slang v0.2.0

slang is a statically typed language built primarily for server-side and network programming, compiling to C. This release adds an HTTP client, compression and encoding, and fixes a runtime memory-safety bug.

Install

From source:

git clone https://github.com/dolphlabs/slang && cd slang
git checkout v0.2.0
sudo make install          # PREFIX=/usr/local, or ~/.local

slangc new hello && cd hello && slangc main.sl --run

Upgrading: run sudo make uninstall from your old checkout first. make install overwrites the binary, but it copies runtime files over the old ones and never deletes stale ones.

From the tarball (macOS x86_64, relocatable, runs in place):

tar -xzf slang-0.2.0-darwin-x86_64.tar.gz
./slang-0.2.0-darwin-x86_64/bin/slangc --version     # slangc 0.2.0

sha256 52994a0d4980de3d6b09ee6cb94e9e684ac955ef4cabc2c4850dbe709408dc24

Requirements

The v0.1.0 notes said building "needs nothing but a C compiler". That is true for the core language, but not for every package:

you import	you need
anything	a C compiler
net with TLS, crypto, httpc over https	OpenSSL headers and pkg-config on your PATH
sql	SQLite (-lsqlite3, ships with macOS)
compress, httpc	zlib (ships with macOS)

On macOS, OpenSSL comes from Homebrew (brew install openssl pkg-config). If an https program fails with 'openssl/err.h' file not found, pkg-config isn't on your PATH. The tarball was verified in an otherwise empty environment with only Homebrew's bin on PATH.

What's new

Packages

encoding	hex, base64, base64url, percent-encoding, query strings
compress	gzip, zlib and raw DEFLATE. Decompression requires an output limit: a 64 MB gzip bomb is refused at 3.9 MB RSS
httpc	HTTP/1.1 client over http and https. Certificates always verified, credentials dropped on cross-origin redirects, every server-controlled buffer bounded

httpc.Client

• Connection pooling. Idle connections are probed before reuse (new net.idle_alive). A dropped request is retried only if it's idempotent, never a POST. The pool key includes the CA bundle.
• Transparent gzip/deflate decoding. Skipped if you set Accept-Encoding yourself.
• Cookie jar, off by default. A server's shared client would otherwise mix users' sessions. RFC 6265 with 6265bis Secure rules.

Language

• pub fn inside impl now parses. Before this, no method could be called from outside its own package, and the compiler's error told you to add the pub it then rejected.
• == and != work between two bools.

The fix worth calling out

Stack relocation left compiler-hoisted stack addresses dangling. When a task's stack grows, it is copied and the old one unmapped. At -O2, clang can keep an address from the old stack in a register across that call. A spawned task doing TLS I/O inside a helper, which is the normal shape of a TLS server, crashed 3/3. Before guard-paged stacks (v0.1.0), the same writes went silently into freed heap memory. After the fix: 5/5 clean, and 3/3 crashes return with it disabled.

Known open

• ~5% SIGBUS under amplified preemption. Still open, and not related to the fix above: that workload never grows a stack.
• No public-suffix list for cookies. Domain=co.uk from a.example.co.uk is accepted.
• A method can't share a name with a function in its package. This is why httpc uses client_get(c, …) rather than c.get(…).
• The stack-relocation regression test is compiler-sensitive, and says so. A clang upgrade could make it pass against a regression.

Only a macOS x86_64 binary is attached, because that is the only platform this release was built and verified on.

Full changes: #115 – #128. Suite: 176 passing.