diff --git a/crates/ghostty-terminal/src/stream_readonly.rs b/crates/ghostty-terminal/src/stream_readonly.rs index 5b274a9..36bd792 100644 --- a/crates/ghostty-terminal/src/stream_readonly.rs +++ b/crates/ghostty-terminal/src/stream_readonly.rs @@ -1078,6 +1078,31 @@ mod tests { assert!(!screen_row_wrap(&t, 1)); } + #[test] + fn difftest_grapheme_wrap_scrolling_margins_keeps_grapheme() { + // Same Devanagari conjunct at the right margin, but on the bottom row + // so the wrap scrolls the margin region and the grapheme data travels + // with its row. Zig asserts/faults (`moveGrapheme` on a blank cell); + // Rust must neither error nor leave a grapheme flag without data. + let mut t = term(255, 5); + t.vt_stream() + .next_slice("\x1b[?2027h\x1b[?69h\x1b[;9s\x1b[24H\t\u{915}\u{94d}\u{937}".as_bytes()) + .unwrap(); + let text = t.plain_string().unwrap(); + assert!(text.contains('\u{915}')); + } + + #[test] + fn difftest_mode_2027_toggle_with_bom_does_not_panic() { + // Zig asserts `!graphemeBreak` while replaying an existing grapheme + // (aborts in safe builds, ignored in ReleaseFast). It must never panic + // here: this repository's release profile enables debug assertions. + let mut t = term(20, 8); + t.vt_stream() + .next_slice(b"\x1b[?2027la\xef\xbb\xbf\x1b[?2027h\xe4\xb8\xad") + .unwrap(); + } + #[test] fn difftest_grapheme_wrap_with_margins_moves_prev_cell() { // Devanagari conjunct widening the cell at the last column while a diff --git a/crates/ghostty-terminal/src/terminal.rs b/crates/ghostty-terminal/src/terminal.rs index 64597f0..1577b2f 100644 --- a/crates/ghostty-terminal/src/terminal.rs +++ b/crates/ghostty-terminal/src/terminal.rs @@ -820,8 +820,12 @@ impl Terminal { .expect("prev cell"); let cps = page.lookup_grapheme(idx).expect("grapheme data"); for &cp2 in cps { - let b = ghostty_unicode::grapheme_break(cp1, cp2, &mut state); - debug_assert!(!b); + // Zig asserts `!graphemeBreak(cp1, cp2)` here, but that + // is reachable from input (mode 2027 toggled after the + // grapheme was built, e.g. with a BOM), so it must not + // panic. ReleaseFast ignores the result; we do too. This + // only advances `state`. + let _ = ghostty_unicode::grapheme_break(cp1, cp2, &mut state); cp1 = cp2; } } @@ -943,18 +947,31 @@ impl Terminal { let new_idx = page.cell_index(new_x, new_y).expect("new cell"); // Zig moves from `prev.cell`, NOT from `old_pin` // (they differ when margins keep the row from - // scrolling the cell out of `old_pin`). - let old_idx = prev_idx; - page.move_grapheme(old_idx, new_idx)?; - page.cells[old_idx].set_content_tag(ContentTag::Codepoint); - page.cells[new_idx].set_content_tag(ContentTag::CodepointGrapheme); - page.rows[new_y].set_grapheme(true); + // scrolling the cell out of `old_pin`). When + // the wrap DID scroll the margin region, the + // data travelled with its row to `old_pin` and + // `prev.cell` is blank: Zig then asserts + // (page.zig moveGrapheme) or faults in + // ReleaseFast. Move from where the data really + // is, and never flag a cell without data. + let old_idx = if page.cells[prev_idx].has_grapheme() { + prev_idx + } else { + page.cell_index(old_x, old_y).expect("old cell") + }; + if page.cells[old_idx].has_grapheme() { + page.move_grapheme(old_idx, new_idx)?; + page.cells[old_idx].set_content_tag(ContentTag::Codepoint); + page.cells[new_idx] + .set_content_tag(ContentTag::CodepointGrapheme); + page.rows[new_y].set_grapheme(true); + } page.update_row_grapheme_flag(old_y); } else { let cps: Vec = { let page = self.screen().page(old_pin.node); let old_idx = page.cell_index(old_x, old_y).expect("old cell"); - page.lookup_grapheme(old_idx).expect("grapheme").to_vec() + page.lookup_grapheme(old_idx).unwrap_or_default().to_vec() }; for cp in cps { let x = self.screen().cursor.x; diff --git a/docs/rewrite/DEVIANT_FIXES.md b/docs/rewrite/DEVIANT_FIXES.md index 790831c..8c7cb67 100644 --- a/docs/rewrite/DEVIANT_FIXES.md +++ b/docs/rewrite/DEVIANT_FIXES.md @@ -35,7 +35,7 @@ when this file was written. | 7 | Core: selection replacement | `Surface.zig:2310-2322` (`setSelection`) | `select()` untracks the previous selection's pins, then `sel.eql(prev)` compares through those released pins (stale pointers). | The comparison happens before the old selection is replaced. (Rust handles are checked, so the naive port panicked; the e2e tests found it.) | 2f58f02 | `select_all_twice_with_copy_on_select_does_not_panic` (`ghostty-core/tests/e2e_bindings.rs`), `drag_selects_and_copy_on_select_fills_selection_clipboard` (`e2e_mouse.rs`). Dedicated eql-before-replace test: unverified | | 8 | Datastruct: `lru` eviction report | `datastruct/lru.zig:163-166` | `entry.data.key` is overwritten with the new key before `entry.data` is copied out as `evicted`, so the evicted key is wrong. | `GetOrPutResult.evicted` carries the old key and old value. | 5b8c92b | `get_or_put` checks only `evicted.value`; the key is not asserted (`ghostty-datastruct/src/lru.rs`) | | 9 | Terminal: stale cell pointer in grapheme attach | `terminal/Terminal.zig:482` and `:539` | `prev.cell` survives a page reallocation (`increaseCapacity` in `printCell` of the spacer tail), so `appendGrapheme` writes into freed memory and the grapheme (for example U+FE0F) is lost. | Cells are addressed by index; the grapheme is kept. | 4eb03f6 | `difftest_upstream_uaf_grapheme_survives_page_growth` (`ghostty-terminal/src/stream_readonly.rs`); the difftest harness stores such mismatches as `suspect*` | -| 10 | Terminal: asserts and segfaults reachable from input | `Terminal.zig:375` (`assert(!graphemeBreak)` after mode 2027 with U+2028/U+2060/BOM), `terminal/page.zig:1012` (`assert(y < size.rows)`; Devanagari conjuncts at the right edge with margins), `Terminal.zig:834` (`assert(!cell.hyperlink)`; REP with a huge count while a hyperlinked page grows) | Zig aborts or segfaults (roughly 0.1-0.4 % of generated difftest cases). | Rust handles the input without panicking. Zig-aborting cases are excluded from the differential comparison, not treated as divergences. | 4eb03f6 | `difftest_grapheme_wrap_with_margins_moves_prev_cell` and the harness (`tools/difftest`, `ZIG CRASH` handling) | +| 10 | Terminal: asserts and segfaults reachable from input | `Terminal.zig:375` (`assert(!unicode.graphemeBreak(cp1, cp2, &state))` after mode 2027 is toggled with U+2028/U+2060/BOM), `terminal/page.zig:1012` (`assert(y < size.rows)`; Devanagari conjunct at the right margin, including the bottom-row case where the margin wrap scrolls and `moveGrapheme(prev.cell, ...)` runs on a blank cell), `Terminal.zig:834` (`assert(!cell.hyperlink)`; REP with a huge count while a hyperlinked page grows) | Zig aborts (ReleaseSafe) or faults (ReleaseFast) in the margin case; the first and third abort only with assertions on (roughly 0.1-0.4 % of generated difftest cases). | No panic and no error. The grapheme replay ignores the break result like ReleaseFast (the assertion is dropped, because this repository's `release` profile enables debug assertions, so input could crash a release build). The margin case moves the grapheme from the cell that actually holds it (`prev.cell`, else the cell above) and never flags a cell without data. Verified with a Rust-only panic hunt (`difftest_fuzz panics`, debug build, about 60k cases, 0 panics) and the Zig differential run (0 divergences). Zig-aborting cases are excluded from the differential comparison. | 4eb03f6 (REP, first margin case); Z21 (uncommitted): assertion and bottom-row margin case | `difftest_grapheme_wrap_with_margins_moves_prev_cell`, `difftest_grapheme_wrap_scrolling_margins_keeps_grapheme`, `difftest_mode_2027_toggle_with_bom_does_not_panic`, `tools/difftest` (`ZIG CRASH` handling, `panics` mode) | | 11 | VT: tmux control-mode ids | `terminal/tmux/control.zig:199,230,270,308` (`parseInt(usize) catch unreachable`) | An id that overflows `usize` hits `unreachable` (crash/UB). | The line is treated as a failed match. | b2b248e | none | | 12 | VT: SGR separator bitset | `terminal/sgr.zig:228,514` (`params_sep.isSet(idx)` past `MAX_PARAMS`) | Asserts / out-of-range in `StaticBitSet` for long parameter lists. | Bounds-tolerant `sep_is_set`. | b2b248e | `sgr_underline_colon_with_trailing_separator_and_short_slice` (`ghostty-vt/src/sgr.rs`); whether Zig's path is reachable: unverified | | 13 | OS: `NOTIFY_SOCKET` | `os/systemd.zig:100-116` | A leading `@` (abstract socket) is accepted by the check, then copied literally into the address, which cannot work. | A leading `@` becomes an abstract-namespace address. | f8c5ce0 | none (the notify tests use a path socket) | diff --git a/tools/difftest/src/bin/difftest_fuzz.rs b/tools/difftest/src/bin/difftest_fuzz.rs index 40e0e02..1c6910c 100644 --- a/tools/difftest/src/bin/difftest_fuzz.rs +++ b/tools/difftest/src/bin/difftest_fuzz.rs @@ -4,6 +4,7 @@ //! difftest_fuzz run [--seed N] [--cases N] [--jobs N] [--tokens N] //! [--zig PATH] [--work DIR] [--size CxR] [--sb BYTES] //! difftest_fuzz minz|minr # minimise an abort +//! difftest_fuzz panics [--seed N] [--cases N] [--tokens N] # Rust only, no Zig //! difftest_fuzz min # minimise a divergence //! difftest_fuzz check # compare one input //! ``` @@ -168,6 +169,10 @@ fn main() { let work = root.join("target/difftest-work"); std::fs::create_dir_all(&work).expect("mkdir"); let ctx = Arc::new(Ctx { zig, work }); + if a.first().map(String::as_str) == Some("panics") { + panics(&a, &ctx); + return; + } std::panic::set_hook(Box::new(|_| {})); match a.first().map(String::as_str) { Some("check" | "min" | "minz" | "minr") => { @@ -305,3 +310,43 @@ fn run(ctx: &Arc, a: &[String]) { std::process::exit(1); } } + +fn lenient_panics(input: &[u8], c: u16, r: u16, sb: usize) -> bool { + let input = input.to_vec(); + std::panic::catch_unwind(move || ghostty_difftest::drive_lenient(&input, c, r, sb)).is_err() +} + +/// Rust-only panic hunt (run it with a debug build so assertions are on): +/// untrusted terminal input must never panic, even where Zig aborts. +fn panics(a: &[String], ctx: &Ctx) { + let seed: u64 = arg(a, "--seed", 1); + let cases: usize = arg(a, "--cases", 1000); + let tokens: usize = arg(a, "--tokens", 60); + let mut found = 0; + for i in 0..cases { + let mut rng = Rng(seed.wrapping_mul(0x1_0000_0001).wrapping_add(i as u64)); + let (c, r, sb) = config(&mut rng); + let n = 1 + rng.below(tokens); + let input = generate(&mut rng, n); + if lenient_panics(&input, c, r, sb) { + found += 1; + let mut min = input.clone(); + let mut i = 0; + while i < min.len() { + let mut cand = min.clone(); + cand.remove(i); + if lenient_panics(&cand, c, r, sb) { + min = cand; + } else { + i += 1; + } + } + let _ = ctx; + eprintln!("case {i}: {c}x{r} sb={sb} minimised={min:02x?}"); + } + } + println!("seed={seed} cases={cases} rust panics={found}"); + if found > 0 { + std::process::exit(1); + } +} diff --git a/tools/difftest/src/lib.rs b/tools/difftest/src/lib.rs index 2ca9e67..ee54973 100644 --- a/tools/difftest/src/lib.rs +++ b/tools/difftest/src/lib.rs @@ -200,6 +200,16 @@ pub fn dump(input: &[u8], cols: u16, rows: u16, max_scrollback: usize) -> String dump_terminal(&t) } +/// Feed `input` and ignore stream errors (they are reported to the caller as +/// `Err`, not a crash). Used by the Rust-only panic hunt. +pub fn drive_lenient(input: &[u8], cols: u16, rows: u16, max_scrollback: usize) -> String { + let mut opts = Options::new(cols, rows); + opts.max_scrollback = max_scrollback; + let mut t = Terminal::new(opts).expect("terminal"); + let _ = t.vt_stream().next_slice(input); + dump_terminal(&t) +} + /// Canonical dump of an already-driven terminal. pub fn dump_terminal(t: &Terminal) -> String { let mut w = String::new();