c-next 0.2.16 → 0.2.18

package/src/transpiler/output/codegen/generators/expressions/__tests__/PostfixExpressionGenerator.test.ts

@@ -147,6 +147,7 @@ function createMockOrchestrator(overrides?: {
   ) => TTypeInfo | null;
   validateCrossScopeVisibility?: (scope: string, member: string) => void;
   generateBitMask?: (width: string, is64?: boolean) => string;
+  tryEvaluateConstant?: (ctx: unknown) => number | undefined;
   hasFloatBitShadow?: (name: string) => boolean;
   registerFloatBitShadow?: (name: string) => void;
   addPendingTempDeclaration?: (decl: string) => void;
@@ -172,7 +173,7 @@ function createMockOrchestrator(overrides?: {
     isCNextFunction: vi.fn(),
     isStructType: vi.fn(),
     getTypeName: vi.fn(),
-    tryEvaluateConstant: vi.fn(),
+    tryEvaluateConstant: overrides?.tryEvaluateConstant ?? vi.fn(),
     getZeroInitializer: vi.fn(),
     getExpressionEnumType: vi.fn(),
     isIntegerExpression: vi.fn(),
@@ -1265,6 +1266,98 @@ describe("PostfixExpressionGenerator", () => {
       const result = generatePostfixExpression(ctx, input, state, orchestrator);
       expect(result.code).toBe("((val) & 0xFF)");
     });
+
+    // Issue #1094: a const/macro width must be resolved to its numeric value (with
+    // a "U" suffix to match the literal path) before mask generation, instead of
+    // being passed through as the identifier — otherwise the mask falls back to a
+    // runtime ((1U << W) - 1) that is UB at full width.
+    it("resolves a const width to a precomputed mask (#1094)", () => {
+      const typeRegistry = new Map<string, TTypeInfo>([
+        [
+          "val",
+          { baseType: "u32", bitWidth: 32, isArray: false, isConst: false },
+        ],
+      ]);
+      const ctx = createMockPostfixExpressionContext("val", [
+        createMockPostfixOp({
+          expressions: [
+            createMockExpression("0"),
+            createMockExpression("WIDTH"),
+          ],
+        }),
+      ]);
+      const input = createMockInput({ typeRegistry });
+      const state = createMockState();
+      const generateBitMask = vi.fn(() => "0xFFFFFFFFU");
+      const orchestrator = createMockOrchestrator({
+        generatePrimaryExpr: () => "val",
+        generateExpression: (ctx) => ctx.getText(),
+        generateBitMask,
+        tryEvaluateConstant: () => 32,
+      });
+
+      const result = generatePostfixExpression(ctx, input, state, orchestrator);
+      // Width resolved to "32U" (not the identifier "WIDTH"); u32 operand → not 64-bit.
+      expect(generateBitMask).toHaveBeenCalledWith("32U", false);
+      expect(result.code).toBe("((val) & 0xFFFFFFFFU)");
+    });
+
+    it("passes the raw width when it is not a const (#1094)", () => {
+      const typeRegistry = new Map<string, TTypeInfo>([
+        [
+          "val",
+          { baseType: "u32", bitWidth: 32, isArray: false, isConst: false },
+        ],
+      ]);
+      const ctx = createMockPostfixExpressionContext("val", [
+        createMockPostfixOp({
+          expressions: [createMockExpression("0"), createMockExpression("n")],
+        }),
+      ]);
+      const input = createMockInput({ typeRegistry });
+      const state = createMockState();
+      const generateBitMask = vi.fn(() => "((1U << n) - 1)");
+      const orchestrator = createMockOrchestrator({
+        generatePrimaryExpr: () => "val",
+        generateExpression: (ctx) => ctx.getText(),
+        generateBitMask,
+        tryEvaluateConstant: () => undefined,
+      });
+
+      generatePostfixExpression(ctx, input, state, orchestrator);
+      // Non-const width: the generated expression string flows through unchanged.
+      expect(generateBitMask).toHaveBeenCalledWith("n", false);
+    });
+
+    it("marks a u64 operand as 64-bit for the mask base (#1094)", () => {
+      const typeRegistry = new Map<string, TTypeInfo>([
+        [
+          "val",
+          { baseType: "u64", bitWidth: 64, isArray: false, isConst: false },
+        ],
+      ]);
+      const ctx = createMockPostfixExpressionContext("val", [
+        createMockPostfixOp({
+          expressions: [
+            createMockExpression("0"),
+            createMockExpression("WIDTH"),
+          ],
+        }),
+      ]);
+      const input = createMockInput({ typeRegistry });
+      const state = createMockState();
+      const generateBitMask = vi.fn(() => "((1ULL << 40U) - 1)");
+      const orchestrator = createMockOrchestrator({
+        generatePrimaryExpr: () => "val",
+        generateExpression: (ctx) => ctx.getText(),
+        generateBitMask,
+        tryEvaluateConstant: () => 40,
+      });
+
+      generatePostfixExpression(ctx, input, state, orchestrator);
+      // u64 operand → is64Bit true, so the mask uses a 64-bit base (1ULL).
+      expect(generateBitMask).toHaveBeenCalledWith("40U", true);
+    });
   });
 
   describe("float bit indexing", () => {
@@ -1371,6 +1464,41 @@ describe("PostfixExpressionGenerator", () => {
       // Uses union member .u for bit access
       expect(result.code).toBe("(__bits_f.u & 0xFF)");
     });
+
+    // Issue #1094: the float branch must resolve a const width too, and tell the
+    // mask generator the f64 union is 64-bit.
+    it("resolves a const width for f64 bit indexing (#1094)", () => {
+      const typeRegistry = new Map<string, TTypeInfo>([
+        [
+          "d",
+          { baseType: "f64", bitWidth: 64, isArray: false, isConst: false },
+        ],
+      ]);
+      const ctx = createMockPostfixExpressionContext("d", [
+        createMockPostfixOp({
+          expressions: [
+            createMockExpression("0"),
+            createMockExpression("WIDTH"),
+          ],
+        }),
+      ]);
+      const input = createMockInput({ typeRegistry });
+      const state = createMockState({ inFunctionBody: true });
+      const generateBitMask = vi.fn(() => "0xFFFFFFFFFFFFFFFFULL");
+      const orchestrator = createMockOrchestrator({
+        generatePrimaryExpr: () => "d",
+        generateExpression: (ctx) => ctx.getText(),
+        generateBitMask,
+        tryEvaluateConstant: () => 64,
+        hasFloatBitShadow: () => true,
+        isFloatShadowCurrent: () => true,
+      });
+
+      const result = generatePostfixExpression(ctx, input, state, orchestrator);
+      // Const width "64U" passed; f64 union → 64-bit mask base.
+      expect(generateBitMask).toHaveBeenCalledWith("64U", true);
+      expect(result.code).toBe("(__bits_d.u & 0xFFFFFFFFFFFFFFFFULL)");
+    });
   });
 
   describe("function call", () => {

package/src/transpiler/output/codegen/generators/statements/ControlFlowGenerator.ts

@@ -14,6 +14,7 @@ import {
   WhileStatementContext,
   DoWhileStatementContext,
   ForStatementContext,
+  ForeverStatementContext,
   ForVarDeclContext,
   ForAssignmentContext,
   ExpressionContext,
@@ -167,6 +168,9 @@ const generateWhile = (
   // Issue #884: Validate condition is a boolean expression (E0701)
   orchestrator.validateConditionIsBoolean(node.expression(), "while");
 
+  // ADR-113 / #1075: reject always-true literal condition (E0707)
+  orchestrator.validateLoopConditionNotAlwaysTrue(node.expression());
+
   const condition = orchestrator.generateExpression(node.expression());
 
   // Issue #250: Flush any temp vars from condition BEFORE generating body
@@ -201,6 +205,9 @@ const generateDoWhile = (
   // Issue #884: Validate condition is a boolean expression (E0701)
   orchestrator.validateConditionIsBoolean(node.expression(), "do-while");
 
+  // ADR-113 / #1075: reject always-true literal condition (E0707)
+  orchestrator.validateLoopConditionNotAlwaysTrue(node.expression());
+
   const body = orchestrator.generateBlock(node.block());
   const condition = orchestrator.generateExpression(node.expression());
 
@@ -286,6 +293,15 @@ const generateFor = (
 ): IGeneratorOutput => {
   const effects: TGeneratorEffect[] = [];
 
+  // ADR-113 / #1075 E0707: a for-loop with no controlling expression (`for (;;)`)
+  // is a disguised infinite loop. C-Next has one source form for that — `forever`.
+  if (!node.expression()) {
+    throw new Error(
+      "Error E0707: for-loop has no controlling expression (infinite loop)\n" +
+        "  help: write 'forever { ... }' for an intentional infinite loop",
+    );
+  }
+
   let init = "";
   const forInit = node.forInit();
   if (forInit) {
@@ -313,15 +329,20 @@ const generateFor = (
   // Issue #250: Flush temps from init before generating condition
   const initTemps = orchestrator.flushPendingTempDeclarations();
 
-  let condition = "";
-  if (node.expression()) {
-    // Issue #254: Validate no function calls in condition (E0702)
-    orchestrator.validateConditionNoFunctionCall(node.expression()!, "for");
+  // The empty-header case (`for (;;)`) already threw E0707 above, so the
+  // controlling expression is guaranteed present here.
+  const conditionExpr = node.expression()!;
 
-    // Issue #884: Validate condition is a boolean expression (E0701)
-    orchestrator.validateConditionIsBoolean(node.expression()!, "for");
-    condition = orchestrator.generateExpression(node.expression()!);
-  }
+  // Issue #254: Validate no function calls in condition (E0702)
+  orchestrator.validateConditionNoFunctionCall(conditionExpr, "for");
+
+  // Issue #884: Validate condition is a boolean expression (E0701)
+  orchestrator.validateConditionIsBoolean(conditionExpr, "for");
+
+  // ADR-113 / #1075: reject always-true literal condition (E0707)
+  orchestrator.validateLoopConditionNotAlwaysTrue(conditionExpr);
+
+  const condition = orchestrator.generateExpression(conditionExpr);
 
   // Issue #250: Flush temps from condition before generating update
   const conditionTemps = orchestrator.flushPendingTempDeclarations();
@@ -357,6 +378,40 @@ const generateFor = (
   return { code: result, effects };
 };
 
+/**
+ * Generate C code for a forever statement (ADR-113).
+ *
+ * Lowers to the MISRA C:2012 Rule 14.3-compliant infinite-loop idiom `for (;;)`
+ * (the carve-out that rule explicitly permits — no controlling expression to be
+ * flagged as invariant). A `forever` loop may appear only in a void function
+ * (E0705): a value-returning function can never honor its return type if it
+ * loops forever.
+ */
+const generateForever = (
+  node: ForeverStatementContext,
+  _input: IGeneratorInput,
+  _state: IGeneratorState,
+  orchestrator: IOrchestrator,
+): IGeneratorOutput => {
+  const effects: TGeneratorEffect[] = [];
+
+  // ADR-113 E0705: forever is void-only.
+  const returnType = orchestrator.getCurrentFunctionReturnType();
+  if (returnType && returnType !== "void") {
+    throw new Error(
+      "Error E0705: forever loop in non-void function\n" +
+        "  help: a forever loop never returns a value; make the function return void, " +
+        "or use a while loop with an exit condition",
+    );
+  }
+
+  const body = orchestrator.generateBlock(node.block());
+  const comment =
+    "/* MISRA C:2012 Rule 14.3: infinite loop is intentional (C-Next `forever`) */";
+
+  return { code: `${comment}\nfor (;;) ${body}`, effects };
+};
+
 // Export all control flow generators
 const controlFlowGenerators = {
   generateReturn,
@@ -364,6 +419,7 @@ const controlFlowGenerators = {
   generateWhile,
   generateDoWhile,
   generateFor,
+  generateForever,
   generateForVarDecl,
   generateForAssignment,
 };

package/src/transpiler/output/codegen/generators/statements/__tests__/ControlFlowGenerator.test.ts

@@ -365,6 +365,7 @@ function createMockOrchestrator(options?: {
     flushPendingTempDeclarations: vi.fn(() => options?.tempDeclarations ?? ""),
     validateConditionNoFunctionCall: vi.fn(),
     validateConditionIsBoolean: vi.fn(),
+    validateLoopConditionNotAlwaysTrue: vi.fn(),
     countStringLengthAccesses: vi.fn(() => new Map()),
     countBlockLengthAccesses: vi.fn(),
     setupLengthCache: vi.fn(() => options?.lengthCacheDecls ?? ""),
@@ -898,15 +899,15 @@ describe("ControlFlowGenerator", () => {
   // ========================================================================
 
   describe("generateFor", () => {
-    it("generates empty for loop (infinite loop)", () => {
-      const ctx = createMockForStatement();
+    it("rejects an empty for(;;) header as a disguised infinite loop (ADR-113 / #1075, E0707)", () => {
+      const ctx = createMockForStatement(); // no controlling expression
       const input = createMockInput();
       const state = createMockState();
       const orchestrator = createMockOrchestrator({ statementCode: "{ }" });
 
-      const result = generateFor(ctx, input, state, orchestrator);
-
-      expect(result.code).toBe("for (; ; ) { }");
+      expect(() => generateFor(ctx, input, state, orchestrator)).toThrow(
+        /E0707: for-loop has no controlling expression/,
+      );
     });
 
     it("generates for loop with all parts", () => {
@@ -947,6 +948,7 @@ describe("ControlFlowGenerator", () => {
             operator: createMockAssignmentOperator("<-"),
           }),
         }),
+        expr: createMockExpression({ text: "i < 10" }),
       });
       const input = createMockInput();
       const state = createMockState();
@@ -1007,6 +1009,7 @@ describe("ControlFlowGenerator", () => {
         init: createMockForInit({
           varDecl: createMockForVarDecl(),
         }),
+        expr: createMockExpression({ text: "i < 10" }),
       });
       const input = createMockInput();
       const state = createMockState();

package/src/transpiler/output/codegen/helpers/AssignmentExpectedTypeResolver.ts

@@ -71,7 +71,10 @@ class AssignmentExpectedTypeResolver {
       // Case 2b: Simple array element access (arr[i] <- value)
       // Issue #872: Resolve element type for MISRA 7.2 U suffix
       if (identifiers.length === 1 && hasSubscript) {
-        return AssignmentExpectedTypeResolver.resolveForArrayElement(baseId);
+        return AssignmentExpectedTypeResolver.resolveForArrayElement(
+          baseId,
+          postfixOps,
+        );
       }
 
       // Case 2c: Member chain with array access (struct.arr[i] <- value)
@@ -87,6 +90,17 @@ class AssignmentExpectedTypeResolver {
     return { expectedType: null, assignmentContext: null };
   }
 
+  /**
+   * True if any postfix subscript is the 2-expression `[offset, length]` form —
+   * an array slice or scalar bit-range write (vs a 1-expression element/bit
+   * access). The grammar models both as `'[' expression ',' expression ']'`.
+   */
+  private static hasRangeSubscript(
+    postfixOps: Parser.PostfixTargetOpContext[],
+  ): boolean {
+    return postfixOps.some((op) => op.expression().length === 2);
+  }
+
   /**
    * Resolve expected type for a simple identifier target.
    */
@@ -124,13 +138,27 @@ class AssignmentExpectedTypeResolver {
   /**
    * Resolve expected type for array element access.
    * Issue #872: arr[i] <- value needs baseType for MISRA 7.2 U suffix.
+   *
+   * An array SLICE (2-expression subscript `arr[off, len]`) is the exception:
+   * its source serializes at the SOURCE's own width, so leaking the element type
+   * as expectedType truncates an element-width-sensitive source such as a
+   * bit-extraction (Issue #1085: `buf[0,4] <- b[0,32]` wrote only the low byte).
+   * This applies only to arrays — a 2-expression subscript on a scalar is a
+   * bit-range write, whose value is genuinely the field's type (unchanged).
    */
-  private static resolveForArrayElement(id: string): IExpectedTypeResult {
+  private static resolveForArrayElement(
+    id: string,
+    postfixOps: Parser.PostfixTargetOpContext[],
+  ): IExpectedTypeResult {
     const typeInfo = CodeGenState.getVariableTypeInfo(id);
     if (!typeInfo?.isArray) {
       return { expectedType: null, assignmentContext: null };
     }
 
+    if (AssignmentExpectedTypeResolver.hasRangeSubscript(postfixOps)) {
+      return { expectedType: null, assignmentContext: null };
+    }
+
     // Element type is the baseType (e.g., u8[10] -> "u8")
     return { expectedType: typeInfo.baseType, assignmentContext: null };
   }

package/src/transpiler/output/codegen/helpers/ParameterInputAdapter.ts

@@ -60,6 +60,13 @@ interface IFromASTDeps {
    * When the C typedef has `const T*`, this preserves const on the generated param.
    */
   forceConst?: boolean;
+
+  /**
+   * Issue #995: Check if a type is an opaque handle (incomplete struct typedef).
+   * Opaque handles should not get auto-const because they must be passed to
+   * C APIs that expect non-const pointers.
+   */
+  isOpaqueType?: (typeName: string) => boolean;
 }
 
 /**
@@ -142,6 +149,8 @@ class ParameterInputAdapter {
     const isKnownPrimitive = !!deps.typeMap[typeName];
     // Issue #958: C-header typedef struct types need pointer semantics
     const isTypedefStruct = deps.isTypedefStructType(typeName);
+    // Issue #995: Detect opaque handles — rule applied in ParameterSignatureBuilder
+    const isOpaque = deps.isOpaqueType?.(typeName) ?? false;
     // Issue #895: Don't add auto-const for callback-compatible functions
     // because it would change the signature and break typedef compatibility
     const isAutoConst =
@@ -171,6 +180,8 @@ class ParameterInputAdapter {
         deps.forcePassByReference || isTypedefStruct || undefined,
       // Issue #895: Preserve const from callback typedef signature
       forceConst: deps.forceConst,
+      // Issue #995: Pass through opaque handle detection — rule applied in builder
+      isOpaqueHandle: isOpaque || undefined,
     };
   }
 
@@ -236,6 +247,8 @@ class ParameterInputAdapter {
       isPassByReference: isCallbackPointer ? true : !deps.isPassByValue,
       forcePointerSyntax: isCallbackPointer || undefined,
       forceConst: param.isCallbackConst || undefined,
+      // Issue #995: Pass through opaque handle detection — rule applied in builder
+      isOpaqueHandle: param.isOpaqueHandle || undefined,
     };
   }
 
@@ -296,14 +309,15 @@ class ParameterInputAdapter {
       }
     }
 
-    const isAutoConst = !deps.isModified && !isConst;
-
+    // ADR-006: Arrays are pass-by-reference and mutable by default.
+    // Never apply auto-const to arrays - only explicit const from source code.
+    // Auto-const would break compatibility with C APIs expecting mutable pointers.
     return {
       name,
       baseType: typeName,
       mappedType,
       isConst,
-      isAutoConst,
+      isAutoConst: false,
       isArray: true,
       arrayDimensions: dims,
       isCallback: false,

package/src/transpiler/output/codegen/helpers/ParameterSignatureBuilder.ts

@@ -47,6 +47,11 @@ class ParameterSignatureBuilder {
       return this._buildStringParam(param);
     }
 
+    // Issue #995: Opaque handles are always pass-by-reference with pointer syntax
+    if (param.isOpaqueHandle) {
+      return this._buildRefParam(param, refSuffix);
+    }
+
     // Known struct or known primitive: pass by reference
     if (param.isPassByReference) {
       return this._buildRefParam(param, refSuffix);
@@ -103,18 +108,21 @@ class ParameterSignatureBuilder {
   /**
    * Build pass-by-reference parameter signature.
    * C mode: const Point* p
-   * C++ mode: const Point& p (unless forcePointerSyntax)
+   * C++ mode: const Point& p (unless forcePointerSyntax or isOpaqueHandle)
    *
    * Issue #895: When forcePointerSyntax is set, always use pointer syntax
    * because C callback typedefs expect pointers, not C++ references.
+   * Issue #995: Opaque handles must use pointer syntax because C APIs
+   * expect pointers to incomplete struct types (e.g., widget_t*).
    */
   private static _buildRefParam(
     param: IParameterInput,
     refSuffix: string,
   ): string {
     const constPrefix = this._getConstPrefix(param);
-    // Issue #895: Override refSuffix for callback-compatible functions
-    const actualSuffix = param.forcePointerSyntax ? "*" : refSuffix;
+    // Issue #895/#995: Override refSuffix for callback-compatible or opaque handle params
+    const actualSuffix =
+      param.forcePointerSyntax || param.isOpaqueHandle ? "*" : refSuffix;
     return `${constPrefix}${param.mappedType}${actualSuffix} ${param.name}`;
   }
 
@@ -130,10 +138,15 @@ class ParameterSignatureBuilder {
    * Get const prefix combining explicit const, auto-const, and forced const.
    * Priority: forceConst > isConst > isAutoConst
    * Issue #895: forceConst preserves const from callback typedef signature.
+   * Issue #995: Opaque handles suppress auto-const (they must be passed to
+   * C APIs that expect non-const pointers).
    */
   private static _getConstPrefix(param: IParameterInput): string {
+    // Issue #995: Opaque handles never get auto-const — they're passed to C APIs
+    // expecting mutable pointers (e.g., LVGL's lv_obj_t)
+    const effectiveAutoConst = param.isOpaqueHandle ? false : param.isAutoConst;
     // Any source of const results in "const " prefix
-    if (param.forceConst || param.isConst || param.isAutoConst) {
+    if (param.forceConst || param.isConst || effectiveAutoConst) {
       return "const ";
     }
     return "";