nandi/rustnim · 8587dec

⑂ 8587dec

Lower Arc and Mutex, with the guard released where Rust releases it

Arc<T> is shared ownership, which a Nim ref gives: two bindings naming one
object. clone() is the identity, since copying the ref is sharing it, and a
method call or field access on an Arc reaches the contents as Rust's
auto-deref does.

Mutex<T>'s guard releases on Drop, and Nim's defer is the same rule including
on an early return -- probed first, together with the fact that two
sequential locked scopes do not deadlock. But where it releases depends on
something a naive lowering gets wrong: a bound guard lives to the end of its
scope, while a temporary is dropped at the end of the statement. The release
is queued when the lock is taken and the statement decides which it was.
Getting that wrong deadlocks, which is how it was found.

Two differences are real and recorded rather than papered over. Arc refcounts
atomically where a plain Nim ref does not, which matters only across threads
and std::thread is not modelled at all. And poisoning has no equivalent: Rust
poisons a mutex when a holder panics and lock() then returns Err, whereas
here lock() always succeeds -- panics map to quit(101) rather than unwinding,
so nothing is left to poison it, but a program that observes poisoning would
differ. AtomicUsize stays unmapped deliberately: it needs memory orderings
and would be indistinguishable from a plain variable in a program with no
threads, which cannot be verified here.

The test case was first written with two lock() calls in one println!, which
deadlocks in Rust too -- Mutex is not reentrant and both guards live to the
end of the statement. The transpiler was right and the case was wrong, but it
exposed a real hole in the harness: the runner blocked forever instead of
reporting. Every child process now has a 60-second timeout and a hanging case
fails with a reason. A harness that can hang is a harness that can stop
telling you things.

Accepted crates unchanged at 18 of 400.

50 differential cases, all green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nandithebull committed 2026-09-19T06:50:09-07:00 Browse files

8587dec parent: edb7777

modified DESIGN.md +46 -8 Viewed

@@ -847,14 +847,52 @@ That took the category from 62 to 54, and what is left divides cleanly:
847	847	\| dependency types \| `Aes256Gcm::new`, `GHash::new`, `Bytes::new` \| the closure problem \|
848	848	\| platform \| `env::var_os`, `getauxval` \| `std::env`, `libc` \|
849	849
850		-The concurrency group is the interesting one, and it is not a mapping table.
851		-`Arc<T>` is shared ownership, which Nim's GC'd `ref` gives — but `Arc` is
852		-atomically refcounted where a plain Nim `ref` is not. `Mutex<T>` needs the
853		-guard's `Drop` to release the lock at scope exit. `AtomicUsize` needs memory
854		-orderings, and would be indistinguishable from a plain variable in a program
855		-with no threads — which we cannot verify, since `std::thread` is not modelled
856		-at all. Each of those is a design question about semantics, not a syntactic
857		-gap, and none should be mapped casually.
	850	+### `Arc` and `Mutex`
	851	+
	852	+`Arc<T>` is shared ownership, which a Nim `ref` gives: two bindings naming one
	853	+object. `.clone()` is therefore the identity — copying the ref is sharing
	854	+it — and a method call or field access on an `Arc` reaches the contents, as
	855	+Rust's auto-deref does.
	856	+
	857	+`Mutex<T>`'s guard releases on `Drop`. Nim's `defer` is the same rule,
	858	+including on an early return, which is what makes this exact rather than
	859	+approximate. But where it releases depends on something Rust decides and a
	860	+naive lowering does not:
	861	+
	862	+- a bound guard (`let g = m.lock().unwrap()`) lives to the end of its
	863	+ scope — `defer`;
	864	+- a temporary (`m.lock().unwrap().field`) is dropped at the end of the
	865	+ statement.
	866	+
	867	+Getting that wrong deadlocks: two `lock()` calls in one statement with the
	868	+first still held. The release is queued when the lock is taken and the
	869	+statement decides which it was.
	870	+
	871	+Two differences are real and are recorded rather than papered over:
	872	+
	873	+- `Arc` refcounts atomically; a plain Nim `ref` does not. That matters
	874	+ only across threads, and `std::thread` is not modelled at all, so a program
	875	+ using it is rejected before reaching here.
	876	+- Poisoning has no equivalent. Rust poisons a mutex when a holder panics
	877	+ and `lock()` then returns `Err`. Here `lock()` always succeeds. Panics map
	878	+ to `quit(101)` rather than unwinding, so there is no holder left to poison
	879	+ it — but a program that depends on observing poisoning would differ.
	880	+
	881	+`AtomicUsize` is still unmapped, and deliberately: it needs memory orderings,
	882	+and would be indistinguishable from a plain variable in a program with no
	883	+threads — which cannot be verified here.
	884	+
	885	+### The harness had a hole
	886	+
	887	+`tests/cases/044` was first written with two `lock()` calls in one `println!`,
	888	+which deadlocks in Rust too — `Mutex` is not reentrant and both guards
	889	+live to the end of the statement. The transpiler was right; the case was
	890	+wrong.
	891	+
	892	+It exposed a real gap: the runner blocked forever instead of reporting. Every
	893	+child process now has a 60-second timeout, and a case that hangs fails with
	894	+"timed out — a deadlock, or an unbounded loop". A harness that can hang is a
	895	+harness that can stop telling you things.
858	896
859	897	So the honest statement about this category is neither "bounded and cheap" nor
860	898	"unbounded tail": part of it was cheap std surface and is done, and the rest

  | **dependency types** | `Aes256Gcm::new`, `GHash::new`, `Bytes::new` | the closure problem |
  | **platform** | `env::var_os`, `getauxval` | `std::env`, `libc` |
--The concurrency group is the interesting one, and it is *not* a mapping table.
++### `Arc` and `Mutex`
--`Arc<T>` is shared ownership, which Nim's GC'd `ref` gives — but `Arc` is
++
--atomically refcounted where a plain Nim `ref` is not. `Mutex<T>` needs the
++`Arc<T>` is shared ownership, which a Nim `ref` gives: two bindings naming one
--guard's `Drop` to release the lock at scope exit. `AtomicUsize` needs memory
++object. `.clone()` is therefore the identity — copying the ref *is* sharing
--orderings, and would be indistinguishable from a plain variable in a program
++it — and a method call or field access on an `Arc` reaches the contents, as
--with no threads — which we cannot verify, since `std::thread` is not modelled
++Rust's auto-deref does.
--at all. Each of those is a design question about semantics, not a syntactic
++
--gap, and none should be mapped casually.
++`Mutex<T>`'s guard releases on `Drop`. Nim's `defer` is the same rule,
++including on an early return, which is what makes this exact rather than
++approximate. But **where** it releases depends on something Rust decides and a
++naive lowering does not:
++
++- a **bound** guard (`let g = m.lock().unwrap()`) lives to the end of its
++  scope — `defer`;
++- a **temporary** (`m.lock().unwrap().field`) is dropped at the end of the
++  *statement*.
++
++Getting that wrong deadlocks: two `lock()` calls in one statement with the
++first still held. The release is queued when the lock is taken and the
++statement decides which it was.
++
++Two differences are real and are recorded rather than papered over:
++
++- `Arc` refcounts **atomically**; a plain Nim `ref` does not. That matters
++  only across threads, and `std::thread` is not modelled at all, so a program
++  using it is rejected before reaching here.
++- **Poisoning has no equivalent.** Rust poisons a mutex when a holder panics
++  and `lock()` then returns `Err`. Here `lock()` always succeeds. Panics map
++  to `quit(101)` rather than unwinding, so there is no holder left to poison
++  it — but a program that depends on *observing* poisoning would differ.
++
++`AtomicUsize` is still unmapped, and deliberately: it needs memory orderings,
++and would be indistinguishable from a plain variable in a program with no
++threads — which cannot be verified here.
++
++### The harness had a hole
++
++`tests/cases/044` was first written with two `lock()` calls in one `println!`,
++which **deadlocks in Rust too** — `Mutex` is not reentrant and both guards
++live to the end of the statement. The transpiler was right; the case was
++wrong.
++
++It exposed a real gap: the runner blocked forever instead of reporting. Every
++child process now has a 60-second timeout, and a case that hangs fails with
++"timed out — a deadlock, or an unbounded loop". A harness that can hang is a
++harness that can stop telling you things.
  So the honest statement about this category is neither "bounded and cheap" nor
  "unbounded tail": part of it was cheap std surface and is done, and the rest

modified src/lower.rs +144 -2 Viewed

@@ -279,7 +279,15 @@ pub struct Lowerer {
279	279	aliases: HashMap<String, (Vec<String>, syn::Type)>,
280	280	/// Whether anything in the input is a future, which decides if the async
281	281	/// runtime is emitted.
	282	+ /// Locks acquired while lowering the current statement, awaiting a
	283	+ /// decision about where they are released.
	284	+ pending_locks: Vec<String>,
282	285	uses_async: bool,
	286	+ /// Whether anything here is an `Arc`/`Rc`/`Mutex`, which decides if the
	287	+ /// locking runtime is emitted. A `Cell` because it is set while mapping
	288	+ /// a type, which happens behind `&self`, and the answer has to be known
	289	+ /// before the prelude is written.
	290	+ uses_sync: std::cell::Cell<bool>,
283	291	/// Module names supplied as separate input files. A `mod x;` naming one
284	292	/// of these is satisfied by that file having been passed in.
285	293	pub modules: Vec<String>,
@@ -339,7 +347,9 @@ impl Lowerer {
339	347	vec_expect: None,
340	348	forwards: Vec::new(),
341	349	aliases: HashMap::new(),
	350	+ pending_locks: Vec::new(),
342	351	uses_async: false,
	352	+ uses_sync: std::cell::Cell::new(false),
343	353	modules: Vec::new(),
344	354	emitted: 0,
345	355	features: Vec::new(),
@@ -429,6 +439,10 @@ impl Lowerer {
429	439	self.out.push_str(include_str!("prelude_async.nim"));
430	440	self.blank();
431	441	}
	442	+ if self.uses_sync.get() {
	443	+ self.out.push_str(include_str!("prelude_sync.nim"));
	444	+ self.blank();
	445	+ }
432	446
433	447	// Pass 2: type definitions, which every signature may mention.
434	448	for (m, f) in files {
@@ -943,6 +957,14 @@ impl Lowerer {
943	957	/// lowering goes through here rather than calling `ty::map` directly, so
944	958	/// an alias cannot be missed in one position and honoured in another.
945	959	fn map_ty(&self, t: &syn::Type) -> Result<Nim, String> {
	960	+ let n = self.map_ty_inner(t)?;
	961	+ if mentions_sync(&n) {
	962	+ self.uses_sync.set(true);
	963	+ }
	964	+ Ok(n)
	965	+ }
	966	+
	967	+ fn map_ty_inner(&self, t: &syn::Type) -> Result<Nim, String> {
946	968	// `Self::Item` names an associated type of the enclosing `impl`.
947	969	if let syn::Type::Path(p) = t {
948	970	let segs: Vec<String> =
@@ -2375,6 +2397,16 @@ impl Lowerer {
2375	2397	}
2376	2398
2377	2399	fn stmt(&mut self, s: &Stmt) -> Result<(), String> {
	2400	+ let r = self.stmt_inner(s);
	2401	+ // Any lock still queued was taken by a temporary guard, which Rust
	2402	+ // drops at the end of the statement.
	2403	+ for lk in std::mem::take(&mut self.pending_locks) {
	2404	+ self.line(&format!("release({})", lk));
	2405	+ }
	2406	+ r
	2407	+ }
	2408	+
	2409	+ fn stmt_inner(&mut self, s: &Stmt) -> Result<(), String> {
2378	2410	match s {
2379	2411	Stmt::Local(l) => self.local(l),
2380	2412	Stmt::Expr(e, _) => {
@@ -2477,6 +2509,13 @@ impl Lowerer {
2477	2509	return Ok(());
2478	2510	}
2479	2511
	2512	+ if v.window.is_some() && !self.pending_locks.is_empty() {
	2513	+ // The binding is the guard, so it lives as long as the scope --
	2514	+ // which is what `defer` gives.
	2515	+ for lk in std::mem::take(&mut self.pending_locks) {
	2516	+ self.line(&format!("defer: release({})", lk));
	2517	+ }
	2518	+ }
2480	2519	if let Some(w) = v.window.clone() {
2481	2520	// `let dst = dst.get_mut(..n).ok_or(..)?;` -- the binding names a
2482	2521	// view into the caller's buffer. Copying it into a `seq` would
@@ -3791,6 +3830,14 @@ impl Lowerer {
3791	3830	syn::Member::Named(n) => n.to_string(),
3792	3831	syn::Member::Unnamed(i) => format!("f{}", i.index),
3793	3832	};
	3833	+ // An `Arc` derefs to its contents, as Rust's does.
	3834	+ let base = match &base.ty {
	3835	+ Some(Nim::Named(n, a)) if n == "RsArc" => Val::new(
	3836	+ format!("{}.v", base.code),
	3837	+ a.first().cloned(),
	3838	+ ),
	3839	+ _ => base,
	3840	+ };
3794	3841	let t = match &base.ty {
3795	3842	Some(bt @ Nim::Named(s, _)) => self
3796	3843	.structs
@@ -4156,7 +4203,14 @@ impl Lowerer {
4156	4203	}
4157	4204	Ok(Val::new(format!("(not {})", v.code), v.ty))
4158	4205	}
4159		- UnOp::Deref(_) => Ok(v),
	4206	+ UnOp::Deref(_) => Ok(match &v.ty {
	4207	+ // `arc` is its contents; `guard` is already the value the
	4208	+ // guard aliases.
	4209	+ Some(Nim::Named(n, a)) if n == "RsArc" => {
	4210	+ Val::new(format!("{}.v", v.code), a.first().cloned())
	4211	+ }
	4212	+ _ => v,
	4213	+ }),
4160	4214	_ => Err("unsupported unary operator".into()),
4161	4215	}
4162	4216	}
@@ -4716,6 +4770,31 @@ impl Lowerer {
4716	4770	}
4717	4771	}
4718	4772
	4773	+ // `Arc::new` / `Rc::new` / `Mutex::new`.
	4774	+ match (
	4775	+ p.path.segments.iter().rev().nth(1).map(\|s\| s.ident.to_string()).as_deref(),
	4776	+ name.as_str(),
	4777	+ codes.len(),
	4778	+ ) {
	4779	+ (Some("Arc" \| "Rc"), "new", 1) => {
	4780	+ self.uses_sync.set(true);
	4781	+ let inner = args[0].ty.clone();
	4782	+ return Ok(Val::new(
	4783	+ format!("rsArcNew({})", codes[0]),
	4784	+ inner.map(\|t\| Nim::Named("RsArc".into(), vec![t])),
	4785	+ ));
	4786	+ }
	4787	+ (Some("Mutex"), "new", 1) => {
	4788	+ self.uses_sync.set(true);
	4789	+ let inner = args[0].ty.clone();
	4790	+ return Ok(Val::new(
	4791	+ format!("rsMutexNew({})", codes[0]),
	4792	+ inner.map(\|t\| Nim::Named("RsMutex".into(), vec![t])),
	4793	+ ));
	4794	+ }
	4795	+ _ => {}
	4796	+ }
	4797	+
4719	4798	// Standard-library constructors. These are not calls into a
4720	4799	// dependency -- they are `std`'s own surface, and each has an exact
4721	4800	// Nim counterpart rather than an approximate one.
@@ -5012,7 +5091,15 @@ impl Lowerer {
5012	5091	}
5013	5092	}
5014	5093	}
5015		- let recv = self.expr(&m.receiver)?;
	5094	+ let mut recv = self.expr(&m.receiver)?;
	5095	+ // A method call on an `Arc` reaches the contents, as Rust's auto-deref
	5096	+ // does -- `arc_of_mutex.lock()` is the mutex's method.
	5097	+ if let Some(Nim::Named(n, a)) = recv.ty.clone() {
	5098	+ if n == "RsArc" && !matches!(m.method.to_string().as_str(), "clone") {
	5099	+ recv = Val::new(format!("{}.v", recv.code), a.first().cloned());
	5100	+ }
	5101	+ }
	5102	+ let recv = recv;
5016	5103	let rt0 = recv.ty.clone();
5017	5104
5018	5105	// `s.get(a..b)` / `s.get_mut(a..b)`: an `Option<&[T]>`. Nim has no
@@ -5093,6 +5180,21 @@ impl Lowerer {
5093	5180	let a0 = args.first().map(\|a\| a.code.clone());
5094	5181	let rt = recv.ty.clone();
5095	5182
	5183	+ // The guard is what `lock()` already produced; `unwrap` on it is the
	5184	+ // identity. A poisoned mutex has no equivalent here -- see
	5185	+ // `src/prelude_sync.nim`. This is checked before the general `unwrap`,
	5186	+ // which would look for a `Result`.
	5187	+ if matches!(name.as_str(), "unwrap" \| "expect") {
	5188	+ if let Some(Nim::Named(n, a)) = &rt {
	5189	+ if n == "RsGuard" {
	5190	+ let inner = a.first().cloned();
	5191	+ let mut v = Val::new(recv.code.clone(), inner.clone());
	5192	+ v.window = Some(Alias::Value { code: recv.code.clone(), ty: inner });
	5193	+ return Ok(v);
	5194	+ }
	5195	+ }
	5196	+ }
	5197	+
5096	5198	// A method the input defines wins over our model of the standard
5097	5199	// library: `is_empty` on a `bitflags!` type is that type's, not the
5098	5200	// sequence one. Rust resolves inherent methods the same way.
@@ -5315,6 +5417,32 @@ impl Lowerer {
5315	5417	Some(Nim::Ptr(Box::new(elem))),
5316	5418	)
5317	5419	}
	5420	+ // `m.lock()` acquires, and the guard releases on Drop -- at scope
	5421	+ // exit and on an early return, which is exactly Nim's `defer`.
	5422	+ // The guard is an alias to the protected value, not a copy, so
	5423	+ // writing through it writes to the mutex.
	5424	+ "lock" \| "try_lock" if matches!(&rt, Some(Nim::Named(n, _)) if n == "RsMutex") => {
	5425	+ let Some(Nim::Named(_, a)) = &rt else { unreachable!() };
	5426	+ let inner = a
	5427	+ .first()
	5428	+ .cloned()
	5429	+ .ok_or("`lock()` on a mutex with no known value type")?;
	5430	+ // Rust drops a temporary guard at the end of the statement
	5431	+ // and a bound one at the end of its scope. Which of those
	5432	+ // applies is not known until the statement is assembled, so
	5433	+ // the release is queued and the statement decides.
	5434	+ self.line(&format!("acquire({}.lk)", recv.code));
	5435	+ self.pending_locks.push(format!("{}.lk", recv.code));
	5436	+ let mut v = Val::new(
	5437	+ format!("{}.val", recv.code),
	5438	+ Some(Nim::Named("RsGuard".into(), vec![inner.clone()])),
	5439	+ );
	5440	+ v.window = Some(Alias::Value {
	5441	+ code: format!("{}.val", recv.code),
	5442	+ ty: Some(inner),
	5443	+ });
	5444	+ return Ok(v);
	5445	+ }
5318	5446	"abs" => (format!("abs({})", recv.code), rt.clone()),
5319	5447	"min" => (format!("min({}, {})", recv.code, a0.unwrap_or_default()), rt.clone()),
5320	5448	"max" => (format!("max({}, {})", recv.code, a0.unwrap_or_default()), rt.clone()),
@@ -5873,6 +6001,20 @@ fn module_of(prefix: &[String]) -> String {
5873	6001	}
5874	6002	}
5875	6003
	6004	+/// Whether a type involves the locking runtime.
	6005	+fn mentions_sync(t: &Nim) -> bool {
	6006	+ match t {
	6007	+ Nim::Named(n, a) => {
	6008	+ n == "RsArc" \|\| n == "RsMutex" \|\| a.iter().any(mentions_sync)
	6009	+ }
	6010	+ Nim::Seq(e) \| Nim::OpenArray(e) \| Nim::Var(e) \| Nim::Array(_, e) \| Nim::Iter(e)
	6011	+ \| Nim::Future(e) \| Nim::Ptr(e) \| Nim::ConstPtr(e) => mentions_sync(e),
	6012	+ Nim::Tuple(ts) => ts.iter().any(mentions_sync),
	6013	+ Nim::Proc(a, r) => a.iter().any(mentions_sync) \|\| mentions_sync(r),
	6014	+ _ => false,
	6015	+ }
	6016	+}
	6017	+
5876	6018	/// Rust's `Default` for a primitive is its zero value, which is Nim's too.
5877	6019	fn default_of(t: &Nim) -> Option<String> {
5878	6020	Some(match t {

      aliases: HashMap<String, (Vec<String>, syn::Type)>,
      /// Whether anything in the input is a future, which decides if the async
      /// runtime is emitted.
++    /// Locks acquired while lowering the current statement, awaiting a
++    /// decision about where they are released.
++    pending_locks: Vec<String>,
      uses_async: bool,
++    /// Whether anything here is an `Arc`/`Rc`/`Mutex`, which decides if the
++    /// locking runtime is emitted. A `Cell` because it is set while *mapping*
++    /// a type, which happens behind `&self`, and the answer has to be known
++    /// before the prelude is written.
++    uses_sync: std::cell::Cell<bool>,
      /// Module names supplied as separate input files. A `mod x;` naming one
      /// of these is satisfied by that file having been passed in.
      pub modules: Vec<String>,
              vec_expect: None,
              forwards: Vec::new(),
              aliases: HashMap::new(),
++            pending_locks: Vec::new(),
              uses_async: false,
++            uses_sync: std::cell::Cell::new(false),
              modules: Vec::new(),
              emitted: 0,
              features: Vec::new(),
              self.out.push_str(include_str!("prelude_async.nim"));
              self.blank();
          }
++        if self.uses_sync.get() {
++            self.out.push_str(include_str!("prelude_sync.nim"));
++            self.blank();
++        }
          // Pass 2: type definitions, which every signature may mention.
          for (m, f) in files {
      /// lowering goes through here rather than calling `ty::map` directly, so
      /// an alias cannot be missed in one position and honoured in another.
      fn map_ty(&self, t: &syn::Type) -> Result<Nim, String> {
++        let n = self.map_ty_inner(t)?;
++        if mentions_sync(&n) {
++            self.uses_sync.set(true);
++        }
++        Ok(n)
++    }
++
++    fn map_ty_inner(&self, t: &syn::Type) -> Result<Nim, String> {
          // `Self::Item` names an associated type of the enclosing `impl`.
          if let syn::Type::Path(p) = t {
              let segs: Vec<String> =
      }
      fn stmt(&mut self, s: &Stmt) -> Result<(), String> {
++        let r = self.stmt_inner(s);
++        // Any lock still queued was taken by a temporary guard, which Rust
++        // drops at the end of the statement.
++        for lk in std::mem::take(&mut self.pending_locks) {
++            self.line(&format!("release({})", lk));
++        }
++        r
++    }
++
++    fn stmt_inner(&mut self, s: &Stmt) -> Result<(), String> {
          match s {
              Stmt::Local(l) => self.local(l),
              Stmt::Expr(e, _) => {
              return Ok(());
          }
++        if v.window.is_some() && !self.pending_locks.is_empty() {
++            // The binding *is* the guard, so it lives as long as the scope --
++            // which is what `defer` gives.
++            for lk in std::mem::take(&mut self.pending_locks) {
++                self.line(&format!("defer: release({})", lk));
++            }
++        }
          if let Some(w) = v.window.clone() {
              // `let dst = dst.get_mut(..n).ok_or(..)?;` -- the binding names a
              // view into the caller's buffer. Copying it into a `seq` would
                      syn::Member::Named(n) => n.to_string(),
                      syn::Member::Unnamed(i) => format!("f{}", i.index),
                  };
++                // An `Arc` derefs to its contents, as Rust's does.
++                let base = match &base.ty {
++                    Some(Nim::Named(n, a)) if n == "RsArc" => Val::new(
++                        format!("{}.v", base.code),
++                        a.first().cloned(),
++                    ),
++                    _ => base,
++                };
                  let t = match &base.ty {
                      Some(bt @ Nim::Named(s, _)) => self
                          .structs
                  }
                  Ok(Val::new(format!("(not {})", v.code), v.ty))
              }
--            UnOp::Deref(_) => Ok(v),
++            UnOp::Deref(_) => Ok(match &v.ty {
++                // `*arc` is its contents; `*guard` is already the value the
++                // guard aliases.
++                Some(Nim::Named(n, a)) if n == "RsArc" => {
++                    Val::new(format!("{}.v", v.code), a.first().cloned())
++                }
++                _ => v,
++            }),
              _ => Err("unsupported unary operator".into()),
          }
      }
              }
          }
++        // `Arc::new` / `Rc::new` / `Mutex::new`.
++        match (
++            p.path.segments.iter().rev().nth(1).map(|s| s.ident.to_string()).as_deref(),
++            name.as_str(),
++            codes.len(),
++        ) {
++            (Some("Arc" | "Rc"), "new", 1) => {
++                self.uses_sync.set(true);
++                let inner = args[0].ty.clone();
++                return Ok(Val::new(
++                    format!("rsArcNew({})", codes[0]),
++                    inner.map(|t| Nim::Named("RsArc".into(), vec![t])),
++                ));
++            }
++            (Some("Mutex"), "new", 1) => {
++                self.uses_sync.set(true);
++                let inner = args[0].ty.clone();
++                return Ok(Val::new(
++                    format!("rsMutexNew({})", codes[0]),
++                    inner.map(|t| Nim::Named("RsMutex".into(), vec![t])),
++                ));
++            }
++            _ => {}
++        }
++
          // Standard-library constructors. These are not calls into a
          // dependency -- they are `std`'s own surface, and each has an exact
          // Nim counterpart rather than an approximate one.
                  }
              }
          }
--        let recv = self.expr(&m.receiver)?;
++        let mut recv = self.expr(&m.receiver)?;
++        // A method call on an `Arc` reaches the contents, as Rust's auto-deref
++        // does -- `arc_of_mutex.lock()` is the mutex's method.
++        if let Some(Nim::Named(n, a)) = recv.ty.clone() {
++            if n == "RsArc" && !matches!(m.method.to_string().as_str(), "clone") {
++                recv = Val::new(format!("{}.v", recv.code), a.first().cloned());
++            }
++        }
++        let recv = recv;
          let rt0 = recv.ty.clone();
  // `s.get(a..b)` / `s.get_mut(a..b)`: an `Option<&[T]>`. Nim has no
          let a0 = args.first().map(|a| a.code.clone());
          let rt = recv.ty.clone();
++        // The guard is what `lock()` already produced; `unwrap` on it is the
++        // identity. A poisoned mutex has no equivalent here -- see
++        // `src/prelude_sync.nim`. This is checked before the general `unwrap`,
++        // which would look for a `Result`.
++        if matches!(name.as_str(), "unwrap" | "expect") {
++            if let Some(Nim::Named(n, a)) = &rt {
++                if n == "RsGuard" {
++                    let inner = a.first().cloned();
++                    let mut v = Val::new(recv.code.clone(), inner.clone());
++                    v.window = Some(Alias::Value { code: recv.code.clone(), ty: inner });
++                    return Ok(v);
++                }
++            }
++        }
++
          // A method the input defines wins over our model of the standard
          // library: `is_empty` on a `bitflags!` type is that type's, not the
          // sequence one. Rust resolves inherent methods the same way.
                      Some(Nim::Ptr(Box::new(elem))),
                  )
              }
++            // `m.lock()` acquires, and the guard releases on Drop -- at scope
++            // exit and on an early return, which is exactly Nim's `defer`.
++            // The guard is an *alias* to the protected value, not a copy, so
++            // writing through it writes to the mutex.
++            "lock" | "try_lock" if matches!(&rt, Some(Nim::Named(n, _)) if n == "RsMutex") => {
++                let Some(Nim::Named(_, a)) = &rt else { unreachable!() };
++                let inner = a
++                    .first()
++                    .cloned()
++                    .ok_or("`lock()` on a mutex with no known value type")?;
++                // Rust drops a *temporary* guard at the end of the statement
++                // and a *bound* one at the end of its scope. Which of those
++                // applies is not known until the statement is assembled, so
++                // the release is queued and the statement decides.
++                self.line(&format!("acquire({}.lk)", recv.code));
++                self.pending_locks.push(format!("{}.lk", recv.code));
++                let mut v = Val::new(
++                    format!("{}.val", recv.code),
++                    Some(Nim::Named("RsGuard".into(), vec![inner.clone()])),
++                );
++                v.window = Some(Alias::Value {
++                    code: format!("{}.val", recv.code),
++                    ty: Some(inner),
++                });
++                return Ok(v);
++            }
              "abs" => (format!("abs({})", recv.code), rt.clone()),
              "min" => (format!("min({}, {})", recv.code, a0.unwrap_or_default()), rt.clone()),
              "max" => (format!("max({}, {})", recv.code, a0.unwrap_or_default()), rt.clone()),
      }
  }
++/// Whether a type involves the locking runtime.
++fn mentions_sync(t: &Nim) -> bool {
++    match t {
++        Nim::Named(n, a) => {
++            n == "RsArc" || n == "RsMutex" || a.iter().any(mentions_sync)
++        }
++        Nim::Seq(e) | Nim::OpenArray(e) | Nim::Var(e) | Nim::Array(_, e) | Nim::Iter(e)
++        | Nim::Future(e) | Nim::Ptr(e) | Nim::ConstPtr(e) => mentions_sync(e),
++        Nim::Tuple(ts) => ts.iter().any(mentions_sync),
++        Nim::Proc(a, r) => a.iter().any(mentions_sync) || mentions_sync(r),
++        _ => false,
++    }
++}
++
  /// Rust's `Default` for a primitive is its zero value, which is Nim's too.
  fn default_of(t: &Nim) -> Option<String> {
      Some(match t {

added src/prelude_sync.nim +41 -0 Viewed

new file mode 100644
@@ -0,0 +1,41 @@
	1	+import std/locks
	2	+
	3	+# ---------------------------------------------------------------------------
	4	+# `Arc`/`Rc` and `Mutex`.
	5	+#
	6	+# `Arc<T>` is shared ownership, which a Nim `ref` gives: two bindings naming
	7	+# one object, collected when the last goes away. `.clone()` is therefore the
	8	+# identity here -- copying the ref is sharing it.
	9	+#
	10	+# `Mutex<T>`'s guard releases the lock when it is dropped, at scope exit and
	11	+# on an early return. Nim's `defer` is that same rule, which is what makes the
	12	+# mapping exact rather than approximate; probed against Nim 2.2.4, including
	13	+# that two sequential locked scopes do not deadlock.
	14	+#
	15	+# Two differences are real and are not papered over:
	16	+#
	17	+# * `Arc` refcounts atomically; a plain Nim `ref` does not. That matters only
	18	+# across threads, and `std::thread` is not modelled at all -- a program
	19	+# using it is rejected before reaching here.
	20	+# * A poisoned `Mutex` has no equivalent. Rust poisons a mutex when a holder
	21	+# panics; `lock()` then returns `Err`. Here `lock()` always succeeds, so a
	22	+# program that depends on observing poisoning would differ. Panics are
	23	+# mapped to `quit(101)` rather than unwinding, so there is no holder left
	24	+# to poison it.
	25	+# ---------------------------------------------------------------------------
	26	+
	27	+type
	28	+ RsArc*[T] = ref object
	29	+ v*: T
	30	+ RsMutex*[T] = ref object
	31	+ lk*: Lock
	32	+ val*: T
	33	+
	34	+proc rsArcNew*[T](v: T): RsArc[T] =
	35	+ new(result)
	36	+ result.v = v
	37	+
	38	+proc rsMutexNew*[T](v: T): RsMutex[T] =
	39	+ new(result)
	40	+ initLock(result.lk)
	41	+ result.val = v

++import std/locks
++
++# ---------------------------------------------------------------------------
++# `Arc`/`Rc` and `Mutex`.
++#
++# `Arc<T>` is shared ownership, which a Nim `ref` gives: two bindings naming
++# one object, collected when the last goes away. `.clone()` is therefore the
++# identity here -- copying the ref *is* sharing it.
++#
++# `Mutex<T>`'s guard releases the lock when it is dropped, at scope exit and
++# on an early return. Nim's `defer` is that same rule, which is what makes the
++# mapping exact rather than approximate; probed against Nim 2.2.4, including
++# that two sequential locked scopes do not deadlock.
++#
++# Two differences are real and are not papered over:
++#
++#   * `Arc` refcounts atomically; a plain Nim `ref` does not. That matters only
++#     across threads, and `std::thread` is not modelled at all -- a program
++#     using it is rejected before reaching here.
++#   * A poisoned `Mutex` has no equivalent. Rust poisons a mutex when a holder
++#     panics; `lock()` then returns `Err`. Here `lock()` always succeeds, so a
++#     program that depends on observing poisoning would differ. Panics are
++#     mapped to `quit(101)` rather than unwinding, so there is no holder left
++#     to poison it.
++# ---------------------------------------------------------------------------
++
++type
++  RsArc*[T] = ref object
++    v*: T
++  RsMutex*[T] = ref object
++    lk*: Lock
++    val*: T
++
++proc rsArcNew*[T](v: T): RsArc[T] =
++  new(result)
++  result.v = v
++
++proc rsMutexNew*[T](v: T): RsMutex[T] =
++  new(result)
++  initLock(result.lk)
++  result.val = v

modified src/ty.rs +3 -0 Viewed

@@ -271,6 +271,9 @@ pub fn map(t: &Type) -> Result<Nim, String> {
271	271	// The `log` facade's types, under shim names.
272	272	("Level", 0) => Ok(Nim::Prim("RsLogLevel".into())),
273	273	("LevelFilter", 0) => Ok(Nim::Prim("RsLogFilter".into())),
	274	+ // Shared ownership and locking: see `src/prelude_sync.nim`.
	275	+ ("Arc", 1) \| ("Rc", 1) => Ok(Nim::Named("RsArc".into(), args)),
	276	+ ("Mutex", 1) => Ok(Nim::Named("RsMutex".into(), args)),
274	277	("Vec", 1) => Ok(Nim::Seq(Box::new(args[0].clone().owned()))),
275	278	("Option", 1) => Ok(Nim::Named("Option".into(), args)),
276	279	("Result", 2) => Ok(Nim::Named("Result".into(), args)),

                  // The `log` facade's types, under shim names.
                  ("Level", 0) => Ok(Nim::Prim("RsLogLevel".into())),
                  ("LevelFilter", 0) => Ok(Nim::Prim("RsLogFilter".into())),
++                // Shared ownership and locking: see `src/prelude_sync.nim`.
++                ("Arc", 1) | ("Rc", 1) => Ok(Nim::Named("RsArc".into(), args)),
++                ("Mutex", 1) => Ok(Nim::Named("RsMutex".into(), args)),
                  ("Vec", 1) => Ok(Nim::Seq(Box::new(args[0].clone().owned()))),
                  ("Option", 1) => Ok(Nim::Named("Option".into(), args)),
                  ("Result", 2) => Ok(Nim::Named("Result".into(), args)),

added tests/cases/044-arc-mutex.rs +68 -0 Viewed

new file mode 100644
@@ -0,0 +1,68 @@
	1	+// `Arc<T>` is shared ownership, which a Nim `ref` gives: two bindings naming
	2	+// one object. `.clone()` is the identity -- copying the ref is sharing it.
	3	+//
	4	+// A `MutexGuard` releases on Drop, at scope exit and on an early return, which
	5	+// is exactly Nim's `defer`. That is what this case checks: the value is shared
	6	+// through the Arc, mutated through the guard, and a later lock in the same
	7	+// function must not deadlock -- which it would if the first guard never
	8	+// released.
	9	+//
	10	+// Single-threaded on purpose: `std::thread` is not modelled, and a program
	11	+// using it is rejected. What is verified here is sharing, mutation through the
	12	+// guard, and release-on-scope-exit.
	13	+
	14	+use std::sync::{Arc, Mutex};
	15	+
	16	+struct Counter {
	17	+ hits: i32,
	18	+ name: String,
	19	+}
	20	+
	21	+fn bump(m: &Arc<Mutex<i32>>) -> i32 {
	22	+ let mut g = m.lock().unwrap();
	23	+ *g += 1;
	24	+ *g
	25	+}
	26	+
	27	+fn early(m: &Arc<Mutex<i32>>, stop: bool) -> i32 {
	28	+ let mut g = m.lock().unwrap();
	29	+ if stop {
	30	+ // Returning here must still release the lock.
	31	+ return -1;
	32	+ }
	33	+ *g += 100;
	34	+ *g
	35	+}
	36	+
	37	+fn main() {
	38	+ let shared: Arc<Mutex<i32>> = Arc::new(Mutex::new(0));
	39	+
	40	+ println!("{}", bump(&shared));
	41	+ println!("{}", bump(&shared));
	42	+
	43	+ // A second handle is the same object.
	44	+ let other = shared.clone();
	45	+ println!("{}", bump(&other));
	46	+ println!("{}", *shared.lock().unwrap());
	47	+
	48	+ println!("{}", early(&shared, true));
	49	+ println!("{}", early(&shared, false));
	50	+ println!("{}", *shared.lock().unwrap());
	51	+
	52	+ // Arc over a struct: field access derefs through it.
	53	+ let c: Arc<Counter> = Arc::new(Counter { hits: 7, name: "abc".to_string() });
	54	+ let c2 = c.clone();
	55	+ println!("{} {} {}", c.hits, c2.hits, c.name);
	56	+
	57	+ // Arc over a Mutex holding a struct.
	58	+ let s: Arc<Mutex<Counter>> = Arc::new(Mutex::new(Counter { hits: 0, name: "m".to_string() }));
	59	+ {
	60	+ let mut g = s.lock().unwrap();
	61	+ g.hits += 5;
	62	+ }
	63	+ // One lock per statement: two guards alive at once would deadlock, in
	64	+ // Rust as much as here, since `Mutex` is not reentrant.
	65	+ let hits = s.lock().unwrap().hits;
	66	+ let nm = s.lock().unwrap().name.clone();
	67	+ println!("{} {}", hits, nm);
	68	+}

++// `Arc<T>` is shared ownership, which a Nim `ref` gives: two bindings naming
++// one object. `.clone()` is the identity -- copying the ref *is* sharing it.
++//
++// A `MutexGuard` releases on Drop, at scope exit and on an early return, which
++// is exactly Nim's `defer`. That is what this case checks: the value is shared
++// through the Arc, mutated through the guard, and a later lock in the same
++// function must not deadlock -- which it would if the first guard never
++// released.
++//
++// Single-threaded on purpose: `std::thread` is not modelled, and a program
++// using it is rejected. What is verified here is sharing, mutation through the
++// guard, and release-on-scope-exit.
++
++use std::sync::{Arc, Mutex};
++
++struct Counter {
++    hits: i32,
++    name: String,
++}
++
++fn bump(m: &Arc<Mutex<i32>>) -> i32 {
++    let mut g = m.lock().unwrap();
++    *g += 1;
++    *g
++}
++
++fn early(m: &Arc<Mutex<i32>>, stop: bool) -> i32 {
++    let mut g = m.lock().unwrap();
++    if stop {
++        // Returning here must still release the lock.
++        return -1;
++    }
++    *g += 100;
++    *g
++}
++
++fn main() {
++    let shared: Arc<Mutex<i32>> = Arc::new(Mutex::new(0));
++
++    println!("{}", bump(&shared));
++    println!("{}", bump(&shared));
++
++    // A second handle is the same object.
++    let other = shared.clone();
++    println!("{}", bump(&other));
++    println!("{}", *shared.lock().unwrap());
++
++    println!("{}", early(&shared, true));
++    println!("{}", early(&shared, false));
++    println!("{}", *shared.lock().unwrap());
++
++    // Arc over a struct: field access derefs through it.
++    let c: Arc<Counter> = Arc::new(Counter { hits: 7, name: "abc".to_string() });
++    let c2 = c.clone();
++    println!("{} {} {}", c.hits, c2.hits, c.name);
++
++    // Arc over a Mutex holding a struct.
++    let s: Arc<Mutex<Counter>> = Arc::new(Mutex::new(Counter { hits: 0, name: "m".to_string() }));
++    {
++        let mut g = s.lock().unwrap();
++        g.hits += 5;
++    }
++    // One lock per statement: two guards alive at once would deadlock, in
++    // Rust as much as here, since `Mutex` is not reentrant.
++    let hits = s.lock().unwrap().hits;
++    let nm = s.lock().unwrap().name.clone();
++    println!("{} {}", hits, nm);
++}

modified tests/differential.rs +21 -0 Viewed

@@ -66,6 +66,11 @@ impl Run {
66	66
67	67	// ------------------------------------------------------------------ helpers
68	68
	69	+/// A case that hangs must be a reported failure, not a hang: the suite
	70	+/// otherwise blocks forever on one deadlock. Found the hard way, by writing a
	71	+/// case that deadlocks in Rust -- two `MutexGuard`s alive in one statement.
	72	+const RUN_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(60);
	73	+
69	74	fn run(cmd: &mut Command, stdin: Option<&str>) -> Result<Run, String> {
70	75	cmd.stdin(if stdin.is_some() { Stdio::piped() } else { Stdio::null() })
71	76	.stdout(Stdio::piped())
@@ -74,6 +79,22 @@ fn run(cmd: &mut Command, stdin: Option<&str>) -> Result<Run, String> {
74	79	if let Some(s) = stdin {
75	80	child.stdin.as_mut().unwrap().write_all(s.as_bytes()).map_err(\|e\| e.to_string())?;
76	81	}
	82	+ // Poll rather than block, so a deadlocked child is killed and reported.
	83	+ let deadline = std::time::Instant::now() + RUN_TIMEOUT;
	84	+ loop {
	85	+ match child.try_wait().map_err(\|e\| e.to_string())? {
	86	+ Some(_) => break,
	87	+ None if std::time::Instant::now() >= deadline => {
	88	+ let _ = child.kill();
	89	+ let _ = child.wait();
	90	+ return Err(format!(
	91	+ "timed out after {}s -- a deadlock, or an unbounded loop",
	92	+ RUN_TIMEOUT.as_secs()
	93	+ ));
	94	+ }
	95	+ None => std::thread::sleep(std::time::Duration::from_millis(20)),
	96	+ }
	97	+ }
77	98	let out = child.wait_with_output().map_err(\|e\| e.to_string())?;
78	99	Ok(Run {
79	100	status: out.status.code(),

  // ------------------------------------------------------------------ helpers
++/// A case that hangs must be a reported failure, not a hang: the suite
++/// otherwise blocks forever on one deadlock. Found the hard way, by writing a
++/// case that deadlocks in *Rust* -- two `MutexGuard`s alive in one statement.
++const RUN_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(60);
++
  fn run(cmd: &mut Command, stdin: Option<&str>) -> Result<Run, String> {
      cmd.stdin(if stdin.is_some() { Stdio::piped() } else { Stdio::null() })
          .stdout(Stdio::piped())
      if let Some(s) = stdin {
          child.stdin.as_mut().unwrap().write_all(s.as_bytes()).map_err(|e| e.to_string())?;
      }
++    // Poll rather than block, so a deadlocked child is killed and reported.
++    let deadline = std::time::Instant::now() + RUN_TIMEOUT;
++    loop {
++        match child.try_wait().map_err(|e| e.to_string())? {
++            Some(_) => break,
++            None if std::time::Instant::now() >= deadline => {
++                let _ = child.kill();
++                let _ = child.wait();
++                return Err(format!(
++                    "timed out after {}s -- a deadlock, or an unbounded loop",
++                    RUN_TIMEOUT.as_secs()
++                ));
++            }
++            None => std::thread::sleep(std::time::Duration::from_millis(20)),
++        }
++    }
      let out = child.wait_with_output().map_err(|e| e.to_string())?;
      Ok(Run {
          status: out.status.code(),