workshopsoft/ludic
2
0
Fork 0
Code Issues Pull requests Projects Releases 26 Packages Wiki Activity Actions

feat(lang): L7 memory is safe unless it says unsafe

Browse source 
The typed buffers are slices: words/floats/fixeds/doubles/pointers(n) make
zeroed, bounds-checked []int/[]float/... and the type names mean them. buffer(n)
is a []byte, with text_of, Fs.read_bytes/write_bytes and view(xs, start, n).
bytes(), indexing a raw pointer or bytes, free, resize, Memory.*, raw file calls,
data_of and C externs are refused outside unsafe { } / unsafe function, and a
project's own files may write unsafe only with --unsafe; the runtime and packages
are the platform. A slice passed to an extern goes as its data.

What the change found: Sync's atomics on a slice header, words(n) uninitialised,
input's fixed axes in ints, truetype's fixed outlines as ints, skin matrices
typed int, gl_shader's source table made from raw bytes. render3d gets safe
entry points (safe_api.ludic). Rendering is byte-identical; a frame costs the same.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Orkun ÇAKILKAYA 2026-09-24 12:53:27 +03:00
parent 9259808f80
commit b0b0b62bce
70 changed files with 69189 additions and 64569 deletions
Download patch file Download diff file Expand all files Collapse all files

12
tools/ludic-cli/build.ludic
View file

@ -47,17 +47,17 @@ function compile_app(src: pointer, out: pointer, mode: int, save: bool) -> bool
var flags = "--windowed"
if mode == 2 { flags = "--headless" }
if save { flags = flags + " --save-temps" }
return shq(`{ludicc()} {flags}{title_flag()} {src} -o {out}`)
return shq(`{ludicc()} {flags}{title_flag()}{unsafe_flag()} {src} -o {out}`)
}
if mode == 2 {
if not shq(`{ludicc()} --headless{title_flag()} {src} --emit-llvm -o {ll}`) { return false }
if not shq(`{ludicc()} --headless{title_flag()}{unsafe_flag()} {src} --emit-llvm -o {ll}`) { return false }
if not shq(`{cc()} -O2 {ll}{gl_link_flags(ll)}{vk_link_flags(ll)}{http_link_flags(ll)}{udp_link_flags(ll)}{process_link_flags(ll)}{threads_link_flags(ll)}{pbf} -o {out}`) { return false }
if not save { shell(`rm -f {ll}`) }
return true
}
if not shq(`{ludicc()} --windowed{title_flag()} {src} --emit-llvm -o {ll}`) { return false }
if not shq(`{ludicc()} --windowed{title_flag()}{unsafe_flag()} {src} --emit-llvm -o {ll}`) { return false }
# audio.ll (#22) is always linked here — unused snd_* are dead-stripped; the
# canonical `ludicc -o` path links it only when Audio.* is used.
let cocoa = `{home}runtime/native/cocoa.ll`
@ -70,6 +70,12 @@ function compile_app(src: pointer, out: pointer, mode: int, save: bool) -> bool
# ` --title "<app name>"` when the project's package.ludic names the app, so the window
# opens under that name rather than the `program` name; "" otherwise, and for a name the
# shell line could not carry safely.
# ` --unsafe` when the build said so: the project's own files may write `unsafe` (L7)
var g_unsafe_build: bool = false
function unsafe_flag() -> pointer {
if g_unsafe_build { return " --unsafe" }
return ""
}
function title_flag() -> pointer {
let name = manifest_app(read_root_manifest(), "name")
if name == "" { return "" }