rt: exact-size heap bounds; n, the words new asked for, lives in bits 32..62 of p[-4]

the bnd recipe and paylen read n instead of the power-of-two block:
  bnd:    r6 = sub p 3; r6 = ld r6; r7 = xor p 0x2B7E1516; r6 = eq r6 r7;
          r7 = sub p 4; r7 = ld r7; r7 = shr r7 32; r7 = mul r7 q;
          r8 = mul i m; r8 = ltu r8 r7; r8 = xor r8 1; r0 = and r6 r8
  paylen: return p[-4] >> 32
two loads instead of three; osize, bchk, release, recycle and the memdebug
leak report all read n (rt.new(4) has length 4, rt.new(0) has 0).

writers: new_raw and new_k set n; stack.h line 87 and tinyvm.ts (BigInt) set
it on stack segments. release clears n when a block goes into quarantine
(len 0, indexing traps; under memdebug bchk reports a use after free); every
free-list path (fpush, mkblock, bdrop, recycle_leaf, balloc hold) rewrites
the word as k << 16, and an array that grows gets a fresh block. a request over
2^31-1-HDR words stops in new_raw (oom), and the compiler only takes the
new_k fast path for constant sizes that fit, so n is never truncated.

bit users checked (all mask or preserve bits 32..62; none compares or copies
the whole word): gc mark and sweep; release, free, recycle, recycle_leaf;
share and own; isobj, quar, checkptr, obj_base; bclass and the bfree buddy
merge; balloc, mkblock, fpush, funlink, heap_grow; frame_grow; stack_allocate
in src/core/stack.h and src/js/tinyvm.ts; micro.c and core.c (check word
only); the compiler's two p[-4] | F_INTERNAL writes (base.zc, builtins.zc).
32-bit ports: none (baremetal, wasm and micro use int64 Cell).

tests: tests/programs/exactsize.zc (n-1/n for non-power-of-two sizes, new(0),
packed bytes, recycle, grow, stack growth); 8-runtime: exact_size_bounds,
pointer_index_n_minus_1, pointer_index_n_traps, pointer_index_n_traps_memdebug,
new_zero_index_traps, new_too_big_traps, stale_index_after_free_traps,
stale_index_after_free_memdebug. expectations changed: leak report shows n
(tests/test.sh line 169, examples/learn/13-memdebug.out, docs/LEARN.md,
4-statements/memdebug_report_line.zc). programs adjusted to keep test.sh
expectations: quarantine.zc (unbounded), bounds_heap.zc (rt.new(11)).
spec 3.7.4 and 4.11 updated. fixpoint 402204 words (main 402197).

1 files changed, 2 insertions, 2 deletions

diff --git a/src/compiler/expr.zc b/src/compiler/expr.zc
index e449508..a548f8d 100644
--- a/src/compiler/expr.zc
+++ b/src/compiler/expr.zc
@@ -171,7 +171,7 @@ int newtyped() {
 		lit(tsz(t)); lit(t);
 		newsz = tsz(t); newleaf = 0;
 		if (isleaf(t)) newleaf = t;
-		if (!o3on && !dry && lookup(s_new_k) >= 0) { lit(szclass(newsz)); fast = 1; }
+		if (newsz <= 0x7FFFFFFF - rt.HDR && !o3on && !dry && lookup(s_new_k) >= 0) { lit(szclass(newsz)); fast = 1; }
 	}
 	expect(s_rp);
 	stamp_site();
@@ -450,7 +450,7 @@ int call(int s) {
 		xaf = af_new(newsz, 2, cp);
 		if (lsp > 0) newloop(cp);
 		// a constant size: the class is known now, so use the allocator's direct path
-		if (newsz >= 0 && !o3on && !dry && lookup(s_new_k) >= 0) {
+		if (newsz >= 0 && newsz <= 0x7FFFFFFF - rt.HDR && !o3on && !dry && lookup(s_new_k) >= 0) {	// (a bigger size has no class: new_t stops it)
 			lit(0);
 			lit(szclass(newsz));
 			s = lookup(s_new_k);