infer: three fuzzer crashes from #4044

[aleksisch]

Fixes #4044 — all three crashes, one fixture each, plus the root cause behind the second one.

1. makeClassRtti null deref

struct A;
class B : A;
class C : B;

class B : A is rejected as it should be, and that rejection returns from ast_structureDeclaration before B gets its generated __rtti. class C : B is then accepted and wrote through a findField("__rtti") that answers null.

makeClassRtti and makeClassFinalize now let the parent lookup pick the branch: a parent that never got the field means the class declares its own. makeClassFinalize had the identical defect one call later and would have been the next crash.

→ error[30134]: class can only derive from a class, one error, no crash.

2. Null ExprOp2::func in buildAccessFlags

The reported crash is a missing guard, but it was hiding a real inference bug.

Root cause. Four safe_* typeinfo traits returned a replacement node without reportAstChanged() — safe_has_field, struct_safe_has_annotation, and both arms of struct_safe_has_annotation_argument. Every sibling branch signals; these four did not. The replacement arrives untyped, the enclosing operator takes its failed to infer early-out, and with no signal that pass is the last one — so ExprOp2::func stays null with no diagnostic.

It broke valid programs, not just fuzzer input:

var b = true
b &&= typeinfo safe_has_field<X>(typeinfo is_ref(1))    // did not compile

Guard. preVisit(ExprOp1*) / preVisit(ExprOp2*) in the access-flag pass now check func the way ExprOp3 and ExprCall already did. buildAccessFlags runs before the side-effect pass that owns the 50613 diagnostic, so without the guard any unsignalled rewrite crashes before it can be reported.

→ the fuzzer input now gives error[30341]: no matching functions or generics: _::&&=(int const, bool const).

A fifth site, is_iterable, looked like the same defect but already signals three lines above its return — left alone.

3. Self-referential fixed-array dimension (OOM, 26.8 GB)

let zz : int[zz][zz]

The dimension expression lives inside the type it dimensions, so giving the dimension's ExprVar the variable's own type gives it a type containing that same expression. With two dimensions each infer pass squares the previous pass's copy — 4^50.

InferTypes::visit(ExprVar*) no longer adopts a global's type while its dimensions are unresolved (isExprType()).

This also covers two shapes the report does not name, both of which OOM'd on master and which the globalVar self-reference guard suggested in the issue would not have caught:

let aa : int[bb][bb]                  // mutual
let bb : int[aa][aa]

let aa : int[length(bb)][length(bb)]  // through a call
let bb : int[length(aa)][length(aa)]

→ error[30109]: array dimension must be constant, twice, in 0.4s.

Tests

fixture	pins
failed_class_parent_rejected.das	1, expect 30134
failed_op2_int_lhs_typeinfo_rhs.das	2, the issue's exact input, expect 30341
failed_global_dim_self_reference.das	3, expect 30109:2
typeinfo_safe_has_field_reinfer.das + 3 siblings	one typeinfo branch each
failed_macro_added_op2_must_infer.das	op1/op2 with a null func reach the 50613 diagnostic

One shape per file is load-bearing for the four typeinfo fixtures: the trait has to fold in a pass where nothing else changes, and a second shape in the same file signals for the first. My first attempt was a six-arm dastest file and it passed without the fix — a tautology. Negative control: rebuilt with the four reportAstChanged() calls reverted, all four files fail.

Two things that are coverage rather than controls, stated plainly:

• the ast_unused guard is not reachable by a test once the root cause is fixed — it is consistency with ExprOp3/ExprCall, as the issue asked for
• failed_macro_added_op2_must_infer.das does not fail without the guard (buildAccessFlags runs before patchAnnotations); it covers two previously untested reportNullFunc sites

Verification

• tests/language: 1759/1759
• full --test tests: 14530 tests, 14514 passed, 0 failed, 0 errors, 16 skipped
• formatter --verify clean over tests/language (410 files); lint clean on the new files; src/ast/REVIEW.das gate OK
• test_aot_subset builds with the new fixtures; the failed_* files are excluded by the existing filter at tests/aot/CMakeLists.txt:334, so no CMake change

🤖 Generated with Claude Code

[borisbat]

mainly why is type-trait an ast-change?

[borisbat]

how so? why is this an AST change??

[borisbat]

same

[borisbat]

same again. why is this an ast change?