v3: snapshot internal fallback report source

Author: medvednikov

cmd/v/macos_v3_dispatch.c.v

@@ -12,6 +12,7 @@ module main
 // the way. The `macos_v3_` name is kept for continuity with the original macOS
 // rollout even though the behavior now also covers Linux.
 import os
+import crypto.sha256
 import v.pref
 import v.util
 import v.builder
@@ -44,6 +45,13 @@ const macos_v3_c_error_kind_file = 'kind'
 // the receiver's c_error_string parser stores a nonempty, groupable diagnostic).
 const macos_v3_compiler_error_message_base = 'error: the experimental V3 compiler hit an internal compiler error building this program'
 
+struct MacosV3InputSnapshot {
+	path     string
+	digest   string
+	v_file   string
+	v_source string
+}
+
 fn macos_v3_compiler_error_message(stage string) string {
 	stage_suffix := if stage == '' { '' } else { ' during ${stage}' }
 	return '${macos_v3_compiler_error_message_base}${stage_suffix} (the stable V compiler built it successfully)'
@@ -217,13 +225,14 @@ fn launch_macos_v3_compiler(prefs &pref.Preferences, raw_args []string) ?MacosV3
 	}
 	replace_macos_v3_process_environment(environment)
 	is_verbose := prefs.is_verbose
-	// The input path is captured before V3 runs so the compatibility fallback can
-	// stage it for a bug report if V3 fails with an internal compiler error.
-	input_path := prefs.path
+	// Capture and bound the source before V3 runs. If an editor or build watcher rewrites
+	// the input while V3 is compiling, the fallback will detect the changed digest and
+	// submit metadata only instead of reading/uploading bytes V3 never parsed.
+	input_snapshot := macos_v3_compiler_error_input_snapshot(prefs.path)
 	retry_args := os.args[1..].clone()
-	at_exit(fn [caller_environment, fallback_file, c_error_dir, retry_args, is_verbose, input_path] () {
+	at_exit(fn [caller_environment, fallback_file, c_error_dir, retry_args, is_verbose, input_snapshot] () {
 		retry_macos_v3_with_old_compiler(caller_environment, fallback_file, c_error_dir,
-			retry_args, is_verbose, input_path)
+			retry_args, is_verbose, input_snapshot)
 	}) or {
 		eprintln('cannot register the V3 compatibility fallback: ${err}')
 		exit(1)
@@ -246,7 +255,7 @@ fn replace_macos_v3_process_environment(environment map[string]string) {
 	}
 }
 
-fn retry_macos_v3_with_old_compiler(caller_environment map[string]string, fallback_file string, c_error_dir string, retry_args []string, is_verbose bool, input_path string) {
+fn retry_macos_v3_with_old_compiler(caller_environment map[string]string, fallback_file string, c_error_dir string, retry_args []string, is_verbose bool, input_snapshot MacosV3InputSnapshot) {
 	fallback_payload := os.read_file(fallback_file) or { return }
 	fallback_reason, fallback_stage := macos_v3_fallback_reason_and_stage(fallback_payload)
 	os.rm(fallback_file) or {}
@@ -289,14 +298,13 @@ fn retry_macos_v3_with_old_compiler(caller_environment map[string]string, fallba
 		}
 	} else if fallback_reason == macos_v3_compiler_error_fallback {
 		// V3 hit an internal compiler error (parser/checker/codegen) that V1 may still
-		// handle. Bound the input V source HERE (trusted) and forward it to the retry as
-		// content, so once the retry's build succeeds it prints the fallback notice and
-		// (for a single-file build) files a bug with the source. A directory build (`v .`)
-		// or non-V input yields no source, so the report stays metadata-only but the
-		// fallback is never silent.
-		export_macos_v3_report_content(macos_v3_compiler_error_fallback, 'v3',
-			macos_v3_compiler_error_message(fallback_stage),
-			macos_v3_compiler_error_input_source(input_path), [])
+		// handle. Forward the pre-V3 source snapshot only if the input still has the same
+		// digest; otherwise send metadata only, never bytes that V3 did not parse. Once the
+		// retry succeeds it prints the fallback notice and files the report. A directory
+		// build (`v .`) or non-V input also remains metadata-only, but never silent.
+		v_file, v_source := input_snapshot.current_report_source()
+		export_macos_v3_bounded_report_content(macos_v3_compiler_error_fallback, 'v3',
+			macos_v3_compiler_error_message(fallback_stage), v_file, v_source)
 		os.rmdir_all(c_error_dir) or {}
 		if should_report {
 			eprintln('V3 compilation failed; retrying with `-old-compiler`.')
@@ -343,6 +351,10 @@ fn take_macos_v3_report_content() ?MacosV3CErrorReport {
 // retry through the environment.
 fn export_macos_v3_report_content(kind string, ccompiler string, c_output string, c_file string, v_sources []string) {
 	v_file, v_source := builder.bounded_v3_fallback_source(kind, c_output, c_file, v_sources)
+	export_macos_v3_bounded_report_content(kind, ccompiler, c_output, v_file, v_source)
+}
+
+fn export_macos_v3_bounded_report_content(kind string, ccompiler string, c_output string, v_file string, v_source string) {
 	builder.export_external_v3_report_to_env(builder.ExternalCErrorBugReport{
 		kind:          kind
 		ccompiler:     ccompiler
@@ -354,6 +366,35 @@ fn export_macos_v3_report_content(kind string, ccompiler string, c_output string
 	})
 }
 
+fn macos_v3_compiler_error_input_snapshot(input_path string) MacosV3InputSnapshot {
+	candidate := macos_v3_compiler_error_input_source(input_path)
+	if candidate == '' {
+		return MacosV3InputSnapshot{}
+	}
+	// Preserve the caller's symlink semantics while making the path independent of any
+	// working-directory changes inside V3.
+	v_path := os.abs_path(candidate)
+	source := os.read_file(v_path) or { return MacosV3InputSnapshot{} }
+	v_file, v_source := builder.bounded_v3_internal_fallback_source(v_path, source)
+	return MacosV3InputSnapshot{
+		path:     v_path
+		digest:   sha256.hexhash(source)
+		v_file:   v_file
+		v_source: v_source
+	}
+}
+
+fn (snapshot MacosV3InputSnapshot) current_report_source() (string, string) {
+	if snapshot.path == '' || snapshot.digest == '' {
+		return '', ''
+	}
+	current := os.read_file(snapshot.path) or { return '', '' }
+	if sha256.hexhash(current) != snapshot.digest {
+		return '', ''
+	}
+	return snapshot.v_file, snapshot.v_source
+}
+
 // macos_v3_compiler_error_input_source returns `input_path` when it is a single V source
 // file whose bounded contents can be uploaded, or '' for a directory / non-V input (which
 // keeps the internal-error report metadata-only).

cmd/v/macos_v3_test.v

@@ -1665,21 +1665,26 @@ fn test_macos_v3_compiler_error_content_extraction() {
 		whole := lines.join('\n')
 		os.write_file(source, whole)!
 		compiler_error := macos_v3_compiler_error_message('source parsing')
-		v_file, v_source := builder.bounded_v3_fallback_source(macos_v3_compiler_error_fallback,
-			compiler_error, macos_v3_compiler_error_input_source(source), [])
+		snapshot := macos_v3_compiler_error_input_snapshot(source)
+		v_file, v_source := snapshot.current_report_source()
 		assert v_file == 'prog.v'
 		assert v_source != ''
 		assert compiler_error.contains('during source parsing')
 		// A bounded strict subset — never the whole file.
 		assert v_source.len < whole.len
+		// Rewriting the file after the pre-V3 snapshot suppresses source completely: the
+		// fallback must not upload bytes that V3 never parsed.
+		os.write_file(source, whole + '\nfn changed_after_snapshot() {}')!
+		changed_file, changed_source := snapshot.current_report_source()
+		assert changed_file == ''
+		assert changed_source == ''
 		// A directory build, a non-V file, or a missing input yields no source, so the
 		// report stays metadata-only.
 		note := os.join_path(root, 'note.txt')
 		os.write_file(note, 'not v source')!
 		for empty in [root, note, os.join_path(root, 'missing.v'), ''] {
-			resolved := macos_v3_compiler_error_input_source(empty)
-			ef, es := builder.bounded_v3_fallback_source(macos_v3_compiler_error_fallback,
-				compiler_error, resolved, [])
+			empty_snapshot := macos_v3_compiler_error_input_snapshot(empty)
+			ef, es := empty_snapshot.current_report_source()
 			assert ef == '', empty
 			assert es == '', empty
 		}

doc/docs.md

@@ -117,9 +117,11 @@ source excerpt is included it is always a **bounded strict subset** of the faili
 file — a window around the failure, or a head+tail window — and the whole file is
 never uploaded.
 An internal V3 compiler error on a short program (and any directory build such as
-`v .`) submits metadata only. A generated-C error, however, maps to a specific V
-file, so it can still upload a strict-subset excerpt of that file plus a few lines
-of context around the failing line, even when the file is short. Inline-assembly
+`v .`) submits metadata only. If a single-file input changes while V3 is compiling
+it, the fallback also submits metadata only rather than source V3 did not parse. A
+generated-C error, however, maps to a specific V file, so it can still upload a
+strict-subset excerpt of that file plus a few lines of context around the failing
+line, even when the file is short. Inline-assembly
 fallbacks are notice-only and do not submit a report; reporting is also skipped
 for test compilations and to the default endpoint in GitHub CI. A custom fallback
 endpoint set with `V_C_ERROR_BUG_REPORT_URL` remains active in CI. The

vlib/v/builder/c_error_report.v

@@ -294,23 +294,34 @@ pub fn export_external_v3_report_to_env(report ExternalCErrorBugReport) {
 // bounded_v3_fallback_source extracts the bounded V source snippet to upload for a V3->V1
 // fallback, reading ONLY files the caller already trusts — it must be invoked by the
 // process that staged the report, never by one that merely inherited a report path from
-// the environment. `c_file` is the user's V source for a V3 internal error, or the staged
-// generated C for a generated-C compilation error. `allowed_v_sources` is the set of
-// source files that V3 actually parsed; generated-C mappings outside that set are
-// rejected before their contents are read. The returned snippet is always a bounded
-// strict subset (never a whole file); ('', '') means no source is available (e.g. a
-// directory build), so the report stays metadata-only.
+// the environment. `c_file` is the staged generated C for a generated-C compilation
+// error. Internal compiler errors deliberately return no source here: their input must
+// be snapshotted before V3 starts and passed to bounded_v3_internal_fallback_source, so
+// a later editor/build-watcher rewrite cannot be uploaded as if V3 had parsed it.
+// `allowed_v_sources` is the set of source files that V3 actually parsed; generated-C
+// mappings outside that set are rejected before their contents are read. The returned
+// snippet is always a bounded strict subset (never a whole file); ('', '') means no
+// source is available, so the report stays metadata-only.
 pub fn bounded_v3_fallback_source(kind string, c_output string, c_file string, allowed_v_sources []string) (string, string) {
-	if c_file == '' || !os.is_file(c_file) {
+	if kind == external_v3_compiler_error_kind {
 		return '', ''
 	}
-	if kind == external_v3_compiler_error_kind {
-		src := os.read_file(c_file) or { return '', '' }
-		return os.base(c_file), v3_report_v_source(src)
+	if c_file == '' || !os.is_file(c_file) {
+		return '', ''
 	}
 	return bounded_v_source_for_generated_c(c_output, c_file, allowed_v_sources)
 }
 
+// bounded_v3_internal_fallback_source bounds source CONTENT captured before V3 starts.
+// It never opens `source_name`; the dispatcher separately verifies that the input still
+// has the captured digest before forwarding this snippet to the stable retry.
+pub fn bounded_v3_internal_fallback_source(source_name string, source string) (string, string) {
+	if source_name == '' {
+		return '', ''
+	}
+	return os.base(source_name), v3_report_v_source(source)
+}
+
 // bounded_v_source_for_generated_c maps a generated-C compilation error back to the V
 // source line it came from (via the #line directives in the trusted staged C) and returns
 // a bounded window of that V file. The generated C was staged by this process's own V3
@@ -376,15 +387,17 @@ pub fn take_external_v3_report_from_env() ?ExternalCErrorBugReport {
 	return report
 }
 
-// submit_external_v3_compiler_error_bug_report reports a V3 internal compiler error
-// after the stable compiler has confirmed the program is buildable. `v_file` is the path
-// to the user's input V source, which this reads and bounds into the uploaded snippet;
-// `v3_output` is a short description of the failure. This file-reading form is used only
-// on the trusted in-process build path, where `v_file` is not caller-forgeable.
+// submit_external_v3_compiler_error_bug_report reports metadata for a V3 internal
+// compiler error after the stable compiler has confirmed the program is buildable.
+// Source may only be supplied through the pre-V3 snapshot/content path, so this legacy
+// path form deliberately does not reopen `v_file` after the failure.
 pub fn submit_external_v3_compiler_error_bug_report(prefs &pref.Preferences, v3_stage string, v3_output string, v_file string, tag string) {
-	v_source := if v_file == '' { '' } else { v3_report_v_source(os.read_file(v_file) or { '' }) }
 	mut b := new_builder(prefs)
-	b.submit_v3_compiler_error_bug_report(v3_stage, v3_output, v_file, v_source, tag)
+	b.submit_v3_compiler_error_bug_report(v3_stage, v3_output, if v_file == '' {
+		''
+	} else {
+		os.base(v_file)
+	}, '', tag)
 }
 
 // submit_inline_v3_compiler_error_bug_report reports a V3 internal compiler error whose

vlib/v/builder/c_error_report_test.v

@@ -323,11 +323,15 @@ fn test_external_v3_report_env_round_trip() {
 	}
 	os.write_file(c_file, lines.join('\n'))!
 	// The owning process bounds the source into content...
-	v_file, v_source := bounded_v3_fallback_source(external_v3_compiler_error_kind,
-		'error: v3 failed', c_file, [])
+	v_file, v_source := bounded_v3_internal_fallback_source(c_file, lines.join('\n'))
 	assert v_file == 'main.v'
 	assert v_source != ''
 	assert v_source.contains(c_error_v_source_truncation_notice)
+	// The path-based extractor must never reopen an internal-error input after V3 fails.
+	late_file, late_source := bounded_v3_fallback_source(external_v3_compiler_error_kind,
+		'error: v3 failed', c_file, [])
+	assert late_file == ''
+	assert late_source == ''
 	// ...then forwards only that content; export reads no path and deletes no directory.
 	export_external_v3_report_to_env(ExternalCErrorBugReport{
 		kind:          external_v3_compiler_error_kind

vlib/v/help/build/build-c.txt

@@ -22,8 +22,10 @@ see also `v help build`.
       be fixed: the V version, target and build options, plus a bounded snippet
       of the failing V source when one is available (always a strict subset,
       never the whole file). An internal V3 error on a short program or a
-      directory build such as `v .` submits metadata only, while a generated-C
-      error can still include a strict-subset excerpt. Inline-assembly fallbacks
+      directory build such as `v .` submits metadata only. A single-file input
+      changed while V3 is compiling also submits metadata only, rather than source
+      V3 did not parse. A generated-C error can still include a strict-subset
+      excerpt. Inline-assembly fallbacks
       are notice-only; test compilations and GitHub CI also submit no report to
       the default endpoint. An explicitly configured custom bug report URL remains
       active in CI. See `v help build` for the full description of the default.

vlib/v/help/build/build.txt

@@ -24,8 +24,10 @@ The default compiler:
   https://bugs.vlang.io, plus a bounded snippet of the failing V source when one
   is available. Any snippet is a strict subset and the whole file is never
   uploaded. An internal V3 compiler error on a short program or a directory build
-  such as `v .` submits metadata only, while a generated-C error maps to a V file
-  and can still upload a strict-subset excerpt of it, even for a short file.
+  such as `v .` submits metadata only. A single-file input changed while V3 is
+  compiling also submits metadata only, rather than source V3 did not parse. A
+  generated-C error maps to a V file and can still upload a strict-subset excerpt
+  of it, even for a short file.
   Inline-assembly fallbacks are notice-only; test compilations and GitHub CI also
   submit no report to the default endpoint. A custom fallback URL set with
   V_C_ERROR_BUG_REPORT_URL remains active in CI. The -bug-report-url option