Merge pull request #3576 from GaijinEntertainment/bbatkin/lints-and-64bit

64-bit hygiene: string length into the base module, wider memcpy/memcmp, and three rules that catch the truncation

Author: borisbat

CLAUDE.md

@@ -187,6 +187,7 @@ Read `skills/writing_skills.md` first — it carries the full checklist. The thr
 
 - No implicit type promotion: `int + float` is a compile error — both sides must match
 - No `bool(int)` cast — use `x != 0`; no `string(bool)` — use `"{flag}"`
+- **`length` and `empty` on a string need no `require`** — both live in the base module, so `length(s)` compiles in a bare file (the rest of the string surface still needs `require strings`). 64-bit forms: `long_length(s)`. The `int`-returning `length` panics past 2^31 rather than wrapping — same always-on guard array/table length already carry
 - `int("123")` does NOT work — use `to_int` from `require strings`. **`to_int` silently returns `0` on garbage** (`to_int("foo")` → `0`, `to_int("12abc")` → `12`). When you need to validate user/external input — including any string that flows into a shell command, file path, or system call — use `try_to_int` / `try_to_float` from `daslib/strings_convert` instead. Those return `Result<T; ConversionError>` distinguishing `invalid_argument` / `out_of_range` / `trailing_garbage`, so `";rm -rf;"` rejects cleanly instead of becoming `0`. Same for `to_float` → `try_to_float`
 - Hex literals are `uint` by default — use `int(0x3F)` for int
 - **16/8-bit type lattice**: `float16` scalar (`half` = builtin alias; literal suffix `1.5h`) + packed vectors `half2/3/4/8`, `short2/3/4/8`, `ushort2/3/4/8`, `byte2/3/4/8/16` (**byte = SIGNED int8**), `ubyte2/3/4/8/16`. Tightly packed (half3 = 6B), element-aligned, pass by value. fp16 family has **closed arithmetic** (per-op promote-to-float-round-back — bit-identical to native fp16); int families are **storage + converts only** (`byte4 + byte4` is a compile error; widen via `int4(b4)`, narrow via ctor = C-truncate or `short4_sat(i4)`-style saturating forms). `.s`-hex swizzles on every vector (`v.s3210`, `b16.sf`), `.lo`/`.hi` on 8/16-lane forms; `xyzw` stays ≤4 lanes. Conformance harness: `tests/type_lattice/` (GENERATED — regen via `daslang utils/dasgen/gen_type_conformance.das`). Lattice vectors have NO ExprConst nodes by design (`isFoldable` false; `Program::makeConst` returns null — callers must handle)
@@ -354,6 +355,9 @@ A generic that should accept `array<T>`, `array<array<T>>`, … (any nesting) 
 | hand-rolled `is X` / `as X` / null-guard / `ExprRef2Value`-peel ladders in macro code | `qmatch(e, $e(a) + $e(b))` for source-syntax shapes; `match (e) { if (ExprField(name = "key", value = ExprVar(...))) { ... } }` for node-class shapes | both matchers peel `ExprRef2Value` automatically; `\|\|` alternation, `&&` guards, and `match_expr(local)` cover most ladders. Limits + the qmatch↔match division of labor: `skills/das_macros.md` "`match` (daslib/match)" |
 | `unsafe(reinterpret<T?>(unsafe(addr(x))))` (reinterpret-of-addr, pointer target) | `unsafe(addr<T?>(x))` | STYLE034: same AST, one unsafe gate instead of two. Non-pointer puns (`reinterpret<uint64>(addr(x))`) have no `addr<T?>` spelling and stay silent; the sugar's own desugared output is exempt via `castFlags.fromAddrSugar` |
 | `b == T('(')` where `b : T` and T is a non-`int` built-in numeric scalar (also `!=`, ranges, and Yoda forms) | make `b : int`, then write `b == '('` | STYLE035: character literals are `int`; changing the plain variable once removes every repeated numeric cast. The warning is deduplicated at the declaration. |
+| `int64(length(x))` / `uint64(capacity(x))` (also `count`, `find_index`, `fread`, `fwrite`) | `long_length(x)` / `long_capacity(x)` / … | LINT017: the inner call returns `int`, so the 2^31 limit is hit *before* the widening cast — as a wrap, or as the panic guard on array/table/string length — and the cast buys nothing. Pair table is hardcoded (an exists-check is meaningless for user functions, since a macro can add/remove them) and gated on receiver type, which keeps same-named user overloads and the fixed-array `length` generic (no `long_` twin) silent |
+| `memcpy(d, s, int(n))` / `memcmp(d, s, int(n))` where `n` is `int64`/`uint64`/`uint` | `memcpy(d, s, n)` | LINT018: `memcpy`/`memcmp` now carry `uint`/`int64`/`uint64` size overloads, so the `int(...)` narrowing is pure loss — above 2^31 it copies the wrong byte count |
+| `cast<T -const>(x)` / `reinterpret<T -#>(x)` / `addr<void? -const>(x)` — any of `-const` `-&` `-[]` `-#` `==const` `==&` on a **concrete** cast target | drop the contract | STYLE036: these are *substitution* contracts — they act only while a generic binds, and infer clears them once consumed, so a flag still set at lint time proves it did nothing. `auto`/unresolved-alias targets are excluded (there substitution hasn't run and the contract is real); a concrete typedef is NOT excluded (`reinterpret<CI? -const>` with `typedef CI = int const` keeps the const) |
 
 For path/filename ops use `fio` helpers (`base_name`/`dir_name`/`path_join`/etc.) — see `skills/filesystem.md`. Never hand-roll `rfind("/")` / slice — misses Windows separators.
 

daslib/array_boost.das

@@ -248,7 +248,7 @@ def array_view(
             var res : array<TT -const>#
             if (length > 0) {
                 let data = addr<TT -const?>(bytes[byte_offset])
-                if (intptr(reinterpret<void? -const>(data)) % uint64(element_align) != 0_ul) {
+                if (intptr(reinterpret<void?>(data)) % uint64(element_align) != 0_ul) {
                     panic("array_view: unaligned typed view")
                 }
                 _builtin_make_temp_array(res, data, length)
@@ -262,7 +262,7 @@ def array_view(
             var res : array<TT -const>#
             if (length > 0_l) {
                 let data = addr<TT -const?>(bytes[byte_offset])
-                if (intptr(reinterpret<void? -const>(data)) % uint64(element_align) != 0_ul) {
+                if (intptr(reinterpret<void?>(data)) % uint64(element_align) != 0_ul) {
                     panic("array_view: unaligned typed view")
                 }
                 _builtin_make_temp_array_i64(res, data, length)

daslib/async_boost.das

@@ -9,7 +9,6 @@ module async_boost shared private
 //! Provides ``[async]`` function annotation and ``await`` call macro that
 //! rewrite annotated functions into generator-based coroutines.
 
-require strings
 require daslib/ast_boost
 require daslib/templates_boost
 require daslib/macro_boost

daslib/debug.das

@@ -1303,7 +1303,7 @@ class private DAgent : DapiDebugAgent {
                         return
                     }
                 }
-                frame.state |> emplace <| (uid = STATE_VARS + uint64(length(frame.state)), name = category, vars = [ variable])
+                frame.state |> emplace <| (uid = STATE_VARS + uint64(long_length(frame.state)), name = category, vars = [ variable])
             }
         })
     }

daslib/debug_eval.das

@@ -205,7 +205,7 @@ def func_call_length(var st : TokenStream; result : Result) : Result {
         }
         if (TypeInfo(basicType = Type.tString)) {
             let pstr = unsafe(reinterpret<string?>(getPD(st, result)))
-            return <- Result(int64(length(*pstr)))
+            return <- Result(long_length(*pstr))
         }
         if (TypeInfo(basicType = Type.tArray)) {
             let parr = unsafe(reinterpret<DapiArray?>(getPD(st, result)))

daslib/delegate.das

@@ -22,7 +22,6 @@ module delegate shared private
 
 require daslib/macro_boost
 require daslib/typemacro_boost
-require strings
 
 // ── helpers ────────────────────────────────────────────────────────────
 

daslib/flatten_opt_common.das

@@ -612,7 +612,7 @@ def public subst_consts(var e : ExpressionPtr; constmap : table<string; Expressi
     var tmpl : Template
     for (nm in keys(constmap)) {
         // ?[] yields a const view; const-strip the raw pointer (apply_template clones per use anyway).
-        var ex = unsafe(reinterpret<Expression? -const>(constmap?[nm] ?? null))
+        var ex = unsafe(reinterpret<Expression?>(constmap?[nm] ?? null))
         tmpl |> replaceVariable(nm, ex)
     }
     var res = apply_template(tmpl, e.at, e, false)
@@ -718,7 +718,7 @@ def public store_base(e : Expression const?) : ExpressionPtr {
     if (e is ExprSwizzle) return store_base((e as ExprSwizzle).value)
     if (e is ExprPtr2Ref) return store_base((e as ExprPtr2Ref).subexpr)
     if (e is ExprRef2Value) return store_base((e as ExprRef2Value).subexpr)
-    return e is ExprVar ? unsafe(reinterpret<Expression? -const>(e)) : null
+    return e is ExprVar ? unsafe(reinterpret<Expression?>(e)) : null
 }
 
 // Names reassigned somewhere in the block (live/loop masks `__flat_*`, any reassigned user `var`).

daslib/flatten_opt_preshade.das

@@ -606,7 +606,7 @@ def private regroup_to_share(var blk : ExprBlock?; no_fast_math : bool) : bool {
 def private alias_source(e : Expression const?) : ExpressionPtr {
     if (e == null) return null
     if (e is ExprRef2Value) return alias_source((e as ExprRef2Value).subexpr)
-    return e is ExprVar ? unsafe(reinterpret<Expression? -const>(e)) : null
+    return e is ExprVar ? unsafe(reinterpret<Expression?>(e)) : null
 }
 
 def private eliminate_aliases(var blk : ExprBlock?) : bool {

daslib/lint.das

@@ -388,8 +388,58 @@ class LintVisitor : AstVisitor {
         validate_argument(arg, "LINT013", "block argument")
     }
 
+    // --- LINT017: int64/uint64 cast of a call that has a long_ counterpart ---
+
+    def lint017_long_twin(fname : string; icall : ExprCall?) : string {
+        // Receiver-gated, so a same-named user overload or the fixed-array `length` generic in daslib/builtin.das (which has no long_ twin) stays silent.
+        let nargs = length(icall.arguments)
+        if (nargs == 0 || icall.arguments[0]._type == null) return ""
+        let bt = icall.arguments[0]._type.baseType
+        if (fname == "length" && (bt == Type.tArray || bt == Type.tTable || bt == Type.tString)) return "long_length"
+        if (fname == "capacity" && (bt == Type.tArray || bt == Type.tTable)) return "long_capacity"
+        if (fname == "count" && (bt == Type.tArray || bt == Type.tIterator)) return "long_count"
+        if (fname == "find_index" && bt == Type.tArray && nargs == 2) return "long_find_index"
+        // fio's `file` is a pointer-to-handle; the type gate keeps a user-defined 2-arg fread/fwrite from being told to call a long_ twin that does not exist.
+        if ((fname == "fread" || fname == "fwrite") && bt == Type.tPointer && nargs == 2) return "long_{fname}"
+        return ""
+    }
+
+    def check_lint017_long_cast(expr : ExprCall?) : void {
+        if (noLint || genericDepth > 0
+            || (expr.name != "int64" && expr.name != "uint64")
+            || length(expr.arguments) != 1) return
+        let inner = expr.arguments[0]
+        if (!(inner is ExprCall)) return
+        let icall = inner as ExprCall
+        let iname = string(icall.func != null && icall.func.fromGeneric != null
+            ? icall.func.fromGeneric.name
+            : icall.name)
+        let twin = lint017_long_twin(iname, icall)
+        if (empty(twin)) return
+        lint_error("LINT017: {expr.name}({iname}(...)) widens an already-32-bit result, so the 2^31 limit is still hit inside {iname} (as a wrap, or as the panic guard on array/table/string length) before the cast runs; call {twin}(...) instead", expr.at)
+    }
+
+    // --- LINT018: narrowing the size argument of memcpy / memcmp ---
+
+    def check_lint018_mem_size_narrowing(expr : ExprCall?) : void {
+        if (noLint || genericDepth > 0
+            || (expr.name != "memcpy" && expr.name != "memcmp")
+            || length(expr.arguments) != 3) return
+        let size = expr.arguments[2]
+        if (!(size is ExprCall)) return
+        let scall = size as ExprCall
+        if (scall.name != "int" || length(scall.arguments) != 1) return
+        let src = scall.arguments[0]._type
+        if (src == null) return
+        let bt = src.baseType
+        if (bt != Type.tInt64 && bt != Type.tUInt64 && bt != Type.tUInt) return
+        lint_error("LINT018: int(...) truncates the {expr.name} size above 2^31; {expr.name} has uint/int64/uint64 overloads, so drop the cast", expr.at)
+    }
+
     def override preVisitExprCall(expr : ExprCall?) : void {
         check_string_push_clone(expr)
+        check_lint017_long_cast(expr)
+        check_lint018_mem_size_narrowing(expr)
     }
 
     // `assume name = <block>` keeps a template block at the alias-definition site; every use of

daslib/style_lint.das

@@ -2367,6 +2367,26 @@ class StyleLintVisitor : AstVisitor {
                 && !expr.subexpr.genFlags.generated) {
             style_warning("STYLE034: reinterpret<{describe(expr.castType)}>(addr(...)) collapses to addr<{describe(expr.castType)}>(...); one unsafe() covers both halves", expr.at)
         }
+        // ===== STYLE036 — type contract that cannot act on a resolved cast type =====
+        if (!expr.genFlags.generated && expr.castType != null) {
+            let inert = style036_inert_contract(expr.castType)
+            if (!empty(inert)) {
+                let tail = inert == "-const" ? "; drop it, along with any 'const' it was meant to cancel" : "; drop it"
+                style_warning("STYLE036: '{inert}' does nothing on the already-resolved cast type {describe(expr.castType)}{tail}", expr.at)
+            }
+        }
+    }
+
+    def style036_inert_contract(t : TypeDecl?) : string {
+        // Substitution contracts: infer clears them when a generic binds (ast_typedecl.cpp:223,422), so one still set on a concrete target was never consumed — but an auto/unresolved-alias target has simply not been substituted yet (linq's `reinterpret<ARGT -const>` does strip const).
+        if (t.isAutoOrAlias) return ""
+        if (t.flags.removeConstant) return "-const"
+        if (t.flags.removeRef) return "-&"
+        if (t.flags.removeDim) return "-[]"
+        if (t.flags.removeTemporary) return "-#"
+        if (t.flags.explicitConst) return "==const"
+        if (t.flags.explicitRef) return "==&"
+        return ""
     }
 
     def override preVisitExprAt(expr : ExprAt?) : void {