Prism v1.1.7

Prism 1.1.7 hardens transpilation, compiler invocation, output publication, cache correctness, and language-feature parsing.

The procedural regression suite grows by 838 cells to 46,334 platform-inclusive cells, faster test suit.

fixes

1. --prism-emit now publishes output atomically.

2. --prism-emit rejects an input file or hard link as its destination, preserves an old destination on failure, and rejects one explicit destination for multiple sources.

3. Stdout emission uses the caller's descriptor on POSIX and reports write, flush, and close failures on every output path.

4. Generated #line filenames now escape quotes, controls, and trigraph-forming question marks.

5. Raw stripping keeps directives on their own line.

6. Stray braces now diagnose safely instead of reaching emission in an invalid parser state.

7. Malformed file-scope orelse now diagnoses safely.

8. Illegal bracket orelse dimensions now diagnose safely.

9. Declaration conditions now diagnose safely.

10. Statement-expression gotos now diagnose safely.

11. Parser arena shrinking is safe for library callers.

12. First-context allocation failure is safe for library callers.

13. Result-error allocation failure is safe for library callers.

14. Source-directive recovery is safe for library callers.

15. prism_reset() is safe for library callers after parser errors.

16. prism_thread_cleanup() is safe for library callers.

17. prism_free(NULL) is safe for library callers.

18. File APIs reject directories and non-C inputs before invoking the compiler.

19. File APIs reject malformed feature-array counts safely.

20. Oversized preprocessor argv construction is rejected before unsafe allocation.

21. File APIs reject embedded-NUL input before unsafe processing.

22. File APIs reject UTF-16-looking .i input before unsafe processing.

23. Compiler processes receive a fresh environment snapshot for every spawn.

24. Windows preserves Unicode environment values and rejects malformed UTF-8 conversion instead of silently changing it.

25. Stdin preprocessing normalizes -x none to C.

26. Re-emitted API definitions preserve preprocessor order and last-definition-wins behavior.

27. Quoted custom compiler commands preserve embedded spaces and platform quote rules without shell parsing.

28. Response files now expand lazily, respect check and -- boundaries, work as option operands, and support nesting and pipes.

29. Response files support UTF-8 and Windows UTF-16 BOMs and handle malformed reads safely.

30. MSVC /c, /Fe, /Fo, /FI, /D, /E, /EP, /P, stdin, and slash-option operands are modeled correctly.

31. GNU -f... flags no longer collide with MSVC dash spellings.

32. Non-flattened direct system headers retain the original preprocessor stream when re-emission could change macro, pragma, include, or reinclusion ordering.

33. The preprocessor cache validates payload checksums, full file identity, working directory, Unicode environment inputs, and volatile header macros.

34. The cache bypasses dependency side effects, marker suppression, response files, specs files, volatile flags, and custom compiler wrappers.

35. Cache publishing uses unique temporary files, saturated limits, and safe unavailable-admin paths.

36. Braceless defer now captures an entire control statement, including if/else, loop, switch, and do/while bodies.

37. Braced defer bodies validate embedded break and continue, preventing an invalid deferred escape from reaching emitted C.

38. Bounds checking now rejects a conditional base derived from tracked arrays instead of using one branch's extent for another.

39. Auto-static no longer mistakes shadowable true or false identifiers for constant initializers.

40. Deferred-capture discovery excludes actual orelse operators.

41. Deferred-capture discovery excludes raw declaration prefixes and raw blocks.

42. defer, orelse, and raw now recognize literal backslash-LF and backslash-CRLF splices before soft-keyword matching.

43. C trigraph translation now runs before splice handling, so a trigraph-derived backslash such as ??/ followed by LF/CRLF also joins a Prism keyword correctly.

44. Generated #line directives now retain the physical source line after a splice instead of mapping the next token to the preceding line.

45. A function that returns a function pointer now synthesizes its defer return-type typedef with the returned type's parameter list. int (*f(void))(int) produced typedef int (*T);, so the return temporary was an int *; GCC 16 and Clang 22 reject the resulting initializer and return outright, and older compilers accepted them with incompatible-pointer warnings. Array-pointer returns were already correct; (params) was the one declarator suffix being dropped.

46. A return value expression with no terminating ; now diagnoses instead of copying the rest of the translation unit into the return temporary's initializer and emitting unbalanced C.

47. Defer bodies, and the synthetic blocks spliced for return, break, continue, and goto, no longer land on a surviving preprocessor directive's line. A conforming preprocessor discards trailing tokens on a directive line, so with -fno-line-directives a #pragma immediately before a scope exit silently deleted the cleanup, and in the return case the return statement with it. Line directives happened to force the line break, which is why the failure only appeared with them disabled.

48. Macro-hygiene wrap parentheses around a declaration initializer no longer hide an empty orelse action. int x = (f() orelse); was accepted and lowered to x = x ? x :;, while the unwrapped int x = f() orelse; was already rejected.

49. An unterminated GNU __label__ declaration no longer duplicates every token from the declaration to end of input. The emitter wrote the tokens before discovering there was no terminator, then reported the statement as unhandled, and the caller emitted them a second time.

50. --prism-emit=<file> publishes with the destination's previous mode when replacing one, and with 0666 & ~umask when creating one. Atomic publication is via mkstemp, which forces 0600.

51. Trigraph translation no longer runs twice. cc -E (and a .i input) has already completed translation phases 1 to 3 with the backend's trigraph policy, which is off by default for GCC, Clang and MSVC and removed outright in C23. Re-applying phase 1 to that stream rewrote literals the compiler had deliberately kept: const char *s = "what??!"; compiled to what| under Prism and what??! under the very compiler Prism was driving. Prism now matches cc exactly under -std=c99, -std=gnu99, -std=c11, -std=c2x, -trigraphs and the default. Raw source reaching the library API is unaffected: Prism is the only front end that text sees, so it still owns phases 1 and 2, and the spliced-keyword forms keep working.

52. An orelse fallback value with no terminating ; now diagnoses instead of copying the rest of the enclosing block into LHS = ( ... ). Same defect and same shape as fix 46, on the bare-assignment path.

53. A defer directly after a GNU __label__ declaration is no longer rejected as expression context. Phase 1D handed on the __label__ token itself as the previous token, so the following statement looked like a continuation of an expression; valid GNU C plus valid Prism was refused, and only when nothing else stood between the two.

54. A __label__ declaration as a braceless defer body now diagnoses. It carries no type tag, so the existing braceless-declaration check never saw it, and the body scan emitted a stray }.

55. A bare orelse whose Phase 1 recipe has no recorded assignment = no longer dereferences a null token. Found by UBSan in the fuzz target.

56. Extension elimination is enforced at emission instead of assumed. A token Phase 1 classified as the keyword, whose feature is enabled and which is not inside a raw { ... } block, must be consumed by a lowering path; reaching raw emission now diagnoses. Three retired-regression cells were locking in the opposite: defer { int x = 5 } with no ; had the rest of the file swallowed into the deferred body and pasted back, so the output declared task_b twice and contained a live defer; and an attribute between if and its ( left p = get() orelse 0; in the generated C. All three inputs are rejected by a C compiler on their own merits, and all three previously produced output no compiler could use. The check costs one predictable branch on an already-loaded tag word.

57. Library calls no longer inherit the line-directive spelling from an earlier call. use_linemarkers selects GCC's # N "f" linemarker over C99's #line N "f"; only the CLI ever assigned it, and no library entry point reset it, so once anything in a thread set it every later prism_transpile_source silently emitted the other spelling. Found by sharding the suite: a shard that ran the internal-platform recipe next to the feature matrix lost #line from all 64 of its line-directive cells.

58. Every posix_spawn site retries the transient failures. Four of the five had no retry at all -- including the preprocessor spawn -- and the one that did covered EAGAIN and ETXTBSY but not ENOMEM, which is what macOS returns when the machine is briefly short of memory.

59. --prism-emit to a destination that is not a regular file (/dev/null, a character device, a fifo) now streams the finished output instead of failing. rename cannot publish onto such a destination, and the fallback also covers a cross-device EXDEV when the sibling temporary had to fall back to $TMPDIR. The destination is still opened only after translation and verification succeed.

60. The Windows build links again. Fix 58's retry helper called nanosleep, which has no MSVC import. The call had existed for a long time inside spawn_command, whose every caller is POSIX-only, so the linker discarded the function whole and the symbol never had to resolve; giving the retry four more call sites that are live on Windows turned it into unresolved external symbol nanosleep. The sleep is now Sleep on Win32 and nanosleep elsewhere, and the helper's parameters match windows.c's posix_spawnp shim rather than the POSIX prototype, since a non-const argument converts to POSIX's const one but not the reverse.

61. windows.c includes <basetsd.h> in lowercase. The MSVC SDK is case-insensitive so both spellings work there, but mingw-w64 ships the lowercase name and a case-sensitive host could not resolve <BaseTsd.h>. This is what had made the _WIN32 source path uncheckable anywhere except Windows CI, which is why fix 60 reached a push.

62. The suite's two infrastructure counters are declared outside the POSIX guard. infra_retries and slow_clock_skips are read by the summary in main(), which is compiled on every platform, but sat beside the POSIX-only code that increments them; MSVC reported four undeclared identifier errors. Same shape as fix 60 -- code added under one platform's assumptions and never built under the other.

63. Bounds checking covers int a[static N]. C11 6.7.6.3p7 promises the argument points at at least N elements, and that promise is the only extent an array parameter has -- it decays to a pointer, so the usual sizeof(a)/sizeof(a[0]) would measure the pointer against the element. The bound is the literal N. [static const N] and [const static N] are both recognised; an array parameter without the promise, and a plain pointer parameter, stay unchecked as before.

64. Bounds checking covers pointer-to-array dereference. int (*p)[4] carries its extent in the type, and *p and p[0] denote the same object, so (*p)[i], p[0][i] and (*(p))[i] all bound against sizeof(p[0])/sizeof(p[0][0]). The pointer hop itself stays unchecked -- nothing says how many arrays p points at -- so p[i] is untouched, and a base built from a pointer-to-array in any other shape is left alone rather than diagnosed.

65. Header-bearing preprocessor-cache entries are enabled. Recording each header's identity was never the missing piece; knowing whether it is still the file the next preprocess would choose was. An entry now also records the backend's include search path, taken from -E -v with the same flags, and each dependency's spelling as the preprocessor reported it. A file appearing ahead of a header in the search path moves that directory's mtime; a symlink retargeted anywhere along the way changes what the spelling resolves to. Either one is a miss. Failing to determine the search path means the entry is not published, so the fallback is exactly the previous behaviour. PP_CACHE_MAGIC advances to PRISMPPC4; older entries are ignored.

66. Macro operands of surviving #pragma directives are preserved. No preprocessor expands a pragma's operands, so flattening -- which hands the preprocessed stream through and re-emits no source defines at all -- left #pragma pack(push, PK) in the output with PK defined nowhere. A define named by a surviving pragma is now kept. Where it goes depends on where it was: a define ahead of the first include is hoisted with the rest, and one that follows a header is emitted in place, immediately before the pragma that needs it, because a define written after a header may be completing or shadowing what that header set up and must not be lifted above it. Defines no pragma names are still dropped. Preserving the define makes the question of whether a given backend expands pragma operands moot: it now does whatever it would have done with the original source.

67. -fno-orelse leaves the word orelse alone. Phase 1D annotated and then diagnosed the declaration-initializer form without consulting the feature bit, so int j = w || orelse; was rejected with the feature off, where the word is an ordinary identifier and an undeclared one is the backend's complaint to make in its own words. It also meant Prism could not reparse its own output whenever an input used the name as a plain identifier -- the reparse oracle runs with every transformation disabled.

68. An expression walk that reaches } without its ; diagnoses instead of consuming the closing brace. This was the last of the four expression walks still missing the bound that fixes 46 and 52 added to the others; found by the fuzz corpus.

69. typeof-based zero-init at file scope no longer indexes a negative function slot. Zero-init lowers to a runtime statement -- a byte loop or a memset -- which has no meaning outside a function, and the emitter reached for the enclosing function before checking there was one.

70. A spawn the machine refused is reported as such instead of as a preprocessing error. The library returned PRISM_ERR_IO with "Preprocessing failed" whether the preprocessor had run and disagreed or the machine had declined to start it at all -- two conditions that need different responses, and only one of which is about C. The message now names the refusal and its errno. The retry budget behind it also grows from five attempts over 0.2s to nine over ~2.8s: a Mac with 14.9 GB paged out refused straight through the old window, and waiting longer costs nothing on a machine where the first attempt succeeds.