@xiaohuo123212/elench 0.0.0-stage → 0.1.0

package/src/borrow.py

@@ -0,0 +1,282 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Elench contributors
+"""borrow.py —— 借用检查（分支敏感，基于 CFG + 活跃性）
+
+**为什么有这个文件**
+
+我们选了 C++ 后端（决定清单 §10.47）。**Rust 会替我们证借用安全，C++ 不会。**
+没有这一层，`const u64& r = xs.at(0); xs.push(1); return r;` 会静默编译通过，
+运行时读越界——**那是在交付 UB，比不做工具更糟。**
+
+**算法（分支敏感）**
+
+1. 为函数体建 CFG（`cfg.build`）；
+2. 算活跃性不动点（`cfg.liveness`）：`live_in[n]` = 执行到 n 之前"之后还会用到"的变量；
+3. 收集借用事件：`const T& r = <以 x 为根的表达式>` → 借用 `(x → r)`；
+4. **判定**：若某节点**修改** `x`，且 `r ∈ live_in[该节点]`，则借用仍活着 → 报 `E-Borrow-Conflict`。
+
+> **这就是 Rust MIR borrowck 的思路（liveness-based NLL）。**
+> 与"一条时间线"的旧近似相比，它能正确处理**分支**：一支改、另一支不改，照样判得准。
+
+**规则覆盖**（对应规格 T7-a）
+
+| 规则 | 状态 |
+|---|---|
+| BR-5 结构体不得存引用 | ✅ |
+| BR-1 借用期间不得可变借用 | ✅ 分支敏感 |
+| BR-2 NLL | ✅ **基于活跃性**（分支敏感，非近似） |
+| BR-4 返回引用归属不明 | ✅ |
+  | BR-3 方法返回引用默认借自 `self` | ✅ **由 `_base_name` 构造实现**（取表达式里第一个 `path`：`xs.at(0)` → `xs`）。方向保守——`s.field.at(0)` 记成借自 `s`，宁可多报 |
+
+**保守方向**：宁可多报，不可漏报——**漏报就是 UB**。
+"""
+from typing import List, Optional, Set, Tuple
+
+import cfg as cfgmod
+from cfg import _base_of
+from ast_util import descendants
+
+
+def _first_path(node) -> Optional[str]:
+    """节点自身或其后代里的第一个 path。"""
+    if node is None:
+        return None
+    if getattr(node, "kind", "") == "path" and getattr(node, "name", None):
+        return node.name
+    for p in descendants(node, "path"):
+        if p.name:
+            return p.name
+    return None
+
+
+def _base_name(node) -> Optional[str]:
+    """表达式的"被借对象"。
+
+    **三种形状要分开**（2026-11-06 修）：
+
+    | 表达式 | 被借对象 | 以前 |
+    |---|---|---|
+    | `xs.at(0)` | `xs`（接收者） | ✅ 对 |
+    | `head_ref(v)` | `v`（实参） | ❌ **取成 `head_ref`**——被调函数名也是个 path！ |
+    | `v` | `v` | ✅ |
+
+    以前的实现一律"取第一个 path"，于是 `head_ref(v)` 被记成借了
+    `head_ref` —— 一个永远不被修改的名字，**借用检查彻底失效**（BR-3 的洞）。
+    """
+    k = getattr(node, "kind", "")
+    if k == "method-call":
+        # 接收者在 children[0]（`xs.at(0)` → path xs）
+        return _first_path(node.children[0] if node.children else None)
+    if k == "call":
+        # **跳过被调名**，只看实参：`head_ref(v)` → v
+        for c in (node.children or []):
+            if getattr(c, "kind", "") == "args":
+                return _first_path(c)
+        return None
+    return _first_path(node)
+
+
+def _check_struct_refs(tu_mod, out) -> None:
+    """BR-5：结构体字段不得为引用。"""
+    if tu_mod is None:
+        return
+    for st in descendants(tu_mod, "struct"):
+        for f in st.children:
+            ty = f.children[0] if f.children else None
+            if ty is not None and getattr(ty, "kind", None) == "type-ref":
+                out.append((
+                    "E-Borrow-StructRef",
+                    f"结构体 `{st.name}` 的字段 `{f.name}` 不能是引用"
+                    f"（BR-5：v0 不支持生命周期标注，引用存进结构体会逃出作用域）",
+                    f.line, f.col,
+                ))
+
+
+def _fn_body(fn):
+    return next((c for c in fn.children if getattr(c, "kind", None) == "block"), None)
+
+
+
+def _mutable_ref_params(mod) -> dict:
+    """`函数名 → 可变引用参数的下标集合`。
+
+    **`const` 记在 `param` 节点上**（不是 type-ref）——查错节点会得出
+    "两种写法一模一样"的错误结论。
+    `const T&` 只读；`T&` 可写，被调方可能改它，于是调用处要算一次"修改"。
+    """
+    out = {}
+    if mod is None:
+        return out
+    for fn in descendants(mod, "fn"):
+        params = next((c for c in (fn.children or []) if c.kind == "params"), None)
+        idx = set()
+        for i, prm in enumerate(params.children if params else []):
+            ty = prm.children[0] if prm.children else None
+            if getattr(ty, "kind", "") != "type-ref":
+                continue
+            if (prm.value or {}).get("const"):
+                continue                      # const T& 只读
+            idx.add(i)
+        if idx and fn.name:
+            out[fn.name] = idx
+    return out
+
+
+def _check_fn(fn, out, mut_params=None) -> None:
+    body = _fn_body(fn)
+    if body is None:
+        return
+    g = cfgmod.build(body)
+    live = cfgmod.liveness(g)
+
+    # 语句 → 节点（简单语句一一对应；控制流节点的 st 是 if/while 本身）
+    node_of = {id(n.st): n for n in g.nodes.values() if n.st is not None}
+
+    # **传可变引用 = 可能被改**：`take(xs)` 里 `xs` 对应 `vector<u64>&` 形参，
+    # 被调方可以改它；以前这种调用**完全不算修改**，于是借用还活着也能传出去。
+    if mut_params:
+        for n in g.nodes.values():
+            if n.st is None:
+                continue
+            for call in descendants(n.st, "call"):
+                idx = mut_params.get(call.name or "")
+                if not idx:
+                    continue
+                args = next((c for c in (call.children or []) if c.kind == "args"), None)
+                for i in idx:
+                    if args is None or i >= len(args.children):
+                        continue
+                    base = _base_of(args.children[i])
+                    if base:
+                        n.muts.add(base)
+                        n.uses.add(base)
+
+    borrows: List[Tuple[str, str, object]] = []      # (被借对象, 引用变量, 声明语句)
+    # **可变引用也算借用**（2026-11-06 修）：以前只扫 `const-decl`，
+    # 于是 `u64& q = xs.at(0); xs.push(9); return q;` **完全不被检查**——
+    # 而可变引用比只读引用更危险（调用方能写穿它）。
+    for st in descendants(body, "const-decl") + descendants(body, "var-decl"):
+        if not st.children or st.name is None:
+            continue
+        ty = st.children[0]
+        if getattr(ty, "kind", None) != "type-ref":
+            continue
+        base = _base_name(st.children[-1])
+        if base:
+            borrows.append((base, st.name, st))
+
+    for base, ref_name, st in borrows:
+        for m in g.nodes.values():
+            if base in m.muts and ref_name in live.get(m.id, set()):
+                # 用被修改节点自己的位置报错，读者能直接跳过去
+                where = m.st if m.st is not None else st
+                out.append((
+                    "E-Borrow-Conflict",
+                    f"`{base}` 在借用 `{ref_name}` 还活着的时候被修改"
+                    f"（BR-1/BR-2：借用期间不得可变借用）",
+                    where.line, where.col,
+                ))
+
+
+def _check_ambiguous_returns(ch_mod, out) -> None:
+    """BR-4：返回引用但有 ≥2 个引用参数 → 无法唯一确定归属，v0 直接拒绝。"""
+    for fn in descendants(ch_mod, "fn"):
+        ret = None
+        for c in fn.children:
+            if getattr(c, "kind", None) == "type-ref":
+                ret = c
+        if ret is None:
+            continue
+        params = next((c for c in fn.children if getattr(c, "kind", None) == "params"), None)
+        ref_params = [p.name or "?" for p in (params.children if params else [])
+                      if p.children and getattr(p.children[0], "kind", None) == "type-ref"]
+        if len(ref_params) >= 2:
+            out.append((
+                "E-Borrow-Ambiguous",
+                f"`{fn.name}` 返回引用，但有 {len(ref_params)} 个引用参数"
+                f"（{', '.join(ref_params)}）——无法唯一确定借自谁（BR-4）",
+                fn.line, fn.col,
+            ))
+
+
+def check_borrows(tu_mod, ch_mod) -> List[Tuple[str, str, int, int]]:
+    """分支敏感版本（默认）。"""
+    out = []
+    _check_struct_refs(tu_mod, out)
+    if ch_mod is not None:
+        mut_params = _mutable_ref_params(ch_mod)
+        for fn in descendants(ch_mod, "fn"):
+            _check_fn(fn, out, mut_params)
+        _check_ambiguous_returns(ch_mod, out)
+    return out
+
+
+# ---------------- 旧近似（保留给差分测试） ----------------
+
+def check_borrows_conservative(tu_mod, ch_mod):
+    """**旧版**：按源码顺序压成一条时间线（不分支敏感）。
+
+    保留它是为了**差分测试**：新旧两版对同一段程序给出不同结论时，
+    必须逐条归因——"新报旧不报"要么是新抓到的真漏报（好），要么是新误报（坏）。
+    """
+    out = []
+    _check_struct_refs(tu_mod, out)
+    if ch_mod is None:
+        return out
+    for fn in descendants(ch_mod, "fn"):
+        body = _fn_body(fn)
+        if body is None:
+            continue
+        stmts = _flatten(body)
+        refs = []
+        for idx, st in enumerate(stmts):
+            if st.kind in ("const-decl", "var-decl") and st.children:
+                ty = st.children[0]
+                if getattr(ty, "kind", None) == "type-ref" and st.name:
+                    base = _base_name(st.children[-1])
+                    if base:
+                        refs.append((st.name, base, idx))
+
+        def last_use(name, after):
+            best = after
+            for i in range(after + 1, len(stmts)):
+                if any(p.name == name for p in descendants(stmts[i], "path")):
+                    best = i
+            return best
+
+        for ref_name, base, at in refs:
+            end = last_use(ref_name, at)
+            if end == at:
+                continue
+            for i in range(at + 1, end + 1):
+                st = stmts[i]
+                hit = False
+                if st.kind == "assign" and st.children:
+                    lhs = st.children[0]
+                    hit = getattr(lhs, "kind", None) == "path" and lhs.name == base
+                if not hit:
+                    for mc in descendants(st, "method-call"):
+                        if (mc.children and getattr(mc.children[0], "kind", None) == "path"
+                                and mc.children[0].name == base
+                                and (mc.name or "") in cfgmod.MUT_METHODS):
+                            hit = True
+                            break
+                if hit:
+                    out.append((
+                        "E-Borrow-Conflict",
+                        f"`{base}` 在借用 `{ref_name}` 还活着的时候被修改",
+                        st.line, st.col,
+                    ))
+    _check_ambiguous_returns(ch_mod, out)
+    return out
+
+
+def _flatten(block) -> list:
+    out = []
+    for st in block.children:
+        out.append(st)
+        for b in st.children:
+            if getattr(b, "kind", None) == "block":
+                out.extend(_flatten(b))
+    return out

package/src/bound.py

@@ -0,0 +1,13 @@
+# -*- coding: utf-8 -*-
+"""兼容层：真正的实现在 `cost_domain.bound`（2026-11-01 合并）。
+
+**为什么用 `sys.modules` 替换，而不是把名字 `import *` 过来**：
+`src/test_ops.py` 会 monkeypatch `bound.OP_COST` 造反例。
+只有把本模块对象**换成真模块**，patch 才落在真正被读的那个全局上；
+复制名字会让 patch 打在副本上，测试就变成"测了个寂寞"。
+"""
+import sys as _sys
+
+from cost_domain import bound as _real
+
+_sys.modules[__name__] = _real

package/src/cfg.py

@@ -0,0 +1,219 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Elench contributors
+"""cfg.py —— 控制流图 + 活跃性分析（分支敏感借用分析的基础）
+
+**为什么需要它**
+
+`borrow.py` 早先的近似把函数体压成"一条时间线"：按源码顺序取引用的最后一次使用。
+它不懂分支，所以两类判定都不准：
+
+| 类型 | 例子 | 后果 |
+|---|---|---|
+| **误报** | `if (c) { const u64& r = xs.at(0); xs.push(1); }` | 被迫改写法 |
+| **漏报** | `const u64& r = xs.at(0); if (c) { xs.push(1); } return r;` | **交付 UB** |
+
+**漏报更严重**，而时间线天然会漏——因为它不知道"这支改、那支不改"。
+
+**这里实现的东西**
+
+1. **CFG**：节点=语句，边=顺序 / `if` 两支 / `while` 与 `for` 的回边 / `match` 各 arm /
+   `return` 与 `break`/`continue` 的跳转；
+2. **def / use / mut**：每个节点写什么、读什么、改谁；
+3. **活跃性不动点**：`live_out[n] = ∪ live_in[succ]`，`live_in[n] = use[n] ∪ (live_out[n] − def[n])`。
+
+**这就是 Rust MIR borrowck 的路子（基于 liveness 的 NLL），只是我们做在 AST 上。**
+"""
+from typing import Dict, List, Optional, Set
+
+from ast_util import descendants
+
+
+class CfgNode:
+    """CFG 节点。`st` 是它对应的 AST 语句（合成节点为 None）。"""
+
+    __slots__ = ("id", "st", "kind", "succ", "uses", "defs", "muts")
+
+    def __init__(self, nid: int, st=None, kind: str = "stmt"):
+        self.id = nid
+        self.st = st
+        self.kind = kind
+        self.succ: List[int] = []
+        self.uses: Set[str] = set()
+        self.defs: Set[str] = set()
+        self.muts: Set[str] = set()
+
+    def __repr__(self) -> str:
+        return f"<{self.id} {self.kind} {getattr(self.st, 'kind', '')}>"
+
+
+#: 会**改容器内容**的方法。漏一个，借用检查就在那个方法上失效
+#: （2026-11-06 补：`fill` / `extend` / `enqueue` / `dequeue` 都曾漏掉）。
+MUT_METHODS = {"push", "pop", "clear", "set", "sort", "sort_by",
+               "reverse", "resize", "insert", "remove",
+               "fill", "extend", "enqueue", "dequeue"}
+
+#: 会改**第一个实参**的内建函数（不是方法，所以方法扫描抓不到）。
+MUT_FUNCS = {"swap"}
+
+
+def _paths(node) -> Set[str]:
+    return {p.name for p in descendants(node, "path") if p.name}
+
+
+def _base_of(node) -> Optional[str]:
+    for p in descendants(node, "path"):
+        if p.name:
+            return p.name
+    return None
+
+
+class Cfg:
+    def __init__(self):
+        self.nodes: Dict[int, CfgNode] = {}
+        self.entry: Optional[int] = None
+
+    def new(self, st=None, kind: str = "stmt") -> CfgNode:
+        n = CfgNode(len(self.nodes), st, kind)
+        self.nodes[n.id] = n
+        return n
+
+    def link(self, a: int, b: Optional[int]) -> None:
+        if b is None:
+            return
+        if b not in self.nodes[a].succ:
+            self.nodes[a].succ.append(b)
+
+    # ---------------- 构建 ----------------
+
+    def build_block(self, block, succ: Optional[int], loop_ctx=None) -> Optional[int]:
+        """从后往前建，返回入口节点 id。`loop_ctx` = (cond_id, exit_node)。"""
+        cur = succ
+        stmts = list(block.children)
+        for st in reversed(stmts):
+            cur = self.build_stmt(st, cur, loop_ctx)
+        return cur
+
+    def build_stmt(self, st, succ: Optional[int], loop_ctx=None) -> Optional[int]:
+        k = getattr(st, "kind", None)
+
+        if k == "block":
+            return self.build_block(st, succ, loop_ctx)
+
+        if k == "if":
+            cond = self.new(st, "cond")
+            cond.uses |= _paths(st.children[0]) if st.children else set()
+            branches = [c for c in st.children[1:] if getattr(c, "kind", None) == "block"]
+            for b in branches:
+                entry = self.build_block(b, succ, loop_ctx)
+                self.link(cond.id, entry if entry is not None else succ)
+            if not branches:
+                self.link(cond.id, succ)
+            return cond.id
+
+        if k in ("while", "for"):
+            cond = self.new(st, "cond")
+            cond.uses |= _paths(st.children[0]) if (k == "while" and st.children) else set()
+            body = next((c for c in st.children if getattr(c, "kind", None) == "block"), None)
+            exit_node = None
+            ctx = (cond.id, exit_node)
+            entry = self.build_block(body, cond.id, ctx) if body is not None else None
+            self.link(cond.id, entry if entry is not None else succ)
+            self.link(cond.id, succ)           # 条件为假 → 退出
+            return cond.id
+
+        if k == "return":
+            n = self.new(st, "return")
+            n.uses |= _paths(st)
+            return n.id                        # 无后继
+
+        if k in ("break", "continue"):
+            n = self.new(st, "jump")
+            if loop_ctx is not None:
+                target = loop_ctx[0] if k == "continue" else loop_ctx[1]
+                self.link(n.id, target)
+            return n.id
+
+        if k == "match":
+            n = self.new(st, "match")
+            n.uses |= _paths(st.children[0]) if st.children else set()
+            arms = [c for c in st.children if getattr(c, "kind", None) == "arm"]
+            for a in arms:
+                for b in a.children:
+                    if getattr(b, "kind", None) == "block":
+                        entry = self.build_block(b, succ, loop_ctx)
+                        self.link(n.id, entry if entry is not None else succ)
+            if not arms:
+                self.link(n.id, succ)
+            return n.id
+
+        # 普通语句
+        n = self.new(st, "stmt")
+        if k in ("const-decl", "var-decl") and st.children:
+            n.uses |= _paths(st.children[-1])
+            if st.name:
+                n.defs.add(st.name)
+        elif k in ("assign", "assign-op") and st.children:
+            lhs = st.children[0]
+            n.uses |= _paths(st)
+            base = _base_of(lhs)
+            if base:
+                n.defs.add(base)
+                n.muts.add(base)
+        else:
+            n.uses |= _paths(st)
+            for mc in descendants(st, "method-call"):
+                if (mc.name or "") not in MUT_METHODS or not mc.children:
+                    continue
+                # **变异归到根变量**（2026-11-06 修）：以前只认 `children[0]` 是 path，
+                # 于是 `s.items.push(9)` 记不上——接收者是 `field` 节点，条件不成立，
+                # **整个字段上的写入都被漏掉**。用 `_base_of` 取根（`s.items` → `s`），
+                # 方向保守：改字段就算改结构体。
+                base = _base_of(mc.children[0])
+                if base:
+                    n.muts.add(base)
+                    n.uses.add(base)
+            # **内建函数也会改第一个实参**（`swap(xs, i, j)`）——方法扫描抓不到它，
+            # 于是"借用还活着就换元素"以前是漏报的。
+            for call in descendants(st, "call"):
+                if (call.name or "") not in MUT_FUNCS:
+                    continue
+                args = next((c for c in (call.children or []) if c.kind == "args"), None)
+                if args is None or not args.children:
+                    continue
+                base = _base_of(args.children[0])
+                if base:
+                    n.muts.add(base)
+                    n.uses.add(base)
+        self.link(n.id, succ)
+        return n.id
+
+
+def build(block) -> Cfg:
+    c = Cfg()
+    entry = c.build_block(block, None)
+    c.entry = entry
+    return c
+
+
+def liveness(cfg: Cfg) -> Dict[int, Set[str]]:
+    """返回 live_in：节点 id → 该点"之后还会用到"的变量集合（不动点）。"""
+    live_in: Dict[int, Set[str]] = {i: set() for i in cfg.nodes}
+    live_out: Dict[int, Set[str]] = {i: set() for i in cfg.nodes}
+    changed = True
+    rounds = 0
+    while changed and rounds < 200:          # 上界防死循环：图是有限的
+        changed = False
+        rounds += 1
+        for i, n in cfg.nodes.items():
+            out = set()
+            for s in n.succ:
+                out |= live_in.get(s, set())
+            if out != live_out[i]:
+                live_out[i] = out
+                changed = True
+            new_in = n.uses | (out - n.defs)
+            if new_in != live_in[i]:
+                live_in[i] = new_in
+                changed = True
+    return live_in