feat(lang): L7 memory is safe unless it says unsafe

The typed buffers are slices: words/floats/fixeds/doubles/pointers(n) make
zeroed, bounds-checked []int/[]float/... and the type names mean them. buffer(n)
is a []byte, with text_of, Fs.read_bytes/write_bytes and view(xs, start, n).
bytes(), indexing a raw pointer or bytes, free, resize, Memory.*, raw file calls,
data_of and C externs are refused outside unsafe { } / unsafe function, and a
project's own files may write unsafe only with --unsafe; the runtime and packages
are the platform. A slice passed to an extern goes as its data.

What the change found: Sync's atomics on a slice header, words(n) uninitialised,
input's fixed axes in ints, truetype's fixed outlines as ints, skin matrices
typed int, gl_shader's source table made from raw bytes. render3d gets safe
entry points (safe_api.ludic). Rendering is byte-identical; a frame costs the same.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Orkun ÇAKILKAYA 2026-09-24 12:53:27 +03:00
parent 9259808f80
commit b0b0b62bce
70 changed files with 69189 additions and 64569 deletions

View file

@ -58,9 +58,17 @@ function q_rotate(o: floats, q: floats, v: floats) -> void {
}
# pitch about X, yaw about Y, roll about Z, composed as yaw * pitch * roll
var q_scratch: floats = null
var q_sy: floats = null # views of q_scratch's second, third and fourth
var q_sz: floats = null
var q_st: floats = null
function q_euler(o: floats, pitch: float, yaw: float, roll: float) -> void {
if q_scratch == null { q_scratch = floats(16) }
let qx = q_scratch; let qy = mem_off(q_scratch, 16); let qz = mem_off(q_scratch, 32); let t = mem_off(q_scratch, 48)
if q_scratch == null {
q_scratch = floats(16)
q_sy = view(q_scratch, 4, 4)
q_sz = view(q_scratch, 8, 4)
q_st = view(q_scratch, 12, 4)
}
let qx = q_scratch; let qy = q_sy; let qz = q_sz; let t = q_st
q_axis_angle(qx, 1.0, 0.0, 0.0, pitch)
q_axis_angle(qy, 0.0, 1.0, 0.0, yaw)
q_axis_angle(qz, 0.0, 0.0, 1.0, roll)