RQ-61-DANGLE (#1102): a retained function relocating against a DECLINED function refuses loudly on every backend

[avrabe]

RQ-61-DANGLE (#1102) — an unlinkable object shipped with exit 0

A retained function calling a function this compile declined shipped an object with exit 0 that could never link — the undefined symbol names a function the module itself defines, so no linker input can resolve it. #952 keys on declined requested exports; #1013 lives only in the aarch64 ELF builder. An internal decline referenced by a retained export slipped past both.

The fix: one backend-agnostic driver gate

In compile_all_exports, after the #952 export gate and before any ELF builder runs: a retained function's relocation whose symbol is a skipped function's index label (func_{idx} on ARM/A32/aarch64, synth_func_{idx} on RV32 — direct calls are always index-labelled) bails with a #1102 error naming every dangling caller→callee edge. No object is written.

Why the driver, not the ELF builders: the two facts already meet there — the driver owns skipped_funcs (now carrying wasm indices) and compiled_funcs[].relocations for all four backends, whose ELF paths are three separate crates (rv32 in main.rs, ARM in synth-backend, aarch64 in its own crate; only aarch64's had a symbol-placement view). One gate, one message, all backends; aarch64's builder Err (#851) stays as defense-in-depth for un-placed symbols that are not skip-related.

--allow-skipped-exports does NOT waive it (pinned by a test): that flag accepts a partial object (a requested export absent — the corpus-sweep shape), which is categorically different from an unlinkable one. aarch64's #1013 refusal was already unconditional; this is the same policy applied where it was missing. No stub, no trap body, no dropped call — both would turn an unlinkable object into a wrong one.

ARM characterised — same defect, and the probe that settled it

arm-none-eabi-readelf -sW -r on the unfixed binary, module every backend declines (#1093 block-type):

leg	before	after
rv32 --relocatable	exit 0, synth_func_0 GLOBAL UNDEF, ld.lld refuses	exit 1, #1102
ARM Thumb-2 --relocatable	exit 0, func_0 GLOBAL UNDEF + retained R_ARM_THM_CALL	exit 1, #1102
ARM Thumb-2 default	exit 0, silently flips to ET_REL with the same dangle	exit 1, #1102
A32 cortex-r5	exit 0, same shape as Thumb-2	exit 1, #1102
aarch64	exit 1 (#1013 builder guard)	exit 1 (driver #1102, builder guard retained)

The "ARM relocatable objects have no .symtab" report was a probe artifact: the ARM builder emits its symtab section with an empty name string, so a probe by section NAME misses what a probe by section TYPE (readelf -sW) finds. ARM was not fine; it was the same defect.

Red-first, both directions

Loud: baseline exits 0 on the minimal module, gale's multi-export shape (both callers named in the refusal), and the ARM/A32 f64-helper shape; fixed binary exits 1 on all, leaves no partial object. New dangling_declined_callee_1102.rs: 8 tests — four backend legs, flag-no-waiver, two negative controls.

Silent (the one that matters more): 835 (fixture,leg) pairs — scripts/repro/*.wat + in-tree .wasm × 5 legs — baseline vs fixed binary:

identical bytes:        666
fail identically:       166
DIFFERING BYTES:          0
newly-declined (#1102):   3   (all rv32)

Each of the 3 newly-declined pairs (aarch64_f32_unsupported_554, popcnt_r11_clobber_1021, recursive_shadow_stack — rv32 leg only) was proven unlinkable before the change: the baseline object carries an UNDEF synth_func_N for a module-defined function. No CI job compiles any of the three on rv32 (the popcnt differential is Thumb-2-only, the shadow-stack fixture is consumed by scry analysis, the f32 fixture by an aarch64 test).

Deliberate test fallout

• a64_dangling_reloc_decline_1013.rs: the refusal now fires at the driver, so the message assertion moved to #1102; the exit-1/no-panic/no-object contract is unchanged, and the header documents that seeing #851 again means the driver gate was removed — a real signal.
• skipped_export_exit_952.rs: its "helper-only skips stay exit 0" negative control was, measured, this defect — the fixture's retained f carried a dangling func_1 GLOBAL UNDEF. Restated: a decline that leaves no dangling reference (full cascade + --allow-skipped-exports) stays exit 0 with the object emitted; the old fixture is now a RED case in the new test file.

Honest residual

The gate matches direct-call index labels only. A declined function referenced solely from a funcref table entry (call_indirect elem segment) is outside this gate and keeps its pre-existing behaviour — same class, different reference kind, left for its own increment rather than widened here without a repro.

Gates

cargo fmt --check / clippy --workspace --all-targets -D warnings / cargo test --workspace (156 suites green, incl. the three touched test files) / claim_check 52/52 / status_evidence 0 failures. BRANCH_POPULATION untouched (main.rs is not on the MC/DC scored surface). Local rivet validate (0.32.0, newer than the CI pin): 40 errors with and without this change — pre-existing version drift, none mine. Status record RQ-61-DANGLE → implemented with verified-by, riding on this branch (R4 first-parent rule).

Refs #1102.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!