nomen-lang 0.6.9 → 0.6.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nomen-lang",
-  "version": "0.6.9",
+  "version": "0.6.11",
   "description": "The CLI for the Nomen programming language.",
   "keywords": [],
   "license": "ISC",

package/src/index.ts

@@ -409,7 +409,14 @@ function processFile(filename: string, config: Config, mode: Mode, program_args:
 	// `build` links the executable but does not run it; `run` links and runs.
 	startTime = performance.now();
 
-	const audit_obj = config.audit ? compile_audit_runtime(config, resolved, buildDir) : undefined;
+	// The audit runtime is linked under --audit, and also whenever the
+	// program references it: `Tester.audit_count` (System::Test) has a raw
+	// body calling `nomen_audit_count`, so a Tester-using program run without
+	// --audit still needs the (inert) counter object at link time.
+	const needs_audit_runtime = config.audit || result.code.includes("nomen_audit_count");
+	const audit_obj = needs_audit_runtime
+		? compile_audit_runtime(config, resolved, buildDir)
+		: undefined;
 	let link_inputs = codefile;
 	if (companionfile) link_inputs += ` ${companionfile}`;
 	if (audit_obj) link_inputs += ` ${audit_obj}`;

package/src/test.ts

@@ -1,4 +1,4 @@
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -49,6 +49,10 @@ export interface TestFileResult {
 	// "LEAK: N allocation(s)" lines the audits runtime printed at exit. Empty
 	// unless the file was run with --audit; a non-empty list fails the file.
 	leaks: string[];
+	// Per-test leak attribution (from the harness's `\nomen|leaks` records):
+	// the tests whose allocation balance grew while they ran. Collected in
+	// every run; only --audit fails the file on them.
+	leaking_tests: LeakRecord[];
 	// Set when the compiled binary crashed before finishing (e.g. a segfault
 	// in a test). We still surface whatever records it managed to emit.
 	crashed?: string;
@@ -83,6 +87,13 @@ interface BenchRecord {
 	stddev: number;
 }
 
+// A `\nomen|leaks|<test>|<n>` record: the test's allocation balance grew by
+// `n` between the harness's counter snapshot and the test's end.
+interface LeakRecord {
+	test: string;
+	count: number;
+}
+
 /** Recursively collect `*.test.nm` files under `root`, skipping build output. */
 export function collect_test_files(root: string): string[] {
 	const out: string[] = [];
@@ -201,11 +212,30 @@ export function generate_harness(tests: TestFunction[], benches: BenchFunction[]
 		})
 		.join("\n");
 
-	let main = "\nimport System\nimport System::Test\n\npub func main = () {\n";
+	let main = "\nimport System\nimport System::Test\n";
+	// Per-test leak attribution: the harness snapshots the audit counter
+	// (Tester.audit_count — the audit runtime is linked into every test
+	// build, see run_test_file) before every test and diffs it after. A
+	// positive delta emits a `\nomen|leaks|<test>|<n>` record, which the CLI
+	// reports as a leaking test instead of leaving the file's exit-time
+	// total unattributed.
+	main += "\npub func main = () {\n";
+	// Unbuffered stdout: a binary that crashes mid-suite still leaves every
+	// record it printed (the CLI reads them from the run's .out file), and a
+	// crash is diagnosed with the tests that PASSED before it instead of
+	// "(crashed before records)".
+	main += `\tConsole.unbuffered()\n`;
 	main += "\tvar Tester t = Tester()\n";
+	main += "\tvar int64 audit_mark = 0\n";
+	main += "\tvar int64 audit_leaked = 0\n";
 	for (const test of tests) {
+		main += `\taudit_mark = Tester.audit_count()\n`;
 		main += `\tt.begin_test("${escape_nm_string(test.name)}")\n`;
 		main += `\t${test.name}(ref t)\n`;
+		main += `\taudit_leaked = Tester.audit_count() - audit_mark\n`;
+		main += `\tif audit_leaked > 0 {\n`;
+		main += `\t\tConsole.write_line("\\\\nomen|leaks|" + "${escape_nm_string(test.name)}" + "|\\{audit_leaked}")\n`;
+		main += `\t}\n`;
 		main += `\tt.end_test()\n`;
 	}
 	for (const bench of benches) {
@@ -227,6 +257,7 @@ interface RunRecord {
 	tests: TestRecord[];
 	fails: FailRecord[];
 	benches: BenchRecord[];
+	leaks: LeakRecord[];
 	other: string[];
 }
 
@@ -235,6 +266,7 @@ export function parse_records(stdout: string): RunRecord {
 	const tests: TestRecord[] = [];
 	const fails: FailRecord[] = [];
 	const benches: BenchRecord[] = [];
+	const leaks: LeakRecord[] = [];
 	const other: string[] = [];
 	for (const line of stdout.split("\n")) {
 		if (!line.startsWith(RECORD_PREFIX)) {
@@ -254,6 +286,8 @@ export function parse_records(stdout: string): RunRecord {
 			});
 		} else if (kind === "fail") {
 			fails.push({ test: parts[1], message: parts.slice(2).join("|") });
+		} else if (kind === "leaks") {
+			leaks.push({ test: parts[1], count: parseInt(parts[2] || "0", 10) });
 		} else if (kind === "bench") {
 			benches.push({
 				label: parts[1],
@@ -266,15 +300,21 @@ export function parse_records(stdout: string): RunRecord {
 			});
 		}
 	}
-	return { tests, fails, benches, other };
+	return { tests, fails, benches, leaks, other };
 }
 
-/** Pull the exit-time audit "LEAK: N allocation(s)" lines out of stdout. */
+/**
+ * Pull the exit-time audit lines out of stdout: "LEAK: N allocation(s)" (a
+ * nonzero malloc/free balance) and "AUDIT-STALE-FREE: N pointer(s) freed that
+ * were not live audit allocations" (a free that matched no live block — a
+ * foreign pointer or a double free; the runtime no longer passes those to
+ * libc free, so this is the only record they leave). Both fail the file.
+ */
 export function extract_leaks(stdout: string): string[] {
 	return stdout
 		.split("\n")
 		.map((l) => l.trim())
-		.filter((l) => l.startsWith("LEAK:"));
+		.filter((l) => l.startsWith("LEAK:") || l.startsWith("AUDIT-STALE-FREE:"));
 }
 
 /**
@@ -302,8 +342,9 @@ export async function run_test_file(
 		tests: [],
 		fails: [],
 		benches: [],
-		other: [],
 		leaks: [],
+		leaking_tests: [],
+		other: [],
 		ms: 0,
 	};
 
@@ -343,29 +384,31 @@ export async function run_test_file(
 
 	const buildDir = build_dir_for(resolved, true);
 	if (!fs.existsSync(buildDir)) fs.mkdirSync(buildDir, { recursive: true });
-	// With --audit, compile the audit runtime (malloc/free counting) and link
-	// it in; the generated main calls nomen_audit_check() at exit, printing
-	// "LEAK: N allocation(s)" when the balance is nonzero.
-	let audit_obj: string | undefined;
-	if (audit) {
-		// Explicit flag wins; else walk up from the test file (a nomen
-		// checkout's src/audit_runtime.c); else the runtime bundled with the
-		// CLI (live repo copy in the dev tree, shipped copy when published)
-		// so `--audit` works outside the nomen checkout with no flag.
-		const runtime_src = audit_runtime
-			? path.resolve(audit_runtime)
-			: (find_audit_runtime(path.dirname(resolved)) ?? find_bundled_audit_runtime());
-		if (!runtime_src || !fs.existsSync(runtime_src)) {
-			result.ok = false;
-			result.phase = "setup";
-			result.crashed =
-				"Audit enabled but audit_runtime.c was not found. Pass --audit-runtime <path>.";
-			result.ms = performance.now() - start;
-			return result;
-		}
-		audit_obj = path.join(buildDir, "audit_runtime.o");
-		await execFile_async("clang", ["-c", runtime_src, "-o", audit_obj]);
+	// The audit runtime is linked into EVERY test build: the generated
+	// harness polls nomen_audit_count() around every test for per-test leak
+	// attribution, and under --audit the generated main additionally calls
+	// nomen_audit_check() at exit, printing "LEAK: N allocation(s)" when the
+	// balance is nonzero.
+	// Runtime discovery: explicit flag wins; else walk up from the test file
+	// (a nomen checkout's src/audit_runtime.c); else the runtime bundled with
+	// the CLI (live repo copy in the dev tree, shipped copy when published)
+	// so it works outside the nomen checkout with no flag.
+	const runtime_src = audit_runtime
+		? path.resolve(audit_runtime)
+		: (find_audit_runtime(path.dirname(resolved)) ?? find_bundled_audit_runtime());
+	if (!runtime_src || !fs.existsSync(runtime_src)) {
+		result.ok = false;
+		result.phase = "setup";
+		result.crashed = "audit_runtime.c was not found. Pass --audit-runtime <path>.";
+		result.ms = performance.now() - start;
+		return result;
 	}
+	// Per-file audit object: two concurrent workers compiling to the SHARED
+	// `audit_runtime.o` raced — a link could read the object mid-rewrite
+	// (concurrent `clang -c` open the output with O_TRUNC) and fail, or link
+	// a stale slab. The runtime is tiny; recompiling per file costs ~0.1s.
+	const audit_obj = path.join(buildDir, path.basename(entry_path, ".nm") + "_audit.o");
+	await execFile_async("clang", ["-c", runtime_src, "-o", audit_obj]);
 	const platform = default_platform();
 	// Match the run/build command's emission: ObjC-bearing sources (GUI code
 	// pulled in through the library graph) must land in a `.m` TU on Apple
@@ -374,10 +417,19 @@ export async function run_test_file(
 	const ext = arch === "aarch64" ? ".s" : platform === "macos" || platform === "ios" ? ".m" : ".c";
 	const codefile = path.join(buildDir, path.basename(entry_path, ".nm") + ext);
 	const outfile = path.join(buildDir, path.basename(entry_path, ".nm"));
-	// The C backend's generated source does `#include "main.h"`, so write the
-	// header next to the code. (aarch64 inlines everything into the .s file.)
-	fs.writeFileSync(path.join(buildDir, "main.h"), buildResult.headers ?? "");
-	fs.writeFileSync(codefile, buildResult.code);
+	// The C backend's generated source does `#include "main.h"`, so the
+	// header lands next to the code. (aarch64 inlines everything into the
+	// .s file and ignores it.) Per-file header name: every test file shares
+	// one build folder, and two concurrent C builds writing the SAME
+	// `main.h` raced — a compile could read another file's header between
+	// the write and the clang read and fail (or mis-declare) spuriously.
+	const header_name = path.basename(entry_path, ".nm") + ".main.h";
+	fs.writeFileSync(path.join(buildDir, header_name), buildResult.headers ?? "");
+	let code_text: string = buildResult.code;
+	if (arch !== "aarch64") {
+		code_text = code_text.replace('#include "main.h"', `#include "${header_name}"`);
+	}
+	fs.writeFileSync(codefile, code_text);
 
 	// Companion C (raw-block functions + the pool/fiber/file-scope C infra):
 	// `run`/`build` compile and link it next to the main TU. The aarch64 .s
@@ -424,45 +476,85 @@ export async function run_test_file(
 		return result;
 	}
 
-	// Run the binary and collect the records it streams over stdout. A
+	// Run the binary with its stdout/stderr redirected to per-file FILES
+	// (next to the binary, doubling as debugging artifacts) instead of node
+	// pipes, then read them. (Why not pipes: this runner's parse/build
+	// phases block the event loop for tens of seconds at a time. A binary
+	// that finished inside such a block exited 0 long before its records
+	// were read, but the 30s execFile timeout that became due during the
+	// block still fired at loop-resume — and the kill path destroyed the
+	// child's unread pipe, silently dropping EVERY record: the file
+	// reported "(0 tests)" and passed. Records on disk are immune to
+	// anything the parent does after the fact.) The documented CWD
+	// contract: the binary runs in the `--in` root (the folder `nomen test`
+	// scanned for *.test.nm files), so fixture paths in tests resolve
+	// against that folder regardless of where the CLI was invoked from. A
 	// non-zero exit (crash, abort) still surfaces whatever records were
-	// emitted before the crash; a timeout is treated as a crash. The
-	// documented CWD contract: the binary runs in the `--in` root (the
-	// folder `nomen test` scanned for *.test.nm files), so fixture paths in
-	// tests resolve against that folder regardless of where the CLI was
-	// invoked from.
+	// emitted before the crash (the harness runs its stdout unbuffered, so
+	// a crashing binary keeps the records it printed); a timeout is treated
+	// as a crash.
+	const run_out = outfile + ".out";
+	const run_err = outfile + ".err";
 	let runStdout = "";
+	let runStderr = "";
 	let crashed: string | undefined;
+	const out_fd = fs.openSync(run_out, "w");
+	const err_fd = fs.openSync(run_err, "w");
 	try {
-		const run = await execFile_async(outfile, [], {
-			encoding: "utf8",
+		const child = spawn(outfile, [], {
 			timeout: 30_000,
-			maxBuffer: 16 * 1024 * 1024,
+			stdio: ["ignore", out_fd, err_fd],
 			cwd: cwd ?? process.cwd(),
 		});
-		runStdout = run.stdout;
-	} catch (err: any) {
-		runStdout = err.stdout ? err.stdout.toString() : "";
-		if (err.signal === "SIGTERM") {
+		const run = await new Promise<{ code: number | null; signal: string | null }>((resolve) => {
+			child.on("error", () => resolve({ code: null, signal: null }));
+			child.on("close", (code, signal) => resolve({ code, signal }));
+		});
+		if (run.signal === "SIGTERM") {
 			crashed = "test binary timed out after 30s";
-		} else {
-			crashed = `test binary exited abnormally (signal ${err.signal ?? err.code})`;
+		} else if (run.signal !== null) {
+			crashed = `test binary exited abnormally (signal ${run.signal})`;
+		} else if (run.code === null) {
+			crashed = "test binary could not be run";
+		} else if (run.code !== 0) {
+			crashed = `test binary exited abnormally (signal ${run.code})`;
 		}
+	} finally {
+		fs.closeSync(out_fd);
+		fs.closeSync(err_fd);
+	}
+	runStdout = fs.readFileSync(run_out, "utf8");
+	try {
+		runStderr = fs.readFileSync(run_err, "utf8");
+	} catch {
+		runStderr = "";
+	}
+	if (crashed && runStderr.trim()) {
+		// A crashed binary's own diagnosis (a libmalloc abort message, a
+		// panic dump) goes to stderr — surface it with the crash record.
+		crashed += `\n${runStderr.trim()}`;
 	}
 
 	const records = parse_records(runStdout);
 	result.tests = records.tests;
 	result.fails = records.fails;
 	result.benches = records.benches;
+	result.leaking_tests = records.leaks;
 	result.other = records.other;
 	// Under --audit the exit-time audit check prints "LEAK: N allocation(s)"
-	// to stdout when the malloc/free balance is nonzero. Treat any such line
-	// as a failure so a leaked test file cannot stay green.
+	// to stdout when the malloc/free balance is nonzero, and
+	// "AUDIT-STALE-FREE: N ..." for frees that matched no live block. Treat
+	// any such line as a failure so a leaked (or double-freeing) test file
+	// cannot stay green. (The per-test `leaks` records are collected always —
+	// they name the leaking tests — but only --audit makes them fail the
+	// file.)
 	result.leaks = audit ? extract_leaks(runStdout) : [];
-	// Leak lines are surfaced explicitly above; drop them from the generic
+	// Audit lines are surfaced explicitly above; drop them from the generic
 	// stdout dump so they are not printed twice.
 	if (result.leaks.length) {
-		result.other = result.other.filter((l) => !l.trim().startsWith("LEAK:"));
+		result.other = result.other.filter(
+			(l) => !l.trim().startsWith("LEAK:") && !l.trim().startsWith("AUDIT-STALE-FREE:"),
+		);
 	}
 	result.crashed = crashed;
 	if (crashed) result.phase = "run";
@@ -535,6 +627,20 @@ export function report_file(result: TestFileResult): void {
 	for (const leak of result.leaks) {
 		console.log(`   ${C.yellow("⚠")} ${C.yellow(leak)}`);
 	}
+	// Per-test attribution: which tests leaked (the exit-time LEAK line above
+	// is the file total; these name the culprits). Shown under --audit only —
+	// without it the file cannot fail on leaks, so the warning would be noise
+	// on every run.
+	if (result.leaks.length) {
+		for (const lt of result.leaking_tests) {
+			console.log(`   ${C.yellow("⚠")} ${lt.test} ${C.dim(`leaked ${lt.count} allocation(s)`)}`);
+		}
+		if (!result.leaking_tests.length) {
+			console.log(
+				`   ${C.yellow("⚠")} ${C.yellow("LEAK: no per-test attribution — leaked outside a test (harness/setup/teardown) or crashed mid-test")}`,
+			);
+		}
+	}
 	for (const b of result.benches) {
 		console.log(
 			`   ${C.cyan("⏱")} ${b.label} ${C.dim(`(n=${b.n})`)} ` +
@@ -641,6 +747,12 @@ export async function runTests(root: string, options: RunTestsOptions = {}): Pro
 	const totalFailed = results.reduce((a, r) => a + r.tests.reduce((x, t) => x + t.failed, 0), 0);
 	const totalPassed = totalTests - totalFailed;
 	const totalLeaks = results.reduce((a, r) => a + r.leaks.length, 0);
+	// Leak attribution: the count of TESTS that leaked (the old summary
+	// counted FILES — one aggregate LEAK line per file told you nothing about
+	// which test to blame). The per-file report lists the leaking tests; the
+	// files' exit-time totals can exceed the per-test sum when allocations
+	// leak outside any test (harness/setup/teardown).
+	const totalLeakingTests = results.reduce((a, r) => a + r.leaking_tests.length, 0);
 	const anyFailed = results.some((r) => !r.ok);
 
 	console.log("");
@@ -659,8 +771,9 @@ export async function runTests(root: string, options: RunTestsOptions = {}): Pro
 	);
 	if (totalLeaks) {
 		console.log(
-			` ${C.dim("Leaks ")} ${C.yellow(`${totalLeaks} reported`)}` +
-				C.dim(" (--audit; leaked files count as failures)"),
+			` ${C.dim("Leaks ")} ${C.yellow(`${totalLeakingTests} leaking test(s)`)}` +
+				(totalLeakingTests !== totalLeaks ? C.dim(` (${totalLeaks} leaked file(s))`) : "") +
+				C.dim(" (--audit; leaking tests fail their file)"),
 		);
 	}
 	console.log(` ${C.dim(" Time ")} ${format_duration(elapsed)}`);