v3: address PR review batch 14 — reject escaping method values, generic fn-type params, non-decimal const lengths

The checker now rejects a method value that escapes its evaluation site — returned from a
factory (`fn bind(c) fn () int { return c.report }`), stored in a struct field, or put in a
map — not just stored in an array (batch 11). The per-site static `_mvctx_N` receiver cannot
keep several escaped callbacks distinct, so they would all invoke the last receiver (a real
fix needs closure capture, which v3 lacks). Immediate callback arguments and local bindings
still work; self-host and doka are unaffected.

subst_generic_text (checker, generic-receiver call signatures) and
substitute_generic_type_text_with_params (transform, specialized method bodies) now recurse
into `fn (...) ...` parameter types, so `fn (b Box[T]) apply(cb fn (T) int)` on `Box[string]`
expects and emits `fn (string) int` instead of the placeholder `fn (T) int` (which cgen would
otherwise render as `fn (int) int`).

Const fixed-array length folding now parses non-decimal V integer literals (hex `0x`, octal
`0o`, binary `0b`, with `_` separators) via a new v_int_literal_value, so `[0xF & 6]int` and
`const n = 0b1100 >> 1` fold to a numeric literal for both the length guard and the emitted C
dimension instead of returning none.

Author: medvednikov

vlib/v3/tests/type_checker_errors_test.v

@@ -610,11 +610,11 @@ fn test_pr_review_codegen_batch_eleven() {
 	// reaching cgen and emitting an undefined helper. Append form:
 	run_bad(v3_bin, 'bad_method_value_array_append',
 		'struct Counter {\n\tid int\n}\nfn (c Counter) report() int {\n\treturn c.id\n}\nfn main() {\n\tmut cbs := []fn () int{}\n\tfor i in 0 .. 3 {\n\t\tc := Counter{\n\t\t\tid: i * 10\n\t\t}\n\t\tcbs << c.report\n\t}\n\tprintln(int_str(cbs.len))\n}\n',
-		'cannot be stored in an array')
+		'cannot escape its call site')
 	// Array-literal form is rejected too.
 	run_bad(v3_bin, 'bad_method_value_array_literal',
 		'struct Counter {\n\tid int\n}\nfn (c Counter) report() int {\n\treturn c.id\n}\nfn main() {\n\ta := Counter{\n\t\tid: 1\n\t}\n\tb := Counter{\n\t\tid: 2\n\t}\n\tcbs := [a.report, b.report]\n\tprintln(int_str(cbs.len))\n}\n',
-		'cannot be stored in an array')
+		'cannot escape its call site')
 	// The supported single-use forms still work: a method value passed directly as a
 	// callback argument, and an `arr << int` append / `int << int` shift are not flagged.
 	imm := run_good(v3_bin, 'good_method_value_immediate_after_guard',
@@ -661,3 +661,33 @@ fn test_pr_review_codegen_batch_thirteen() {
 		'fn take(a [8 >>> 1]int) int {\n\treturn a[0]\n}\nfn main() {\n\t_ := take([1, 2]!)\n}\n',
 		'cannot use')
 }
+
+// Regression tests for the fourteenth PR-review batch (vlang/v#27557).
+fn test_pr_review_codegen_batch_fourteen() {
+	v3_bin := build_v3()
+	// Non-decimal integer literals (hex `0x`, octal `0o`, binary `0b`) fold in const
+	// fixed-array lengths: `0xF & 6` = 6, `0b1100 >> 1` = 6, `0o17 & 8` = 8.
+	nondec := run_good(v3_bin, 'good_non_decimal_const_fixed_array_len',
+		'const flags = 0b1010 | 0b0100\nfn main() {\n\ta := [0xF & 6]int{}\n\tb := [0b1100 >> 1]int{}\n\tc := [0o17 & 8]int{}\n\td := [flags]int{}\n\tprintln(int_str(a.len + b.len + c.len + d.len))\n}\n')
+	// 6 + 6 + 8 + 14 = 34
+	assert nondec == '34'
+	// The length guard evaluates non-decimal too: `[1, 2]` does not match `[0xF & 6]int`.
+	run_bad(v3_bin, 'bad_non_decimal_fixed_array_literal_len',
+		'fn take(a [0xF & 6]int) int {\n\treturn a[0]\n}\nfn main() {\n\t_ := take([1, 2]!)\n}\n',
+		'cannot use')
+	// A generic-receiver method with a function-type parameter substitutes the type params
+	// inside the signature, so `Box[string].apply` expects `fn (string) int`, and a matching
+	// callback is accepted and emitted with the right fn-pointer type.
+	apply := run_good(v3_bin, 'good_generic_method_fn_type_param',
+		"struct Box[T] {\n\tv T\n}\nfn (b Box[T]) apply(cb fn (T) int) int {\n\treturn cb(b.v)\n}\nfn slen(s string) int {\n\treturn s.len\n}\nfn main() {\n\tb := Box[string]{\n\t\tv: 'hello'\n\t}\n\tprintln(int_str(b.apply(slen)))\n}\n")
+	assert apply == '5'
+	// A method value that escapes its call site is rejected: returned from a factory, stored
+	// in a struct field, or put in a map (the per-site static receiver can't keep several
+	// instances distinct). Immediately-passed callbacks and local bindings still work.
+	run_bad(v3_bin, 'bad_method_value_return_escape',
+		'struct Counter {\n\tid int\n}\nfn (c Counter) report() int {\n\treturn c.id\n}\nfn bind(c Counter) fn () int {\n\treturn c.report\n}\nfn main() {\n\t_ := bind(Counter{\n\t\tid: 1\n\t})\n}\n',
+		'cannot escape its call site')
+	run_bad(v3_bin, 'bad_method_value_struct_field_escape',
+		'struct Counter {\n\tid int\n}\nfn (c Counter) report() int {\n\treturn c.id\n}\nstruct Engine {\n\tcb fn () int\n}\nfn main() {\n\t_ := Engine{\n\t\tcb: Counter{\n\t\t\tid: 1\n\t\t}.report\n\t}\n}\n',
+		'cannot escape its call site')
+}

vlib/v3/transform/monomorphize.v

@@ -1812,6 +1812,14 @@ fn substitute_generic_type_text_with_params(typ string, args []string, params []
 				substitute_generic_type_text_with_params(clean[bracket_end + 1..], args, params)
 		}
 	}
+	if clean.starts_with('fn(') || clean.starts_with('fn (') {
+		// Substitute the generic params inside a function-type parameter so a specialized
+		// method body emits e.g. `fn (string) int`, not the placeholder `fn (T) int` (which
+		// cgen would otherwise render as `fn (int) int`).
+		if sub := subst_generic_fn_type_text(clean, args, params) {
+			return sub
+		}
+	}
 	base, nested_args, ok := generic_app_parts(clean)
 	if ok {
 		mut resolved_args := []string{}
@@ -1823,6 +1831,54 @@ fn substitute_generic_type_text_with_params(typ string, args []string, params []
 	return clean
 }
 
+// subst_generic_fn_type_text substitutes generic params inside a `fn (...) ...` type text,
+// recursing into each parameter type and the return type. Returns none when the signature
+// is malformed (unbalanced parens).
+fn subst_generic_fn_type_text(clean string, args []string, params []string) ?string {
+	params_start := clean.index_u8(`(`) + 1
+	mut depth := 1
+	mut params_end := params_start
+	for params_end < clean.len {
+		if clean[params_end] == `(` {
+			depth++
+		} else if clean[params_end] == `)` {
+			depth--
+			if depth == 0 {
+				break
+			}
+		}
+		params_end++
+	}
+	if params_end >= clean.len {
+		return none
+	}
+	params_str := clean[params_start..params_end]
+	mut fn_parts := []string{}
+	if params_str.trim_space().len > 0 {
+		mut pdepth := 0
+		mut start := 0
+		for i := 0; i < params_str.len; i++ {
+			c := params_str[i]
+			if c == `(` || c == `[` {
+				pdepth++
+			} else if c == `)` || c == `]` {
+				pdepth--
+			} else if c == `,` && pdepth == 0 {
+				fn_parts << substitute_generic_type_text_with_params(params_str[start..i], args,
+					params)
+				start = i + 1
+			}
+		}
+		fn_parts << substitute_generic_type_text_with_params(params_str[start..], args, params)
+	}
+	ret_str := clean[params_end + 1..].trim_space()
+	if ret_str.len > 0 {
+		return 'fn(${fn_parts.join(', ')}) ${substitute_generic_type_text_with_params(ret_str,
+			args, params)}'
+	}
+	return 'fn(${fn_parts.join(', ')})'
+}
+
 // subst_type substitutes generic placeholders in a type-text using the currently
 // active generic parameter names (so non-canonical params resolve by name). Falls
 // back to positional substitution when no params are active.

vlib/v3/types/checker.v

@@ -1670,6 +1670,56 @@ fn is_decimal_int_literal(s string) bool {
 	return true
 }
 
+// v_int_literal_value parses a complete V integer literal — decimal, hex (`0x`), octal
+// (`0o`), or binary (`0b`), with optional `_` digit separators — to its value. Returns
+// none when `s` is not a whole integer literal (a const name, an expression, etc.), so
+// const-length folding accepts `0xF & 6` / `[0b1100 >> 1]int`, not just decimal text.
+fn v_int_literal_value(s string) ?int {
+	if s.len == 0 {
+		return none
+	}
+	t := s.replace('_', '')
+	if t.len == 0 {
+		return none
+	}
+	mut base := 10
+	mut digits := t
+	if t.len >= 2 && t[0] == `0` {
+		c := t[1]
+		if c == `x` || c == `X` {
+			base = 16
+			digits = t[2..]
+		} else if c == `o` || c == `O` {
+			base = 8
+			digits = t[2..]
+		} else if c == `b` || c == `B` {
+			base = 2
+			digits = t[2..]
+		}
+	}
+	if digits.len == 0 {
+		return none
+	}
+	mut value := 0
+	for ch in digits {
+		mut d := 0
+		if ch >= `0` && ch <= `9` {
+			d = int(ch - `0`)
+		} else if ch >= `a` && ch <= `f` {
+			d = int(ch - `a`) + 10
+		} else if ch >= `A` && ch <= `F` {
+			d = int(ch - `A`) + 10
+		} else {
+			return none
+		}
+		if d >= base {
+			return none
+		}
+		value = value * base + d
+	}
+	return value
+}
+
 // is_bare_generic_param reports whether is bare generic param applies in types.
 fn is_bare_generic_param(typ string) bool {
 	return typ.len == 1 && typ[0] >= `A` && typ[0] <= `Z`
@@ -2080,12 +2130,17 @@ fn (mut tc TypeChecker) check_node(id flat.NodeId) {
 		tc.check_select_stmt(node)
 		return
 	}
-	// A method value stored in an array escapes the single-use guarantee of its per-site
-	// static receiver, so reject `[obj.method]` literals and `arr << obj.method` appends.
+	// A method value stored in a container escapes the single-use guarantee of its per-site
+	// static receiver, so reject `[obj.method]` / `arr << obj.method` / `{'k': obj.method}`.
 	if node.kind == .array_literal {
 		for i in 0 .. node.children_count {
 			tc.reject_stored_method_value(tc.a.child(&node, i))
 		}
+	} else if node.kind == .map_init {
+		// children alternate key, value, key, value, ...; check the value positions.
+		for j := 1; j < node.children_count; j += 2 {
+			tc.reject_stored_method_value(tc.a.child(&node, j))
+		}
 	} else if node.kind == .infix && node.op == .left_shift && node.children_count >= 2 {
 		if unwrap_pointer(tc.resolve_type(tc.a.child(&node, 0))) is Array {
 			tc.reject_stored_method_value(tc.a.child(&node, 1))
@@ -2516,6 +2571,12 @@ fn (mut tc TypeChecker) resolve_lvalue_type(lhs_id flat.NodeId) Type {
 
 // check_return validates check return state for types.
 fn (mut tc TypeChecker) check_return(id flat.NodeId, node flat.Node) {
+	// A returned method value escapes the function, where its per-site static receiver
+	// can't keep multiple returned callbacks distinct (a factory `fn bind(c) fn () int {
+	// return c.report }`); reject it rather than emitting invalid C.
+	for i in 0 .. node.children_count {
+		tc.reject_stored_method_value(tc.a.child(&node, i))
+	}
 	expected := tc.cur_fn_ret_type
 	if expected is Void {
 		if node.children_count > 0 && tc.should_diagnose(id) {
@@ -4465,6 +4526,9 @@ fn (mut tc TypeChecker) check_struct_init(id flat.NodeId, node flat.Node) {
 				continue
 			}
 			value_id := tc.a.child(&field, 0)
+			// A method value stored in a struct field escapes the evaluation site (several
+			// instances from the same `Foo{cb: obj.method}` site would share one receiver).
+			tc.reject_stored_method_value(value_id)
 			mut expected := Type(void_)
 			if field.value.len > 0 {
 				mut found := false
@@ -4527,14 +4591,17 @@ fn (tc &TypeChecker) expr_is_method_value(id flat.NodeId) bool {
 	return false
 }
 
-// reject_stored_method_value reports a clear error when a method value is stored into an
-// array, where the per-site static receiver slot cannot keep multiple instances distinct
-// (e.g. `cbs << obj.method` in a loop would make every callback use the last receiver).
-// Without this the value reaches cgen and emits C referencing an unsupported helper.
+// reject_stored_method_value reports a clear error when a method value escapes its
+// evaluation site — stored in an array/map/struct field or returned. The per-site static
+// receiver slot cannot keep several live instances distinct, so a factory like
+// `fn bind(c Counter) fn () int { return c.report }` (or storage in a loop) would make
+// every escaped callback use the last receiver; without this the value also reaches cgen
+// and emits C referencing an unsupported helper. Pass method values directly as a
+// callback argument instead (a real closure capture is not yet supported).
 fn (mut tc TypeChecker) reject_stored_method_value(id flat.NodeId) {
 	if tc.expr_is_method_value(id) && tc.should_diagnose(id) {
 		tc.record_error(.assignment_mismatch,
-			'a method value (`obj.method`) cannot be stored in an array (no closure capture); pass it directly as a callback argument',
+			'a method value (`obj.method`) cannot escape its call site (no closure capture); pass it directly as a callback argument',
 			id)
 	}
 }
@@ -5354,8 +5421,8 @@ pub fn (tc &TypeChecker) const_int_value(name string, seen []string) ?int {
 			return tc.const_int_expr(expr_id, next_seen)
 		}
 	}
-	if is_decimal_int_literal(name) {
-		return name.int()
+	if v := v_int_literal_value(name) {
+		return v
 	}
 	// Simple const arithmetic in string form, e.g. a fixed-array size `[SEGS + 1]`,
 	// `[SEGS+1]`, `[segs / 2]`, `[segs % 4]` or `[2 * (segs + 1)]`. A length wrapped
@@ -5453,8 +5520,8 @@ fn (tc &TypeChecker) const_int_expr(id flat.NodeId, seen []string) ?int {
 	node := tc.a.nodes[int(id)]
 	match node.kind {
 		.int_literal {
-			if is_decimal_int_literal(node.value) {
-				return node.value.int()
+			if v := v_int_literal_value(node.value) {
+				return v
 			}
 		}
 		.ident {
@@ -7597,6 +7664,39 @@ fn subst_generic_text(typ string, args []string, params []string) string {
 				1..], args, params)
 		}
 	}
+	if clean.starts_with('fn(') || clean.starts_with('fn (') {
+		// A function-type parameter (`fn (T) int`) carries the generic params in its own
+		// signature; substitute each parameter and the return type so a `Box[string].apply`
+		// callback is expected as `fn (string) int`, not the unsubstituted `fn (T) int`.
+		params_start := clean.index_u8(`(`) + 1
+		mut depth := 1
+		mut params_end := params_start
+		for params_end < clean.len {
+			if clean[params_end] == `(` {
+				depth++
+			} else if clean[params_end] == `)` {
+				depth--
+				if depth == 0 {
+					break
+				}
+			}
+			params_end++
+		}
+		if params_end < clean.len {
+			mut fn_parts := []string{}
+			params_str := clean[params_start..params_end]
+			if params_str.trim_space().len > 0 {
+				for part in split_params(params_str) {
+					fn_parts << subst_generic_text(normalize_fn_type_param_text(part), args, params)
+				}
+			}
+			ret_str := clean[params_end + 1..].trim_space()
+			if ret_str.len > 0 {
+				return 'fn(${fn_parts.join(', ')}) ${subst_generic_text(ret_str, args, params)}'
+			}
+			return 'fn(${fn_parts.join(', ')})'
+		}
+	}
 	bracket := clean.index_u8(`[`)
 	if bracket > 0 {
 		bracket_end := find_matching_bracket(clean, bracket)