nomen-lang 0.8.0 → 0.9.0

package/audit_runtime.c

@@ -51,13 +51,20 @@ typedef struct {
 	unsigned long pad; // keeps the payload 16-byte aligned
 } nomen_audit_header;
 
+// True when the NOMEN_AUDIT_TRACE env var is on. The getenv is not cached —
+// the trace is a developer diagnostic, and alloc/free volumes under it are
+// already dominated by the fprintf.
+static int audit_trace(void) {
+	return getenv("NOMEN_AUDIT_TRACE") != 0;
+}
+
 static void *audit_alloc(unsigned long size) {
 	nomen_audit_header *header = (nomen_audit_header *)malloc(size + sizeof(nomen_audit_header));
 	if (!header) return 0;
 	header->magic = NOMEN_AUDIT_MAGIC;
 	header->size = size;
 	header->state = NOMEN_AUDIT_LIVE;
-	if (getenv("NOMEN_AUDIT_TRACE")) fprintf(stderr, "ALLOC %lu\n", (unsigned long)size);
+	if (audit_trace()) fprintf(stderr, "ALLOC %p %lu\n", (void *)(header + 1), (unsigned long)size);
 	__atomic_add_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
 	return (void *)(header + 1);
 }
@@ -74,7 +81,7 @@ static nomen_audit_header *audit_header(void *ptr) {
 // Retire a block: poison the header first so a second free of the same pointer
 // is recognized as stale, then hand the memory back and drop the count.
 static void audit_release(nomen_audit_header *header) {
-	if (getenv("NOMEN_AUDIT_TRACE")) fprintf(stderr, "FREE %lu\n", (unsigned long)header->size);
+	if (audit_trace()) fprintf(stderr, "FREE %p %lu\n", (void *)(header + 1), (unsigned long)header->size);
 	header->magic = 0;
 	header->state = NOMEN_AUDIT_DEAD;
 	__atomic_sub_fetch(&nomen_malloc_count, 1, __ATOMIC_SEQ_CST);
@@ -157,6 +164,9 @@ void nomen_free_wrap(void *ptr) {
 	// of passing it on, and leave the count alone: an unmatched free is not
 	// evidence that a live block was reclaimed.
 	if (!header || header->state != NOMEN_AUDIT_LIVE) {
+		if (audit_trace())
+			fprintf(stderr, "STALE-FREE %p (%s)\n", ptr,
+					header ? "already freed" : "not an audit allocation");
 		audit_record_stale();
 		audit_report_stale(0);
 		return;

package/core/System/Arena.nm

@@ -77,7 +77,14 @@ pub mv struct Arena<T> {
 			self.generations.store_int(index, 0)
 		}
 		self.values.grow(index + 1)
-		self.values.store(index, value)
+		// The value arrives owned (`mv T value`): move a value-struct element
+		// into the fresh slot (the caller's storage zeroes, no deep copy);
+		// strings keep the deep-copying store (their pair arrives by value).
+		if T_IS_VALUE_STRUCT {
+			self.values.store_take(index, value)
+		} else {
+			self.values.store(index, value)
+		}
 		var handle = ArenaRef<T>()
 		handle.index = index
 		handle.generation = self.generations.load_int(index)

package/core/System/Buffer.nm

@@ -127,7 +127,6 @@ pub struct Buffer<T> {
 		self.data = calloc(size, 8)
 		return self.cap
 	}
-
 	internal func grow_int = (ref self, int needed, out int: out >= needed) {
 		if self.cap >= needed {
 			return self.cap
@@ -171,6 +170,125 @@ pub struct Buffer<T> {
 		```
 	}
 
+	// Labeled delegation point for raw-body callers in other containers
+	// (StableList's chunked storage calls this). Deliberately a RAW bitwise
+	// slot load — NOT a delegation to `load`: the owning-specialized `load`
+	// body materializes an owned copy (strdup) for string elements, while
+	// the accessor-family classification of every name that reaches user
+	// bindings (`at`, `load_tail` → this) promises a BORROW — the slot keeps
+	// sole ownership and the caller's binding is never freed. A strdup here
+	// would pair a counted allocation with a borrow binding that never frees
+	// it (audit LEAK).
+	internal func load_from = (self, int i: i >= 0 && i < self.cap, out T) {
+		```
+		#arch: c
+		return ((T*)(unsigned long long)self->data)[i];
+		```
+		```
+		#arch: aarch64
+		// x19 = self, x1 = i. The return register convention is per type
+		// KIND: `string` returns the fat pair in x0/x1 (T_FAT folds to 1),
+		// composites larger than 8 bytes return through the x8 sret buffer,
+		// scalars are width-matched into x0.
+		mov x14, #T_FAT
+		cmp x14, #1
+		b.eq .Lbuffer_load_from_fat
+		ldr x0, [x19, #8]
+		mov x3, #T_SIZE
+		madd x1, x1, x3, xzr
+		add x0, x0, x1
+		cmp x3, #16
+		b.gt .Lbuffer_load_from_copy
+		cmp x3, #8
+		b.gt .Lbuffer_load_from_pair
+		cmp x3, #1
+		b.eq .Lbuffer_load_from_1
+		cmp x3, #2
+		b.eq .Lbuffer_load_from_2
+		cmp x3, #4
+		b.eq .Lbuffer_load_from_4
+		ldr x0, [x0]
+		b .Lbuffer_load_from_end
+		.Lbuffer_load_from_1:
+		ldrb w0, [x0]
+		b .Lbuffer_load_from_end
+		.Lbuffer_load_from_2:
+		ldrh w0, [x0]
+		b .Lbuffer_load_from_end
+		.Lbuffer_load_from_4:
+		ldr w0, [x0]
+		b .Lbuffer_load_from_end
+		.Lbuffer_load_from_pair:
+		// Word-pair load (T_SIZE <= 16): both words into the sret
+		// buffer, no call.
+		ldp x9, x10, [x0]
+		stp x9, x10, [x8]
+		b .Lbuffer_load_from_end
+		.Lbuffer_load_from_copy:
+		mov x1, x0
+		mov x0, x8
+		mov x2, x3
+		bl _memcpy
+		b .Lbuffer_load_from_end
+		.Lbuffer_load_from_fat:
+		ldr x0, [x19, #8]
+		lsl x2, x1, #4
+		add x0, x0, x2
+		ldp x0, x1, [x0]
+		.Lbuffer_load_from_end:
+		```
+	}
+
+	// Initialize this buffer as a VIEW over a foreign slab (INTERNAL — the
+	// chunked-container primitive): `data` becomes `slab` and `cap` becomes
+	// `fill`, and the buffer owns NOTHING — the slab keeps its real owner
+	// (never grown, never freed by the view). The mono'd slot family
+	// (`store`/`load`/`load_from`/`shift`) then runs against the view
+	// unchanged, with its per-element specializations intact. This is how
+	// StableList's directory chunks reach the typed store without a staging
+	// relay — the same stack view the raw bodies build by hand, in typed
+	// Nomen. The holder must clear the view afterwards (see clear_view):
+	// an owning Buffer FIELD is destroyed by its holder's teardown.
+	internal func init_view = (ref self, uint64 slab, int fill: fill >= 0) {
+		self.data = slab
+		self.cap = fill
+	}
+
+	// Clear a view initialized by init_view: `data`/`cap` back to zero, so
+	// the holder's own field destroy reclaims nothing (the slab's real owner
+	// still owns it).
+	internal func clear_view = (ref self) {
+		self.data = 0
+		self.cap = 0
+	}
+
+	// Store `val` into slot `slot` of a foreign slab at `slab` (fill `fill`)
+	// through this buffer as a transient view — INTERNAL (StableList's
+	// directory chunks): init the view, run the mono'd `store` (the per-
+	// element deep-copy specialization), then clear the view so the holder's
+	// teardown reclaims nothing. The holder passes a Buffer FIELD, never a
+	// local — a local owning Buffer would be auto-destroyed at scope exit
+	// and free the slab it only borrows.
+	internal func store_in_slab = (
+		ref self,
+		uint64 slab,
+		int fill: fill >= 0,
+		int slot: slot >= 0,
+		T val
+	) {
+		self.init_view(slab, fill)
+		// `val` arrives owned from the container's `mv T` push parameter: a
+		// value-struct element moves into the chunk slot (store_take — the
+		// caller's storage zeroes, no deep copy); strings keep the
+		// deep-copying store (their pair arrives by value).
+		if T_IS_VALUE_STRUCT {
+			self.store_take(slot, val)
+		} else {
+			self.store(slot, val)
+		}
+		self.clear_view()
+	}
+
 	// Move a value out of a slot: return it and clear the slot to 0. This is
 	// the ownership-extracting primitive (used by e.g. List.pop) — unlike
 	// load_int (a borrow read), it relinquishes the slot so the buffer no
@@ -215,8 +333,9 @@ pub struct Buffer<T> {
 	}
 
 	// T_SIZE-aware primitives for value-struct elements. Slab is sized in
-	// multiples of T_SIZE; load/store use memcpy so multi-word structs work
-	// correctly. Classes route to ClassBuffer<T> (per-element destroy), so T
+	// multiples of T_SIZE; multi-word slots copy as one word pair at
+	// T_SIZE <= 16 (ldp/stp — no call) and via memcpy above that, so
+	// structs of any width work correctly. Classes route to ClassBuffer<T> (per-element destroy), so T
 	// reaching here is always a value type (primitive or struct).
 
 	func alloc = (ref self, int size, out int: out >= size) {
@@ -264,8 +383,10 @@ pub struct Buffer<T> {
 		mov x3, #T_SIZE
 		madd x1, x1, x3, xzr
 		add x0, x0, x1
-		cmp x3, #8
+		cmp x3, #16
 		b.gt .Lbuffer_load_T_copy
+		cmp x3, #8
+		b.gt .Lbuffer_load_T_pair
 		// Width-matched load (zero-extends) — an 8-byte ldr on a sub-8
 		// element would read past the slab's end and leave garbage in the
 		// upper bits.
@@ -286,6 +407,12 @@ pub struct Buffer<T> {
 		.Lbuffer_load_T_4:
 		ldr w0, [x0]
 		b .Lbuffer_load_T_end
+		.Lbuffer_load_T_pair:
+		// Word-pair load (T_SIZE <= 16): both words into the sret
+		// buffer, no call.
+		ldp x9, x10, [x0]
+		stp x9, x10, [x8]
+		b .Lbuffer_load_T_end
 		.Lbuffer_load_T_copy:
 		mov x1, x0
 		mov x0, x8
@@ -315,8 +442,10 @@ pub struct Buffer<T> {
 		mov x3, #T_SIZE
 		madd x1, x1, x3, xzr
 		add x0, x0, x1
-		cmp x3, #8
+		cmp x3, #16
 		b.gt .Lbuffer_store_T_copy
+		cmp x3, #8
+		b.gt .Lbuffer_store_T_pair
 		// Sub-8 element types must use a width-matched store: an 8-byte str
 		// would clobber the following slots (and run past the slab's end).
 		cmp x3, #1
@@ -336,6 +465,12 @@ pub struct Buffer<T> {
 		.Lbuffer_store_T_4:
 		str w2, [x0]
 		b .Lbuffer_store_T_end
+		.Lbuffer_store_T_pair:
+		// Word-pair store (T_SIZE <= 16): the value's address (x2)
+		// feeds both words, no call.
+		ldp x9, x10, [x2]
+		stp x9, x10, [x0]
+		b .Lbuffer_store_T_end
 		.Lbuffer_store_T_copy:
 		mov x1, x2
 		mov x2, x3
@@ -344,6 +479,94 @@ pub struct Buffer<T> {
 		```
 	}
 
+	// TAKE a value into slot `i`. The caller's storage (`val`'s source — on
+	// both backends a value-struct parameter arrives as a POINTER to the
+	// caller's value) is byte-copied into the fresh slot and then ZEROED, so
+	// the buffer becomes the sole owner and the caller's own teardown frees
+	// nothing. The ownership-taking counterpart of `store` (which deep-copies
+	// a borrowed value): the `add`/`alloc` family's bodies use it when
+	// `T_IS_VALUE_STRUCT` folds true, eliding the per-slot deep copy.
+	// INTERNAL: only valid for a value-struct `T` (the only shape whose
+	// parameter is a pointer to the caller's storage — a `string`'s fat pair
+	// arrives by value, so take-store would zero the callee's copy and leave
+	// the caller's buffer shared).
+	internal inline func store_take = (ref self, int i: i >= 0 && i < self.cap, T val) {
+		```
+		#arch: c
+		{
+		T* _st = (T*)(unsigned long long)self->data;
+		#if T_IS_VALUE_STRUCT
+		// A value-struct parameter is a POINTER to the caller's storage.
+		T* _src = &(*val);
+		_st[i] = *_src;
+		memset((void*)_src, 0, T_SIZE);
+		#else
+		// Never called for a non-value-struct instantiation (the container
+		// bodies fold their `T_IS_VALUE_STRUCT` arm); this arm only keeps the
+		// emitted instance compiling.
+		T _tmp = val;
+		T* _src = &_tmp;
+		_st[i] = *_src;
+		(void)_src;
+		#endif
+		}
+		```
+		```
+		#arch: aarch64
+		// x19 = self, x1 = i, x2 = &val (the caller's storage)
+		ldr x0, [x19, #8]
+		mov x3, #T_SIZE
+		madd x1, x1, x3, xzr
+		add x0, x0, x1
+		cmp x3, #16
+		b.gt .Lbuffer_take_T_copy
+		cmp x3, #8
+		b.gt .Lbuffer_take_T_pair
+		cmp x3, #1
+		b.eq .Lbuffer_take_T_1
+		cmp x3, #2
+		b.eq .Lbuffer_take_T_2
+		cmp x3, #4
+		b.eq .Lbuffer_take_T_4
+		ldr x9, [x2]
+		str x9, [x0]
+		str xzr, [x2]
+		b .Lbuffer_take_T_end
+		.Lbuffer_take_T_1:
+		ldrb w9, [x2]
+		strb w9, [x0]
+		strb wzr, [x2]
+		b .Lbuffer_take_T_end
+		.Lbuffer_take_T_2:
+		ldrh w9, [x2]
+		strh w9, [x0]
+		strh wzr, [x2]
+		b .Lbuffer_take_T_end
+		.Lbuffer_take_T_4:
+		ldr w9, [x2]
+		str w9, [x0]
+		str wzr, [x2]
+		b .Lbuffer_take_T_end
+		.Lbuffer_take_T_pair:
+		ldp x9, x10, [x2]
+		stp x9, x10, [x0]
+		stp xzr, xzr, [x2]
+		b .Lbuffer_take_T_end
+		.Lbuffer_take_T_copy:
+		mov x4, x2
+		mov x1, x2
+		mov x2, x3
+		stp x4, x3, [sp, #-16]!
+		bl _memcpy
+		ldp x4, x3, [sp], #16
+		mov x0, x4
+		mov x1, #0
+		mov x2, x3
+		bl _memset
+		.Lbuffer_take_T_end:
+		```
+	}
+
 	// Move a value out of a T_SIZE-sized slot: return it and zero the slot so the
 	// buffer no longer holds a (possibly mv) copy. Declared `mv out T` so
 	// the result is treated as OWNED by the borrow checker — the slot is
@@ -364,8 +587,10 @@ pub struct Buffer<T> {
 		mov x3, #T_SIZE
 		madd x5, x1, x3, xzr
 		add x5, x4, x5
-		cmp x3, #8
+		cmp x3, #16
 		b.gt .Lbuffer_move_T_copy
+		cmp x3, #8
+		b.gt .Lbuffer_move_T_pair
 		// Width-matched load + zero-clear: an 8-byte access on a sub-8
 		// element would zero the following slots and run past the slab.
 		cmp x3, #1
@@ -389,6 +614,14 @@ pub struct Buffer<T> {
 		ldr w0, [x5]
 		str wzr, [x5]
 		b .Lbuffer_move_T_end
+		.Lbuffer_move_T_pair:
+		// Word-pair move (T_SIZE <= 16): the sret pair takes both
+		// words and the slot zeroes, no calls.
+		ldp x9, x10, [x5]
+		stp x9, x10, [x8]
+		stp xzr, xzr, [x5]
+		mov x0, x8
+		b .Lbuffer_move_T_end
 		.Lbuffer_move_T_copy:
 		mov x0, x8
 		mov x1, x5
@@ -518,8 +751,10 @@ pub struct Buffer<T> {
 		mov x3, #T_SIZE
 		madd x1, x1, x3, xzr
 		add x0, x0, x1
-		cmp x3, #8
+		cmp x3, #16
 		b.gt .Lbuffer_replace_T_copy
+		cmp x3, #8
+		b.gt .Lbuffer_replace_T_pair
 		// Width-matched store: an 8-byte str on a sub-8 element would
 		// clobber the following slots and run past the slab's end.
 		cmp x3, #1
@@ -539,6 +774,12 @@ pub struct Buffer<T> {
 		.Lbuffer_replace_T_4:
 		str w2, [x0]
 		b .Lbuffer_replace_T_end
+		.Lbuffer_replace_T_pair:
+		// Word-pair store (T_SIZE <= 16): the value's address (x2)
+		// feeds both words, no call.
+		ldp x9, x10, [x2]
+		stp x9, x10, [x0]
+		b .Lbuffer_replace_T_end
 		.Lbuffer_replace_T_copy:
 		mov x1, x2
 		mov x2, x3
@@ -558,6 +799,52 @@ pub struct Buffer<T> {
 		self.replace(i, value)
 	}
 
+	// Reclaim slot i's owned heap state WITHOUT writing the slot (the raw
+	// no-op below is correct for trivially-destructible elements; for
+	// `string` and mv value-struct elements both backends specialize this
+	// body — free the displaced pointer / guarded T_destroy — the same
+	// dispatch replace_T gets). This is the DESTROY half of replace,
+	// separated from the copy so the in-place store lowering can reclaim
+	// the displaced value and then CONSTRUCT the new one straight into the
+	// slot (no donor, no deep copy). Contract: the slot must be
+	// overwritten before it is read or destroyed again — Map.set_slot_ptr
+	// (the probe-then-construct primitive) and the in-place `set` splice
+	// are the callers, and both overwrite immediately.
+	internal func destroy_at = (ref self, int i: i >= 0 && i < self.cap) {
+		```
+		#arch: c
+		T* _slots = (T*)(unsigned long long)self->data;
+		#if T_NEEDS_STRDUP
+		// A string slot owns its strdup'd bytes — free the buffer before the
+		// zero. Owning value-struct elements never reach this body: their
+		// destroy_at is replaced at the call site by the owning-buffer
+		// specialization (payload reclaim + zero).
+		free(_slots[i].ptr);
+		#endif
+		memset((void*)&_slots[i], 0, T_SIZE);
+		```
+		```
+		#arch: aarch64
+		// Same contract as the C body: string slots free their strdup'd
+		// buffer first (the T_NEEDS_STRDUP dispatch folds away for every
+		// other element kind); owning value-struct elements take the
+		// call-site specialization instead.
+		ldr x4, [x19, #8]
+		mov x3, #T_SIZE
+		madd x5, x1, x3, xzr
+		add x5, x4, x5
+		mov x9, #T_NEEDS_STRDUP
+		cbz x9, .Lbuffer_destroy_at_T_zero
+		ldr x0, [x5]
+		bl _free
+		.Lbuffer_destroy_at_T_zero:
+		mov x0, x5
+		mov x1, #0
+		mov x2, #T_SIZE
+		bl _memset
+		```
+	}
+
 	// Address of slot `i` (library-only): the ELEMENT BORROW primitive —
 	// `ref T x = list.at(i)` (docs/HANDLERS.md Stage 4, the dynamic-tree
 	// dispatch) lowers to this, binding the alias to the slot itself rather
@@ -567,7 +854,7 @@ pub struct Buffer<T> {
 	// borrow-invalidation rules. Library-internal: the caller (the `List`
 	// wrapper, or trusted internals) bounds-checks; the body is raw-only so
 	// the missing-return net does not apply to the raw return.
-	pub func slot_ptr = (ref self, int i, out ptr T) {
+	internal func slot_ptr = (ref self, int i, out ptr T) {
 		```
 		#arch: c
 		return (T*)(unsigned long long)self->data + i;
@@ -614,8 +901,10 @@ pub struct Buffer<T> {
 		madd x6, x2, x3, x4
 		cmp x5, x6
 		b.eq .Lbuffer_shift_T_end
-		cmp x3, #8
+		cmp x3, #16
 		b.gt .Lbuffer_shift_T_copy
+		cmp x3, #8
+		b.gt .Lbuffer_shift_T_pair
 		// Width-matched mv: an 8-byte access on a sub-8 element would
 		// clobber the following slot (and run past the slab's end).
 		cmp x3, #1
@@ -643,6 +932,13 @@ pub struct Buffer<T> {
 		str w7, [x5]
 		str wzr, [x6]
 		b .Lbuffer_shift_T_end
+		.Lbuffer_shift_T_pair:
+		// Word-pair shift (T_SIZE <= 16): both words move wholesale
+		// and the source pair zeroes, no calls.
+		ldp x7, x9, [x6]
+		stp x7, x9, [x5]
+		stp xzr, xzr, [x6]
+		b .Lbuffer_shift_T_end
 		.Lbuffer_shift_T_copy:
 		mov x0, x5
 		mov x1, x6
@@ -658,6 +954,67 @@ pub struct Buffer<T> {
 		```
 	}
 
+	// Bulk transfer for backward-shift deletion: move the `count` slots at
+	// `src` down to `dst` (src >= dst) as ONE block move, then zero the
+	// source slots the destination never covers — for the contiguous
+	// deletion shape (src = dst + 1) that is exactly one tail slot, so a
+	// whole range shift costs one memmove + one memset instead of
+	// count × (memcpy + memset) per-element `shift` calls. PROOF
+	// OBLIGATION on the caller (INTERNAL, byte-level like `shift`): every
+	// slot in [dst, dst + count) must be DEAD — zeroed by a move-out or
+	// otherwise unowned — because the block move overwrites them without
+	// reclaiming (the ownership proof is why the deletion algorithms zero
+	// and relocate in lockstep; a live displaced value belongs in `shift`,
+	// which reclaims dst first). The bytes transfer wholesale, so the move
+	// carries mv elements' heap pointers with them — correct for every
+	// element kind, raw for both backends (never names T).
+	internal inline func move_range = (
+		ref self,
+		int dst: dst >= 0,
+		int src: src >= dst,
+		int count: count >= 0 && src + count <= self.cap
+	) {
+		```
+		#arch: c
+		if (count > 0) {
+			T* _slots = (T*)(unsigned long long)self->data;
+			memmove((void*)&_slots[dst], (void*)&_slots[src],
+				(unsigned long long)count * T_SIZE);
+			// Zero the source slots the destination does not overwrite:
+			// [dst + count, src + count) — one slot for the contiguous
+			// deletion shape, the gap+1 slots for a strided one.
+			memset((void*)&_slots[dst + count], 0,
+				(unsigned long long)(src - dst) * T_SIZE);
+		}
+		```
+		```
+		#arch: aarch64
+		// x19 = self, x1 = dst, x2 = src, x3 = count. x0-x18 die across the
+		// bl calls, so the block math parks on the stack around _memmove.
+		cbz x3, .Lbuffer_move_range_T_end
+		ldr x4, [x19, #8]
+		mov x5, #T_SIZE
+		madd x6, x1, x5, x4
+		madd x7, x2, x5, x4
+		madd x9, x3, x5, xzr
+		sub x10, x2, x1
+		madd x10, x10, x5, xzr
+		stp x6, x9, [sp, #-16]!
+		str x10, [sp, #-16]!
+		mov x0, x6
+		mov x1, x7
+		mov x2, x9
+		bl _memmove
+		ldr x10, [sp], #16
+		ldp x6, x9, [sp], #16
+		add x0, x6, x9
+		mov x1, #0
+		mov x2, x10
+		bl _memset
+		.Lbuffer_move_range_T_end:
+		```
+	}
+
 	// A non-mv (ptr, len) slice [start, end) over this buffer's element
 	// storage, returned as a `view T`. It borrows from self: it may not outlive
 	// self's scope and is invalidated if self is reassigned. This is the single