inline: do not auto-inline a body that reads a parameter inside a

can_shadow block

A can_shadow block argument is one the shadowing check deliberately lets
cover an outer name of the same spelling. Hosts set it on generated query
blocks (dagor's ecs marks every [es] component argument), and
daslib/linq_boost sets it on the blocks it generates.

Splicing a callee that reads a parameter inside such a block is unsafe.
The parameter becomes the caller's argument expression, and when that
expression names a variable the block also declares, it rebinds to the
block's variable. Nothing reports it, because can_shadow is exactly what
switches error 30701 off, so the program is silently wrong rather than
rejected:

    def callee(squad_team : int)
      return apply_team() <| $ [shadowable] (team : int)
        return squad_team * 100 + team
    def caller(team : int)
      return callee(team)         // 505, should be 705

The 505 is the block's own team (5) used for both operands. In dagor's
enlisted this turned `squad_team != team` into `team != team`; that one
happened to trip -Wtautological-compare in the AOT output, but a
collision between two different variables compiles clean and just
computes the wrong value.

Keep those callees out of the heuristic tier. An explicit [inline] still
splices - that contract is the author's call. The added test fails with
505 before the change.

Author: aleksisch

src/ast/ast_inline.cpp

@@ -565,6 +565,32 @@ namespace das {
         // shapes: to_array_move's heap-mode array literal spliced into a generated
         // `let <-` re-infers under the in-place make-local protocol and corrupts
         // the array header (probe-verified: garbage sums, SIGSEGV)
+        // a can_shadow block argument is one the shadowing check deliberately lets cover an outer
+        // name of the same spelling - host query blocks set it on every component argument (dagor's
+        // ecs does), and daslib/linq_boost sets it on its generated blocks. Splicing a body that
+        // READS A PARAMETER inside such a block is unsafe: the parameter becomes the caller's
+        // argument expression, and if that expression names a variable the block also declares, it
+        // rebinds to the block's variable. Nothing diagnoses it, because can_shadow is exactly what
+        // switches the shadowing error off, so the result is a silently wrong program - dagor hit
+        // `squad_team != team` emitted as `team != team`. Keep such callees out of the auto tier;
+        // an explicit [inline] contract still splices, that is the author's call.
+        bool captureHazardFn ( Function * fn ) {
+            bool hazard = false;
+            lookupExpressions(fn->body, [&](Expression * e) {
+                if ( hazard || !e->rtti_isBlock() ) return;
+                auto blk = static_cast<ExprBlock *>(e);
+                bool anyCanShadow = false;
+                for ( auto & a : blk->arguments ) {
+                    if ( a->can_shadow ) { anyCanShadow = true; break; }
+                }
+                if ( !anyCanShadow ) return;
+                lookupExpressions(blk, [&](Expression * inner) {
+                    if ( inner->rtti_isVar() && static_cast<ExprVar *>(inner)->argument ) hazard = true;
+                });
+            });
+            return hazard;
+        }
+
         bool autoEligibleFn ( Function * fn, const AutoInlineCfg & cfg ) {
             if ( !fn || fn->mustInline || fn->builtIn ) return false;
             if ( !fn->body || fn->isTemplate ) return false;
@@ -582,6 +608,7 @@ namespace das {
             // module's visible-function set. Cross-module inlining is the author's
             // explicit [inline] contract, not a heuristic's call
             if ( fn->module != cfg.thisModule ) return false;
+            if ( captureHazardFn(fn) ) return false;
             return worthAutoInline(fn, cfg);
         }
 

tests/language/_inline_shadow_helper.das

@@ -0,0 +1,23 @@
+options gen2
+options indenting = 4
+module _inline_shadow_helper public
+require daslib/ast public
+require daslib/ast_boost
+
+// Marks the annotated block's arguments can_shadow, which is what a host ECS does for query blocks
+// (dagor: gameLibs/ecs/scripts/das/das_es.cpp sets arg->can_shadow on every [es] block argument) and
+// what daslib/linq_boost does for its generated blocks.
+[block_macro(name="shadowable")]
+class ShadowableBlock : AstBlockAnnotation {
+    def override apply(var blk : ExprBlock?; var group : ModuleGroup;
+                       args : AnnotationArgumentList; var errors : das_string) : bool {
+        for (a in blk.arguments) {
+            a.flags.can_shadow = true
+        }
+        return true
+    }
+    def override finish(var blk : ExprBlock?; var group : ModuleGroup;
+                        args, progArgs : AnnotationArgumentList; var errors : das_string) : bool {
+        return true
+    }
+}

tests/language/inline_shadow_capture.das

@@ -0,0 +1,19 @@
+options gen2
+options auto_inline_functions = true
+require dastest/testing_boost
+require _inline_shadow_helper
+
+[never_inline] def apply_team(blk : block<(team : int) : int>) : int { return invoke(blk, 5) }
+
+def callee(squad_team : int) : int {
+    return apply_team() <| $ [shadowable] (team : int) : int {
+        return squad_team * 100 + team
+    }
+}
+
+def caller(team : int) : int { return callee(team) }
+
+[test]
+def test_no_capture_when_inlined(t : T?) {
+    t |> equal(caller(7), 705)
+}