rt: exact-size heap bounds; n, the words new asked for, lives in bits 32..62 of p[-4]

the bnd recipe and paylen read n instead of the power-of-two block:
  bnd:    r6 = sub p 3; r6 = ld r6; r7 = xor p 0x2B7E1516; r6 = eq r6 r7;
          r7 = sub p 4; r7 = ld r7; r7 = shr r7 32; r7 = mul r7 q;
          r8 = mul i m; r8 = ltu r8 r7; r8 = xor r8 1; r0 = and r6 r8
  paylen: return p[-4] >> 32
two loads instead of three; osize, bchk, release, recycle and the memdebug
leak report all read n (rt.new(4) has length 4, rt.new(0) has 0).

writers: new_raw and new_k set n; stack.h line 87 and tinyvm.ts (BigInt) set
it on stack segments. release clears n when a block goes into quarantine
(len 0, indexing traps; under memdebug bchk reports a use after free); every
free-list path (fpush, mkblock, bdrop, recycle_leaf, balloc hold) rewrites
the word as k << 16, and an array that grows gets a fresh block. a request over
2^31-1-HDR words stops in new_raw (oom), and the compiler only takes the
new_k fast path for constant sizes that fit, so n is never truncated.

bit users checked (all mask or preserve bits 32..62; none compares or copies
the whole word): gc mark and sweep; release, free, recycle, recycle_leaf;
share and own; isobj, quar, checkptr, obj_base; bclass and the bfree buddy
merge; balloc, mkblock, fpush, funlink, heap_grow; frame_grow; stack_allocate
in src/core/stack.h and src/js/tinyvm.ts; micro.c and core.c (check word
only); the compiler's two p[-4] | F_INTERNAL writes (base.zc, builtins.zc).
32-bit ports: none (baremetal, wasm and micro use int64 Cell).

tests: tests/programs/exactsize.zc (n-1/n for non-power-of-two sizes, new(0),
packed bytes, recycle, grow, stack growth); 8-runtime: exact_size_bounds,
pointer_index_n_minus_1, pointer_index_n_traps, pointer_index_n_traps_memdebug,
new_zero_index_traps, new_too_big_traps, stale_index_after_free_traps,
stale_index_after_free_memdebug. expectations changed: leak report shows n
(tests/test.sh line 169, examples/learn/13-memdebug.out, docs/LEARN.md,
4-statements/memdebug_report_line.zc). programs adjusted to keep test.sh
expectations: quarantine.zc (unbounded), bounds_heap.zc (rt.new(11)).
spec 3.7.4 and 4.11 updated. fixpoint 402204 words (main 402197).

1 files changed, 45 insertions, 0 deletions

diff --git a/tests/conformance/8-runtime/exact_size_bounds.zc b/tests/conformance/8-runtime/exact_size_bounds.zc
new file mode 100644
index 0000000..7a8c440
--- /dev/null
+++ b/tests/conformance/8-runtime/exact_size_bounds.zc
@@ -0,0 +1,45 @@
+// expect: 11 11 11 11 11 11 11 11/10 1/1101/1601/200000 11 11/
+// spec 8.4: exact heap lengths at n-1 and n, new(0), packed bytes, a recycled block, a grown array, after the stacks grow (copy of tests/programs/exactsize.zc)
+include rt;
+// exact-size bounds: a heap block knows the n words new asked for (bits 32..62 of
+// p[-4]), not just its power-of-two block. rt.bnd(p, i, 1, 1) is 1 when p[i] is
+// outside: the same recipe every backend inlines in front of p[i].
+struct P { int a; int b; int c; }
+struct Q { int a; }
+// n-1 inside, n outside, osize is n, and p[n-1] is usable
+int edge(int n) {
+	word* p = rt.new(n);
+	p[n - 1] = n;
+	return rt.bnd(p, n - 1, 1, 1) * 100 + rt.bnd(p, n, 1, 1) * 10 + (rt.osize(p) == n) + (p[n - 1] == n) - 1;
+}
+int zero() { word* p = rt.new(0); return rt.bnd(p, 0, 1, 1) * 10 + rt.osize(p); }
+int bytes() { word* p = rt.new(3); return rt.bnd(p, 23, 1, 8) * 10 + rt.bnd(p, 24, 1, 8); }	// 3 words are 24 bytes
+int where;
+int leaf() { P* a = rt.new(P); a.c = 3; where = (&a.a) as int; return a.c; }	// a is recycled at the function's end
+// recycle: the next 1-word object reuses the 3-word block, with n = 1
+int reuse() {
+	Q* q = rt.new(Q); int same = where == ((&q.a) as int);
+	return same * 1000 + rt.osize(q) * 100 + rt.bnd(q, 0, 1, 1) * 10 + rt.bnd(q, 1, 1, 1);
+}
+// grow: the items block is replaced by one with its own exact n (16 words for 9 ints)
+int grow() {
+	int[?] d = rt.new(int[?], 0); int i = 0; word* h; word* p;
+	while (i < 9) { d.push(i); i++; }
+	h = &d[0]; p = h;
+	return rt.osize(p) * 100 + rt.bnd(p, 15, 1, 1) * 10 + rt.bnd(p, 16, 1, 1);
+}
+// deep enough to grow the stacks: their segments are heap blocks the core allocates
+// (src/core/stack.h, src/js/tinyvm.ts) with n set too. after they go back, blocks reused
+// from them carry their own n.
+int deep(int k) { if (k == 0) return 0; return deep(k - 1) + 1; }
+fn main() {
+	rt.put_n(edge(1)); rt.put_c(32); rt.put_n(edge(3)); rt.put_c(32); rt.put_n(edge(5)); rt.put_c(32);
+	rt.put_n(edge(6)); rt.put_c(32); rt.put_n(edge(7)); rt.put_c(32); rt.put_n(edge(11)); rt.put_c(32);
+	rt.put_n(edge(13)); rt.put_c(32); rt.put_n(edge(100)); rt.put_c(10);
+	rt.put_n(zero()); rt.put_c(32); rt.put_n(bytes()); rt.put_c(10);
+	leaf(); rt.put_n(reuse()); rt.put_c(10);
+	rt.put_n(grow()); rt.put_c(10);
+	rt.put_n(deep(200000)); rt.put_c(32); rt.put_n(edge(9)); rt.put_c(32); rt.put_n(edge(21)); rt.put_c(10);
+	return 0;
+}
+// zc0: skip