14 files changed, 164 insertions, 8 deletions
diff --git a/tests/conformance/4-statements/memdebug_report.zc b/tests/conformance/4-statements/memdebug_report.zc
index 406662e..782a85e 100644
--- a/tests/conformance/4-statements/memdebug_report.zc
+++ b/tests/conformance/4-statements/memdebug_report.zc
@@ -1,5 +1,5 @@
 // expect: leak: line 8 3 words/107/
-// spec 4.11: rt.memreport() returns the count of live recorded objects
+// spec 4.11: rt.memreport() returns the count of live recorded objects; W is the 3 words new asked for
 include rt;
 void pn(int x) { rt.put_n(x); rt.put_c(10); }
 memdebug on;
diff --git a/tests/conformance/4-statements/memdebug_report_line.zc b/tests/conformance/4-statements/memdebug_report_line.zc
index 52eecba..8a1b6cf 100644
--- a/tests/conformance/4-statements/memdebug_report_line.zc
+++ b/tests/conformance/4-statements/memdebug_report_line.zc
@@ -1,4 +1,4 @@
-// expect: leak: line 9 3 words/
+// expect: leak: line 9 2 words/
 // spec 4.11: leak: line N W words per live recorded object (N is the allocation line)
 include rt;
 void pn(int x) { rt.put_n(x); rt.put_c(10); }
diff --git a/tests/conformance/8-runtime/exact_size_bounds.zc b/tests/conformance/8-runtime/exact_size_bounds.zc
new file mode 100644
index 0000000..7a8c440
--- /dev/null
+++ b/tests/conformance/8-runtime/exact_size_bounds.zc
@@ -0,0 +1,45 @@
+// expect: 11 11 11 11 11 11 11 11/10 1/1101/1601/200000 11 11/
+// spec 8.4: exact heap lengths at n-1 and n, new(0), packed bytes, a recycled block, a grown array, after the stacks grow (copy of tests/programs/exactsize.zc)
+include rt;
+// exact-size bounds: a heap block knows the n words new asked for (bits 32..62 of
+// p[-4]), not just its power-of-two block. rt.bnd(p, i, 1, 1) is 1 when p[i] is
+// outside: the same recipe every backend inlines in front of p[i].
+struct P { int a; int b; int c; }
+struct Q { int a; }
+// n-1 inside, n outside, osize is n, and p[n-1] is usable
+int edge(int n) {
+	word* p = rt.new(n);
+	p[n - 1] = n;
+	return rt.bnd(p, n - 1, 1, 1) * 100 + rt.bnd(p, n, 1, 1) * 10 + (rt.osize(p) == n) + (p[n - 1] == n) - 1;
+}
+int zero() { word* p = rt.new(0); return rt.bnd(p, 0, 1, 1) * 10 + rt.osize(p); }
+int bytes() { word* p = rt.new(3); return rt.bnd(p, 23, 1, 8) * 10 + rt.bnd(p, 24, 1, 8); }	// 3 words are 24 bytes
+int where;
+int leaf() { P* a = rt.new(P); a.c = 3; where = (&a.a) as int; return a.c; }	// a is recycled at the function's end
+// recycle: the next 1-word object reuses the 3-word block, with n = 1
+int reuse() {
+	Q* q = rt.new(Q); int same = where == ((&q.a) as int);
+	return same * 1000 + rt.osize(q) * 100 + rt.bnd(q, 0, 1, 1) * 10 + rt.bnd(q, 1, 1, 1);
+}
+// grow: the items block is replaced by one with its own exact n (16 words for 9 ints)
+int grow() {
+	int[?] d = rt.new(int[?], 0); int i = 0; word* h; word* p;
+	while (i < 9) { d.push(i); i++; }
+	h = &d[0]; p = h;
+	return rt.osize(p) * 100 + rt.bnd(p, 15, 1, 1) * 10 + rt.bnd(p, 16, 1, 1);
+}
+// deep enough to grow the stacks: their segments are heap blocks the core allocates
+// (src/core/stack.h, src/js/tinyvm.ts) with n set too. after they go back, blocks reused
+// from them carry their own n.
+int deep(int k) { if (k == 0) return 0; return deep(k - 1) + 1; }
+fn main() {
+	rt.put_n(edge(1)); rt.put_c(32); rt.put_n(edge(3)); rt.put_c(32); rt.put_n(edge(5)); rt.put_c(32);
+	rt.put_n(edge(6)); rt.put_c(32); rt.put_n(edge(7)); rt.put_c(32); rt.put_n(edge(11)); rt.put_c(32);
+	rt.put_n(edge(13)); rt.put_c(32); rt.put_n(edge(100)); rt.put_c(10);
+	rt.put_n(zero()); rt.put_c(32); rt.put_n(bytes()); rt.put_c(10);
+	leaf(); rt.put_n(reuse()); rt.put_c(10);
+	rt.put_n(grow()); rt.put_c(10);
+	rt.put_n(deep(200000)); rt.put_c(32); rt.put_n(edge(9)); rt.put_c(32); rt.put_n(edge(21)); rt.put_c(10);
+	return 0;
+}
+// zc0: skip
diff --git a/tests/conformance/8-runtime/new_too_big_traps.zc b/tests/conformance/8-runtime/new_too_big_traps.zc
new file mode 100644
index 0000000..b1692f2
--- /dev/null
+++ b/tests/conformance/8-runtime/new_too_big_traps.zc
@@ -0,0 +1,6 @@
+// expect error: zc: out of heap memory
+// spec 8.4: a request over 2^31 - 1 words (less the header) stops at the allocation; the length is never truncated
+include rt;
+void pn(int x) { rt.put_n(x); rt.put_c(10); }
+fn main() { word* p = rt.new(0x80000000); pn(p[0]); return 0; }
+// zc0: skip
diff --git a/tests/conformance/8-runtime/new_zero_index_traps.zc b/tests/conformance/8-runtime/new_zero_index_traps.zc
new file mode 100644
index 0000000..ee77d88
--- /dev/null
+++ b/tests/conformance/8-runtime/new_zero_index_traps.zc
@@ -0,0 +1,6 @@
+// expect error: zy: index 0 out of range (length 0)
+// spec 8.4: rt.new(0) has no words, so p[0] is outside
+include rt;
+void pn(int x) { rt.put_n(x); rt.put_c(10); }
+fn main() { word* p = rt.new(0); int i = 0; pn(p[i]); return 0; }
+// zc0: skip
diff --git a/tests/conformance/8-runtime/pointer_index_n_minus_1.zc b/tests/conformance/8-runtime/pointer_index_n_minus_1.zc
new file mode 100644
index 0000000..2b34e83
--- /dev/null
+++ b/tests/conformance/8-runtime/pointer_index_n_minus_1.zc
@@ -0,0 +1,7 @@
+// expect: 7/
+// spec 8.4: a heap pointer's length is the n words new asked for; p[n-1] is inside (5 words in a 16-word block)
+include rt;
+void pn(int x) { rt.put_n(x); rt.put_c(10); }
+int at(word* p, int i) { p[i] = 7; return p[i]; }
+fn main() { word* p = rt.new(5); pn(at(p, 4)); return 0; }
+// zc0: skip
diff --git a/tests/conformance/8-runtime/pointer_index_n_traps.zc b/tests/conformance/8-runtime/pointer_index_n_traps.zc
new file mode 100644
index 0000000..ccb7e3a
--- /dev/null
+++ b/tests/conformance/8-runtime/pointer_index_n_traps.zc
@@ -0,0 +1,7 @@
+// expect error: zy: index 5 out of range (length 5)
+// spec 8.4: p[n] is outside even though the block has slack (5 words in a 16-word block, whose payload is 11)
+include rt;
+void pn(int x) { rt.put_n(x); rt.put_c(10); }
+int at(word* p, int i) { p[i] = 7; return p[i]; }
+fn main() { word* p = rt.new(5); pn(at(p, 5)); return 0; }
+// zc0: skip
diff --git a/tests/conformance/8-runtime/pointer_index_n_traps_memdebug.zc b/tests/conformance/8-runtime/pointer_index_n_traps_memdebug.zc
new file mode 100644
index 0000000..49d914a
--- /dev/null
+++ b/tests/conformance/8-runtime/pointer_index_n_traps_memdebug.zc
@@ -0,0 +1,8 @@
+// expect error: zy: index 11 out of range (length 11)
+// spec 8.4 and 4.11: the exact length holds under memdebug too (11 words, a 16-word block)
+memdebug on;
+include rt;
+void pn(int x) { rt.put_n(x); rt.put_c(10); }
+int at(word* p, int i) { p[i] = 7; return p[i]; }
+fn main() { word* p = rt.new(11); pn(at(p, 10)); pn(at(p, 11)); return 0; }
+// zc0: skip
diff --git a/tests/conformance/8-runtime/stale_index_after_free_memdebug.zc b/tests/conformance/8-runtime/stale_index_after_free_memdebug.zc
new file mode 100644
index 0000000..69dc5e3
--- /dev/null
+++ b/tests/conformance/8-runtime/stale_index_after_free_memdebug.zc
@@ -0,0 +1,17 @@
+// expect error: zy: use after free from line 9
+// spec 3.7.4 and 4.11: under memdebug the same stale index is a use after free
+memdebug
+on;
+include rt;
+void pn(int x) { rt.put_n(x); rt.put_c(10); }
+int g;
+// unchecked: the analyzer stays out, so the block is freed (quarantined, with its check word) rather than recycled
+unchecked int make() { let p = rt.new(5); p[4] = 1; g = p; return 0; }
+unchecked int drop() { let p = g; rt.free(p); return 0; }
+fn main() {
+	word* q; int i = 4;
+	make(); q = g as word*; pn(q[i]);
+	drop(); q = g as word*; pn(q[i]);
+	return 0;
+}
+// zc0: skip
diff --git a/tests/conformance/8-runtime/stale_index_after_free_traps.zc b/tests/conformance/8-runtime/stale_index_after_free_traps.zc
new file mode 100644
index 0000000..bd2a185
--- /dev/null
+++ b/tests/conformance/8-runtime/stale_index_after_free_traps.zc
@@ -0,0 +1,15 @@
+// expect error: zy: index 4 out of range (length 0)
+// spec 3.7.4: a freed block has length 0, so an index through a stale copy of its pointer traps
+include rt;
+void pn(int x) { rt.put_n(x); rt.put_c(10); }
+int g;
+// unchecked: the analyzer stays out, so the block is freed (quarantined, with its check word) rather than recycled
+unchecked int make() { let p = rt.new(5); p[4] = 1; g = p; return 0; }
+unchecked int drop() { let p = g; rt.free(p); return 0; }
+fn main() {
+	word* q; int i = 4;
+	make(); q = g as word*; pn(q[i]);
+	drop(); q = g as word*; pn(q[i]);
+	return 0;
+}
+// zc0: skip
diff --git a/tests/programs/bounds_heap.zc b/tests/programs/bounds_heap.zc
index d0bd318..719757e 100644
--- a/tests/programs/bounds_heap.zc
+++ b/tests/programs/bounds_heap.zc
@@ -1,12 +1,13 @@
 namespace;
 include rt;
 
-// a pointer to the start of a live heap block is checked against the block's
-// payload, which a buddy block rounds up: rt.new(4) holds 11 words. a pointer
+// a pointer to the start of a live heap block is checked against exactly the
+// words new asked for: rt.new(11) holds 11 words (its block holds 11 too, but
+// rt.new(4) would hold 4, not the 11 its 16-word block has room for). a pointer
 // into the middle of a block, or to memory that is not a heap block, is not
 // checked. a char is a word, so a char* counts words.
 int main() {
-	int* p = rt.new(4); int* q; char* c = rt.new(2); int i = 10;
+	int* p = rt.new(11); int* q; char* c = rt.new(3); int i = 10;
 	p[i] = 3; rt.put_n(p[i]); rt.put_c(10);
 	q = p + 1; i = 10; rt.put_n(q[i - 1] - 3); rt.put_c(10);
 	i = 2; c[i] = 'x'; rt.put_c(c[i]); rt.put_c(10);
diff --git a/tests/programs/exactsize.zc b/tests/programs/exactsize.zc
new file mode 100644
index 0000000..c3b22cc
--- /dev/null
+++ b/tests/programs/exactsize.zc
@@ -0,0 +1,42 @@
+include rt;
+// exact-size bounds: a heap block knows the n words new asked for (bits 32..62 of
+// p[-4]), not just its power-of-two block. rt.bnd(p, i, 1, 1) is 1 when p[i] is
+// outside: the same recipe every backend inlines in front of p[i].
+struct P { int a; int b; int c; }
+struct Q { int a; }
+// n-1 inside, n outside, osize is n, and p[n-1] is usable
+int edge(int n) {
+	word* p = rt.new(n);
+	p[n - 1] = n;
+	return rt.bnd(p, n - 1, 1, 1) * 100 + rt.bnd(p, n, 1, 1) * 10 + (rt.osize(p) == n) + (p[n - 1] == n) - 1;
+}
+int zero() { word* p = rt.new(0); return rt.bnd(p, 0, 1, 1) * 10 + rt.osize(p); }
+int bytes() { word* p = rt.new(3); return rt.bnd(p, 23, 1, 8) * 10 + rt.bnd(p, 24, 1, 8); }	// 3 words are 24 bytes
+int where;
+int leaf() { P* a = rt.new(P); a.c = 3; where = (&a.a) as int; return a.c; }	// a is recycled at the function's end
+// recycle: the next 1-word object reuses the 3-word block, with n = 1
+int reuse() {
+	Q* q = rt.new(Q); int same = where == ((&q.a) as int);
+	return same * 1000 + rt.osize(q) * 100 + rt.bnd(q, 0, 1, 1) * 10 + rt.bnd(q, 1, 1, 1);
+}
+// grow: the items block is replaced by one with its own exact n (16 words for 9 ints)
+int grow() {
+	int[?] d = rt.new(int[?], 0); int i = 0; word* h; word* p;
+	while (i < 9) { d.push(i); i++; }
+	h = &d[0]; p = h;
+	return rt.osize(p) * 100 + rt.bnd(p, 15, 1, 1) * 10 + rt.bnd(p, 16, 1, 1);
+}
+// deep enough to grow the stacks: their segments are heap blocks the core allocates
+// (src/core/stack.h, src/js/tinyvm.ts) with n set too. after they go back, blocks reused
+// from them carry their own n.
+int deep(int k) { if (k == 0) return 0; return deep(k - 1) + 1; }
+fn main() {
+	rt.put_n(edge(1)); rt.put_c(32); rt.put_n(edge(3)); rt.put_c(32); rt.put_n(edge(5)); rt.put_c(32);
+	rt.put_n(edge(6)); rt.put_c(32); rt.put_n(edge(7)); rt.put_c(32); rt.put_n(edge(11)); rt.put_c(32);
+	rt.put_n(edge(13)); rt.put_c(32); rt.put_n(edge(100)); rt.put_c(10);
+	rt.put_n(zero()); rt.put_c(32); rt.put_n(bytes()); rt.put_c(10);
+	leaf(); rt.put_n(reuse()); rt.put_c(10);
+	rt.put_n(grow()); rt.put_c(10);
+	rt.put_n(deep(200000)); rt.put_c(32); rt.put_n(edge(9)); rt.put_c(32); rt.put_n(edge(21)); rt.put_c(10);
+	return 0;
+}
diff --git a/tests/programs/quarantine.zc b/tests/programs/quarantine.zc
index 061c4da..5697400 100644
--- a/tests/programs/quarantine.zc
+++ b/tests/programs/quarantine.zc
@@ -3,8 +3,10 @@ include rt;
 
 // free quarantines the block. a stale alias still reads it, and freeing
 // through the alias does nothing because the header already says free.
-// unchecked so the analyzer doesn't reject the use after free.
-unchecked fn main() {
+// unchecked so the analyzer doesn't reject the use after free, and unbounded
+// because a freed block has length 0 (a checked stale index traps, see
+// tests/conformance/8-runtime/stale_index_after_free_traps.zc).
+unchecked unbounded fn main() {
 	let p = rt.new(4), q, r, i = 0, t, bad = 0;
 	p[0] = 111; p[1] = 222; p[2] = 333; p[3] = 444;
 	q = p;
diff --git a/tests/test.sh b/tests/test.sh
index 9dd04a8..78b1f77 100755
--- a/tests/test.sh
+++ b/tests/test.sh
@@ -166,7 +166,7 @@ hello world!42
 256
 v" "$l a full capture is still terminated inside its buffer"
 	chk "$($vm < tests/programs/sys.zc)" "2 zy time" "$l syscalls: write, read, time"
-	chk "$($vm < tests/programs/memleak.zc)" $'leak: line 8 3 words\n1' "$l memdebug names a live allocation"
+	chk "$($vm < tests/programs/memleak.zc)" $'leak: line 8 1 words\n1' "$l memdebug names a live allocation"
 	chk "$($vm < tests/programs/uaf.zc)" $'zc: line 10: warning: use after free: this storage\'s lifetime ended on line 9\nzy: use after free from line 7\n  at <stdin>:10 in main' "$l memdebug: use after free"
 	chk "$($vm < tests/programs/uaf_in.zc)" $'zy: use after free from line 7\n  at <stdin>:11 in main' "$l memdebug: use after free through an interior pointer"
 	chk "$($vm < tests/programs/doublefree.zc)" $'zy: double free from line 7\n  at <stdin>:9 in main\nok' "$l memdebug: double free is reported and does nothing"