nomen-lang 0.6.9 → 0.6.11

package/audit_runtime.c

@@ -2,44 +2,164 @@
 #include <stdlib.h>
 #include <string.h>
 
+// The allocation ledger behind `--audit` (`nomen test --audit`,
+// `Tester.audit_count`, and the generated harness's per-test attribution).
+//
+// Every wrapped block carries a 16-byte header (magic, size, state) in front of
+// the payload the program sees, so every wrapped free can be matched against a
+// LIVE block. The header is the whole point: a bare counter cannot tell a
+// correct free from an incorrect one, and both failures it used to absorb are
+// ownership bugs the generated code cannot prove away.
+//
+//   - free of a pointer this runtime never handed out (a pool/BSS/rodata
+//     address, a libc allocation, a stale pointer kept across a realloc) used
+//     to decrement the counter like any other free. That silently hid the exact
+//     failure the allmark aarch64 sanitize runs hit — `free()` of a non-heap
+//     address aborting in libmalloc with no audit-level diagnosis — and it let
+//     the reported count drift away from the allocator's real state, so a
+//     genuine leak count and a phantom one were indistinguishable.
+//   - a second free of the SAME block (a double free, or a stale pointer whose
+//     memory the allocator already recycled) decremented a second time.
+//   - `realloc(p, 0)` frees `p`; the old counter kept it live, so every such
+//     call read as one phantom allocation.
+//
+// A stale free no longer decrements and no longer reaches libc `free` (it may
+// not be ours to free at all): it is counted in `nomen_stale_frees` and
+// reported by `nomen_audit_check`, so the run fails with a diagnosis instead of
+// dying inside the allocator. The allocation count itself is unchanged — one
+// increment per wrapped block, one decrement per reclaimed block — so it stays
+// exactly as before: the audit test contract.
+
 // Atomic: worker threads from the pool malloc/free concurrently, and a
 // plain `long` would lose updates under that contention (showing up as
 // spurious LEAK/negative-count failures in tests that use spawns).
 static volatile long nomen_malloc_count = 0;
 
-void *nomen_malloc_wrap(unsigned long size) {
-	void *ptr = malloc(size);
+// Frees that did not match a live wrapped block (foreign pointer, double
+// free, realloc of a stale pointer). Reported at exit; never affects the
+// allocation count.
+static volatile long nomen_stale_frees = 0;
+
+#define NOMEN_AUDIT_MAGIC 0x6e6f6d656e415531UL // "nomenAU1"
+#define NOMEN_AUDIT_LIVE 1UL
+#define NOMEN_AUDIT_DEAD 2UL
+
+typedef struct {
+	unsigned long magic;
+	unsigned long size;
+	unsigned long state;
+	unsigned long pad; // keeps the payload 16-byte aligned
+} nomen_audit_header;
+
+static void *audit_alloc(unsigned long size) {
+	nomen_audit_header *header = (nomen_audit_header *)malloc(size + sizeof(nomen_audit_header));
+	if (!header) return 0;
+	header->magic = NOMEN_AUDIT_MAGIC;
+	header->size = size;
+	header->state = NOMEN_AUDIT_LIVE;
 	__atomic_add_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
-	return ptr;
+	return (void *)(header + 1);
+}
+
+// The header in front of `ptr`, or 0 when `ptr` is not one of ours (a libc
+// allocation, a static/BSS address, or already-freed memory whose header was
+// cleared).
+static nomen_audit_header *audit_header(void *ptr) {
+	nomen_audit_header *header = (nomen_audit_header *)ptr - 1;
+	if (header->magic != NOMEN_AUDIT_MAGIC) return 0;
+	return header;
+}
+
+// Retire a block: poison the header first so a second free of the same pointer
+// is recognized as stale, then hand the memory back and drop the count.
+static void audit_release(nomen_audit_header *header) {
+	header->magic = 0;
+	header->state = NOMEN_AUDIT_DEAD;
+	__atomic_sub_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
+	free(header);
+}
+
+static long audit_record_stale(void) {
+	return __atomic_add_fetch(&nomen_stale_frees, 1, __ATOMIC_SEQ_CST);
+}
+
+// Diagnose each KIND once: a shape that double-frees per iteration would
+// otherwise print thousands of identical lines. The exit-time
+// AUDIT-STALE-FREE count carries the total.
+static void audit_report_stale(int kind) {
+	static volatile int reported[2] = {0, 0};
+	static const char *const messages[2] = {
+		"audit: free of a pointer that is not a live audit allocation "
+		"(a foreign address, or one already freed)",
+		"audit: realloc of a pointer that is not a live audit allocation",
+	};
+	if (kind < 0 || kind > 1) return;
+	if (__atomic_exchange_n(&reported[kind], 1, __ATOMIC_SEQ_CST)) return;
+	fprintf(stderr, "%s\n", messages[kind]);
+}
+
+void *nomen_malloc_wrap(unsigned long size) {
+	return audit_alloc(size);
 }
 
 void *nomen_calloc_wrap(unsigned long count, unsigned long size) {
-	void *ptr = calloc(count, size);
-	__atomic_add_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
+	unsigned long total = count * size;
+	void *ptr = audit_alloc(total);
+	if (ptr) memset(ptr, 0, total);
 	return ptr;
 }
 
+void *nomen_strdup_wrap(const char *s) {
+	unsigned long len = strlen(s) + 1;
+	void *ptr = audit_alloc(len);
+	if (ptr) memcpy(ptr, s, len);
+	return ptr;
+}
+
+// realloc: the count is unchanged (one block in, one block out) — the block is
+// only RETIRED, which is what fixes `realloc(p, 0)`: C lets it free `p` and
+// return NULL, and the old counter left `p` live, reading as a phantom
+// allocation. This implementation always returns the fresh block (a valid
+// unique pointer, the other conforming option), so callers that treat a NULL
+// result as "the buffer is gone" keep working.
+//
+// A stale or foreign `old_ptr` reallocates to NULL (realloc's failure mode)
+// and is counted as a stale free: the pointer is left untouched rather than
+// memcpy'd out of memory that isn't ours.
 void *nomen_realloc_wrap(void *old_ptr, unsigned long size) {
-	if (!old_ptr) {
-		__atomic_add_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
+	if (!old_ptr) return audit_alloc(size);
+	nomen_audit_header *header = audit_header(old_ptr);
+	if (!header || header->state != NOMEN_AUDIT_LIVE) {
+		audit_record_stale();
+		audit_report_stale(1);
+		return 0;
 	}
-	void *ptr = realloc(old_ptr, size);
+	unsigned long old_size = header->size;
+	void *ptr = audit_alloc(size);
+	// An allocation failure keeps the old block live (realloc's contract).
+	if (!ptr) return 0;
+	memcpy(ptr, old_ptr, old_size < size ? old_size : size);
+	audit_release(header);
 	return ptr;
 }
 
 void nomen_free_wrap(void *ptr) {
-	if (ptr) {
-		free(ptr);
-		__atomic_sub_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
+	if (!ptr) return;
+	nomen_audit_header *header = audit_header(ptr);
+	// Not a live wrapped block: a libc allocation, a static/BSS/rodata
+	// address, a pointer the allocator already recycled, or a block this
+	// runtime already freed (the double-free case — the header is poisoned on
+	// release, so a stale pointer can never look live). Freeing it would be an
+	// invalid free, and libmalloc aborts INSIDE free() with no context, which
+	// is exactly how the allmark aarch64 sanitize run died. Report it instead
+	// of passing it on, and leave the count alone: an unmatched free is not
+	// evidence that a live block was reclaimed.
+	if (!header || header->state != NOMEN_AUDIT_LIVE) {
+		audit_record_stale();
+		audit_report_stale(0);
+		return;
 	}
-}
-
-void *nomen_strdup_wrap(const char *s) {
-	unsigned long len = strlen(s) + 1;
-	void *ptr = malloc(len);
-	if (ptr) memcpy(ptr, s, len);
-	__atomic_add_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
-	return ptr;
+	audit_release(header);
 }
 
 void nomen_audit_check(void) {
@@ -47,4 +167,22 @@ void nomen_audit_check(void) {
 	if (count != 0) {
 		printf("LEAK: %ld allocation(s)\n", count);
 	}
+	long stale = __atomic_load_n(&nomen_stale_frees, __ATOMIC_SEQ_CST);
+	if (stale != 0) {
+		printf("AUDIT-STALE-FREE: %ld pointer(s) freed that were not live audit allocations\n",
+			   stale);
+	}
+}
+
+// Per-test leak attribution (`nomen test`): the generated harness snapshots
+// the counter before every test and diffs it after, so a leaking test is
+// named instead of a whole file aggregating into one exit-time count.
+long nomen_audit_count(void) {
+	return __atomic_load_n(&nomen_malloc_count, __ATOMIC_SEQ_CST);
 }
+
+// Frees that matched no live block (foreign pointer / double free). Polled the
+// same way as the count so a run can attribute them like leaks.
+long nomen_audit_stale_frees(void) {
+	return __atomic_load_n(&nomen_stale_frees, __ATOMIC_SEQ_CST);
+}

package/core/System/Console.nm

@@ -43,6 +43,32 @@ pub struct Console {
 		```
 	}
 
+	// Disable stdout buffering: every write goes straight to the file
+	// descriptor. The `nomen test` harness calls this at startup so a
+	// crashing binary still leaves every record it printed before the
+	// crash — a buffered stdout loses its pending bytes on an abnormal
+	// exit, which used to turn a mid-suite abort into "no records at all".
+	pub func unbuffered = () {
+		```
+		#arch: c
+		setbuf(stdout, NULL);
+		```
+		```
+		#arch: aarch64
+		// setbuf(stdout, NULL): Apple's stdio names the FILE* global
+		// __stdoutp (stdout itself is a macro), so the Mach-O symbol is
+		// ___stdoutp — and it must load through the GOT (@GOTPAGE), the
+		// only relocation the linker accepts for it. The aarch64 backend
+		// always emits Mach-O symbol names (see `bl _printf` above), so
+		// this is unconditional like every other core raw body.
+		adrp x0, ___stdoutp@GOTPAGE
+		ldr x0, [x0, ___stdoutp@GOTPAGEOFF]
+		ldr x0, [x0]
+		mov x1, #0
+		bl _setbuf
+		```
+	}
+
 	// Read one line from stdin (newline stripped). The raw body mallocs the
 	// buffer — `move out string` transfers ownership to the caller.
 	pub func read_line = (move out string) {

package/core/System/Test.nm

@@ -11,6 +11,7 @@
 //
 //	\nomen|start|<test>
 //	\nomen|fail|<test>|<message>
+//	\nomen|leaks|<test>|<n>
 //	\nomen|done|<test>|<passed>|<failed>|<ns>
 //	\nomen|bench|<label>|<n>|<min>|<median>|<max>|<mean>|<stddev>
 //
@@ -70,6 +71,23 @@ pub class Tester {
 	var bench_label = ""
 	var bench_samples = 1000
 
+	// (audit) The process's current malloc/free balance — allocations made
+	// but not yet freed. `nomen test --audit` snapshots this around every
+	// test so a leak is attributed to the test that leaked instead of one
+	// file-level exit-time count. The audit runtime is linked into every
+	// test build; in other binaries the counter simply never moves.
+	pub func audit_count = (out int64) {
+		```
+		#arch: c
+		extern long nomen_audit_count(void);
+		return (long long)nomen_audit_count();
+		```
+		```
+		#arch: aarch64
+		bl _nomen_audit_count
+		```
+	}
+
 	// (harness) Start timing `name` and clear the per-test state. Called by
 	// the `main` that `nomen test` generates — not by test code.
 	pub func begin_test = (ref self, string name) {