//! Executable checks for recoverable backend bounds.

use std::lang::alloc;

use std::lang::il;

use std::lang::gen::bitset;

use std::lang::gen::data;

use std::lang::gen::regalloc;

use std::collections::dict;

use std::arch::rv64;

use std::arch::rv64::encode;

/// A backend check could not obtain its required test storage.

union TestError: Copy {

    /// Test setup failed.

    Failed,

}

/// Reusable emitter storage.

static ASSEMBLY_ARENA_STORAGE: [u8; 16777216] = [0; 16777216];

/// Run all backend boundary checks.

@default unsafe fn main() -> u32 {

    try testBackendBounds() catch {

        panic "backend bounds failed";

    };

    return 0;

}

/// Register limit checks use bounded scratch storage.

static REGISTER_SCRATCH: [u8; 65536] = [0; 65536];

/// Register numbers at or above the supported count return allocation errors.

unsafe fn testRegisterLimit() throws (TestError) {

    for number in [8191, 8192, 0xffffffff] {

        let mut arena = alloc::new(&mut REGISTER_SCRATCH[..]);

        let mut instructions = [il::Instr::Ret { val: il::Val::Reg(il::Reg { n: number }) }];

        let func = il::Fn {

            name: "limit", params: &[], returnType: il::Type::W64, isExtern: false, isLeaf: true,

            blocks: &[il::Block { label: "entry", params: &[], instrs: &mut instructions[..], locs: &[], preds: &[], loopDepth: 0 }],

        };

        let mut failed = false;

        try regalloc::liveness::analyze(&func, &mut arena) catch {

            set failed = true;

        };

        assert failed == (number >= 8192);

        if failed {

            assert arena.offset == 0;

        }

    }

}

/// Excess live values return an error before the spill candidate table overflows.

unsafe fn testSpillCandidateLimit() throws (TestError) {

    let mut arena = alloc::new(&mut REGISTER_SCRATCH[..]);

    let mut liveSet = try! bitset::allocate(&mut arena, 257);

    for i in 0..257 {

        bitset::put(&mut liveSet, i);

    }

    let mut out = [liveSet];

    let live = regalloc::liveness::LiveInfo {

        liveIn: &mut [], liveOut: &mut out[..], defs: &mut [], uses: &mut [], blockCount: 1, maxReg: 257,

    };

    let func = il::Fn {

        name: "pressure", params: &[], returnType: il::Type::W64, isExtern: false, isLeaf: true,

        blocks: &[il::Block { label: "entry", params: &[], instrs: &mut [], locs: &[], preds: &[], loopDepth: 0 }],

    };

    let mut failed = false;

    try regalloc::spill::analyze(&func, &live, 23, 11, 8, &mut arena) catch {

        set failed = true;

    };

    assert failed;

}

/// Frame size arithmetic must not wrap into a negative stack allocation.

unsafe fn testFrameSizeOverflow() throws (TestError) {

    for size in [0x7fffffff, -1] {

        let mut failed = false;

        try rv64::emit::computeFrame(size, 0, 0, false, false) catch error {

            assert error == rv64::Error::Capacity;

            set failed = true;

        };

        assert failed;

    }

    let frame = try rv64::emit::computeFrame(16, 0, 0, false, false) catch {

        throw TestError::Failed;

    };

    assert frame.totalSize == 32;

}

/// Oversized reserves must fail before narrowing their byte counts.

unsafe fn testReserveOverflow() throws (TestError) {

    let mut arena = alloc::new(&mut ASSEMBLY_ARENA_STORAGE[..]);

    let mut scratch = alloc::new(&mut REGISTER_SCRATCH[..]);

    let mut generator = try! rv64::beginProgram(

        rv64::ProgramOptions { entryPatch: rv64::EntryPatch::None, debug: false }, &mut arena

    );

    let mut instructions = [

        il::Instr::Reserve { dst: il::Reg { n: 0 }, size: il::Val::Imm(0x100000000), alignment: 8 },

        il::Instr::Ret { val: nil },

    ];

    let func = il::Fn {

        name: "reserve", params: &[], returnType: il::Type::W64, isExtern: false, isLeaf: true,

        blocks: &[il::Block { label: "entry", params: &[], instrs: &mut instructions[..], locs: &[], preds: &[], loopDepth: 0 }],

    };

    rv64::generateFunction(&mut generator, &func, &mut scratch);

    assert generator.e.error == rv64::Error::Capacity;

    assert scratch.offset == 0;

    let config = rv64::targetConfig();

    let ralloc = try! regalloc::allocate(&func, &config, &mut scratch);

    set generator.e.error = rv64::Error::Symbol;

    rv64::isel::selectFn(&mut generator.e, &ralloc, &func);

    assert generator.e.error == rv64::Error::Symbol;

}

/// An exhausted instruction buffer records failure and stops writes.

unsafe fn testCodeCapacity() throws (TestError) {

    let mut arena = alloc::new(&mut ASSEMBLY_ARENA_STORAGE[..]);

    let mut e = try rv64::emit::emitter(&mut arena, false) catch {

        throw TestError::Failed;

    };

    set e.code = &mut e.code[..0];

    rv64::emit::emit(&mut e, encode::nop());

    assert e.error == rv64::Error::Capacity;

    rv64::emit::emit(&mut e, encode::ebreak());

    assert e.codeLen == 0;

}

/// Generator initialization must report exhausted storage without trapping.

unsafe fn testGeneratorAllocationFailure() throws (TestError) {

    let mut arena = alloc::new(&mut REGISTER_SCRATCH[..64]);

    set arena.offset = 8;

    let mut failed = false;

    try rv64::beginProgram(

        rv64::ProgramOptions { entryPatch: rv64::EntryPatch::None, debug: false }, &mut arena

    ) catch error {

        assert error == rv64::Error::Allocation;

        set failed = true;

    };

    assert failed;

    assert arena.offset == 8;

}

/// Function allocation failure preserves the scratch checkpoint.

unsafe fn testFunctionAllocationFailure() throws (TestError) {

    let mut arena = alloc::new(&mut ASSEMBLY_ARENA_STORAGE[..]);

    let mut scratch = alloc::new(&mut REGISTER_SCRATCH[..8]);

    set scratch.offset = 8;

    let mut generator = try! rv64::beginProgram(

        rv64::ProgramOptions { entryPatch: rv64::EntryPatch::None, debug: false }, &mut arena

    );

    let mut instructions = [il::Instr::Ret { val: il::Val::Imm(0) }];

    let func = il::Fn {

        name: "allocation", params: &[], returnType: il::Type::W64, isExtern: false, isLeaf: true,

        blocks: &[il::Block { label: "entry", params: &[], instrs: &mut instructions[..], locs: &[], preds: &[], loopDepth: 0 }],

    };

    rv64::generateFunction(&mut generator, &func, &mut scratch);

    assert generator.e.error == rv64::Error::Allocation;

    assert scratch.offset == 8;

}

/// Full metadata tables reject appends before requesting more storage.

unsafe fn testMetadataCapacity() throws (TestError) {

    for kind in 0..5 {

        let mut e = boundsEmitter();

        match kind {

            case 0 => {

                set e.pendingBranches.len = 0;

                set e.pendingBranches.cap = 0;

                rv64::emit::recordBranch(&mut e, 0, rv64::emit::BranchKind::Jump);

            }

            case 1 => {

                set e.pendingCalls.len = 0;

                set e.pendingCalls.cap = 0;

                rv64::emit::recordCall(&mut e, "call");

            }

            case 2 => {

                set e.pendingJumps.len = 0;

                set e.pendingJumps.cap = 0;

                rv64::emit::recordJumpAt(&mut e, "jump", rv64::ZERO, 0);

            }

            case 3 => {

                set e.pendingAddrLoads.len = 0;

                set e.pendingAddrLoads.cap = 0;

                rv64::emit::recordDataAddrLoad(&mut e, "data", rv64::A0);

            }

            else => {

                set e.funcs.len = 0;

                set e.funcs.cap = 0;

                rv64::emit::recordFunc(&mut e, "function");

            }

        }

        assert e.error == rv64::Error::Capacity;

        let length = e.codeLen;

        rv64::emit::emit(&mut e, encode::nop());

        assert e.codeLen == length;

    }

}

/// Debug entries report exhausted storage without writing beyond the buffer.

unsafe fn testDebugCapacity() throws (TestError) {

    let mut e = boundsEmitter();

    rv64::emit::recordSrcLoc(&mut e, il::SrcLoc { moduleId: 0, offset: 0 });

    assert e.error == rv64::Error::Capacity;

    assert e.debugEntriesLen == 0;

}

/// Block labels report an out-of-range table index.

unsafe fn testBlockCapacity() throws (TestError) {

    let mut e = boundsEmitter();

    let count = e.labels.blockOffsets.len;

    rv64::emit::recordBlock(&mut e, count);

    assert e.error == rv64::Error::Capacity;

    assert e.labels.blockCount == 0;

}

/// Unresolved calls preserve their placeholder instructions and report a symbol error.

unsafe fn testMissingCallSymbol() throws (TestError) {

    let mut e = boundsEmitter();

    rv64::emit::recordCall(&mut e, "missing");

    rv64::emit::patchCalls(&mut e);

    assert e.error == rv64::Error::Symbol;

    assert e.code[0] == encode::nop();

    assert e.code[1] == encode::nop();

}

/// Local jumps outside their immediate range preserve the reserved instruction.

unsafe fn testLocalJumpRange() throws (TestError) {

    let mut e = boundsEmitter();

    rv64::emit::recordBranch(&mut e, 0, rv64::emit::BranchKind::Jump);

    set e.labels.blockOffsets[0] = 0x200000;

    set e.labels.blockCount = 1;

    rv64::emit::patchLocalBranches(&mut e);

    assert e.error == rv64::Error::Relocation;

    assert e.code[0] == encode::nop();

}

/// Assembly jumps reject targets beyond the J-type displacement range.

unsafe fn testAssemblyJumpRange() throws (TestError) {

    let mut e = boundsEmitter();

    rv64::emit::emit(&mut e, encode::nop());

    rv64::emit::recordJumpAt(&mut e, "far", rv64::ZERO, 0);

    rv64::emit::recordFuncOffsetAt(&mut e, "far", 0x80000);

    rv64::emit::patchJumps(&mut e);

    assert e.error == rv64::Error::Relocation;

    assert e.code[0] == encode::nop();

}

/// Missing data symbols preserve address-load placeholders.

unsafe fn testMissingDataSymbol() throws (TestError) {

    let mut e = boundsEmitter();

    static entries: [dict::Entry; 4] = undefined;

    let map = try! data::buildMap(&[], &mut entries[..]);

    rv64::emit::recordDataAddrLoad(&mut e, "missing", rv64::A0);

    rv64::emit::patchAddrLoads(&mut e, &map);

    assert e.error == rv64::Error::Symbol;

    assert e.code[0] == encode::nop();

    assert e.code[1] == encode::nop();

}

/// Data addresses outside the supported signed address range are rejected.

unsafe fn testDataAddressRange() throws (TestError) {

    let mut e = boundsEmitter();

    static entries: [dict::Entry; 4] = undefined;

    static symbols: [data::DataSym; 1] = [data::DataSym { name: "far", addr: 0x80000000 }];

    let map = try! data::buildMap(&symbols[..], &mut entries[..]);

    rv64::emit::recordDataAddrLoad(&mut e, "far", rv64::A0);

    rv64::emit::patchAddrLoads(&mut e, &map);

    assert e.error == rv64::Error::Relocation;

    assert e.code[0] == encode::nop();

    assert e.code[1] == encode::nop();

}

/// Data section sizes must not wrap when alignment exceeds the address space.

unsafe fn testDataLayoutOverflow() throws (TestError) {

    let items = [il::Data { name: "value", size: 8, alignment: 8, readOnly: true, isZeroInit: false, values: &[] }];

    let mut symbols: [data::DataSym; 1] = undefined;

    let mut count: u32 = 0;

    let mut failed = false;

    try data::layoutSectionAtOffset(&items[..], &mut symbols[..], &mut count, 0, 0xfffffffc, true) catch error {

        assert error == data::Error::Overflow;

        set failed = true;

    };

    assert failed;

    assert count == 0;

}

/// Initializers must not write past their declared data slot.

unsafe fn testDataInitializerBounds() throws (TestError) {

    try testDataMapCapacity();

    let mut arena = alloc::new(&mut ASSEMBLY_ARENA_STORAGE[..]);

    let e = try! rv64::emit::emitter(&mut arena, false);

    static entries: [dict::Entry; 4] = undefined;

    let map = try! data::buildMap(&[], &mut entries[..]);

    let mut items = [il::Data {

        name: "small", size: 1, alignment: 1, readOnly: true, isZeroInit: false,

        values: &[il::DataValue { item: il::DataItem::Val { typ: il::Type::W64, val: 7 }, count: 1 }],

    }];

    let mut bytes = [0xaa as u8; 16];

    let mut failed = false;

    try data::emitSection(&items[..], &map, &e.labels, 0, &mut bytes[..], true) catch error {

        assert error == data::Error::Capacity;

        set failed = true;

    };

    assert failed;

    assert bytes[0] == 0xaa and bytes[1] == 0xaa;

    set items[0].size = 8;

    let written = try! data::emitSection(&items[..], &map, &e.labels, 0, &mut bytes[..8], true);

    assert written == 8;

    assert bytes[0] == 7;

    for i in 1..8 {

        assert bytes[i] == 0;

    }

    assert bytes[8] == 0xaa;

}

/// Data maps must reject inputs beyond the backing dictionary capacity.

unsafe fn testDataMapCapacity() throws (TestError) {

    static mapCapacityEntries: [dict::Entry; 2] = undefined;

    static mapCapacitySymbols: [data::DataSym; 2] = [

        data::DataSym { name: "first", addr: 0 },

        data::DataSym { name: "second", addr: 8 },

    ];

    let mut failed = false;

    try data::buildMap(&mapCapacitySymbols[..], &mut mapCapacityEntries[..]) catch error {

        assert error == data::Error::Capacity;

        set failed = true;

    };

    assert failed;

}

/// Create an emitter in reusable static storage for bounds checks.

unsafe fn boundsEmitter() -> rv64::emit::Emitter {

    let mut arena = alloc::new(&mut ASSEMBLY_ARENA_STORAGE[..]);

    return try! rv64::emit::emitter(&mut arena, false);

}

/// Verify recoverable backend bounds and allocation failures.

unsafe fn testBackendBounds() throws (TestError) {

    try testFunctionMapCapacity();

    try testRegisterLimit();

    try testSpillCandidateLimit();

    try testFrameSizeOverflow();

    try testReserveOverflow();

    try testCallArgumentCapacity();

    try testBlockArgumentCapacity();

    try testCodeCapacity();

    try testGeneratorAllocationFailure();

    try testFunctionAllocationFailure();

    try testMetadataCapacity();

    try testDebugCapacity();

    try testBlockCapacity();

    try testMissingCallSymbol();

    try testLocalJumpRange();

    try testAssemblyJumpRange();

    try testMissingDataSymbol();

    try testDataAddressRange();

    try testDataLayoutOverflow();

    try testDataAlignment();

    try testDataInitializerBounds();

    try testDataEmissionSymbol();

    try testFunctionInitializerSymbol();

    try testOutputPrefixCapacity();

    try testMissingEntry();

    try testCodeBaseOverflow();

}

/// Function labels reject a full dictionary before insertion.

unsafe fn testFunctionMapCapacity() throws (TestError) {

    let mut e = boundsEmitter();

    static entries: [dict::Entry; 2] = undefined;

    set e.labels.funcs = dict::init(&mut entries[..]);

    rv64::emit::recordFuncOffsetAt(&mut e, "first", 0);

    rv64::emit::recordFuncOffsetAt(&mut e, "second", 1);

    assert e.error == rv64::Error::Capacity;

    assert e.labels.funcs.count == 1;

}

/// Data initializers report unresolved symbols before writing the slot.

unsafe fn testDataEmissionSymbol() throws (TestError) {

    let e = boundsEmitter();

    static entries: [dict::Entry; 4] = undefined;

    let map = try! data::buildMap(&[], &mut entries[..]);

    let items = [il::Data { name: "symbol", size: 8, alignment: 8, readOnly: true, isZeroInit: false,

        values: &[il::DataValue { item: il::DataItem::Sym("missing"), count: 1 }] }];

    let mut bytes = [0xaa as u8; 8];

    let mut failed = false;

    try data::emitSection(&items[..], &map, &e.labels, 0, &mut bytes[..], true) catch error {

        assert error == data::Error::Symbol;

        set failed = true;

    };

    assert failed;

    assert bytes[0] == 0xaa;

}

/// Function initializers report unresolved symbols before writing the slot.

unsafe fn testFunctionInitializerSymbol() throws (TestError) {

    let e = boundsEmitter();

    static entries: [dict::Entry; 4] = undefined;

    let map = try! data::buildMap(&[], &mut entries[..]);

    let items = [il::Data { name: "symbol", size: 8, alignment: 8, readOnly: true, isZeroInit: false,

        values: &[il::DataValue { item: il::DataItem::Fn("missing"), count: 1 }] }];

    let mut bytes = [0xaa as u8; 8];

    let mut failed = false;

    try data::emitSection(&items[..], &map, &e.labels, 0, &mut bytes[..], true) catch error {

        assert error == data::Error::Symbol;

        set failed = true;

    };

    assert failed;

    assert bytes[0] == 0xaa;

}

/// The read-only prefix must fit its output buffer.

unsafe fn testOutputPrefixCapacity() throws (TestError) {

    let mut arena = alloc::new(&mut ASSEMBLY_ARENA_STORAGE[..]);

    let mut generator = try! rv64::beginProgram(

        rv64::ProgramOptions { entryPatch: rv64::EntryPatch::None, debug: false }, &mut arena

    );

    static symbols: [data::DataSym; 1] = undefined;

    static entries: [dict::Entry; 4] = undefined;

    let storage = rv64::Storage { dataSyms: &mut symbols[..], dataSymEntries: &mut entries[..] };

    let mut failed = false;

    try rv64::finishProgram(&mut generator, &[], storage, "x", &mut [], &mut []) catch error {

        assert error == rv64::Error::Capacity;

        set failed = true;

    };

    assert failed;

}

/// A reserved entry jump requires an entry symbol.

unsafe fn testMissingEntry() throws (TestError) {

    let mut arena = alloc::new(&mut ASSEMBLY_ARENA_STORAGE[..]);

    let mut generator = try! rv64::beginProgram(

        rv64::ProgramOptions { entryPatch: rv64::EntryPatch::Reserved(nil), debug: false }, &mut arena

    );

    static symbols: [data::DataSym; 1] = undefined;

    static entries: [dict::Entry; 4] = undefined;

    let storage = rv64::Storage { dataSyms: &mut symbols[..], dataSymEntries: &mut entries[..] };

    let mut failed = false;

    try rv64::finishProgram(&mut generator, &[], storage, "", &mut [], &mut []) catch error {

        assert error == rv64::Error::Symbol;

        set failed = true;

    };

    assert failed;

}

/// Code placement must not wrap after the read-only section.

unsafe fn testCodeBaseOverflow() throws (TestError) {

    let mut arena = alloc::new(&mut ASSEMBLY_ARENA_STORAGE[..]);

    let mut generator = try! rv64::beginProgram(

        rv64::ProgramOptions { entryPatch: rv64::EntryPatch::None, debug: false }, &mut arena

    );

    static symbols: [data::DataSym; 1] = undefined;

    static entries: [dict::Entry; 4] = undefined;

    let storage = rv64::Storage { dataSyms: &mut symbols[..], dataSymEntries: &mut entries[..] };

    let items = [il::Data { name: "large", size: 0xfffeffff, alignment: 1, readOnly: true, isZeroInit: true, values: &[] }];

    let mut failed = false;

    try rv64::finishProgram(&mut generator, &items[..], storage, "", &mut [], &mut []) catch error {

        assert error == rv64::Error::Data(data::Error::Overflow);

        set failed = true;

    };

    assert failed;

}

/// Call arguments must fit the architectural argument register bank.

unsafe fn testCallArgumentCapacity() throws (TestError) {

    let mut arena = alloc::new(&mut ASSEMBLY_ARENA_STORAGE[..]);

    let mut scratch = alloc::new(&mut REGISTER_SCRATCH[..]);

    let mut generator = try! rv64::beginProgram(

        rv64::ProgramOptions { entryPatch: rv64::EntryPatch::None, debug: false }, &mut arena

    );

    let args = [il::Val::Imm(0); 9];

    let mut instructions = [

        il::Instr::Call { retTy: il::Type::W64, dst: nil, func: il::Val::FnAddr("target"), args: &args[..] },

        il::Instr::Ret { val: nil },

    ];

    let func = il::Fn {

        name: "call", params: &[], returnType: il::Type::W64, isExtern: false, isLeaf: false,

        blocks: &[il::Block { label: "entry", params: &[], instrs: &mut instructions[..], locs: &[], preds: &[], loopDepth: 0 }],

    };

    rv64::generateFunction(&mut generator, &func, &mut scratch);

    assert generator.e.error == rv64::Error::Capacity;

    assert scratch.offset == 0;

    set generator.e.error = nil;

    set instructions[0] = il::Instr::Call {

        retTy: il::Type::W64, dst: nil, func: il::Val::FnAddr("target"), args: &args[..8],

    };

    rv64::generateFunction(&mut generator, &func, &mut scratch);

    assert generator.e.error == nil;

    assert scratch.offset == 0;

}

/// Block argument lists must fit the parallel move storage.

unsafe fn testBlockArgumentCapacity() throws (TestError) {

    let mut arena = alloc::new(&mut ASSEMBLY_ARENA_STORAGE[..]);

    let mut scratch = alloc::new(&mut REGISTER_SCRATCH[..]);

    let mut generator = try! rv64::beginProgram(

        rv64::ProgramOptions { entryPatch: rv64::EntryPatch::None, debug: false }, &mut arena

    );

    let mut args = [il::Val::Imm(0); 17];

    let mut params = [il::Param { value: il::Reg { n: 0 }, type: il::Type::W64 }; 17];

    for i in 0..params.len {

        set params[i].value.n = i;

    }

    let mut entry = [il::Instr::Jmp { target: 1, args: &mut args[..] }];

    let mut exit = [il::Instr::Ret { val: nil }];

    let mut blocks = [

        il::Block { label: "entry", params: &[], instrs: &mut entry[..], locs: &[], preds: &[], loopDepth: 0 },

        il::Block { label: "exit", params: &params[..], instrs: &mut exit[..], locs: &[], preds: &[0], loopDepth: 0 },

    ];

    let func = il::Fn {

        name: "block", params: &[], returnType: il::Type::W64, isExtern: false, isLeaf: true,

        blocks: &blocks[..],

    };

    rv64::generateFunction(&mut generator, &func, &mut scratch);

    assert generator.e.error == rv64::Error::Capacity;

    assert scratch.offset == 0;

    set generator.e.error = nil;

    set entry[0] = il::Instr::Jmp { target: 1, args: &mut args[..16] };

    set blocks[1].params = &params[..16];

    rv64::generateFunction(&mut generator, &func, &mut scratch);

    assert generator.e.error == nil;

    assert scratch.offset == 0;

}

/// Initialized and zero-filled data require power-of-two alignment.

unsafe fn testDataAlignment() throws (TestError) {

    for zeroInit in [false, true] {

        for alignment in [0, 3, 8] {

            let items = [il::Data {

                name: "aligned", size: 8, alignment, readOnly: true,

                isZeroInit: zeroInit, values: &[],

            }];

            let mut symbols: [data::DataSym; 1] = undefined;

            let mut count: u32 = 0;

            let mut failed = false;

            let size = try data::layoutSectionAtOffset(

                &items[..], &mut symbols[..], &mut count, 16, 1, true

            ) catch error {

                assert error == data::Error::Alignment;

                set failed = true;

                0;

            };

            assert failed == (alignment <> 8);

            if not failed {

                assert size == 16 and count == 1;

                assert symbols[0].addr == 24;

            } else {

                assert count == 0;

            }

        }

    }

}