Add CI coverage for edlcodegen out-param codegen - #208
Merged
Branden Bonaby (bbonaby) merged 3 commits intoAug 3, 2026
Conversation
This commit fixes a code-generation bug that made every Rust enclave ecall (or
host callback) with an out-only, non-array struct or wstring parameter fault,
hardens the symmetric result-extraction path against malformed input, and adds
regression coverage for both.
Details:
- Inbound dispatch: the enclave/host closure borrowed a struct/wstring [out]
param from an ABI Option<T> that is None on entry (the caller never sends an
out value) via .as_mut().expect(...). That panicked; in a no_std enclave the
panic handler is loop {}, so the call spun at ~99% CPU. Generate
abi_type.m_x.insert(Default::default()) instead: it inserts a default so the
closure can borrow &mut T, and because it overwrites unconditionally it also
discards any value the other side of the ABI supplied for an out-only param,
so caller-controlled contents never reach the implementation.
- Result extraction: the caller stub copied a returned struct/wstring out param
back with result.m_x.expect(...). When an enclave unpacks a host callback's
result this runs on untrusted, host-controlled data, so a host omitting the
field would re-trigger the same panic/loop inside the enclave. Generate
result.m_x.ok_or(<crate>::AbiError::Hresult(0x80070057u32 as i32))? instead
(0x80070057 is E_INVALIDARG; the u32-to-i32 cast matches the library, as the
value does not fit in i32), so a missing field fails the call as an ABI error
rather than faulting the caller.
- Only non-array, out-only struct and wstring params take these Option<T> ABI
paths; string, arrays, vectors, and in/inout params are unaffected and already
correct. Scalar/optional out-params were also unaffected.
- Extend CurrentCodeGenerationState/CodeGenerationState.edl with [out]
TestStruct1 and [out] wstring params (trusted and untrusted). The prior test
EDL had no out-only non-array struct/wstring param, so these codegen paths
were never captured in the checked-in baselines, which is why the bug shipped.
- Regenerate the CurrentCodeGenerationState baselines so the fixed dispatch and
extraction code is locked in against regression.
Test:
- Rebuilt ToolingExecutable; its post-build GenerateCodeGenCurrentState target
regenerated the C++ and Rust baselines with no errors.
- Confirmed the regenerated Rust dispatch closures emit insert(Default::default())
and the extraction stubs emit
ok_or(<crate>::AbiError::Hresult(0x80070057u32 as i32))? for the new
struct/wstring out-params.
- Type-checked both generated patterns with rustc: insert yields &mut T for the
closure, and ok_or(...)? returns Err on a missing (None) field
(0x80070057u32 as i32 == -2147024809).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 3f90c337-7087-44f5-98d7-c0534d1f49b1
This commit adds regression protection for the Rust out-only struct/wstring code-generation paths fixed in the parent commit: a generator unit test that fails if the fix is reverted, and a CI gate that fails if the checked-in generated baselines drift from the generator. Details: - Add tests/UnitTests/ToolingExecutableTests/CodeGenerationRustOutParamTests.cpp, a unit test that parses TestFiles/OutParamCodeGenTest.edl and asserts the Rust emit functions produce the panic-safe forms: the dispatch closure inserts a default for out-only struct/wstring params (never .as_mut().expect(...) or get_or_insert_with), and the extraction stub surfaces a missing field via ok_or(<crate>::AbiError::Hresult(0x80070057u32 as i32))? (never .expect(...)). An [in, out] struct is included as a contrast case (plain borrow / move). The test runs in the existing cpp_ci EdlCodeGen unit-test job. - Add a cpp_ci step that, after the build regenerates src/ToolingSharedLibrary/CurrentCodeGenerationState, fails if those baselines differ from the freshly-built generator output (x64 only; the generator only runs on x64). This catches a forgotten regeneration or unexpected codegen change in review rather than shipping silently. Test: - Built UnitTests via the solution (Debug and Release x64) and ran the new tests with vstest: all 3 pass (Dispatch_OutStructAndWString_UseInsert_NotExpect, Extract_OutStructAndWString_UseOkOr_NotExpect, Extract_HostDirection_UsesHostCrate). - Verified the baseline drift gate passes on the current tree (no drift). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3f90c337-7087-44f5-98d7-c0534d1f49b1
Gudge (MGudgin)
force-pushed
the
user/gudge/edlcodegen/codegen-ci-coverage
branch
from
July 15, 2026 22:02
f1bf8bd to
9c303bb
Compare
Branden Bonaby (bbonaby)
previously approved these changes
Jul 25, 2026
Gudge (MGudgin)
changed the base branch from
user/gudge/edlcodegen/fix-struct-out-param
to
main
July 31, 2026 23:18
Gudge (MGudgin)
dismissed
Branden Bonaby (bbonaby)’s stale review
July 31, 2026 23:18
The base branch was changed.
Branden Bonaby (bbonaby)
approved these changes
Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #207. That PR fixed the Rust out-only struct/wstring out-param codegen (panic-loop on
None, plus a symmetric result-extraction DoS). This PR adds the regression protection that was called out as missing: an executable test of the generator and a CI gate against baseline drift.Changes
1. Generator unit test (executable, catches a revert)
tests/UnitTests/ToolingExecutableTests/CodeGenerationRustOutParamTests.cppparsesTestFiles/OutParamCodeGenTest.edland asserts the Rust emit functions produce the panic-safe forms:GetClosureFunctionStatement): out-only struct/wstring params emitinsert(Default::default())— never.as_mut().expect(...)orget_or_insert_with.GetMoveFromAbiStructToParamStatements): out-only struct/wstring emitok_or(<crate>::AbiError::Hresult(0x80070057u32 as i32))?— never.expect(...), with the crate-appropriate error path (edlcodegen_enclavevsedlcodegen_host).[in, out]struct is included as a contrast case (plain borrow / plain move), so the test also pins that these paths are not over-applied.Reverting either fix in
CodeGenerationHelpers.hfails this test. It runs in the existingcpp_ciEdlCodeGen unit-test job (no new infra).2. Baseline drift gate
A
cpp_cistep runs after the build (which regeneratesCurrentCodeGenerationState) and fails if the checked-in baselines differ from the freshly-built generator's output — catching a forgotten regeneration or an unexpected codegen change in review. x64 only, since the generator only runs on x64.Testing
UnitTestsvia the solution and ran the new tests withvstest: 3/3 pass (Dispatch_OutStructAndWString_UseInsert_NotExpect,Extract_OutStructAndWString_UseOkOr_NotExpect,Extract_HostDirection_UsesHostCrate).