d61ff9f | plum | pyrossh

git clone https://git.pyrossh.dev/plum

A statically typed, imperative programming language inspired by rust, python

d61ff9f — Peter John 2026-11-06T13:36:25+05:30

fip fun: a compile-time guarantee of in-place updates

Files changed (29) hide show

compiler/checker/tests/checker/fip_test.rs +176 -0
compiler/checker/tests/checker/fusion_pipeline_test.rs +1 -1
compiler/checker/tests/checker/main.rs +1 -0
compiler/core/src/ast.rs +2 -0
compiler/core/src/ctors.rs +2 -0
compiler/core/src/drive.rs +3 -1
compiler/core/src/fip.rs +98 -0
compiler/core/src/lib.rs +1 -0
compiler/core/src/parser.rs +2 -0
compiler/core/src/simplify.rs +1 -0
compiler/core/src/tests_lower.rs +1 -0
compiler/core/src/uniqueness.rs +75 -42
compiler/core/tests/core/parser_test.rs +16 -0
compiler/core/tests/core/uniqueness_test.rs +1 -1
compiler/driver/src/lib.rs +33 -5
compiler/lsp/src/completion.rs +1 -0
compiler/tooling/tree-sitter-plum/grammar.js +2 -0
compiler/tooling/tree-sitter-plum/queries/plum/format.scm +2 -0
compiler/tooling/tree-sitter-plum/queries/plum/highlights.scm +1 -0
compiler/tooling/tree-sitter-plum/src/grammar.json +0 -0
compiler/tooling/tree-sitter-plum/src/node-types.json +0 -0
compiler/tooling/tree-sitter-plum/src/parser.c +0 -0
compiler/tooling/tree-sitter-plum/test/corpus/fip.txt +81 -0
compiler/tooling/vscode-plum/syntaxes/plum.tmLanguage.json +1 -1
compiler/wasm-codegen/src/emit.rs +1 -0
docs/plans/2026-11-06-fbip-stage1.md +1 -1
tests/fbip/fip.plum +75 -0
tests/fbip/fuzz/fuzz.sh +24 -0
tests/fbip/fuzz/gen.pl +118 -0

compiler/checker/tests/checker/fip_test.rs ADDED Viewed

@@ -0,0 +1,176 @@
+#![allow(non_snake_case)]
+//! `fip fun`: every spread and `Array.with` written in the body must be proved in place; a
+//! violation is a compile error at the exact span, from the driver, after the proof ran.
+use plum_core::Diagnostic;
+use plum_driver::PassOptions;
+use plum_test_support::load;
+const HEAD: &str = "import std/Int\nimport std/Array\n\nstruct Pt(px: Int, py: Int)\n\n";
+fn run(name: &str, body: &str, opts: &PassOptions) -> Result<(), Vec<Diagnostic>> {
+    let source = load(name, &format!("{HEAD}{body}")).expect("loads");
+    plum_driver::check(&source, opts).map(|_| ())
+}
+/// 1-based line and column of the first `needle` in `HEAD + body`, and its end (exclusive).
+fn span(body: &str, needle: &str) -> (usize, usize, usize, usize) {
+    let all = format!("{HEAD}{body}");
+    let at = all.find(needle).unwrap_or_else(|| panic!("no {needle:?}"));
+    let line = all[..at].matches('\n').count() + 1;
+    let col = at - all[..at].rfind('\n').map_or(0, |n| n + 1) + 1;
+    (line, col, line, col + needle.len())
+}
+fn errs(name: &str, body: &str) -> Vec<Diagnostic> {
+    run(name, body, &PassOptions::default()).expect_err("a fip violation")
+}
+/// One error, at exactly `needle`, whose message is `not in place: ` + `reason`.
+fn expectAt(name: &str, body: &str, needle: &str, reason: &str) {
+    let es = errs(name, body);
+    assert_eq!(es.len(), 1, "{es:?}");
+    let e = &es[0];
+    assert_eq!((e.line, e.column, e.end_line, e.end_column), span(body, needle), "{e:?}");
+    assert_eq!(e.message, format!("not in place: {reason}"), "{e:?}");
+}
+#[test]
+fn passing_forms_compile() {
+    let body = "\
+fip fun plain(a: Int) -> Int = a + 1
+fip fun fresh() -> Array[Int] = Array.filled(2, 0).with(0, 1)
+fip fun mv(p: Pt) -> Pt = Pt(..p, px: p.px + 1)
+fun useMv() -> Pt = mv(Pt(px: 1, py: 2))
+";
+    run("fip_ok", body, &PassOptions::default()).expect("compiles");
+}
+#[test]
+fn alias_kept() {
+    let body = "fip fun upd(a: Array[Int]) -> Array[Int] =\n  b := a\n  a.with(0, 1)\n";
+    expectAt("fip_alias", body, "a.with(0, 1)", "`a` is also held by `b`");
+}
+#[test]
+fn spread_alias_kept() {
+    let body = "fip fun upd(s: Pt) -> Pt =\n  k := s\n  Pt(..s, px: 1)\n";
+    expectAt("fip_spread_alias", body, "Pt(..s, px: 1)", "`s` is also held by `k`");
+}
+#[test]
+fn stored_in_a_list() {
+    let body = "fip fun upd(a: Array[Int]) -> Array[Int] =\n  xs := [a]\n  a.with(0, 1)\n";
+    expectAt("fip_list", body, "a.with(0, 1)", "`a` is stored in field `head`");
+}
+#[test]
+fn captured_by_a_closure() {
+    let body = "fip fun upd(a: Array[Int]) -> Array[Int] =\n  g := || a.get(0)\n  a.with(0, 1)\n";
+    expectAt("fip_capture", body, "a.with(0, 1)", "`a` is captured by a closure");
+}
+#[test]
+fn read_after_the_update() {
+    let body = "fip fun upd(a: Array[Int]) -> Int =\n  b := a.with(0, 1)\n  a.get(0)\n";
+    expectAt("fip_after", body, "a.with(0, 1)", "`a` is read after the update");
+}
+#[test]
+fn shared_by_another_caller() {
+    let body = "fip fun upd(a: Array[Int]) -> Array[Int] = a.with(0, 1)\nfun keep(x: Array[Int]) -> Int =\n  y := upd(x)\n  x.get(0)\n";
+    expectAt(
+        "fip_caller",
+        body,
+        "a.with(0, 1)",
+        "`a` may be shared by a caller: `x` is passed to `upd`, which may keep it or the caller reads it afterwards (call of `upd` from keep)",
+    );
+}
+#[test]
+fn spread_shared_by_another_caller() {
+    let body = "fip fun upd(p: Pt) -> Pt = Pt(..p, px: 1)\nfun keep(x: Pt) -> Int =\n  y := upd(x)\n  y.px + x.px\n";
+    expectAt(
+        "fip_spread_caller",
+        body,
+        "Pt(..p, px: 1)",
+        "`p` may be shared by a caller: `x` is passed to `upd`, which may keep it or the caller reads it afterwards (call of `upd` from keep)",
+    );
+}
+#[test]
+fn a_caller_that_hands_over_keeps_it_in_place() {
+    let body = "fip fun upd(p: Pt) -> Pt = Pt(..p, px: 1)\nfun keep(x: Pt) -> Pt = upd(x)\n";
+    run("fip_handover", body, &PassOptions::default()).expect("compiles");
+}
+#[test]
+fn update_inside_a_closure() {
+    let body = "fip fun upd(a: Array[Int]) -> Array[Int] =\n  g := || a.with(0, 1)\n  g()\n";
+    expectAt("fip_in_closure", body, "a.with(0, 1)", "the update is inside a closure");
+}
+#[test]
+fn spread_inside_a_closure_counts() {
+    let body = "fip fun upd(p: Pt) -> Pt =\n  g := |n: Int| Pt(..p, px: n)\n  g(1)\n";
+    expectAt("fip_spread_closure", body, "Pt(..p, px: n)", "`p` is captured by a closure");
+}
+#[test]
+fn a_fip_method() {
+    let body = "\
+struct Bx(items: Array[Int], n: Int) =
+  fip fun put(self, x: Int) -> Bx = Bx(..self, items: self.items.with(0, x))
+  fun peek(self) -> Int = self.items.get(0)
+fun twice(b: Bx) -> Int =
+  c := b.put(1)
+  c.peek() + b.peek()
+";
+    let es = errs("fip_method", body);
+    let why = "`self` may be shared by a caller: `b` is the receiver of `put`, which may keep it or the caller reads it afterwards (call of `put` from twice)";
+    let want = [span(body, "Bx(..self, items: self.items.with(0, x))"), span(body, "self.items.with(0, x)")];
+    let got: Vec<_> = es.iter().map(|e| (e.line, e.column, e.end_line, e.end_column)).collect();
+    assert_eq!(got, want, "{es:?}");
+    assert!(es.iter().all(|e| e.message == format!("not in place: {why}")), "{es:?}");
+}
+#[test]
+fn a_fip_method_handed_over_compiles() {
+    let body = "\
+struct Bx(items: Array[Int], n: Int) =
+  fip fun put(self, x: Int) -> Bx = Bx(..self, items: self.items.with(0, x))
+fun once(n: Int) -> Bx =
+  b := Bx(items: Array.filled(n, 0), n: n)
+  b = b.put(1)
+  b
+";
+    run("fip_method_ok", body, &PassOptions::default()).expect("compiles");
+}
+#[test]
+fn an_inlined_callee_is_reported_at_the_fip_fun() {
+    // `helper` is small, so fusion builds its spread into `upd`; the spot is no longer the user's.
+    let body = "fun helper(s: Pt) -> Pt = Pt(..s, px: s.px + 1)\nfip fun upd(p: Pt) -> Int =\n  q := helper(p)\n  q.px + p.px\n";
+    let es = errs("fip_inlined", body);
+    assert_eq!(es.len(), 1, "{es:?}");
+    let (line, col, _, _) = span(body, "fip fun upd");
+    assert_eq!((es[0].line, es[0].column), (line, col), "{es:?}");
+    assert_eq!(
+        es[0].message,
+        "not in place: `p` is read after the spread (a spread that fusion built into `fip fun upd`; the exact spot is not kept)"
+    );
+}
+#[test]
+fn a_fip_fun_is_not_inlined_away() {
+    // Were `upd` inlined into `keep` and left without callers, its own spread would look unshared.
+    let body = "fip fun upd(p: Pt) -> Pt = Pt(..p, px: 1)\nfun keep(x: Pt) -> Int =\n  y := upd(x)\n  y.px + x.px\n";
+    assert_eq!(errs("fip_not_inlined", body).len(), 1);
+}
+#[test]
+fn not_enforced_without_the_proof() {
+    let body = "fip fun upd(a: Array[Int]) -> Array[Int] =\n  b := a\n  a.with(0, 1)\n";
+    run("fip_nofbip", body, &PassOptions { fbip: false, ..PassOptions::default() }).expect("--no-fbip: not enforced");
+    run("fip_nofusion", body, &PassOptions { fusion: false, ..PassOptions::default() }).expect("--no-fusion: not enforced");
+    assert_eq!(errs("fip_on", body).len(), 1);
+}

compiler/checker/tests/checker/fusion_pipeline_test.rs CHANGED Viewed

@@ -124,7 +124,7 @@ fn explain_lists_unproved_uniqueness() {
     let mut copy = parse(src);
     let notes = fusionNotes(&mut copy);
     let n = notes.iter().find(|n| n.contains("not in place")).unwrap_or_else(|| panic!("{notes:?}"));
-    assert!(n.contains("aliased"), "{n}");
+    assert!(n.contains("also held"), "{n}");
 }
 #[test]

compiler/checker/tests/checker/main.rs CHANGED Viewed

@@ -6,6 +6,7 @@ mod diagnostic_tests;
 mod io_primitive_tests;
 mod explicit_generics_tests;
 mod features;
+mod fip_test;
 mod fusion_pipeline_test;
 mod inline_variants_tests;
 mod question_tests;

compiler/core/src/ast.rs CHANGED Viewed

@@ -543,6 +543,8 @@ pub struct Fn {
     /// `abstract fun m(self) -> T` (no body): an abstract struct method that every
     /// subtype must override.
     pub is_abstract: bool,
+    /// `fip fun`: every spread and `Array.with` in the body must be proved in place (driver check).
+    pub is_fip: bool,
     /// The fn declared `self` as its first parameter (an instance method). A
     /// fn nested in a type or `primitive` body without it is a static.
     pub has_self: bool,

compiler/core/src/ctors.rs CHANGED Viewed

@@ -484,6 +484,7 @@ pub fn lowerCtors(source: &mut Source) -> Vec<String> {
                 is_test: false,
                 is_override: false,
                 is_abstract: false,
+                is_fip: false,
                 has_self: true,
                 params: vec![],
                 returns: None,
@@ -503,6 +504,7 @@ pub fn lowerCtors(source: &mut Source) -> Vec<String> {
             is_test: false,
             is_override: false,
             is_abstract: false,
+            is_fip: false,
             has_self: false,
             params: nparams
                 .iter()

compiler/core/src/drive.rs CHANGED Viewed

@@ -513,7 +513,8 @@ impl Driver {
                             continue;
                         }
                     }
+                    // A `fip fun` stays a call, so the uniqueness proof sees every caller of it.
-                    if f.is_extern || f.is_export {
+                    if f.is_extern || f.is_export || f.is_fip {
                         continue;
                     }
                     let k = keyOf(f);
@@ -1849,6 +1850,7 @@ impl Driver {
             is_test: false,
             is_override: false,
             is_abstract: false,
+            is_fip: false,
             has_self: false,
             params,
             returns: cret.as_ref().map(|r| substType(r, &map)),

compiler/core/src/fip.rs ADDED Viewed

@@ -0,0 +1,98 @@
+//! `fip fun`: a compile-time guarantee that the function's own updates run in place.
+//!
+//! Every spread `T(..x, ..)` and every `Array.with` call written in the body of a `fip fun`
+//! (closures inside it included) must be proved in place by `uniqueness::markUnique`. Calls to
+//! other functions are not checked: the guarantee is local to the body.
+//!
+//! The check runs on the program after fusion, because only there is the proof complete. Fusion
+//! never inlines or fuses a `fip fun` (simplify and drive skip it), so every call of one stays
+//! visible to the proof and the function is never removed; the flag lives on the `Fn`, so the
+//! check cannot be skipped. A site whose span is not one the function had before fusion (a
+//! callee inlined into its body) is reported at the `fip` function's own line instead, with a
+//! note saying so.
+use crate::ast::*;
+use crate::diag::{DiagKind, Diagnostic};
+use crate::uniqueness::UniqueReport;
+use crate::visit::walkBlockRef;
+use std::collections::{HashMap, HashSet};
+type SpanKey = (usize, usize, usize, usize);
+fn key(s: &Span) -> SpanKey {
+    (s.startLine, s.startColumn, s.endLine, s.endColumn)
+}
+/// The spans of the spreads and `.with` calls each `fip fun` had before fusion, by the fn's
+/// own position (the rewrites keep a fn's line and column).
+#[derive(Default)]
+pub struct FipOrigins(HashMap<(String, usize, usize), HashSet<SpanKey>>);
+impl FipOrigins {
+    pub fn isEmpty(&self) -> bool {
+        self.0.is_empty()
+    }
+}
+fn isCheckedSite(e: &Expr) -> bool {
+    match &e.kind {
+        ExprKind::ClassCall(c) => c.spread.is_some(),
+        ExprKind::Attribute(a) => matches!(&a.attr, AttrKind::Method(c) if c.name == "with"),
+        _ => false,
+    }
+}
+/// Records the `fip fun`s of `src` and the spans of their checked sites.
+pub fn origins(src: &Source) -> FipOrigins {
+    let mut out = FipOrigins::default();
+    for item in &src.items {
+        let Item::Fn(f) = item else { continue };
+        if !f.is_fip {
+            continue;
+        }
+        let mut spans = HashSet::new();
+        let mut note = |e: &Expr| {
+            if isCheckedSite(e) {
+                spans.insert(key(&e.span));
+            }
+        };
+        match &f.body {
+            FnBody::Expr(e) => crate::visit::walkRef(e, &mut note),
+            FnBody::Block(b) => walkBlockRef(b, &mut note),
+            FnBody::Extern => {}
+        }
+        out.0.insert((f.file.clone(), f.line, f.column), spans);
+    }
+    out
+}
+/// One error per spread or `Array.with` of a `fip fun` that the proof left a copy.
+pub fn diagnostics(src: &Source, report: &UniqueReport, origins: &FipOrigins) -> Vec<Diagnostic> {
+    let mut out: Vec<Diagnostic> = Vec::new();
+    for v in &report.fipSites {
+        let Err(why) = &v.result else { continue };
+        let Some(Item::Fn(f)) = src.items.get(v.itemIdx) else { continue };
+        let known = origins.0.get(&(f.file.clone(), f.line, f.column));
+        let d = match known {
+            Some(spans) if spans.contains(&key(&v.span)) => Diagnostic::new(
+                DiagKind::Type,
+                f.file.clone(),
+                v.span.startLine,
+                v.span.startColumn,
+                format!("not in place: {why}"),
+            )
+            .with_end(v.span.endLine, v.span.endColumn),
+            _ => Diagnostic::new(
+                DiagKind::Type,
+                f.file.clone(),
+                f.line,
+                f.column,
+                format!("not in place: {why} (a {} that fusion built into `fip fun {}`; the exact spot is not kept)", v.what, f.name),
+            ),
+        };
+        if !out.iter().any(|o| o.file == d.file && o.line == d.line && o.column == d.column && o.message == d.message) {
+            out.push(d);
+        }
+    }
+    out.sort_by(|a, b| (&a.file, a.line, a.column).cmp(&(&b.file, b.line, b.column)));
+    out
+}

compiler/core/src/lib.rs CHANGED Viewed

@@ -12,6 +12,7 @@ pub mod drive;
 pub mod embeds;
 pub mod enum_checks;
 pub mod formatter;
+pub mod fip;
 pub mod forms;
 pub mod generics;
 pub mod layout;

compiler/core/src/parser.rs CHANGED Viewed

@@ -481,6 +481,7 @@ impl<'a> AstParser<'a> {
         let is_export = node.child_by_field_name("exportKw").is_some();
         let is_override = node.child_by_field_name("overrideKw").is_some();
         let is_abstract = node.child_by_field_name("abstractKw").is_some();
+        let is_fip = node.child_by_field_name("fipKw").is_some();
         let generics: Vec<String> = node
             .child_by_field_name("generics")
@@ -505,6 +506,7 @@ impl<'a> AstParser<'a> {
             is_test: false,
             is_override,
             is_abstract,
+            is_fip,
             has_self: !self.childrenOfKind(node, "self").is_empty(),
             params,
             returns,

compiler/core/src/simplify.rs CHANGED Viewed

@@ -297,6 +297,7 @@ impl<'a> Cx<'a> {
             && !self.recursive.contains(name)
             && !self.stack.iter().any(|s| s == name)
             && !f.is_extern
+            && !f.is_fip
             && !f.is_export
             && !f.has_self
             && f.type_param.is_none()

compiler/core/src/tests_lower.rs CHANGED Viewed

@@ -116,6 +116,7 @@ fn desugarTestsToFns(source: &crate::ast::Source) -> (crate::ast::Source, Vec<(S
                     is_test: true,
                     is_override: false,
                     is_abstract: false,
+                    is_fip: false,
                     has_self: true,
                     params: ioParam.clone(),
                     returns: Some(crate::ast::Type {

compiler/core/src/uniqueness.rs CHANGED Viewed

@@ -47,6 +47,20 @@ use std::collections::{HashMap, HashSet};
 pub struct UniqueReport {
     pub proved: Vec<String>,
     pub unproved: Vec<(String, String)>,
+    /// A verdict per spread and per `Array.with` inside a `fip fun` (empty when there is none).
+    pub fipSites: Vec<SiteVerdict>,
+}
+/// One spread or `Array.with` call of a `fip fun`, and whether it was proved in place.
+#[derive(Debug, Clone)]
+pub struct SiteVerdict {
+    /// Index of the fn in `Source.items`.
+    pub itemIdx: usize,
+    pub span: Span,
+    /// `"spread"` or `"Array.with"`.
+    pub what: &'static str,
+    /// `Err` carries the reason in plain words.
+    pub result: Result<(), String>,
 }
 // ---------- traversal ----------
@@ -432,6 +446,7 @@ struct SpreadWith {
 struct SpreadSite {
     unit: usize,
+    node: NodeId,
     typeName: String,
     var: Option<String>,
     given: Vec<String>,
@@ -646,14 +661,14 @@ impl An {
         let param = u.params.iter().position(|p| p.name == v);
         if let Some(i) = param {
             if !u.free && !u.method {
-                return Err(format!("{v} is a parameter of an exported or iterator fn; callers are not tracked"));
+                return Err(format!("`{v}` is a parameter of an exported or iterator fn; its callers are not tracked"));
             }
             if !u.params[i].plain {
-                return Err(format!("{v} is a fn-typed parameter"));
+                return Err(format!("`{v}` is a fn-typed parameter"));
             }
             if !entryUnique && !self.paramUnique(unit, i) {
                 let why = self.upWhy.borrow().get(&(unit, i)).cloned();
-                return Err(why.unwrap_or_else(|| format!("a caller of {} may pass a shared {v}", u.name)));
+                return Err(why.unwrap_or_else(|| format!("a caller of `{}` may pass a shared `{v}`", u.name)));
             }
         }
         let mut s = Scan { an: self, v, strict, boundDepth: if param.is_some() { Some(0) } else { None }, err: None };
@@ -662,7 +677,7 @@ impl An {
             return Err(e);
         }
         if s.boundDepth.is_none() {
-            return Err(format!("{v} is not a local or parameter (global or field)"));
+            return Err(format!("`{v}` is not a local or parameter (a global or a field)"));
         }
         Ok(())
     }
@@ -673,7 +688,7 @@ impl An {
     /// `x.f = x.f.with(..)`, or `T(..s, f: s.f.with(..))` of a unique `s`.
     fn withOk(&self, site: &Site) -> Result<(), String> {
         if site.inClosure {
-            return Err("inside a closure".to_string());
+            return Err("the update is inside a closure".to_string());
         }
         let Some(Some(recv)) = site.args.first() else { return Err("no receiver".to_string()) };
         if self.fresh(recv) {
@@ -687,27 +702,27 @@ impl An {
                 if consumed {
                     Ok(())
                 } else {
-                    Err(format!("{v} is used after the write"))
+                    Err(format!("`{v}` is read after the update"))
                 }
             }
             ExprKind::Attribute(a) => {
-                let AttrKind::Field(f) = &a.attr else { return Err("receiver is a method result".to_string()) };
+                let AttrKind::Field(f) = &a.attr else { return Err("the receiver is a method result".to_string()) };
                 match self.spreadWith.get(&site.node) {
                     Some(sw) => {
                         if !sw.clean {
-                            return Err(format!("another field of the spread reads {f}"));
+                            return Err(format!("another field of the spread reads `{f}`"));
                         }
                         self.varOk(sw.unit, &sw.var)?;
                         if self.uf.borrow().contains(&sw.field) {
                             Ok(())
                         } else {
-                            Err(format!("field {f} may be shared"))
+                            Err(format!("field `{f}` may be shared"))
                         }
                     }
                     None => self.argOk(site, recv),
                 }
             }
-            _ => Err("receiver may be shared".to_string()),
+            _ => Err("the array may be held elsewhere".to_string()),
         }
     }
@@ -728,28 +743,28 @@ impl An {
             return Ok(());
         }
         if site.inClosure {
-            return Err("argument inside a closure".to_string());
+            return Err("an argument is passed from inside a closure".to_string());
         }
         match &e.kind {
             ExprKind::Var(_) | ExprKind::Self_ => self.varOk(site.caller, varName(e).unwrap()),
             ExprKind::Attribute(a) => {
                 let AttrKind::Field(f) = &a.attr else {
-                    return Err("argument is a method call result that may be shared".to_string());
+                    return Err("an argument is a method call result that may be shared".to_string());
                 };
                 let ok = match &site.assignBack {
                     Some(AssignTarget::Field(tobj, tf)) => tf == f && **tobj == a.object,
                     _ => false,
                 };
                 if !ok {
-                    return Err(format!("field {f} passed without being written back"));
+                    return Err(format!("field `{f}` is passed on without being written back"));
                 }
                 if self.uf.borrow().contains(f) {
                     Ok(())
                 } else {
-                    Err(format!("field {f} may be shared"))
+                    Err(format!("field `{f}` may be shared"))
                 }
             }
-            _ => Err("argument may be shared".to_string()),
+            _ => Err("an argument may be shared".to_string()),
         }
     }
 }
@@ -814,14 +829,14 @@ impl<'a> Scan<'a> {
     }
     fn escapes(&self) -> String {
-        format!("{} escapes while still live", self.v)
+        format!("`{}` is still used after the update", self.v)
     }
     fn checkPatterns(&mut self, ps: &[CasePattern]) {
         let mut names = vec![];
         ps.iter().for_each(|p| crate::visit::patternBinders(p, &mut names));
         if names.iter().any(|n| n == self.v) {
-            self.fail(format!("{} rebound by a pattern", self.v));
+            self.fail(format!("`{}` is rebound by a pattern", self.v));
         }
     }
@@ -841,27 +856,27 @@ impl<'a> Scan<'a> {
                                 match self.boundDepth {
                                     None => self.boundDepth = Some(depth),
                                     Some(d) if d == depth => {}
-                                    Some(_) => self.fail(format!("{v} shadowed in an inner scope")),
+                                    Some(_) => self.fail(format!("`{v}` is shadowed in an inner scope")),
                                 }
                             }
                             if !self.bindingOk(val, a.declare) {
-                                self.fail(format!("{v} bound to a value that may be shared"));
+                                self.fail(format!("`{v}` is bound to a value that may be shared"));
                             } else {
                                 self.expr(val, false, true);
                             }
                         }
-                        AssignTarget::Var(n) => self.operand(val, format!("{v} aliased by {n}")),
+                        AssignTarget::Var(n) => self.operand(val, format!("`{v}` is also held by `{n}`")),
                         AssignTarget::Field(o, f) => {
                             if !self.bare(o) {
                                 self.expr(o, false, false);
                             }
-                            self.operand(val, format!("{v} stored in field {f}"));
+                            self.operand(val, format!("`{v}` is stored in field `{f}`"));
                         }
                     }
                 } else {
                     for t in &a.targets {
                         match t {
-                            AssignTarget::Var(n) if *n == v => self.fail(format!("{v} rebound in a multi-assign")),
+                            AssignTarget::Var(n) if *n == v => self.fail(format!("`{v}` is rebound in a multi-assign")),
                             AssignTarget::Var(_) => {}
                             AssignTarget::Field(o, _) => {
                                 if !self.bare(o) {
@@ -871,7 +886,7 @@ impl<'a> Scan<'a> {
                         }
                     }
                     for val in &a.values {
-                        self.operand(val, format!("{v} escapes via a multi-assign"));
+                        self.operand(val, format!("`{v}` is also held through a multi-assign"));
                     }
                 }
             }
@@ -894,7 +909,7 @@ impl<'a> Scan<'a> {
                 for (k, sub) in m.subjects.iter().enumerate() {
                     if self.bare(sub) {
                         if m.cases.iter().any(|c| matches!(c.patterns.get(k), Some(CasePattern::Name(_)))) {
-                            self.fail(format!("{v} aliased by a pattern binding"));
+                            self.fail(format!("`{v}` is also held by a pattern binding"));
                         }
                     } else {
                         self.expr(sub, false, false);
@@ -927,7 +942,7 @@ impl<'a> Scan<'a> {
                             && (!ab || self.resultOk(g))
                     });
                 if !ok {
-                    self.fail(format!("{v} passed to {} without being dead afterwards", c.name));
+                    self.fail(format!("`{v}` is passed to `{}`, which may keep it or the caller reads it afterwards", c.name));
                 }
             } else {
                 self.expr(e, false, false);
@@ -954,7 +969,7 @@ impl<'a> Scan<'a> {
         let readOnly = recvBare && !cands.is_empty() && cands.iter().all(|g| self.an.ro.contains(g));
         if recvBare {
             if !readOnly && !handOver(self, None) {
-                self.fail(format!("{v} passed as self to {} without being dead afterwards", c.name));
+                self.fail(format!("`{v}` is the receiver of `{}`, which may keep it or the caller reads it afterwards", c.name));
             }
         } else {
             self.expr(&a.object, false, false);
@@ -963,7 +978,7 @@ impl<'a> Scan<'a> {
             let e = argExpr(x);
             if self.bare(e) {
                 if !handOver(self, Some(k)) {
-                    self.fail(format!("{v} passed to method {} without being dead afterwards", c.name));
+                    self.fail(format!("`{v}` is passed to method `{}`, which may keep it or the caller reads it afterwards", c.name));
                 }
             } else {
                 self.expr(e, false, false);
@@ -996,14 +1011,14 @@ impl<'a> Scan<'a> {
                 match &cc.spread {
                     Some(s) if self.bare(s) => {
                         if !(tail || ab) {
-                            self.fail(format!("{v} used after its spread"));
+                            self.fail(format!("`{v}` is read after the spread"));
                         }
                     }
                     Some(s) => self.expr(s, false, false),
                     None => {}
                 }
                 for fa in &cc.fields {
-                    self.operand(&fa.value, format!("{v} stored in field {}", fa.name));
+                    self.operand(&fa.value, format!("`{v}` is stored in field `{}`", fa.name));
                 }
             }
             ExprKind::Attribute(a) => match &a.attr {
@@ -1025,7 +1040,7 @@ impl<'a> Scan<'a> {
                     true
                 });
                 if found {
-                    self.fail(format!("{v} captured by a closure"));
+                    self.fail(format!("`{v}` is captured by a closure"));
                 }
             }
             ExprKind::Binary(b) => {
@@ -1076,19 +1091,26 @@ pub fn markUnique(src: &mut Source) -> UniqueReport {
     solve(&an);
     // Report and mark.
     let mut report = UniqueReport::default();
+    let isFip = |ui: usize| matches!(&src.items[an.units[ui].itemIdx], Item::Fn(f) if f.is_fip);
+    let mut verdicts: Vec<(usize, NodeId, &'static str, Result<(), String>)> = Vec::new();
     let mut okVars: Vec<HashSet<String>> = vec![HashSet::new(); an.units.len()];
     for (ui, u) in an.units.iter().enumerate() {
         let label = format!("{}:{}", u.label, lineOf(src, u));
         for s in an.spreads.iter().filter(|s| s.unit == ui) {
-            match &s.var {
+            let verdict = match &s.var {
-                None => report.unproved.push((label.clone(), "spread source is not a plain variable".into())),
+                None => Err("the spread source is not a plain variable".to_string()),
-                Some(v) => match an.varOk(ui, v) {
+                Some(v) => an.varOk(ui, v),
+            };
+            match (&s.var, &verdict) {
-                    Ok(()) => {
+                (Some(v), Ok(())) => {
-                        report.proved.push(label.clone());
+                    report.proved.push(label.clone());
-                        okVars[ui].insert(v.clone());
+                    okVars[ui].insert(v.clone());
-                    }
+                }
-                    Err(r) => report.unproved.push((label.clone(), r)),
+                (_, Err(r)) => report.unproved.push((label.clone(), r.clone())),
+                _ => {}
-                },
+            }
+            if isFip(ui) {
+                verdicts.push((ui, s.node, "spread", verdict));
             }
         }
     }
@@ -1100,12 +1122,16 @@ pub fn markUnique(src: &mut Source) -> UniqueReport {
             continue;
         }
         let label = format!("{}:{} (array write)", u.label, lineOf(src, u));
-        match an.withOk(site) {
+        let verdict = an.withOk(site);
+        match &verdict {
             Ok(()) => {
                 withMarks.insert(site.node);
                 report.proved.push(label);
             }
-            Err(r) => report.unproved.push((label, r)),
+            Err(r) => report.unproved.push((label, r.clone())),
+        }
+        if isFip(site.caller) {
+            verdicts.push((site.caller, site.node, "Array.with", verdict));
         }
     }
     // Mutable pass.
@@ -1114,7 +1140,9 @@ pub fn markUnique(src: &mut Source) -> UniqueReport {
             continue;
         }
         let ok = &okVars[ui];
+        let mut spans: HashMap<NodeId, Span> = HashMap::new();
         let mut mark = |e: &mut Expr| {
+            spans.insert(e.id, e.span);
             if withMarks.contains(&e.id) {
                 if let ExprKind::Attribute(a) = &mut e.kind {
                     if let AttrKind::Method(c) = &mut a.attr {
@@ -1141,6 +1169,10 @@ pub fn markUnique(src: &mut Source) -> UniqueReport {
             Item::Test(t) => mutBlock(&mut t.body, &mut mark),
             _ => {}
         }
+        for (_, node, what, result) in verdicts.iter().filter(|v| v.0 == ui) {
+            let span = spans.get(node).copied().unwrap_or_default();
+            report.fipSites.push(SiteVerdict { itemIdx: u.itemIdx, span, what, result: result.clone() });
+        }
     }
     report
 }
@@ -1702,6 +1734,7 @@ fn collectFacts(an: &mut An) {
                         if let Some(s) = &cc.spread {
                             spreads.push(SpreadSite {
                                 unit: ui,
+                                node: e.id,
                                 typeName: cc.type_name.clone(),
                                 var: varName(s).map(|v| v.to_string()),
                                 given,
@@ -1907,7 +1940,7 @@ fn solve(an: &An) {
                     Err(m) => {
                         let from = &an.units[site.caller].label;
                         if why.is_none() {
-                            why = Some(format!("{} (in a call of {} from {})", m, an.units[g].name, from));
+                            why = Some(format!("`{}` may be shared by a caller: {} (call of `{}` from {})", an.units[g].params[j].name, m, an.units[g].name, from));
                         }
                     }
                     Ok(()) => okFrom = okFrom.or(Some(site.caller)),

compiler/core/tests/core/parser_test.rs CHANGED Viewed

@@ -825,6 +825,22 @@ fn abstractFunSetsFlag() {
     assert!(fns.iter().any(|f| f.name == "other" && !f.is_abstract));
 }
+#[test]
+fn fipFunSetsFlag() {
+    let s = parseRaw("fip fun a1() -> Int = 1\nfun b1() -> Int = 2\nstruct Sq(x: Int) =\n  override fip fun d(self) -> Int = self.x\n");
+    let fns: Vec<&Fn> = s.items.iter().filter_map(|i| if let Item::Fn(f) = i { Some(f) } else { None }).collect();
+    assert!(fns.iter().any(|f| f.name == "a1" && f.is_fip && !f.is_override));
+    assert!(fns.iter().any(|f| f.name == "b1" && !f.is_fip));
+    assert!(fns.iter().any(|f| f.name == "d" && f.is_fip && f.is_override));
+}
+#[test]
+fn fipStaysAnOrdinaryName() {
+    // a variable, a field and a field read called `fip` still parse
+    let s = parseRaw("struct Hold(fip: Int) =\n  fun get(self) -> Int = self.fip\nfun main() -> Int =\n  fip := 3\n  fip + 1\n");
+    assert!(s.items.iter().all(|i| !matches!(i, Item::Fn(f) if f.is_fip)));
+}
 // `try g()`, `g() catch 0`, `null` and `error.Bad` are not listed: they are now ordinary names, so they read as separate
 // expressions or a field access and fail in the checker (undefined name), not the parser.
 #[test]

compiler/core/tests/core/uniqueness_test.rs CHANGED Viewed

@@ -85,7 +85,7 @@ fn aliased_by_local_not_unique() {
     let s = format!("{PRE}fun bad(s: Pt) -> Pt =\n  k := s\n  Pt(..s, x: 1)\n");
     let (src, r) = run(&s);
     assert!(!proved(&r, "bad:3"));
-    assert_eq!(reason(&r, "bad:3"), "s aliased by k");
+    assert_eq!(reason(&r, "bad:3"), "`s` is also held by `k`");
     assert!(!anyUnique(&src, "bad"));
 }

compiler/driver/src/lib.rs CHANGED Viewed

@@ -7,6 +7,7 @@ use plum_checker::{checkOnce, checkProgram, TypedInfo};
 use plum_core::ast::Source;
 use plum_core::closure_spec::Hints;
 use plum_core::diag::Diagnostic;
+use std::cell::RefCell;
 use std::rc::Rc;
 /// Which passes run, and whether dropped or applied rewrites are explained on stderr.
@@ -46,6 +47,8 @@ pub struct Env<'a> {
     pub fbip: bool,
     /// Receiver types of method calls, read off the checked program (see `closureHints`).
     pub hints: &'a Hints,
+    /// Errors a pass found in the program it rewrote (`fip fun` sites that stayed copies).
+    pub errors: &'a RefCell<Vec<Diagnostic>>,
 }
 /// One rewrite pass: changes the program in place, returns whether anything changed.
@@ -68,6 +71,14 @@ pub fn fusionNotes(copy: &mut Source) -> Vec<String> {
 /// `fusionNotes`; with `fbip` off, uniqueness and cell reuse do not run, so nothing is updated in place.
 pub fn fusionNotesWith(copy: &mut Source, fbip: bool) -> Vec<String> {
+    fusionRun(copy, fbip).0
+}
+/// `fusionNotesWith`, and the errors of the `fip fun`s whose spreads or `Array.with` calls the
+/// proof left as copies (see `plum_core::fip`). Needs `fbip`; without it nothing is enforced.
+pub fn fusionRun(copy: &mut Source, fbip: bool) -> (Vec<String>, Vec<Diagnostic>) {
+    let origins = plum_core::fip::origins(copy);
+    let mut errors = Vec::new();
     let pure = plum_core::purity::pureFns(copy);
     let mut notes = plum_core::simplify::simplify(copy, &pure);
     notes.extend(plum_core::drive::drive(copy, &pure));
@@ -75,15 +86,17 @@ pub fn fusionNotesWith(copy: &mut Source, fbip: bool) -> Vec<String> {
         let rep = plum_core::uniqueness::markUnique(copy);
         notes.extend(rep.proved.iter().map(|l| format!("unique spread at {l}")));
         notes.extend(rep.unproved.iter().map(|(l, why)| format!("uniqueness: not in place {l}: {why}")));
+        errors = plum_core::fip::diagnostics(copy, &rep, &origins);
         notes.retain(|n| !n.is_empty());
         notes.extend(plum_core::reuse::markReuse(copy));
     }
     notes.retain(|n| !n.is_empty());
-    notes
+    (notes, errors)
 }
 fn fusion(copy: &mut Source, env: &Env) -> bool {
-    let notes = fusionNotesWith(copy, env.fbip);
+    let (notes, errors) = fusionRun(copy, env.fbip);
+    env.errors.borrow_mut().extend(errors);
     if env.explain {
         for n in &notes {
             eprintln!("fusion: {n}");
@@ -110,6 +123,8 @@ struct State {
     pre: Source,
     result: Result<(), Vec<Diagnostic>>,
     info: TypedInfo,
+    /// `fip fun` violations, kept even when the rewrite that found them is dropped.
+    fip: Vec<Diagnostic>,
 }
 /// Checks `source`, then runs the enabled passes of `PASSES` in order, each adopted only if
@@ -122,8 +137,11 @@ pub fn check(source: &Source, opts: &PassOptions) -> Result<TypedInfo, Vec<Diagn
 /// `check` with an explicit pass list.
 pub fn check_with(source: &Source, opts: &PassOptions, passes: &[Pass]) -> Result<TypedInfo, Vec<Diagnostic>> {
     let (result, info) = checkProgram(source);
-    let mut st = State { pre: preUnionSource(source), result, info };
+    let mut st = State { pre: preUnionSource(source), result, info, fip: Vec::new() };
     if st.result.is_ok() {
+        if opts.explain && !(opts.fusion && opts.fbip) && !plum_core::fip::origins(&st.pre).isEmpty() {
+            eprintln!("fusion: fip fun is not enforced: it needs the uniqueness proof, which --no-fusion and --no-fbip switch off");
+        }
         for pass in passes.iter().filter(|p| (p.enabled)(opts)) {
             runPass(pass, source, opts, &mut st);
         }
@@ -132,6 +150,9 @@ pub fn check_with(source: &Source, opts: &PassOptions, passes: &[Pass]) -> Resul
     if let Some(lowered) = st.info.lowered.as_mut().and_then(Rc::get_mut) {
         plum_core::tail::markTailCalls(lowered);
     }
+    if st.result.is_ok() && !st.fip.is_empty() {
+        return Err(st.fip);
+    }
     st.result.map(|()| st.info)
 }
@@ -148,7 +169,8 @@ fn runPass(pass: &Pass, original: &Source, opts: &PassOptions, st: &mut State) {
     } else {
         Hints::new()
     };
+    let errors = RefCell::new(Vec::new());
-    let env = Env { explain: opts.explain, fbip: opts.fbip, hints: &hints };
+    let env = Env { explain: opts.explain, fbip: opts.fbip, hints: &hints, errors: &errors };
     let mut copy = match pass.target {
         Target::Pre => st.pre.clone(),
         Target::Lowered => match st.info.lowered.as_ref() {
@@ -156,7 +178,13 @@ fn runPass(pass: &Pass, original: &Source, opts: &PassOptions, st: &mut State) {
             None => return,
         },
     };
-    if !(pass.rewrite)(&mut copy, &env) {
+    let changed = (pass.rewrite)(&mut copy, &env);
+    for d in errors.into_inner() {
+        if !st.fip.contains(&d) {
+            st.fip.push(d);
+        }
+    }
+    if !changed {
         return;
     }
     // A pass builds nodes with no id and copies code; number the new ones, and in a debug

compiler/lsp/src/completion.rs CHANGED Viewed

@@ -647,6 +647,7 @@ mod tests {
             is_test: false,
             is_override: false,
             is_abstract: false,
+            is_fip: false,
             has_self: false,
             params: vec![],
             returns: None,

compiler/tooling/tree-sitter-plum/grammar.js CHANGED Viewed

@@ -249,6 +249,8 @@ module.exports = grammar({
           // `export fun foo(...) = ...` is a normal function that is also exported from
           // the wasm module under its own name, with the `extern` boundary ABI.
           optional(choice(field("externKw", "extern"), field("exportKw", "export"), field("overrideKw", "override"), field("abstractKw", "abstract"))),
+          // `fip fun`: a compile-time guarantee that the body's updates run in place.
+          optional(field("fipKw", "fip")),
           field("kw", "fun"),
           field("name", $.fn_identifier),
           // Declared type parameters: `fun map[B](..)`, `fun id[Elem](..)`.

compiler/tooling/tree-sitter-plum/queries/plum/format.scm CHANGED Viewed

@@ -132,6 +132,8 @@
 (fn "abstract" @append_space)
+(fn "fip" @append_space)
 (fn "fun" @append_space)
 (if "if" @append_space)

compiler/tooling/tree-sitter-plum/queries/plum/highlights.scm CHANGED Viewed

@@ -95,6 +95,7 @@
   "export"
   "override"
   "abstract"
+  "fip"
   "fn"
   "test"
 ] @keyword

compiler/tooling/tree-sitter-plum/src/grammar.json CHANGED Viewed

Binary file

compiler/tooling/tree-sitter-plum/src/node-types.json CHANGED Viewed

Binary file

compiler/tooling/tree-sitter-plum/src/parser.c CHANGED Viewed

Binary file

compiler/tooling/tree-sitter-plum/test/corpus/fip.txt ADDED Viewed

@@ -0,0 +1,81 @@
+================================================================================
+fip fun
+================================================================================
+fip fun step(n: Int) -> Int = n
+--------------------------------------------------------------------------------
+(source
+  (fn
+    (fn_identifier)
+    (param
+      (var_identifier)
+      (type
+        (type_identifier)))
+    (type
+      (type_identifier))
+    (expression
+      (primary_expression
+        (var_identifier)))))
+================================================================================
+override fip fun in a struct body
+================================================================================
+struct P(x: Int, fip: Int) =
+  override fip fun size(self) -> Int = self.fip
+--------------------------------------------------------------------------------
+(source
+  (struct
+    (type_identifier)
+    (enum_named_field
+      (var_identifier)
+      (type
+        (type_identifier)))
+    (enum_named_field
+      (var_identifier)
+      (type
+        (type_identifier)))
+    (fn
+      (fn_identifier)
+      (self)
+      (type
+        (type_identifier))
+      (expression
+        (primary_expression
+          (attribute
+            (primary_expression
+              (self))
+            (fn_identifier)))))))
+================================================================================
+fip as a variable name
+================================================================================
+fun main() -> Int =
+  fip := 3
+  fip + 1
+--------------------------------------------------------------------------------
+(source
+  (fn
+    (fn_identifier)
+    (type
+      (type_identifier))
+    (body
+      (assign
+        (var_identifier)
+        (expression
+          (primary_expression
+            (integer))))
+      (expression
+        (primary_expression
+          (binary_operator
+            (primary_expression
+              (var_identifier))
+            (primary_expression
+              (integer))))))))

compiler/tooling/vscode-plum/syntaxes/plum.tmLanguage.json CHANGED Viewed

@@ -39,7 +39,7 @@
     "keywords": {
       "patterns": [
         {
-          "match": "\\b(module|struct|enum|trait|primitive|fun|fn|extern|export|self|test)(?![A-Za-z0-9_])",
+          "match": "\\b(module|struct|enum|trait|primitive|fun|fn|extern|export|override|abstract|fip|self|test)(?![A-Za-z0-9_])",
           "name": "keyword.const.plum"
         },
         {

compiler/wasm-codegen/src/emit.rs CHANGED Viewed

@@ -64,6 +64,7 @@ impl<'a> Emit<'a> {
             is_test: false,
             is_override: false,
             is_abstract: false,
+            is_fip: false,
             has_self: true,
             params: Vec::new(),
             returns: None,

docs/plans/2026-11-06-fbip-stage1.md CHANGED Viewed

@@ -70,7 +70,7 @@ e.g. `v = v.bumped()` in a `for` loop, with `bumped(self) = Cell(..self, n: self
 **Test code:** `tests/fbip/aliasing.plum`: keep an alias then update; store in a list then update; capture in a closure; return both; a value in two fields; a shared value through a method; an override keeping `self`; update in only one branch. Each gives the copying answer, and matches `--no-fbip`. Plus positive tests in `uniqueness_test.rs`.
 ### T4 Array.with · Complexity 5 · Est. context 55k
-**Owns:** std/Array.plum, compiler/core/src/*.rs, compiler/core/tests/core/*.rs, compiler/wasm-codegen/src/*.rs, compiler/wasm-codegen/tests/wasm_codegen/**/*.rs, compiler/checker/src/*.rs, tests/fbip/*.plum
+**Owns:** std/Array.plum, compiler/core/src/*.rs, compiler/core/tests/core/*.rs, compiler/wasm-codegen/src/*.rs, compiler/wasm-codegen/tests/wasm_codegen/**/*.rs, compiler/checker/src/*.rs, tests/fbip/*.plum, tests/fbip/fuzz/*
 **Components:** 2
 **LOC owned:** 180
 **Tests:** fast

tests/fbip/fip.plum ADDED Viewed

@@ -0,0 +1,75 @@
+import std/Int
+import std/Array
+# `fip fun` forms that must compile: every spread and `Array.with` written in the body is
+# proved in place. The sweep also runs this file with `--no-fbip` and `--no-fusion`, where `fip`
+# is not enforced and the programs still give the same answers. Names are unique per scenario
+# because the proof resolves methods and fields by name.
+# a fip fun with no update at all is trivially true
+fip fun plainSum(a: Int, b: Int) -> Int = a + b
+# a fresh array written once
+fip fun freshWrite() -> Array[Int] = Array.filled(3, 0).with(1, 7)
+# a local array written in a loop
+fip fun squares(n: Int) -> Array[Int] =
+  a := Array.filled(n, 0)
+  for i := range n
+    a = a.with(i, i * i)
+  a
+# a spread of a parameter every caller builds fresh
+struct Pt(px: Int, py: Int)
+fip fun movePt(p: Pt, dx: Int) -> Pt = Pt(..p, px: p.px + dx)
+fun walkPt(n: Int) -> Pt =
+  p := Pt(px: 0, py: 5)
+  for i := range n
+    p = movePt(p, 2)
+  p
+# a fip method: self handed back by `v = v.push(..)`
+struct Bag(items: Array[Int], count: Int) =
+  fip fun bagAdd(self, i: Int, x: Int) -> Bag = Bag(..self, items: self.items.with(i, x), count: self.count + 1)
+  fun bagAt(self, i: Int) -> Int = self.items.get(i)
+fun fillBag(n: Int) -> Bag =
+  b := Bag(items: Array.filled(n, 0), count: 0)
+  for i := range n
+    b = b.bagAdd(i, i + 10)
+  b
+# a fip fun whose update sits in a closure-free helper chain
+fip fun bumpAt(xs: Array[Int], i: Int) -> Array[Int] = xs.with(i, xs.get(i) + 1)
+# a generic fip fun
+fip fun setFirst[Elem](xs: Array[Elem], x: Elem) -> Array[Elem] = xs.with(0, x)
+test "fip: plain"
+  assert plainSum(2, 3) == 5
+test "fip: fresh array write"
+  a := freshWrite()
+  assert a.get(0) == 0 && a.get(1) == 7
+test "fip: loop of writes"
+  a := squares(5)
+  assert a.get(3) == 9 && a.get(4) == 16
+test "fip: spread of a fresh parameter"
+  p := walkPt(4)
+  assert p.px == 8 && p.py == 5
+test "fip: method"
+  b := fillBag(4)
+  assert b.bagAt(0) == 10 && b.bagAt(3) == 13 && b.count == 4
+test "fip: read then write"
+  a := bumpAt(Array.filled(2, 4), 1)
+  assert a.get(1) == 5 && a.get(0) == 4
+test "fip: generic"
+  a := setFirst(Array.filled(2, 1), 9)
+  assert a.get(0) == 9 && a.get(1) == 1

tests/fbip/fuzz/fuzz.sh ADDED Viewed

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Differential fuzzer for the FBIP uniqueness proof.
+# A wrong proof writes through a value another holder can see, so a generated
+# program must give the same result with and without --no-fbip. Any DIFF is a
+# real miscompile. Usage (after a build): tests/fbip/fuzz/fuzz.sh FROM TO  (seeds)
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+root="$(cd "$here/../../.." && pwd)"
+cd "$root" || exit 1
+out=$(mktemp -d "${TMPDIR:-/tmp}/plum-fuzz.XXXXXX")
+ok=0; diff=0; err=0
+for i in $(seq "$1" "$2"); do
+  f="$out/p$i.plum"
+  perl "$here/gen.pl" "$i" "$f"
+  a=$(target/debug/plum test --lib-path . "$f" 2>&1)
+  if echo "$a" | grep -q "^error"; then
+    err=$((err+1)); echo "ERR $i: $(echo "$a" | head -1 | cut -c1-200)"; continue
+  fi
+  b=$(target/debug/plum test --no-fbip --lib-path . "$f" 2>&1)
+  if [ "$a" == "$b" ]; then ok=$((ok+1)); rm -f "$f"
+  else diff=$((diff+1)); echo "DIFF $i: $f"; fi
+done
+echo "done ok=$ok diff=$diff err=$err"
+echo "$out"
+[ "$diff" -eq 0 ]

tests/fbip/fuzz/gen.pl ADDED Viewed

@@ -0,0 +1,118 @@
+#!/usr/bin/perl
+use strict; use warnings;
+my ($seed, $out) = @ARGV;
+srand($seed);
+sub r { return int(rand($_[0])); }
+sub pick { return $_[r(scalar @_)]; }
+my @arr = ('a','b','c','d','e');
+my @st = ('s','t','u');
+sub aexpr { # Array[Int] expression (reads)
+  return pick(@arr);
+}
+sub iexpr {
+  my $k = r(9);
+  return r(5) if $k == 0;
+  return pick(@arr).".get(".r(3).")" if $k <= 2;
+  return pick(@st).".f.get(".r(3).")" if $k == 3;
+  return pick(@st).".g.get(".r(3).")" if $k == 4;
+  return pick(@st).".n" if $k == 5;
+  return pick(@st).".total()" if $k == 6;
+  return "m.f.get(".r(3).")" if $k == 7;
+  return pick(@arr).".length()";
+}
+sub idx { return r(3); }
+my @stmts;
+for my $n (1..(6+r(10))) {
+  my $A = pick(@arr); my $B = pick(@arr); my $S = pick(@st); my $T = pick(@st);
+  my $k = r(34);
+  my %alias = map { $_ => 1 } (2,8,9,10,17,18,19,20,21,22,25,26,4,15,12,1,30);
+  while ($alias{$k} && r(100) >= 12) { $k = r(34); }
+  my $s;
+  if ($k==0) { $s = "$A = $A.with(".idx().", ".iexpr().")"; }
+  elsif ($k==1) { $s = "$A = $B.with(".idx().", ".iexpr().")"; }
+  elsif ($k==2) { $s = "$A = $B"; }
+  elsif ($k==3) { $s = "$A = h1($A)"; }
+  elsif ($k==4) { $s = "$A = h1($B)"; }
+  elsif ($k==5) { $s = "$S = S(..$S, f: $S.f.with(".idx().", ".iexpr()."))"; }
+  elsif ($k==6) { $s = "$S = S(..$S, f: $S.f.with(".idx().", ".iexpr()."), n: ".iexpr().")"; }
+  elsif ($k==7) { $s = "$S = S(..$S, g: $S.g.with(".idx().", $S.f.get(".idx()."))), f: $S.f.with(".idx().", 1))"; $s = "$S = S(..$S, g: $S.g.with(".idx().", $S.f.get(".idx().")), f: $S.f.with(".idx().", 1))"; }
+  elsif ($k==8) { $s = "$S = $T"; }
+  elsif ($k==9) { $s = "$A = $S.f"; }
+  elsif ($k==10) { $s = "$S = S(f: $A, g: $B, n: ".r(4).")"; }
+  elsif ($k==11) { $s = "$S = S(f: $A, g: Array.filled(3, 0), n: ".r(4).")"; }
+  elsif ($k==12) { $s = "$S = $T.put(".idx().", ".iexpr().")"; }
+  elsif ($k==13) { $s = "$S = $S.put(".idx().", ".iexpr().")"; }
+  elsif ($k==14) { $s = "$S = upd($S, ".idx().")"; }
+  elsif ($k==15) { $s = "$S = upd($T, ".idx().")"; }
+  elsif ($k==16) { $s = "m.f = m.f.with(".idx().", ".iexpr().")"; }
+  elsif ($k==17) { $s = "m.f = $A"; }
+  elsif ($k==18) { $s = "$A = m.f"; }
+  elsif ($k==19) { $s = "xs.push($A)"; }
+  elsif ($k==20) { $s = "ys.push($S)"; }
+  elsif ($k==21) { $s = "$A = xs.at(".r(2).")"; }
+  elsif ($k==22) { $s = "$S = ys.at(".r(2).")"; }
+  elsif ($k==23) { $s = "$A = Array.filled(3, ".r(5).")"; }
+  elsif ($k==24) { $s = "$A = $A.resize(3)"; }
+  elsif ($k==25) { $s = "$S = $S.view().put(".idx().", ".iexpr().")"; }
+  elsif ($k==26) { $s = "$A = $S.fOf()"; }
+  elsif ($k==27) { $s = "$S = $S.bump()"; }
+  elsif ($k==28) { $s = "$S = S(..$S, f: $S.f.with(".idx().", $S.total()))"; }
+  elsif ($k==29) { $s = r(2) ? "$S = S(..$S, n: $S.total(), f: $S.f.with(".idx().", 7))" : "$S = S(..$S, f: $S.f.with(".idx().", 7), n: $S.total())"; }
+  elsif ($k==30) { $s = "$S = $S + $T"; }
+  elsif ($k==31) { $s = "$S = -$S"; }
+  elsif ($k==32) { $s = "$A = pass($A, $B)"; }
+  else { $s = "if ".iexpr()." > 1\n    $A = $A.with(".idx().", 9)\n  else\n    $B = $A"; }
+  push @stmts, $s;
+}
+my $body = join("\n  ", @stmts);
+my $dump = "  out := \"\"\n";
+for my $v (@arr) { $dump .= "  out = out + show3(\"$v\", $v.get(0), $v.get(1), $v.get(2))\n"; }
+for my $v (@st) { $dump .= "  out = out + show3(\"$v.f\", $v.f.get(0), $v.f.get(1), $v.f.get(2)) + show3(\"$v.g\", $v.g.get(0), $v.g.get(1), $v.g.get(2)) + \"$v.n=\" + $v.n.toStr() + \";\"\n"; }
+$dump .= "  out = out + show3(\"m.f\", m.f.get(0), m.f.get(1), m.f.get(2))" . join("", map { my $e=$_; " + show3(\"$e\", $e.get(0), $e.get(1), $e.get(2))" } ("xs.at(0)","xs.at(1)","ys.at(0).f","ys.at(1).f","ys.at(0).g")) . "\n  assert out == \"\"\n";
+open(my $fh, '>', $out) or die;
+print $fh <<"EOP";
+import std/Int
+import std/Str
+import std/Array
+import std/Slice
+struct S(f: Array[Int], g: Array[Int], n: Int) =
+  fun put(self, i: Int, x: Int) -> S = S(..self, f: self.f.with(i, x))
+  fun total(self) -> Int = self.f.get(0) + self.g.get(1) + self.n
+  fun view(self) -> S = self
+  fun fOf(self) -> Array[Int] = self.f
+  fun bump(self) -> S = S(..self, g: self.g.with(2, self.total()), n: self.n + 1)
+  fun add(self, o: S) -> S = S(..self, f: self.f.with(0, o.n))
+  fun neg(self) -> S = S(..self, g: self.g.with(0, 5))
+struct M(mut f: Array[Int])
+fun h1(x: Array[Int]) -> Array[Int] = x.with(0, x.get(1) + 1)
+fun pass(x: Array[Int], y: Array[Int]) -> Array[Int] = if x.get(0) > 2 then x else y.with(1, 3)
+fun upd(s: S, i: Int) -> S = S(..s, g: s.g.with(i, s.f.get(i)))
+fun show3(name: Str, x: Int, y: Int, z: Int) -> Str =
+  name + "=" + x.toStr() + "," + y.toStr() + "," + z.toStr() + ";"
+test "fuzz"
+  a := Array.filled(3, 1)
+  b := Array.filled(3, 2)
+  c := Array.filled(3, 3)
+  d := Array.filled(3, 30)
+  e := Array.filled(3, 31)
+  s := S(f: Array.filled(3, 4), g: Array.filled(3, 5), n: 1)
+  t := S(f: Array.filled(3, 6), g: Array.filled(3, 7), n: 2)
+  u := S(f: Array.filled(3, 16), g: Array.filled(3, 17), n: 5)
+  m := M(f: Array.filled(3, 8))
+  xs := Slice[Array[Int]]()
+  xs.push(Array.filled(3, 10))
+  xs.push(Array.filled(3, 11))
+  ys := Slice[S]()
+  ys.push(S(f: Array.filled(3, 12), g: Array.filled(3, 13), n: 3))
+  ys.push(S(f: Array.filled(3, 14), g: Array.filled(3, 15), n: 4))
+  $body
+$dump
+EOP
+close $fh;