the
+/// guard dead code on the one target where overflow is unrecoverable: there is no MMU
+/// and no guard page, so the stack silently grows down into agb's IWRAM data and the
+/// corruption surfaces frames later as an illegal opcode somewhere unrelated.
+///
+/// The bounds ARE known statically here — the linker hands us the IWRAM extent — so
+/// this is a link-time constant plus a pointer compare, about the cost of the
+/// thread-local read it replaces on the host.
+#[inline]
+pub fn stack_low() -> bool {
+    let anchor = 0u8;
+    let sp = &anchor as *const u8 as usize;
+    let floor = (&raw const __iwram_end) as usize + GBA_STACK_MARGIN;
+    sp < floor
+}
+
+/// Enter a boxed user-fn call frame, or trip the recursion guard. Trips on EITHER the
+/// counted ceiling (`tishlang_core`) or real stack pressure ([`stack_low`]) — on a
+/// 32 KB IWRAM stack the counted default is far out of reach, so pressure is the
+/// trigger that actually fires. On trip: parks the catchable `RangeError` and returns
+/// `None`, exactly as on the host.
 #[inline]
 pub fn enter_call_guarded() -> Option<CallDepthGuard> {
+    if stack_low() {
+        set_pending_throw(stack_overflow_error());
+        return None;
+    }
     tishlang_core::enter_call_guarded()
 }
 
+/// #655 — bail path for a tripped typed-fn recursion guard (GBA mirror of the host's
+/// `recursion_tripped_f64`): park the catchable `RangeError` and unwind the numeric
+/// frame with NaN until the first `Value` frame's pending-throw checkpoint raises it.
+#[cold]
+#[inline(never)]
+pub fn recursion_tripped_f64() -> f64 {
+    set_pending_throw(stack_overflow_error());
+    f64::NAN
+}
+
 // ── Error type for throw/return non-local control flow ───────────────────────
 /// Mirrors `tishlang_runtime::TishError` (the host runtime defines its own; kept
 /// in lock-step). `run()` in generated code returns `Result<(), Box<dyn Error>>`.

package/crates/tish_test/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tishlang_test"
-version = "0.0.0-dev"
+version = "0.1.0"
 edition = "2021"
 description = "Native tish test runner, expect, and Node-compatible assert"
 license-file = { workspace = true }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tishlang/tish-format",
-  "version": "3.7.0",
+  "version": "3.8.6",
   "description": "Tish code formatter",
   "license": "PIF",
   "repository": {