ReleasesPrism changelog and release history

Prism release history. All releases are available on GitHub Releases.

#v1.1.7 current

Prism 1.1.7 hardens transpilation, compiler invocation, output publication, cache correctness, and language-feature parsing.

The procedural regression suite grows by 838 cells to 46,334 platform-inclusive cells, faster test suit.

#fixes

--prism-emit now publishes output atomically.
--prism-emit rejects an input file or hard link as its destination, preserves an old destination on failure, and rejects one explicit destination for multiple sources.
Stdout emission uses the caller's descriptor on POSIX and reports write, flush, and close failures on every output path.
Generated #line filenames now escape quotes, controls, and trigraph-forming question marks.
Raw stripping keeps directives on their own line.
Stray braces now diagnose safely instead of reaching emission in an invalid parser state.
Malformed file-scope orelse now diagnoses safely.
Illegal bracket orelse dimensions now diagnose safely.
Declaration conditions now diagnose safely.
Statement-expression gotos now diagnose safely.
Parser arena shrinking is safe for library callers.
First-context allocation failure is safe for library callers.
Result-error allocation failure is safe for library callers.
Source-directive recovery is safe for library callers.
prism_reset() is safe for library callers after parser errors.
prism_thread_cleanup() is safe for library callers.
prism_free(NULL) is safe for library callers.
File APIs reject directories and non-C inputs before invoking the compiler.
File APIs reject malformed feature-array counts safely.
Oversized preprocessor argv construction is rejected before unsafe allocation.
File APIs reject embedded-NUL input before unsafe processing.
File APIs reject UTF-16-looking .i input before unsafe processing.
Compiler processes receive a fresh environment snapshot for every spawn.
Windows preserves Unicode environment values and rejects malformed UTF-8 conversion instead of silently changing it.
Stdin preprocessing normalizes -x none to C.
Re-emitted API definitions preserve preprocessor order and last-definition-wins behavior.
Quoted custom compiler commands preserve embedded spaces and platform quote rules without shell parsing.
Response files now expand lazily, respect check and -- boundaries, work as option operands, and support nesting and pipes.
Response files support UTF-8 and Windows UTF-16 BOMs and handle malformed reads safely.
MSVC /c, /Fe, /Fo, /FI, /D, /E, /EP, /P, stdin, and slash-option operands are modeled correctly.
GNU -f... flags no longer collide with MSVC dash spellings.
Non-flattened direct system headers retain the original preprocessor stream when re-emission could change macro, pragma, include, or reinclusion ordering.
The preprocessor cache validates payload checksums, full file identity, working directory, Unicode environment inputs, and volatile header macros.
The cache bypasses dependency side effects, marker suppression, response files, specs files, volatile flags, and custom compiler wrappers.
Cache publishing uses unique temporary files, saturated limits, and safe unavailable-admin paths.
Braceless defer now captures an entire control statement, including if/else, loop, switch, and do/while bodies.
Braced defer bodies validate embedded break and continue, preventing an invalid deferred escape from reaching emitted C.
Bounds checking now rejects a conditional base derived from tracked arrays instead of using one branch's extent for another.
Auto-static no longer mistakes shadowable true or false identifiers for constant initializers.
Deferred-capture discovery excludes actual orelse operators.
Deferred-capture discovery excludes raw declaration prefixes and raw blocks.
defer, orelse, and raw now recognize literal backslash-LF and backslash-CRLF splices before soft-keyword matching.
C trigraph translation now runs before splice handling, so a trigraph-derived backslash such as ??/ followed by LF/CRLF also joins a Prism keyword correctly.
Generated #line directives now retain the physical source line after a splice instead of mapping the next token to the preceding line.
A function that returns a function pointer now synthesizes its defer return-type typedef with the returned type's parameter list. int (*f(void))(int) produced typedef int (*T);, so the return temporary was an int *; GCC 16 and Clang 22 reject the resulting initializer and return outright, and older compilers accepted them with incompatible-pointer warnings. Array-pointer returns were already correct; (params) was the one declarator suffix being dropped.
A return value expression with no terminating ; now diagnoses instead of copying the rest of the translation unit into the return temporary's initializer and emitting unbalanced C.
Defer bodies, and the synthetic blocks spliced for return, break, continue, and goto, no longer land on a surviving preprocessor directive's line. A conforming preprocessor discards trailing tokens on a directive line, so with -fno-line-directives a #pragma immediately before a scope exit silently deleted the cleanup, and in the return case the return statement with it. Line directives happened to force the line break, which is why the failure only appeared with them disabled.
Macro-hygiene wrap parentheses around a declaration initializer no longer hide an empty orelse action. int x = (f() orelse); was accepted and lowered to x = x ? x :;, while the unwrapped int x = f() orelse; was already rejected.
An unterminated GNU __label__ declaration no longer duplicates every token from the declaration to end of input. The emitter wrote the tokens before discovering there was no terminator, then reported the statement as unhandled, and the caller emitted them a second time.
--prism-emit=<file> publishes with the destination's previous mode when replacing one, and with 0666 & ~umask when creating one. Atomic publication is via mkstemp, which forces 0600.
Trigraph translation no longer runs twice. cc -E (and a .i input) has already completed translation phases 1 to 3 with the backend's trigraph policy, which is off by default for GCC, Clang and MSVC and removed outright in C23. Re-applying phase 1 to that stream rewrote literals the compiler had deliberately kept: const char *s = "what??!"; compiled to what| under Prism and what??! under the very compiler Prism was driving. Prism now matches cc exactly under -std=c99, -std=gnu99, -std=c11, -std=c2x, -trigraphs and the default. Raw source reaching the library API is unaffected: Prism is the only front end that text sees, so it still owns phases 1 and 2, and the spliced-keyword forms keep working.
An orelse fallback value with no terminating ; now diagnoses instead of copying the rest of the enclosing block into LHS = ( ... ). Same defect and same shape as fix 46, on the bare-assignment path.
A defer directly after a GNU __label__ declaration is no longer rejected as expression context. Phase 1D handed on the __label__ token itself as the previous token, so the following statement looked like a continuation of an expression; valid GNU C plus valid Prism was refused, and only when nothing else stood between the two.
A __label__ declaration as a braceless defer body now diagnoses. It carries no type tag, so the existing braceless-declaration check never saw it, and the body scan emitted a stray }.
A bare orelse whose Phase 1 recipe has no recorded assignment = no longer dereferences a null token. Found by UBSan in the fuzz target.
Extension elimination is enforced at emission instead of assumed. A token Phase 1 classified as the keyword, whose feature is enabled and which is not inside a raw { ... } block, must be consumed by a lowering path; reaching raw emission now diagnoses. Three retired-regression cells were locking in the opposite: defer { int x = 5 } with no ; had the rest of the file swallowed into the deferred body and pasted back, so the output declared task_b twice and contained a live defer; and an attribute between if and its ( left p = get() orelse 0; in the generated C. All three inputs are rejected by a C compiler on their own merits, and all three previously produced output no compiler could use. The check costs one predictable branch on an already-loaded tag word.
Library calls no longer inherit the line-directive spelling from an earlier call. use_linemarkers selects GCC's # N "f" linemarker over C99's #line N "f"; only the CLI ever assigned it, and no library entry point reset it, so once anything in a thread set it every later prism_transpile_source silently emitted the other spelling. Found by sharding the suite: a shard that ran the internal-platform recipe next to the feature matrix lost #line from all 64 of its line-directive cells.
Every posix_spawn site retries the transient failures. Four of the five had no retry at all -- including the preprocessor spawn -- and the one that did covered EAGAIN and ETXTBSY but not ENOMEM, which is what macOS returns when the machine is briefly short of memory.
--prism-emit to a destination that is not a regular file (/dev/null, a character device, a fifo) now streams the finished output instead of failing. rename cannot publish onto such a destination, and the fallback also covers a cross-device EXDEV when the sibling temporary had to fall back to $TMPDIR. The destination is still opened only after translation and verification succeed.

The Windows build links again. Fix 58's retry helper called nanosleep, which has no MSVC import. The call had existed for a long time inside spawn_command, whose every caller is POSIX-only, so the linker discarded the function whole and the symbol never had to resolve; giving the retry four more call sites that are live on Windows turned it into unresolved external symbol nanosleep. The sleep is now Sleep on Win32 and nanosleep elsewhere, and the helper's parameters match windows.c's posix_spawnp shim rather than the POSIX prototype, since a non-const argument converts to POSIX's const one but not the reverse.
windows.c includes <basetsd.h> in lowercase. The MSVC SDK is case-insensitive so both spellings work there, but mingw-w64 ships the lowercase name and a case-sensitive host could not resolve <BaseTsd.h>. This is what had made the _WIN32 source path uncheckable anywhere except Windows CI, which is why fix 60 reached a push.

The suite's two infrastructure counters are declared outside the POSIX guard. infra_retries and slow_clock_skips are read by the summary in main(), which is compiled on every platform, but sat beside the POSIX-only code that increments them; MSVC reported four undeclared identifier errors. Same shape as fix 60 -- code added under one platform's assumptions and never built under the other.
Bounds checking covers int a[static N]. C11 6.7.6.3p7 promises the argument points at at least N elements, and that promise is the only extent an array parameter has -- it decays to a pointer, so the usual sizeof(a)/sizeof(a[0]) would measure the pointer against the element. The bound is the literal N. [static const N] and [const static N] are both recognised; an array parameter without the promise, and a plain pointer parameter, stay unchecked as before.
Bounds checking covers pointer-to-array dereference. int (*p)[4] carries its extent in the type, and *p and p[0] denote the same object, so (*p)[i], p[0][i] and (*(p))[i] all bound against sizeof(p[0])/sizeof(p[0][0]). The pointer hop itself stays unchecked -- nothing says how many arrays p points at -- so p[i] is untouched, and a base built from a pointer-to-array in any other shape is left alone rather than diagnosed.
Header-bearing preprocessor-cache entries are enabled. Recording each header's identity was never the missing piece; knowing whether it is still the file the next preprocess would choose was. An entry now also records the backend's include search path, taken from -E -v with the same flags, and each dependency's spelling as the preprocessor reported it. A file appearing ahead of a header in the search path moves that directory's mtime; a symlink retargeted anywhere along the way changes what the spelling resolves to. Either one is a miss. Failing to determine the search path means the entry is not published, so the fallback is exactly the previous behaviour. PP_CACHE_MAGIC advances to PRISMPPC4; older entries are ignored.

Macro operands of surviving #pragma directives are preserved. No preprocessor expands a pragma's operands, so flattening -- which hands the preprocessed stream through and re-emits no source defines at all -- left #pragma pack(push, PK) in the output with PK defined nowhere. A define named by a surviving pragma is now kept. Where it goes depends on where it was: a define ahead of the first include is hoisted with the rest, and one that follows a header is emitted in place, immediately before the pragma that needs it, because a define written after a header may be completing or shadowing what that header set up and must not be lifted above it. Defines no pragma names are still dropped. Preserving the define makes the question of whether a given backend expands pragma operands moot: it now does whatever it would have done with the original source.
-fno-orelse leaves the word orelse alone. Phase 1D annotated and then diagnosed the declaration-initializer form without consulting the feature bit, so int j = w || orelse; was rejected with the feature off, where the word is an ordinary identifier and an undeclared one is the backend's complaint to make in its own words. It also meant Prism could not reparse its own output whenever an input used the name as a plain identifier -- the reparse oracle runs with every transformation disabled.
An expression walk that reaches } without its ; diagnoses instead of consuming the closing brace. This was the last of the four expression walks still missing the bound that fixes 46 and 52 added to the others; found by the fuzz corpus.
typeof-based zero-init at file scope no longer indexes a negative function slot. Zero-init lowers to a runtime statement -- a byte loop or a memset -- which has no meaning outside a function, and the emitter reached for the enclosing function before checking there was one.
A spawn the machine refused is reported as such instead of as a preprocessing error. The library returned PRISM_ERR_IO with "Preprocessing failed" whether the preprocessor had run and disagreed or the machine had declined to start it at all -- two conditions that need different responses, and only one of which is about C. The message now names the refusal and its errno. The retry budget behind it also grows from five attempts over 0.2s to nine over ~2.8s: a Mac with 14.9 GB paged out refused straight through the old window, and waiting longer costs nothing on a machine where the first attempt succeeds.

#v1.1.6

GitHub ↗

Prism 1.1.6 fixes 41 issues with new procedural test suite with 45,496 test cells, performance is 1.25x faster than 1.1.5 and 1.59x faster than 1.1.4. Warm cached builds are 2.87x faster than 1.1.4.

new test suit measured coverage is 93.35% lines, 75.23% branches, and 99.05% functions.

#fixes

Separate-argument compiler flags are parsed correctly. This includes -isysroot, -imultilib, -aux-info, -dumpbase, -dumpbase-ext, -dumpdir, -wrapper, --param, and supported ld64 flags. SDK paths no longer become extra source files on macOS.
A block-comment line ending in \ no longer causes the next live #define to disappear in non-flatten mode.
Function-like macros now use a valid identifier-only guard. #define SUM(a,b) is guarded by #ifndef SUM, not #ifndef SUM(a,b).
idx[&(a[0])] and equivalent nested forms can no longer bypass commutative-subscript rejection.
Pointer-arithmetic dereferences after braceless if, while, for, and switch statements are rejected instead of passing through unchecked.
Address expressions after braceless control conditions no longer receive a false runtime check on a legal one-past pointer.
}, ++, and -- are recognized as value tokens when distinguishing binary & from address-of, so the following subscript remains checked.
Address-of suppression now spans parentheses. &(a[n]) permits the same legal one-past pointer as &a[n].
The Windows mkstemps shim rejects templates without replacement X characters instead of opening a predictable fixed path.
The first library call targeting MSVC now emits matching MSVC diagnostic pragmas. It no longer starts with a GCC push and ends with an MSVC pop.
--prism-verify now counts dialect keywords with the tokenizer. Raw strings, prefixes, UCNs, digraphs, comments, and macro shadowing can no longer hide a leaked defer or orelse token.
Nested groups in a defer expression now share the 4096-level parser limit. Excessive nesting reports a diagnostic instead of overflowing the stack.
setjmp taint now propagates through same-file call edges, preventing defer in callers that can be bypassed by longjmp.
Casted calls such as (void)wrapper(p) no longer hide transitive setjmp or vfork taint.
Calls to a declared function named defer keep their arguments. defer(1) is no longer mistaken for the language construct.
Calls through a function-pointer value named defer are preserved for local, ANSI parameter, typedef parameter, and K&R parameter forms.
Library-mode defer inside an unresolved preprocessor arm is rejected instead of being moved outside the conditional and made unconditional.
A do-while block containing trailing defer in a GNU statement expression now receives the same required diagnostic as equivalent block forms.
C23 constexpr values are treated as integer constant expressions for array sizing instead of as VLAs.
A parameter shadowing a constexpr binding now restores VLA behavior inside the function.
File-scope symbol discovery now requires a valid function declarator. defer (void)0; can no longer register defer as a function and evade the file-scope diagnostic.
Unevaluated state now survives nested delimiters and comma expressions in sizeof, typeof, and _Generic control expressions. _Generic association expressions remain evaluated.
Qualifiers inside balanced sizeof, alignof, and offsetof operands no longer leak into the result type of an enclosing typeof.
Const typeof objects use a declaration initializer when legal instead of delayed byte writes through a const object.
Direct typeof(variable) lookup preserves atomic qualification. Unsupported const atomic zero initialization now reports a diagnostic.
Direct typeof(variable) lookup preserves const qualification, while typeof_unqual removes it.
Typedefs derived from typeof retain that origin through alias chains, preserving whole-object initialization for types such as x86 long double.
Top-level volatile and _Atomic qualifiers on pointer declarators and pointer typedefs are no longer confused with pointee qualifiers.
ANSI parameters retain exact const, volatile, atomic, pointer, and adjusted-array traits for typeof lookup.
K&R parameter declarations now register const, volatile, atomic, and long-double traits instead of only VLA traits.
Direct, typedef, complex, and volatile x86 long double locals now clear the full object, including x87 padding bytes.
Every link in a chained bare-assignment orelse now receives the variably-modified side-effect check. Middle links can no longer evaluate twice.
A declaration fallback ending in a preprocessor directive now places its generated semicolon after the directive line instead of producing #endif;.
A nonzero PrismFeatures array count with a NULL array pointer is normalized safely instead of dereferencing NULL.
Sparse define, include, flag, and forced-include arrays are checked by every consumer, including non-flatten re-emission.
Negative feature-array counts are normalized before capacity arithmetic, preventing integer overflow.
prism_transpile_file(NULL, ...) returns a deterministic IO error without invoking the compiler.
Removing raw at the start of a line now preserves the newline. Declarations after pragmas no longer merge into the pragma line.
prism install creates missing parent directories such as $HOME/.local/bin instead of failing and retrying with sudo.
Reinstalling through a symlink, relative path, hard link, or path containing /../ recognizes the existing binary by file identity and avoids copying it onto itself.
All ten feature flags accept positive and negative forms. Prism consumes only exact feature names, so unrelated flags such as -fdefer-pop and -fno-strict-aliasing still reach the backend.

#v1.1.5

GitHub ↗

Prism 1.1.5 fixes 200+ bugs since v1.1.4, Prism gets faster ~2.02x end-to-end warm cache; 1.65x on the stress TU with the cache disabled.

New: preprocessed-output cache, prism check <analyzer>, @file response files, stdin input.

Four fixes address bugs that corrupt a build: a uint16 scope-cap that dropped the scope tree past 32,768 scopes with no diagnostic; orelse reaching the C backend intact inside a case label; a braceless defer declaration that copied every following statement into the cleanup; and orelse on a volatile or _Atomic object reading it up to three times.

#Performance

Preprocessed-output cache. cc -E was 39 to 99% of wall time (8.19 of 8.28 ms on a no-include file; 103.8 of 262.8 ms on test.c). Prism now caches the preprocessor's output and skips the spawn when nothing it read changed.

The preprocess phase drops 10 to 25x on a hit, scaling with how much output has to be read back: 6.5 → 0.4 ms for a 57 KB entry, 29.0 → 1.2 ms for 328 KB, 46.2 → 1.8 ms for 1.2 MB. End-to-end that is 2.02x v1.1.4 on a warm cache (70.9 → 35.0 ms, best-of-3 over four suite files).

Transpiler. Gains are workload-dependent, and the cache accounts for most of the end-to-end figure above. With PRISM_NO_PP_CACHE=1, on a 2,500-function defer/orelse/-fbounds-check stress TU it is 1.65x (70.9 → 43.0 ms); across four ordinary suite files 1.07x, ranging 1.20x on test.torture.c down to 0.94x on test.defer.c. Earlier notes reported ~65% on the phase timings of a stress TU; that holds for that shape, not as a general figure.

On Arch/9950X, GCC -O2 -g -DNDEBUG, CPU 8 pinned, 80-run perf stat batches: the 6,091,701-byte procedural TU moves 77.66 → 70.32 ms task-clock (−9.45%), cycles −10.26%, instructions −10.36%. The 1,109,463-byte self-host TU moves 15.94 → 15.05 ms (−5.58%). Outputs byte-identical.

#Bug Fixes

#defer

Scope-cap uint16 truncation: a TU with more than 32,768 scopes lost the rest of the scope tree with no error and mis-lowered file-scope declarations (b007d1e)
A declaration as a braceless body scanned past its own semicolon and pasted every statement up to the block close into the deferred code, so they ran a second time at scope exit. The prior test only checked the output contained int t = 0, so it never saw the duplication (16bba07)
Missing-semicolon detection inspected only the body's first token: defer break; was rejected, defer f() break; was accepted and emitted as f() break; with the keyword stripped, so the backend error pointed at code the user never wrote (unreleased)
Labeled break/continue unwound the wrong scope, including GNU __label__ (f6bff02)
Mid-expression defer after a comma or in return (x=1, defer g();, return defer g(), 0;) leaked the keyword in release builds; reject_defer_in_expr_context was PRISM_DEBUG-only (78f9c8a)
Expression-context splices through sizeof, !, ~, &, casts and ?: (86c20fc)
Scope/block depth confusion over-unwound defers across goto boundaries (c0a4935)
Braceless bodies under name shadows mis-parsed; defer;, for-init and ++ forms had to stay identifiers (06bb332)
Braceless control flow in defer/orelse bodies broke brace injection (fc098bb)
{ defer } brace-init false reject (86c20fc)
typeof(defer) (fc3716d)
defer _Pragma (c0a4935)
File-scope defer was not rejected (5732201)
in_defer_emit thread-local was not reset after a pparse_error longjmp skipped the restore (a661b6b)
Attribute labels in a defer chain (a661b6b)
Unevaluated sizeof defer was not a no-op (f2cf4aa)
Zero-init-off orelse inside a defer (6bf4f84)
Braceless defer die(); missed __builtin_unreachable() injection: the synthesized ; skipped the noreturn probe (78f9c8a)

#orelse

Reached the C backend intact inside a case label: case (x orelse 1): was accepted and the literal token passed through. Found by the tag-alphabet totality suite on its first run (16bba07)
On a volatile or _Atomic object, read the object up to three times; single-eval hoisting now covers atomic typedefs (ee1fc71)
typeof(int[N]) / _Atomic(int[N]) accepted because arrayness lived on the type rather than the declarator, emitting broken if (!a){…} (c0a4935)
Dimension holes in _Alignof, _Generic, _Static_assert and nested typeof (78f9c8a)
Return-expression leak: return (x) orelse 1 leaked because the backward walk crossed (x) to return and applied the return orelse; identifier exemption (78f9c8a)
static / extern / _Thread_local dimension orelse lowered to illegal static VLAs (17329c2)
_Atomic(int[n orelse …]) leaked: type-specifier dims were skipped and the type emitter never walked _Atomic( (17329c2)
.orelse orelse decl-init (06bb332)
Mid-chain empty orelse orelse; orelse() now allowed (86c20fc)
Mid-chain continue / block-form reject (f2cf4aa)
Struct-value and chain-after-control-flow rejects (b007d1e)
Keyword leak via static raw verbatim bypass
Raw string literal R"(...)" inside #if 0 desynchronized block-comment state
__attribute__ bracket-orelse queue desynchronization
init-cast VLA crash on variably-modified types
Bare comma split escaped braceless control flow; paren comma corruption in chained expressions
Preprocessor-conditional mangling in bracket orelse
Designator side effects, compound-literal VLA, and nested _Static_assert leak (f6bff02)
Non-ICE designator-dimension orelse; false control-flow diagnostic (06bb332)
Soft type-spelling orelse values (06bb332)
const _Atomic / volatile if-hoist; _Nonnull / _Nullable qualifier scoping (86c20fc)
typeof(_Atomic(int) orelse 0) leaked: _Atomic(T) was not treated as a type-specifier constructor
typedef int (*F)(int a[0 orelse 1]) ternary-lowered parameter dims; the declarator check jumped the (*F) group and typedef walks never called the prototype reject
GNU range designators [0 ... 2 orelse 3] ternary-destroyed the ... into illegal C
constexpr int a[0 orelse 1] hoisted a runtime temporary into a constexpr dimension
Empty-orelse emit leaks; return + defer subscript orelse (65b0ee7)
Paren-led bare orelse after a control statement (97a9fba, b20455e)
Multi-label and attribute bare-orelse peel (e03ee60)
Brace-init designator leak; _Atomic side-effect register; GNU attribute-between-dims FIFO (f2cf4aa)
typeof(enum) did not set is_enum (f2cf4aa)
enum E : typeof(T) { orelse } and enum E : _Atomic(int) { orelse } (c0a4935, 86c20fc)
asm symbolic [orelse] operand names (c0a4935)
Array variable orelse that can never trigger is now diagnosed rather than silently lowered

#bounds-check

Local pointers, including qualified, typedef, pointer-to-array and raw forms, could shadow a tracked file-scope array without creating a typedef-table shadow, so g[i] inherited the outer array and was wrapped with sizeof(pointer)/sizeof(pointer[0])
Block-scope incomplete extern int g[] inherited the complete outer bounds, generating an invalid sizeof(g)
Decayed parameters wrapped against the file-scope array: int g[10]; f(int g[20]){ return g[i]; }, same for K&R and int *g params that skipped the shadow optimization
Wraps skipped when the index itself used orelse (a[i orelse 0]) because try_bracket_orelse ran before the subscript check in the emit loop; they compose now, with the ternary index inside __prism_bchk (78f9c8a)
Silent bypasses: (i)[tern], ((i))[tern], (2)[tern] (last emitted was )); *((T*)(a+i)) and *(((T*)(a+i))) (a grouping paren hid the cast+additive pair); bare idx[&arr[0]] without an outer paren; (*&(a))[i] and (*a)[j] (c0a4935, 78f9c8a)
p[a[i]] false-rejected as commutative idx[arr] despite the subscripted-index exemption (c0a4935)
Cast×subscript used naive sizeof(arr)/sizeof(arr[0]) instead of the cast element size
Cast-prefix unary & one-past ((void)&a[n], (int*)&a[n]) mistook the cast ) for a binary-& operand (78f9c8a)
(a+i)[0], 0[a+i], cast-deref and _Atomic·typeof dims (f6bff02)
One-past parenthesized bounds (aa1b961); paren-deref (b007d1e)
for/if/switch-init declarations never registered array bindings (missing wraps) or shadows (pointer init-stmt inheriting outer sizeof) (c0a4935)
Block-scope static/constexpr initializers wrapped g[0] into a non-ICE (c0a4935)
raw VLAs were still re-registered (c0a4935)
Pointer-arith *(a+i) bypass after the registry split; the lookup still consulted only the typedef table
typeof(fixed_array) bounds registration; VLA-of-pointers false wraps
emit_statements did not run bounds checks (e03ee60)
C89 __prism_bchk form (fc3716d)

#zero-init

Empty and [0] aggregate memset (06bb332)
Const-subobject memset was undefined behaviour (aa1b961)
typeof(_BitInt(N))
sole-FAM and nested-empty {0}, plus register/const × memset rejects
for/if-init _Atomic and register rejects (86c20fc)
Member-side const-union false reject (86c20fc)
_Atomic aggregate and union/VLA const cases now diagnosed rather than silently mis-lowered
Soft-keyword bitfields (fc3716d)
SUE { scope tagging (ee1fc71)

#auto-static / auto-unreachable

Auto-static promoted mutable typeof(int[N]); typeof-as-const applies to orelse temps only (c0a4935)
Auto-static missed leading cleanup / [[attr]], typedef-const, unbraced string initializers, C23 true/false, typeof(int[N]) (86c20fc)
Statement-final noreturn through casts, grouping, comma tails and call arguments ((void)(0, die());, die(), 1;, foo(die());) missed __builtin_unreachable(); detection required an immediate ; after the call's ) (78f9c8a)
Unevaluated operands falsely marked unreachable: sizeof die(); and no-paren sizeof +die() (78f9c8a)
Contextual noreturn/taint poisoning via soft-keyword callee, attribute name, asm __volatile__ goto, declaration shadow (aa1b961)
User TU definitions of exit/setjmp/… false-tainted and false-unreached
_Noreturn void a(), b(); tagged only the first declarator
asm soft-keyword taint (fc3716d)

#raw

raw { … } still lowered defer/orelse or injected auto-static, bounds and unreachable
typedef int raw; raw raw x keyword strip (c0a4935)
Statement-form raw { … } suppress blocks (c0a4935)
raw on a VLA is still subject to the goto check, since jumping past a VLA bypasses stack allocation regardless of initialization
An all-raw declaration must emit identically to the same declaration with raw deleted and zero-init off. That differential failed 32/229 cells on first run and exposed __attribute__((unused)) const raw int v; emitting const const int v;, invalid C that Phase 1 accepted. The attribute prelude was bounded at the raw token even when raw sat inside the specifiers

#tokenizer / preprocessor

Function-like macros were silently dropped from re-emitted defines while object-like ones survived: #define MAX(a,b) did not round-trip a transpile (unreleased)
.i input: //\ line splice, UTF-8 BOM, universal character names in identifiers (06bb332)
.i translation units were dropped entirely (fc3716d)
Digraph %: line markers (86c20fc); digraph/trigraph #define (f6bff02)
UTF-16 BOM now rejected with a diagnostic instead of mis-tokenized (b007d1e)
Sticky # N "a.h" 1 3 system-skip dropped the rest of a user TU
Hard type keywords used as declarator names (06bb332)
Parenthesized _Generic fold (06bb332); glibc _Generic default-fold declarations (5732201)
GNU nested-function is_func_body CFG classification (06bb332); nested-function verbatim emission (fc3716d)
goto "assigned-first" analysis accepted x = x + 1 (86c20fc)
goto into C23 if/switch init when the init-semicolon search returned NULL
Brace-unsafe walk could scan past type_end on large TUs (86c20fc)
Enum-walk underflow (65b0ee7)
Ill-formed while (decl), do decl, for (raw {…}), scalar for (raw int x = 1), while(defer 0), if(defer 0) in control parens

#driver / CLI

@file response files treated a backslash as a path separator on Windows, eating C:\ paths (1d18a57)
Force-include re-injection; split -I under -fpreprocessed; bits/ re-include (fc3716d)
-M dependency routing (b007d1e)
-U_GNU_SOURCE ordering; clang #… 3 under no-flatten (f6bff02)
No-flatten #include path escaping
C++ mix driver preprocess/skip, C++ link, -x c temps, cross-compiler prefix (65b0ee7)
sos_ensure_do OOM dangling pointer (5732201); sos_* thread-local free (a661b6b)
Calling-convention return capture (6bf4f84)
Newline emission before declarations after statement boundaries (ee1fc71)
Control-paren scope tracking in emit_statements; for-init is_loop preservation (a661b6b); else/do paren-led forms and do at-statement-start (b20455e); GNU attribute control-paren tracking (e03ee60)

#Windows / MSVC

memstream, handle inheritance, PATH, mkstemps, install (aa1b961)
build_clean_environ was used by windows.c before its declaration; MSVC infers int() and then rejects the real declaration with C2040. GCC 14+ would reject it too (unreleased)
win32_memstream_path removed; suite tests rewritten for DELETE_ON_CLOSE (06bb332)
mkstemps and noreturn shims (5732201)
CLI_PUSH under-allocation (65b0ee7)
__assume(0) now counted as an unreachable marker alongside __builtin_unreachable (17329c2)
Fake cl test used bash; Alpine has no /bin/bash (1d18a57)

#assertions / harness

PRISM_DEBUG false assertions: balanced-group checks treated initializer braces and index brackets as parentheses, and the missing-declaration-recipe assertion forgot that Phase 1 excludes GNU nested-function locals from the outer CFG table (78f9c8a)
Harness accounting: a local total in test_win_env_scrubbing shadowed the runner's thread-local CHECK counter, so three checks incremented passed but not total. The invariant total == passed + failed is now itself a counted meta-test
Four leaked temp/result ownership paths found by LeakSanitizer; undefined _Bool feature-mask write; UB-based OOB "trap" oracles replaced with wrapper-presence and zero-survivor checks

#Testing

104 generative tiers Prism test suit moves to more procedural tests to cover much wider set of edge cases. suites test.autostatic.c, test.autounreach.c, test.golf.c, test.cert.c and test.raw.c were absorbed into generative tiers.

#Code organization

C-language logic moved out of prism.c into parse.c, which is moving towards a reusable C-parsing library with Prism dialect support. parse.c 4,595 → 12,928 lines; prism.c 12,336 → 9,696.

#Stats

200+ bugs fixed since v1.1.4
40 commits; 36 files changed, +37,133 / −17,479
104 generative tiers, 3,820 CHECK sites (876 at v1.1.4)
Suite: 14,543+ platform-inclusive CHECK inventory, up from 6,035 in v1.1.4. Audited: 14,286/14,286 Darwin/Clang, 14,355/14,355 Arch/GCC 16, the latter also clean under ASan + UBSan + LeakSanitizer. 11,327/11,327 verified under GCC across 18 of 19 tiers. test.parse.c requires Clang, since it uses for (typedef double x;;), which C11 6.8.5.3 permits only for auto/register
Self-host: stage0 → stage1 → stage2 → stage3 transpile output byte-identical (1,058,598 bytes)
--prism-verify passes on prism.c, parse.c, and all 21 corpus sources
2.02x end-to-end warm cache; 1.65x on the stress TU with the cache disabled

#v1.1.4

GitHub ↗

Prism v1.1.4 is a bug-fix release: ~105 bugs across 8 fix commits, including 8 bounds-check bypass vectors, ~62 C23 init-statement false rejections, soft-keyword identifier corruption in the parser, const+orelse aggregate UB, computed-goto false positives, and a #pragma link parser crash. Also: optimization-attribute support and a Windows thread-attribute fix.

#Security

#pragma link parser crash on malformed/empty payload: collect_link_pragmas dereferenced past end-of-line on a bare #pragma link with no platform tag or names; bounds-checked range-walk now rejects cleanly (0b3f158)
8 bounds-check (-fbounds-check) bypass vectors: commutative-subscript paths missed several shapes that let an indeterminate index reach the backend unwrapped: idx[(arr)], (idx)[arr] chained through compound literals, idx[(expr, arr)] where the comma-RHS aliases through a typedef, brute-scan fallback on multi-line array expressions, __builtin_* wrappers, ternary-arm subscripts, _Generic-association subscripts, and the *(arr+idx) pointer-arithmetic form. All 8 now route through bc_wrap and emit the runtime check (0b3f158)
~9 internal-limit silent passes / false rejections: token-pool, scope-tree, P1FuncEntry, and typedef-table growth paths previously could either silently truncate (info hiding) or hard-error at safe sizes; explicit overflow predicates added at every *_count > UINT16_MAX / > UINT32_MAX site, with tests covering each (0b3f158)
Dynamic-buffer regression from 1.1.3's prep-dir scanner: a length miscalculation could leave one byte uninitialized at the boundary between two consecutive #include-expanded buffers; backends might read stack noise (0b3f158)
const + bare orelse aggregate fallback emitted indeterminate read: const struct S s = get() orelse {0}; produced a ternary whose false-arm read s before the assign, exposing whatever was on the stack at the declaration point; bare orelse on const-qualified aggregates now hard-rejected (must use block form orelse { return ...; }) (48cec3c)
Computed goto false-positive over user-initialized declarations (void *targets[] = { &&L1, &&L2 }; goto *targets[i];): the CFG verifier's unverifiable_jump blocked all zeroinit-eligible decls without checking decl.has_init, so the standard label-address-table dispatch idiom was rejected even though the user had taken over initialization (e645922)
goto-over-uninit false positive when the label site assigns first: Prism rejected goto L; int x; ... L: x = compute(); use(x); despite the first reference to x being a plain assignment (no indeterminate read); third-pass scan now applies an assign-first heuristic that walks tokens forward from the label's :, finds the first identifier matching the skipped variable, and accepts when followed by a single-character = (e645922)

#Bug Fixes

~62 C23 init-statement over-rejections: for(int x; ...), if(union U u; ...), switch(_Atomic int a; ...), if(typeof(*p) v; ...) and combinations involving _Atomic(typeof(...)), typedef-of-aggregate, _Alignas, pointer-to-VLA receivers, etc. all relied on a __builtin_memset injection that cannot land between the init clause and the controlling expression. The init-statement path now satisfies needs-memset cases with = {0} (or = 0 for typeof scalars) directly at the declarator, lifting the rejection. C23 if/switch-init VLAs are now accepted uninitialized (matching plain C semantics); only for-init VLAs remain rejected (no compatible escape hatch). const + unavoidable-memset rejection lifted in init-statement context (no memset emitted, brace-init of a const is a normal initialization) (0b3f158, e645922)
4 const-union edge cases: const union U u = {0}; at file scope, in for-init, in stmt-expr last expression, and as a multi-declarator second decl all routed through inconsistent gates that either double-rejected or silently emitted memset over a const (0b3f158)
Switch unbraced declaration false positives: Phase 1D + Pass 2 rejected every declaration directly in switch (x) <decl>; even when the user had explicit intent: static, extern, _Thread_local, register, _Atomic, constexpr, _Alignas, typedef, struct/union/enum reference, raw, or any explicit = initializer. Both gates now restrict to the plain auto-no-init trapdoor; the actual case-skips-decl violation is still caught by the CFG verifier (e645922)
GNU nested function false rejection: Prism rejected GCC nested function definitions in any function regardless of whether the outer function used defer. Plain GNU C nested-function idioms (including statement-expression nested-function definitions: int (*fp)(int) = ({ int g(int x) { return x + 1; } g; });) now pass through verbatim; rejection only fires when the outer function actually contains a defer keyword (forward-scan from the function body's opening {) (e645922)
File-scope typeof + orelse segfault: struct/union/enum declarators at file scope with [1 orelse 2] array dimensions dereferenced a NULL scope_tree slot (cur_sid == 0); guard added at the P1K_DECL allocation site (e645922)
5 soft-keyword identifier handling issues in the parser: variables named defer, orelse, raw, noreturn, and unreachable lost their identifier role under specific declarator shapes (multi-decl with attribute, K&R param, function-pointer return, typeof-typed init, sizeof operand). Token classification now consistently checks is_soft_keyword_identifier before applying keyword semantics (6fc467d, 48cec3c)
Function declarator handling and MSVC unreachable() test failures: function-typed declarators with parameter lists containing _Pragma or __attribute__ were misclassified as call expressions; MSVC's __assume(0) mapping for unreachable() was emitted with the wrong macro guard (115d2ba)
typeof on local function declarations: void f(void); typeof(f) g; inside a function body fell through to the variable-declaration path because the local extern function decl was not registered in the prescan's typedef table; g then had VLA-detection run on a non-VLA type (16de944)
Windows thread attribute: _Thread_local / thread_local mapping for MSVC used __declspec(thread) placement that broke when combined with static; the storage-class ordering now matches the MSVC declarator grammar (d385352)

#Features

Optimization attribute pass-through: __attribute__((hot)), ((cold)), ((flatten)), ((optimize(...))), and the C23 [[gnu:hot]] / [[gnu:cold]] / [[gnu:flatten]] forms are now parsed and emitted verbatim through the function-attribute slot, including in defer-transformed function definitions where the synthesised epilogue must inherit the outer attribute set (d914e2c)
Internal optimizations: token-walk hot paths in Phase 1D and Pass 2, scope-stack iteration, and typedef-lookup hash probing tightened; ~5% wall-time reduction on large translation units (23a91cc, ac53f44)

#Stats

~105 bugs fixed (~88 bug fixes, ~17 security vulnerabilities)
+635 new tests, total: 6,035 tests passing (darwin/clang; alpine x86_64 / linux CI parity maintained)
+2,226 lines of new test coverage
13 files changed, +3,391 insertions, −643 deletions
Self-host: stage1 == stage2 byte-identical

#v1.1.3

GitHub ↗

Prism 1.1.3 is a bug-fix release after 1.1.2. Focus: contextual keyword handling, C23/extension keyword identifier cases, orelse disambiguation, and the Windows CI regression around defer union zero-init checks.

#Bug Fixes

Fixed parenthesized GNU statement-expression declaration orelse fallbacks escaping Phase 1 validation: int x = get() orelse (({ 0; })); now rejects correctly with the same diagnostic as the direct ({ ... }) form (9868145)
Fixed C23 u8'…' character literal tokenization so Prism preserves the prefix as part of the character token instead of emitting invalid spacing (6df08b2)
Fixed C23 / extension soft keywords used as ordinary declarator names, typedefs, tags, labels, and goto targets, including alignas, constexpr, typeof, static_assert, thread_local, bool, and related spellings (6df08b2)
Fixed soft-keyword typedefs and struct/union tags losing aggregate metadata, which could make zero-init emit scalar 0 instead of {0} (6df08b2, 3d4ca2b)
Fixed alignas typedef precedence so a real typedef named alignas wins in type-name position, while true alignas(...) attribute syntax still works (3d4ca2b)
Fixed contextual orelse handling in array dimensions: enum constants or variables named orelse at the start of [...] remain identifiers, while real bracket-orelse fallback syntax is still recognized after an expression LHS (3d4ca2b)
Fixed Prism keywords used as C labels, GNU local labels, computed-goto labels, function identifiers, calls, and parameters (40866fc)
Fixed Prism keywords used as struct/union/enum declarator names, including typedef union { ... } defer; and anonymous union { ... } defer; zero-init cases (40866fc)
Fixed the Windows CI expectation mismatch for the defer union zero-init regressions by using name-aware zero-init assertions (67759dd)

#Stats

5 bug-fix commits since 1.1.2
+58 tests
5,807 tests passing locally on darwin/arm64
+718 insertions, −53 deletions across 6 files
Self-host transpiled source: stage1 == stage2

#v1.1.2

GitHub ↗

Prism 1.1.2 adds -fbounds-check: runtime subscript trapping for tracked arrays, without wrapping declarator contexts, typedef chains, multi-dimensional arrays, or parenthesized variants incorrectly. It also adds two CLI helpers, plus bounds-, defer-, orelse-, and phase-1 scope-tracking fixes found while shipping the feature.

This release also fixes build-system issues, including Meson.

#Features

-fbounds-check: runtime subscript bounds-checking (a0632b8, 28 follow-up hardening commits). arr[i] is wrapped in a __prism_bchk macro that traps on out-of-range access. Coverage includes: multi-dimensional subscripts at every level (a[i][j][k], (a[i])[j]), typedef-of-array chains (typedef int T[3][4]; T a;), file-scope arrays with complete dimensions, parenthesized arrays ((a)[i], ((a))[i]), array-of-pointers with inner rank guard (int *p[10]; p[0][i] stays unwrapped), side-effect-once semantics for indices, commutative idx[arr] hard-rejection (ISO C §6.5.2.1 equivalence that every detector misses silently: prism points the user at the equivalent arr[idx] form). Works with auto-static, _Generic controlling expressions, and under -fpreprocessed / -x cpp-output / MSVC / MinGW LLP64. SPEC §6.6 documents the full model.
prism run -- <args> (7eee1b5): trailing argv passthrough to the executed binary. prism -O3 run build.c -- hello world 42 now works; -- is the explicit separator so flag-like prog args (-v) are not mistaken for prism flags. SPEC §8.
#pragma link <platform> <libs>... (7eee1b5): declarative per-source link flags. #pragma link macos Cocoa QuartzCore emits -framework Cocoa -framework QuartzCore on Apple hosts; #pragma link linux m pthread emits -lm -lpthread; platform tag matches current host triple (e.g. macos_arm64, linux_x86_64, bare OS name) and is filtered at compile time. -fno-link-pragma disables the scan globally for security-sensitive builds.

#Security

OOB read in p1_mark_uneval_brackets: scan iterated from i=0, reading the uninitialized token_pool[0] sentinel; random TF_SIZEOF/TT_TYPEOF bit on uninitialized flags caused tok_next(garbage_next_idx) to walk a wild pointer. AddressSanitizer-confirmed; manifested as intermittent BUS/SEGV on macOS arm64 (138/139), Linux 139, Windows 1, varying ~50% of prism run .github/test.c invocations across CI. Fixed to start at i=1 (8d9fbe5); defense-in-depth patch also explicitly zeros slot 0 on first allocation (ad2d5f0)
Const-aggregate memset UB: zero-init emitted memset(&obj, 0, sizeof obj) for const-qualified unions / VLAs / _Atomic aggregates, laundering the mutation through (void*) past compiler warnings but still violating ISO C11 §6.7.3p6 (modifying a defined const object), poisoning TBAA, and permitting silent reordering; now hard-rejected with a clear diagnostic (f351461)
Commutative-subscript bounds bypass: ISO C defines arr[idx] and idx[arr] as equivalent, but -fbounds-check's walker only matched the array-on-the-left form, silently emitting idx[arr] raw and bypassing the runtime trap; now a hard error that points the user at the canonical form (f351461)
File-scope arrays never registered for bounds-check: the registration gate skipped globals entirely, so every -fbounds-check build had a silent info-leak/OOB hole on any module-level int g[N]; now registered with rank propagation through TU boundaries (502a7ac)
Array-of-pointers never registered: int *a[10]; a[i] was excluded by !decl.is_pointer, which rejected the array-of-pointers case (is_array && is_pointer) along with true pointer types; replaced with the codebase's standard declarator-top-level array predicate (a0ce82f)
Parenthesized and typedef array subscripts unwrapped: (a)[i], ((a))[i], and typedef int T[N]; T a; a[i] all escaped the wrap; paren-peel now iterates through all parenthesis layers and registration walks through typedef chains (7c33ec4, 9eb60ed)
sizeof (a)[i] unevaluated-bracket miss: postfix chain stopped at the ) closing (a), so the [i] bracket was not tagged unevaluated and its runtime index could be miscompiled / double-evaluated; now walks the full postfix chain past the closing paren (7c33ec4)
offsetof/sizeof subscript wrap false negatives and spurious one-past-end traps: unary &arr[len] (a well-defined one-past-end address computation) was trapping; nested arr[m[i]] inner index was silently unwrapped; struct-member subscripts shadowed by local sizeof names produced both class (24d2353)
Auto-static emission without trailing space: under -fauto-static -fbounds-check, const int a[10] = {0}; became uncompilable staticconst int a[10]... (a0ce82f)
Zero-init skip on typeof(int[f()]) / typeof(int[(n)]) aggregates: declarator-array VM scan was folded through typeof(...) (a749df0, d0dedf6, d159a98)
Phase-1 scope exhaustion crash on large static tables: files with 131K+ lines (intel_perf_metrics.c) exhausted the uint16_t scope_id space (>65534) because every { .reg = x, .val = y } initializer brace allocated a fresh scope; Phase 1A now skips scope-tree entries for init-in-init braces, bounding growth to O(actual compound statements). Phase 1D scope-id consumer also desynced in the process, mis-matching for-loop body braces against unrelated switch scopes and producing spurious zero-init diagnostics: matched-open-tok guard added (a4b5717)
realloc-inside-realloc class in bounds-check preamble emission: preamble used __SIZE_TYPE__ which is not expanded under -fpreprocessed / -x cpp-output (CI flatten-mode fail); switched to unsigned long then unsigned long long after LLP64 truncation was discovered on MinGW/Clang-on-Windows x64 where unsigned long is 32-bit but size_t is 64-bit (d59bb16, 1a3f08b)

#Bug Fixes

Bounds-check false positives and spurious wraps

Declarator-bracket class closed at a single guard site: prototype int f(int g[20]), K&R tail type-decls int f(g) int g[10]; { ... }, nested prototypes, function-pointer parameters with array-typed params, function-pointer typedefs, and struct fields holding function pointers were all wrapping their declarator [ as if they were expression subscripts, producing VLA-mismatch warnings or runtime traps. try_bounds_check_subscript now has a declarator-context guard (TT_TYPE | TT_QUALIFIER | TT_SUE | TT_TYPEOF or pointer-declarator *); p1_register_param_shadows registers non-VLA parameter names as is_param shadows so body uses mask file-scope arrays of the same name (048c31d: seven concrete cases)
Struct-field array dim false-positive: pthread.h's __cancel_jmp_buf[1] was being wrapped (1abc7f4)
Ternary LHS peel through bounds_find_array_ident (d0dedf6)
&(arr)[i] one-past-end unary-address spurious trap (d159a98)
Member-LHS subscript s.arr[i] false positive (2814de3)
Bare array inside sizeof operand spurious wrap (2814de3)
Static-storage initializers: subscript expressions inside file-scope array initializers now wrapped correctly (2814de3)
_Generic controlling expression: was bounds-wrapped (must stay unevaluated) (ab9cd86)
Incomplete extern int a[]; base: bounds skip added (a749df0)
static_assert(arr[0] == 0, "...") predicate wrap false positive (cf5ad34)
Comma subscript arr[(x, i)] pointer base handling (cf5ad34)
Array rank and incomplete outer-dim: typedef int T[][4]; T a; handled (7becfca)
Rank-16 sentinel: ARRAY_RANK_WRAP_ALL=255 so arrays with >15 dimensions (rare, but legal) don't drop outer wraps (16d1b2c)
array_dim_complete recorded on typedef array types for accurate sizeof recovery (16d1b2c)
Side-effect-once verification: a[bump()][bump()] counters advance exactly once each (58d2116)
Pool-predecessor fallback: last_emitted doesn't advance through synthetic OUT_LIT/out_str output, walker now consults token_pool[idx-1] when seeking root identifier across earlier wraps (58d2116)

Defer, orelse, zero-init

typeof(volatile T): zero-init scan now handles volatile-qualified typeof (d159a98)
Volatile orelse compound literal: now rejected (avoids double-read of volatile source) (d159a98)
defer body break at control paren: defer break; inside if (...) correctly handled (342e9cc)
defer capture hash restore (d159a98)
Braceless defer body P1_IS_DECL annotation in !at_stmt_start branch (d159a98)
typeof enum ghosts / fixed-underlying balanced skip (C23 attrs) (d159a98, d0dedf6)
K&R param VLA scan (d159a98)
K&R 2D VLA CFG regression (565cf86)
Attribute-on-orelse emit desync: C23 [[...]] now emitted verbatim in Pass 2 (565cf86)
Raw walk_back off-by-one and subscript strip (342e9cc)
Raw strip skips string literals (cf5ad34)
Raw stripped from scraped #defines (a749df0)
raw * x silent miscompile: TF_RAW added to shadow-registration predicate at 3 Phase 1D sites; P1_HAS_ENTRY early-return in try_strip_raw (dd1f6b6)
sizeof(vla + k) variably-modified type handling (342e9cc)
sizeof VLA param +/- pointer arith (cf5ad34)
sizeof(vla[i]) no-paren subscript wrapped (spurious trap) (0245cf5)
Nested arr[m[i]] inner index unwrapped (24d2353)
CFG has_init vs -fno-zeroinit gate (342e9cc, d0dedf6)
Const value orelse rejected when type_vm is set (16d1b2c)
_Atomic split from type_vm for array-bounds (a749df0)
Ptr-to-array declarator bracket rank (cf5ad34)
Bracket-orelse chain first LHS handling + O(n) paren depth (7becfca, 342e9cc)
Commutative idx[arr[i]] detector (7becfca)
Switch-unbraced-decl diagnostics, case-label-bypasses-init-decl (2814de3)
Spurious brace wrapping around decl after if-body whose condition contains a nested non-ctrl paren (cast in _Generic, etc.) (2814de3)

Other

typedef shadow dedup (cf5ad34)
Typedef array pointer is_array registration (a749df0)
Auto-unreachable for-init in ctrl paren (cf5ad34)
Auto-static multi-decl (7becfca)
Struct field vs typedef disambiguation (7becfca)
typeof_unqual aggregate scan (7becfca)
skip_one_stmt trail snap beyond SOS_IF_MAX and cache[tix] self-host (cf5ad34, 7becfca)
struct body tag lookup for volatile/VLA (a749df0)
C23 float literals emitted verbatim (342e9cc)
Emit #undef before every #define in flatten output: cpp-evaluated #ifndef guards are gone in flattened form, so redefining macros like __attribute_const__ across headers became fatal under -Werror (1abc7f4)
Emit system-header flag (3) in linemarkers (1abc7f4)
Drop -c/-o/-S from preprocessor argv: clang's -Werror=unused-command-line-argument fires in meson probes (1abc7f4)
Stop forcing -D_POSIX_C_SOURCE=200809L alongside -D_GNU_SOURCE: sources that #undef _GNU_SOURCE were being left with POSIX alone, suppressing __USE_MISC and dropping syscall/sbrk/brk/crypt/getentropy decls (1abc7f4)
Capture full cc --version in prism --version output (gcc's "Free Software Foundation" identifier is on line 2) for meson/autoconf compat (1abc7f4, Windows twin bad59cf)
static/_Thread_local/thread_local/__thread storage in defer body: now rejected with clear diagnostic (ab9cd86)

Windows / cross-platform

windows fix: unresolved external capture_all_output in MSVC link step; prism.c's --version handler called the POSIX-only function unconditionally; added Windows twin in windows.c using CreateProcessW + restricted-handle inheritance, reads to EOF, normalizes CRLF→LF (bad59cf)
Restored signal_temps_unregister: earlier cleanup removed it as "dead" but Windows memstream fclose path still calls it (23a879c)
LLP64 bounds-check truncation on MinGW/Clang-on-Windows x64: unsigned long is 32-bit while size_t is 64-bit, silently truncating indices; switched to unsigned long long (1a3f08b)
Test harness pins 8 MiB pthread stack for CI workers: musl's 128 KiB default overflowed on deep test inputs (Linux-only flake, glibc 8 MiB and macOS 512 KiB normally survive) (9fbaee6)
Windows test fixes (cea01b4)

#Stats

80+ bugs fixed across 36 commits (spanning bounds-check hardening, defer/orelse correctness, zero-init gates, phase-1 scope tracking, Windows LLP64, and memory-safety UB in token-pool scans)
+349 new tests, total: 5,749 tests passing (darwin/arm64; CI matrix covers linux x86_64, linux arm64, linux riscv64, macOS x86_64/arm64, windows build)
Major new test file: test.bounds.c (+1,958 lines, all runtime-trap probes verified under ASan+UBSan)
+5,929 insertions, −736 deletions across 18 files
Self-host: stage1 == stage2 byte-identical
New SPEC coverage: §6.6 bounds checking (full runtime model), §3.2 TypedefEntry array_rank, §6.4 defer validation storage rejection, §6.10 bounds-check preamble emission, §8 CLI modes (program args, link pragma)

#v1.1.1

GitHub ↗

Prism 1.1.1 is bug fixes only: 27 bugs across 9 commits, including memory-safety issues in the preprocessor pipeline, multiple zero-init bypass vectors, defer/orelse interaction breakage, and emitter-level codegen drift.

#Security

#define comment-strip use-after-free: collect_source_defines retained pointers into a buffer that was reallocated mid-scan when a #define line crossed the SWAR padding boundary; subsequent dereference read freed memory (fe20798)
realloc double-free in source-defines arena: the modified flag was reused across iterations, causing the same buffer to be re-realloc'd then freed twice on certain #define patterns (fe20798)
typeof(int[f()]) / typeof(int[(n)]) skipped zero-init: is_typeof_func_type's top-level walk did not skip balanced [...] groups, so any ( inside an array-dimension expression was misread as a function parameter list, classifying the typeof as a function type and suppressing memset; declared local VLA was left indeterminate, x[0] read uninitialized stack memory (info leak) (98423f6)
Attribute-noise blindspot in VLA predecessor: is_array_bracket_predecessor did not walk past GNU __attribute__((...)) and C23 [[...]] between a SUE keyword and a tag name, so typeof(struct __attribute__((packed)) Tag [n]) failed VLA detection and skipped zero-init (17013d6)
_Atomic(...) inner-type VLA scan missing: _Atomic(int[n]) and _Atomic(VLA_typedef) were not flagged as VLA, falling through to = {0} (compile error) or no init (info leak); parse_type_specifier now scans _Atomic(...) contents identically to typeof(...) (17013d6)
typeof(struct __attribute__((...)) S) zero-init skip: anonymous struct with attribute noise between struct keyword and body was not detected as aggregate, dropping the memset (e11bd95)
VM func-ptr orelse double-evaluation: typeof(RHS) in the bare-orelse temp pattern evaluated the RHS twice when the result type was variably modified (C11 §6.7.2.4p2); a function pointer with VLA-array return type triggered the duplication, double-calling f() and double-reading volatile sources (e11bd95)
-fno-orelse defer-in-paren safety bypass: with F_ORELSE disabled, defer (return); and similar paren-wrapped defer bodies bypassed Phase 1F validation entirely; the orelse paren-recursion scanner now also runs when only F_DEFER is enabled (6c12a53)
defer-body orelse emitter overshoot: emit_bare_orelse_impl and emit_deferred_orelse consumed the trailing ; and advanced past it without respecting the deferred-range end boundary, spilling the next user statement (and the function body's closing }) into the emitted defer body: invalid C output (253266e)
ret_counter desync in defer-wrapped return: emit_return_body read ctx->ret_counter twice (once for __prism_ret_<N> = (...), once for return __prism_ret_<N>;) with emit_all_defers() between them; the defer body's __prism_oe_K allocations bumped the shared counter, emitting a return __prism_ret_<M> referring to an undeclared identifier (253266e)

#Bug Fixes

noreturn: K&R-style funcptr param scan misclassified void (*cb)(int, int); as a forward declaration; precise inner-paren walk discriminates parameter type list from declarator (17013d6)
noreturn: forward-declaration scan failed when the noreturn attribute appeared between qualifier and identifier; func-proto map now records both branches (17013d6)
stmt-expr inside control-flow paren: a ({…}) inside if(…)/while(…) parens corrupted Phase 1D's at_stmt_start tracking on the body's first token, dropping declaration annotation and zero-init (17013d6)
defer enum body false shadow: Phase 1D's enum-body scanner falsely flagged inner-scope enum constants as shadowing defer-captured names when no control-flow exit was reachable while the shadow was live (e11bd95)
#define block-comment leak in source-defines collection: multi-line /* ... */ comments containing #define lines silently scraped _FILE_OFFSET_BITS and similar macros into the output, mutating the compiled program's ABI (e11bd95)
_Generic defer body missing SCOPE_GENERIC: defer bodies inside _Generic associations did not push the generic scope, causing : separators in nested associations to be mis-identified as labels (871c20f)
Stale last_emitted in 5 orelse scan-context checks: last_emitted from the prior emission leaked into orelse's "is keyword" disambiguation, producing both false rejections and false acceptances depending on the prior token (871c20f)
stmt-expr in for-init defer-shadow desync: for ( ({ defer ...; }) ; ; ) produced incorrect shadow-vs-capture decisions because Phase 1D's shadow scanner used the wrong scope-id at the stmt-expr boundary (345e5d2)
defer keyword leak in expression context: (s.defer), arr[defer], and other expression positions where defer is a member/subscript-context identifier emitted the defer token verbatim to the backend, producing a compile error (345e5d2)
__label__ ctrl_pending leak in Phase 1D: GNU __label__ L1, L2; declarations did not clear p1d_ctrl_pending, causing a subsequent declaration to be erroneously bounded to a non-existent braceless control body (387b1c6)
Pass 0 taint variable-name false positive: a local variable named vfork (or any taint-tagged identifier) inherited the global TT_SPECIAL_FN tag, falsely tainting the function and rejecting defer; member-access predecessor check added (387b1c6)
Wrapper-of-exit falsely tainted as vfork: wrapper_taint[] propagated bare TT_NORETURN_FN from a callee onto the wrapper's body without mirroring the direct-body scan's vfork-only rule, hard-rejecting any defer in functions calling a user wrapper of exit/abort/_Exit/thrd_exit/quick_exit with a misleading "vfork()" error (98423f6)
Braceless defer body declaration with orelse initializer emitted invalid __typeof__(int t) __prism_oe_N = ...: Phase 1D walks braceless defer bodies in the !at_stmt_start branch, missing the P1_IS_DECL annotation; Phase 1F now rejects with a clear message directing the user at defer { ... } (98423f6)
Pass 1 ann field flag space exhausted at 8 bits: widened to uint16_t and added P1_REJECTED for explicit rejection tracking (6c12a53)

#Stats

27 bugs fixed (17 bug fixes, 10 security vulnerabilities)
+166 new tests, total: 5,400 tests passing (alpine x86_64 / linux CI; 5,361 on darwin/clang)
+1,663 lines of new test coverage
14 files changed, +2,131 insertions, −339 deletions
Self-host: stage1 == stage2 byte-identical

#v1.1.0

GitHub ↗

Prism 1.1.0 introduces auto-static promotion and bug fixes.

#New Features

Auto-static: const arrays with literal initializers are automatically promoted from stack to static storage, eliminating hidden memcpy on every function call. Fires conservatively: block-scope const arrays only, every initializer token must be a literal or enum constant, no volatile/static/extern/register/constexpr/_Thread_local, no VLA dimensions, no orelse, no attributes on the declarator. Pointer arrays require const on the array itself (const int * const arr[3]). Opt-out: -fno-auto-static (d0b7f55)

#Security

Union = {0} padding infoleak: = {0} only initializes the first named member of a union (C11 §6.7.9p17); §6.7.9p21 implicit zeroing applies only to aggregates (C11 §6.2.5p21: arrays and structs, NOT unions); GCC-15 empirically leaves remaining bytes indeterminate: unions now route to __builtin_memset unconditionally, with is_union tracked through the full type system including _Atomic(union) and typedef chains via TDF_UNION
Compound literal dangling pointer via top_is_call heuristic: function-call exclusion in compound literal detection allowed identity_ptr(&(struct Config){.mode=1}) to use if/else path, scoping the compound literal to the else block (C11 §6.5.2.5p5): if the function returns the CL address, the pointer dangles; token-level analysis cannot determine escape behavior; removed heuristic entirely, ternary path now unconditional at all parenthesis depths
register union zeroinit bypass: register union U u; fell through to = {0} (memset blocked by !has_register), only zeroing the first member; now rejected with a hard error in both Phase 1D and Pass 2, since register forbids address-taking (ISO C11 §6.7.1p6) making memset impossible

#Bug Fixes

noreturn: attribute scanner only searched forward from attribute position: post-declarator forms like void die(void) __attribute__((noreturn)); invisible because scan hit ; before finding ident(; added backward scan from attribute origin through token pool (89ef391)
zeroinit: _Atomic(union U) and _Atomic(UnionTypedef) missing is_union flag propagation: _Atomic(type) handler in parse_type_specifier now sets is_union for both direct SUE and typedef inner types
zeroinit: Phase 1D for-init union rejection missing: for(union U u; ...) passed Phase 1D, caught only by Pass 2 defense-in-depth; two-pass invariant violation fixed
zeroinit: Phase 1D const-VLA would_memset missing union: const union U u; requiring memset not caught by const rejection check
Windows POSIX shim and test compatibility fixes (d60d16a, bc042f2)

#Tests

Auto-unreachable test suite: +183 tests validating __builtin_unreachable() injection after noreturn function calls across all attribute forms, chained calls, and edge cases (89ef391)

#Stats

7 issues fixed (4 bugs, 3 security vulnerabilities)
+112 new test functions, +319 new tests, total: 5,234 tests passing
+2,337 lines of new test coverage
10 files changed, +2,651 insertions, −102 deletions

#v1.0.9

GitHub ↗

Prism 1.0.9 fixes 17 bugs across defer validation, orelse transformation, zero-initialization, and the typedef table, including chain-aware scanning in defer bodies and orelse side-effect validation.

#Security

Defer validator scope escape: skip_to_semicolon in Phase 1F's validate_defer_statement had no scope boundary check; a missing ; inside a defer { ... } block caused the scanner to walk past } into unrelated code, either producing spurious errors on valid functions or silently missing real control-flow violations (f7caf27)
Chained orelse defer control-flow leak: defer_scan_orelse_in_group and validate_defer_statement's inline orelse scanner both had premature break after the first orelse; chained (expr orelse expr orelse return) in defer bodies let return/goto/break/continue bypass Phase 1F entirely, breaking LIFO unwinding guarantees (792ec8b)

#Bug Fixes

defer: false "shadows a name captured by defer" errors for variables declared at the top level of defer bodies: defer_body_refs_name used wrong block-depth threshold (1081ea0)
defer: walk_balanced expression-context enum bodies (sizeof(enum { X = 1 })) never registered defer shadow entries: silent rebinding at exit points (864197b)
defer: walk_balanced_orelse array-dimension enum bodies had the same shadow-tracking gap as walk_balanced (864197b)
defer: enum defer shadow check in Phase 1D issued hard error even when enclosing block has no control-flow exits: false positive on valid code (864197b)
defer: case/default label scanner in validate_defer_statement escaped block boundaries on complex case expressions (f7caf27)
defer: O(N×M) quadratic blowup in defer_body_refs_name caused apparent hang on large generated/macro-heavy files: replaced with single-pass O(M) capture set + O(1) per-name lookups (792ec8b)
orelse: typeof(... orelse ...) verbatim keyword leak in 9 emit paths: try_typeof_orelse hook missing from emit_range_ex, emit_expr_to_stop, emit_raw_verbatim_to_semicolon, emit_orelse_fallback_value, emit_expr_to_semicolon, and emit_bare_orelse_impl inner loops (792ec8b)
orelse: chained typeof orelse side-effect validation gap: Phase 1D break after first orelse only checked first LHS, intermediate LHS ranges in typeof(a orelse b orelse c) unchecked for side effects (792ec8b)
zeroinit: __extension__-prefixed for-init declarations bypassed zero-initialization: p1_scan_init_shadows didn't skip __extension__/TT_INLINE prefix tokens (5661e79)
zeroinit: P1_IS_DECL annotation placed on __extension__ prefix instead of actual type keyword: Pass 2 scan past storage/inline tokens never found annotation (5661e79)
zeroinit: declarations after complex case labels (case (int)'A':, case ENUM | FLAG:) missed zeroinit: : handler only recognized identifier/number predecessors (1081ea0)
zeroinit: braceless while/do loop body zeroinit gated on FEAT(F_DEFER) only: with -fno-defer, brace wrapping never applied (1081ea0)
zeroinit: any_would_memset two-pass invariant violation: Phase 1D split predicate missing is_typedef in _Atomic aggregate check, disagreeing with Pass 2 (1081ea0)
Inner-scope struct tag redefinitions not registered when body lacked VLA/volatile members: tag_lookup returned stale outer-scope flags, causing false CFG errors or incorrect memset (f7caf27)
Struct tag registration blocked by same-name typedefs: parse_typedef_declaration gated on !is_known_typedef(tag), losing volatile/VLA member tracking for the common typedef struct Foo { ... } Foo pattern (792ec8b)

#Stats

17 bugs fixed, 2 security vulnerabilities patched
+8 new test functions, +56 new tests, total: 4,915 tests passing
+728 lines of new test coverage
8 files changed, +1,031 insertions, −142 deletions

#v1.0.8

GitHub ↗

Prism 1.0.8 closes 20 bugs across the transpiler, including keyword table coverage, namespace isolation, statement-expression dispatch completeness, and braceless control flow scope tracking.

#Security

ILP32 keyword shift UB: KW_MARKER used (uintptr_t)flags << 32 which is undefined behavior on 32-bit platforms where uintptr_t is 32 bits, corrupting all keyword tag/flag classification and silently breaking every keyword-dependent analysis (61b5fb3)
Braceless compound literal scope underflow: compound literal braces (struct S){...} inside braceless control flow didn't decrement ctrl_state.brace_depth properly, leaking ctrl_state.pending to the next statement and popping defer shadows below the current scope (61b5fb3)
Braceless shadow scope leak: p1d_probe_declaration registered typedef shadows using the enclosing block's scope close, so braceless body declarations like if (c) int MyTypedef; permanently poisoned the name for the entire enclosing scope, blinding the CFG verifier and skipping zero-init (379c242)
walk_balanced bracket stmt-expr bypass: the bracket [...] flat-emit loop had no is_stmt_expr_open check, so ({...}) inside array subscripts in balanced groups bypassed zero-init, defer cleanup, and all keyword processing (490a8c5)
emit_noise_between_raws stmt-expr bypass: flat emit_tok loop lacked stmt-expr dispatch, allowing ({...}) inside attribute noise between raw declarators to bypass the full processing engine (490a8c5)
process_declarators raw-bail stmt-expr bypass: the raw declaration verbatim-emit loop used flat token emission without stmt-expr detection, allowing zero-init and defer bypass inside statement expressions (490a8c5)
_Alignas SUE probe skip in defer: EMIT_DEFER_BODY's SUE body probe didn't skip parenthesized arguments of qualifiers, so _Alignas(16) struct S { int x; }; in a defer body caused = 0 to be injected into struct field definitions (490a8c5)
Attribute-stealing struct tag scanner: skip_noise was missing from the struct tag extraction loop, so struct __attribute__((aligned(8))) Tag { registered aligned instead of Tag as the struct name: corrupting VLA/volatile member tracking (76a1612)
C11 §6.2.3 namespace collapse: typedef_add_entry duplicate check, typedef_lookup, and parse_type_specifier's typeof handler collapsed C's tag namespace with ordinary identifiers, silently dropping struct tag entries and bypassing zero-init/volatile tracking (76a1612)
Param orelse funcdef bypass: p1d_reject_proto_param_orelse only checked for ; after ) (prototypes), letting function definitions with { escape entirely: void f(int buf[hw_flag orelse 128]) { } produced a ternary with volatile double-read UB (9e71bc1)
Asm specifier evasion: GCC __asm__("symbol_name") renaming specifiers after ) were not skipped by skip_noise, causing the ;/{ detection to fail and the entire bracket-orelse parameter scan to be silently skipped (9e71bc1)
Block-scope typedef rettype gate: p1_func_proto_map at brace_depth>0 missed typedef-named return types, so typeof(f) inside a function body triggered spurious memset on a function type: writing to .text segment (SIGSEGV) (9e71bc1)
Nested funcptr param scan: bracket-orelse parameter scan was flat (no recursion into nested () groups), so orelse inside function-pointer parameter brackets was never checked, enabling the same volatile double-eval UB (9e71bc1)
typeof funcptr attribute blindness: is_typeof_func_type used tok_next(fs) without skip_noise, missing __attribute__/[[...]] between ( and *: function pointer type misclassified as function type, skipping memset → write to .text → SIGSEGV (f439990)
Missing C23/GCC type keywords: 14 float types (__float128, _Float16, _Float32, _Float32x, _Float64, _Float64x, _Float128x, _Decimal32, _Decimal64, _Decimal128, etc.) and 2 typeof_unqual variants (__typeof_unqual__, __typeof_unqual) absent from keyword table: treated as plain identifiers, bypassing zero-init; also fixed is_unqual length check (== 13 → >= 13) which broke qualifier stripping for 15/17-char variants (f439990)

#Bug Fixes

orelse: orelse inside GNU __attribute__((...)) or C23 [[...]] arguments was invisible to Phase 1D, leaking the raw keyword to the backend compiler (320fe44)
raw: emit_type_range had no try_strip_raw in its final emit_tok fallthrough, so raw inside struct/union bodies at brace depth > 0 leaked verbatim to C output (320fe44)
raw: emit_token_range used bare OUT_TOK(t) without try_strip_raw, so raw int f() { defer ...; return 42; } produced raw int __prism_ret_0 = (42); (320fe44)
orelse: reject_orelse_side_effects fired unconditionally on bare orelse RHS with LHS indirection, but function return types are never variably-modified (C11 §6.7.6.3p1): false positive on valid code (76a1612)
defer: emit_statements' : label handler was gated on mode != EMIT_DEFER_BODY, preventing case/default labels from resetting at_stmt_start: bare orelse after case labels in defer bodies leaked verbatim to C output (f439990)

#Stats

20 bugs fixed, 15 security vulnerabilities patched
+13 new test functions, +110 new compliance tests, total: 4,859 tests passing
+1,131 lines of new test coverage
9 files changed, +1,412 insertions, −127 deletions

#v1.0.7

GitHub ↗

Prism 1.0.7 closes 26 bugs across the transpiler, including defer body emission integrity, two-pass invariant enforcement, volatile/VLA type tracking through struct bodies, and noreturn detection safety.

#Security

Lexical noreturn shadowing: a local variable or parameter shadowing a noreturn function name (void (*exit)(void)) still got __builtin_unreachable() injected after the call: silent miscompilation turning reachable code into UB (018a0a0)
Volatile member memset: structs with volatile-qualified fields were zero-initialized via memset, which strips the volatile qualifier: compiler may optimize away stores to memory-mapped I/O registers (c81cff2)
C tag namespace collapse: typedef_lookup collapsed C's tag namespace (§6.2.3) with ordinary identifiers, so int MMIO = 1; created a shadow that hid struct MMIO { volatile int x; }: volatile-member and VLA-member lookups on the struct tag silently failed (76c3ba1)
typeof/_Atomic paren-skipping in struct body scanners: struct_body_contains_vla() and struct_body_contains_volatile() skipped all (...) groups, making typeof(volatile int) and typeof(int[n]) fields invisible: volatile qualifier stripped or VLA missed (76c3ba1)
Backward goto over VLA: CFG verifier only checked defers between label and goto, not VLA declarations: a backward goto looping over a same-scope VLA re-allocates without freeing, enabling unbounded stack exhaustion (2bf9e0d)
const VLA memset: const typeof(int[len]) buf; emitted __builtin_memset on a const object: undefined behavior (C11 §6.7.3p6) (86be39a)
register VLA: register int buf[n]; has no valid zero-init strategy (VLA can't use = {0}, register forbids address-taking for memset): silent failure to initialize (86be39a)
Bare orelse VM-type double evaluation: typeof(RHS) evaluates operand at runtime for variably-modified types; if the RHS function returns a pointer-to-VLA, the call fires twice (86be39a)
Defer body ctrl_state leak: EMIT_DEFER_BODY didn't consume ctrl_state on { tokens, so after if(cond) the pending state leaked into the braced body, wrapping declarations in spurious { int x = 0; }: variable went out of scope immediately (ed9fd38)

#Bug Fixes

defer: typeof-orelse expressions inside defer bodies were gated by mode != EMIT_DEFER_BODY: raw orelse keyword leaked verbatim to backend (ed9fd38)
defer: bracket-orelse inside defer bodies had the same EMIT_DEFER_BODY gate: compound literal and sizeof orelse leaked raw (ed9fd38)
defer: paren-wrapped orelse (0 orelse return) inside defer bypassed Phase 1F validation: scan_decl_orelse strips outer parens, making the return action reachable, corrupting defer stack unwinding (5c3657b)
defer: ctrl_state not reset after braceless body brace-wrap computation: leaked to next declaration, suppressing check_defer_var_shadow (c81cff2)
defer: body emission loops (emit_block_body, emit_deferred_range) ran walk_balanced on control-flow conditions without at_stmt_start tracking: declarations and labels inside for()/if() inits bypassed zero-init and CFG checks (2bf9e0d)
orelse: constexpr combined with orelse was not rejected by Phase 1D: runtime fallback emitted into a C23 compile-time constant declaration (86be39a)
orelse: bracket orelse reject_orelse_side_effects passed check_asm=false at 4 call sites: asm statements inside orelse LHS silently duplicated by ternary expansion (86be39a)
orelse: Phase 1D multi-declarator split predicate was blind to orelse on the current declarator: int a = f() orelse 5, b; didn't trigger a split, emitting incompatible anonymous struct types (3cc88eb)
orelse: Phase 1D split predicate only checked has_init for the next declarator, missing VLA: typeof(int[n]) a = {0}, b; violated the two-pass invariant (3cc88eb)
orelse: VM return-type double evaluation: bare orelse exempted bare function calls in RHS from side-effect rejection, but a function can return pointer-to-VLA, causing typeof(RHS) to evaluate the call at runtime (86be39a)
zeroinit: se_brace[8] capacity in defer_body_refs_name was too small for 9+ nested statement expressions: conservative false-positive blocked valid defer variable references (86be39a)
zeroinit: stmt-expr in ctrl condition label blindspot: Phase 1D balanced-group scan abort on ({...}) in if(...) left the closing ) unprocessed, so at_stmt_start was never set for the braceless body: labels and declarations invisible to CFG verification and zero-init (c2b7f68)
BOFrame fixed-size array overflow: unsigned oe_ids[16], dim_ids[16] poisoned by inner stmt-expr declarations beyond 16 bracket-orelse entries: now arena-allocated with unbounded capacity (2bf9e0d)
HashMap arena leak: HashMap.buckets used calloc/free (heap) but FuncMeta.defer_name_set lives on the arena; arena_reset obliterated FuncMeta without freeing buckets: permanent heap leak per function-with-defer in PRISM_LIB_MODE (c81cff2)
typeof control-flow keyword rejection unconditionally errored on return/goto/break/continue/defer inside typeof(): broke glibc INLINE_SYSCALL macro which expands to __typeof__(({...return...})) (b6f83b2)
extern declaration false positive as nested function: K&R fallback scan walked forward from ; through subsequent code to find { (e.g. a switch body), falsely classifying the extern declaration as a nested function definition (ed38b7e)

#Stats

26 bugs fixed, 9 security vulnerabilities patched
+8 new test functions, +37 new compliance tests, total: 4,751 tests passing
+1,352 lines of new test coverage
9 files changed, +1,744 insertions, −244 deletions

#v1.0.6

GitHub ↗

Prism 1.0.6 drops the _Generic member rewrite engine (spec-only, no codegen) and fixes 18 bugs found in a full-pass audit. Areas covered: C23 attribute handling across orelse/bracket/struct paths, Objective-C compatibility, typeof nesting, __label__ local labels, and orelse keyword shadow disambiguation (including real typedefs named orelse, via positional context).

#Security

Nested typeof(typeof(VLA)) misidentified as function type: memset skipped, leaving VLA uninitialized (63ab2b4)
emit_block_body missing zero-init dispatch after labels/case in statement expressions: variables left uninitialized in ({...}) blocks (194f498)

#Bug Fixes

orelse: typedef int orelse; followed by orelse x = get() orelse 42; produced untransformed output: 12-site fix unifying real typedef + shadow into positional disambiguation across Phase 1D and Pass 2 (63ab2b4)
orelse: C23 [[attr]] on first declarator stole bracket orelse FIFO queue entry meant for second declarator: int [[attr]] a[f() orelse 1], b[g() orelse 2]; corrupted b's transformation (17b40d0)
orelse: C23 attribute prefix leaked orelse keyword into output: attribute noise tokens before orelse bypassed keyword detection (17b40d0)
orelse: bare orelse comma-prefix range used raw emit_tok loop: raw keyword leaked through in x = 1, y = f() orelse 0; (63ab2b4)
raw: walk_balanced bracket subscript fast-path used emit_tok instead of emit_tok_checked: raw keyword leaked through [(raw int)x] cast expressions (63ab2b4)
typeof: typeof(typeof(int[n])) inner ( misidentified as function parameter list: suppressed VLA memset (63ab2b4)
typeof: void function with trailing GNU __attribute__((noreturn)): walk_back_skip_attrs stopped at the attribute instead of reaching function name, causing false function-type identification failure (5299296)
defer: struct/union/enum bodies inside defer false-positive zero-initialized members: struct { int x; } in defer body got int x = 0; (194f498)
defer: storage class / type specifier prefix on struct declaration inside defer bypassed SUE body detection: static struct S { int x; } s; in defer zero-initialized the struct body (194f498)
emit_block_body: missing typeof orelse, bracket orelse, SUE body, and enum defer shadow dispatches in statement expression processing (194f498)
zeroinit: _Pragma(...) and C23 [[attr]] noise tokens at statement start inside ({...}) blocked zero-init detection: ({ _Pragma("once") int x; x; }) left x uninitialized (5299296)
zeroinit: Objective-C @interface/@implementation ivar blocks treated as regular struct bodies: { int _reserved; } after @interface got false zero-initialization (4d4e839)
zeroinit: Objective-C protocol declarations and generics angle brackets <Type> mismatched as less-than operator: caused parse confusion in subsequent declarations (4d4e839)
C23 [[attr]] before named struct in walk_back_skip_attrs: attribute tokens between struct keyword and name blocked backward walk, breaking zero-init and function-type detection (86a98d8)
auto-unreachable: __builtin_unreachable() injected inside braceless control body in statement expressions: if (cond) noreturn_fn(); inside ({...}) created multi-statement braceless body (86a98d8)
anonymous struct multi-declarator split detection used skip_prep_dirs instead of skip_noise: C23 attributes before anonymous struct body bypassed the split rejection check (86a98d8)
__label__: duplicate label names in Phase 1D name mangling produced identical mangled labels: __label__ a; __label__ a; in nested scopes crashed or produced wrong code (17b40d0)
macOS preprocessing missing _DARWIN_C_SOURCE define: system headers using Darwin extensions failed during flatten (4d4e839)

#Other Changes

Dropped _Generic member rewrite engine: removed ~500 lines of codegen and 22 test functions; _Generic now passes through untransformed (standard C) (1841bdc)
Unified emit_block_body + emit_deferred_range into 2-mode emit_statements engine: single code path for all statement-level processing in defer bodies and statement expressions (17d642a)
Shrunk P1FuncEntry and TypedefEntry from 40 → 32 bytes (2 per cache line); reduced skip_one_stmt_impl stack from 82KB → 9KB (fe50fa9)
Updated SPEC.md: orelse shadow disambiguation section rewritten, walk_balanced raw stripping, is_typeof_func_type nested typeof skip, 8 distributed positional check sites documented

#Stats

18 bugs fixed, 2 security vulnerabilities patched
+19 new test functions, total: 4,653 tests passing
+214 net lines of new test coverage
12 files changed, +2,833 insertions, −2,817 deletions

#v1.0.5

GitHub ↗

Prism 1.0.5 includes internal refactoring for upcoming features, plus correctness and security fixes: 67 bugs across the transpiler, including the _Generic member rewrite engine, two-pass invariant violations, defer cleanup integrity, and orelse type safety.

This release also introduces a formal language specification with 307 compliance tests, expanding validation toward ISO C99 / C11 / C23.

#Security

Function type erasure: typeof(func_typedef) through chained typedefs and direct typeof(int(int,int)) signatures lost the function-type flag, emitting memset on function type: .text segment write / SIGSEGV (c92930a)
Initializer braces pushed SCOPE_BLOCK instead of SCOPE_INIT, inflating block_depth: defer cleanup silently dropped on scope exit (6e926ac)
Forward-declared non-noreturn function tagged noreturn by attribute scanner, injecting __builtin_unreachable(): unconditional crash (edae040)
K&R function name resolution walked past token_pool[0]: out-of-bounds memory access (6dafccd)
emit_defers_ex triggered infinite recursion on cyclic scope reference: stack overflow DoS (6dafccd)
_Generic member rewrite used buffer-relative position invalidated by 128KB out_flush(): non-deterministic code corruption at buffer boundary (a694cb6)
Bare orelse typeof(LHS) with indirection operators (*, ->, ., []) evaluated operand at runtime for variably-modified types: spurious volatile reads / double side effects (8fcca8a)

#Bug Fixes

_Generic: ternary colon confused with association separator, blocking member rewrite on ternary branches (40b6fbc)
_Generic: same-name-different-args: function with identical name but different arguments silently lost the argument list (6e926ac)
_Generic: extraction discarded trailing expressions after close paren (a694cb6)
_Generic: chain walk destroyed factory pattern suffixes: obj.factory().method() truncated to obj.factory() (a694cb6)
_Generic: prefix multiplication on chained calls: get_api()->fetch() injected prefix before both identifiers (a694cb6)
_Generic: ring buffer overflow on long prefix chains fell back to wrong code silently (e32bdc2)
_Generic: paren-wrapped target int: (handler) bypassed rewrite (e32bdc2)
_Generic: multi-layer paren peeling not handled: int: ((handler)) bypassed rewrite (452a220)
_Generic: prefix_buf overflow produced silent fallback instead of hard error (452a220)
_Generic: ternary branch prefix drop: one arm of conditional target missed injection (3410f7d)
_Generic: line directive desync on member rewrite rewind: #line tracking corrupted after output buffer rewind (3410f7d)
_Generic: nested rewrite left orphan prefix text in output buffer (3410f7d)
_Generic: inner-generic prefix drop: nested _Generic inside outer _Generic association lost the member prefix (60fc35e)
_Generic: paren-complex target with cast prefix not handled (60fc35e)
_Generic: array/member target boundary detection produced wrong rewrite range (60fc35e)
_Generic: cast-prefix (type)handler dropped during association value rewrite (c13effd)
_Generic: nested rewrite blind spots in subtree emission loops: walk_balanced and walk_balanced_orelse missing hook (e966190)
_Generic: member rewrite missing from emit_deferred_range, emit_range_ex, and emit_token_range_orelse: defer bodies, const orelse init, and bracket orelse emitted _Generic verbatim; emit_token_range_orelse used raw OUT_TOK bypassing last_emitted and emit save ring entirely (f69d460)
defer: ghost enum defer shadow bypass in sizeof/cast/typeof expressions (edae040)
defer: ghost enum defer shadow escape into enclosing scopes (452a220)
defer: stmt-expr escape in control-flow condition heads inside defer bodies bypassed validation (edae040)
defer: backward goto over same-scope defer loop: CFG verifier missed same-depth defer entries (3410f7d)
defer: backward goto in nested scope used wrong ancestor-check direction: defer cleanup silently skipped (ae8a43f)
defer: C23 [[attr]] between function signature and body consumed into return-type typedef synthesis (2ac2200)
defer: emit_deferred_range/emit_block_body flat emit_tok loop bypassed stmt-expr/orelse/zeroinit processing in control-flow conditions (6e926ac)
defer: attributes encapsulating control-flow statements bypassed CFG verification (e966190)
orelse: -> operator matched as -- in side-effect rejection check: false rejection of member access (8fcca8a)
orelse: UB shift in orelse_shadow_is_kw: undefined behavior in transpiler itself (8fcca8a)
orelse: bracket orelse stmt-expr reentrancy clobbered processing state: nested ({...}) in array dimensions corrupted context (e51e08b)
orelse: orelse inside prototype VLA dimensions not rejected: produced invalid C (e51e08b)
orelse: typeof_var memset queue reentrancy clobber in stmt-expr array dimensions: pending memset entries silently overwritten (44ce49a)
orelse: reject_orelse_side_effects missing control-flow keyword check: orelse goto L not detected as action form (44ce49a)
orelse: RHS control-flow duplication: goto/return in chained orelse fallback emitted twice (c13effd)
orelse: control-flow keywords inside type specifier positions not rejected (c13effd)
orelse: C23 constexpr declarations with orelse not rejected: constexpr requires compile-time constant (c13effd)
orelse: last-link bare orelse used ternary with usual arithmetic conversions: silently widened types across arms (e41533c)
orelse: deferred orelse action not routed through full transpilation engine: blocks and keywords processed raw (e41533c)
orelse: const-pointee VLA false rejection: const int (*p)[n] has const pointee, not const VLA (ae8a43f)
orelse: stmt-expr paren-strip leaked keyword: (orelse) inside statement expression bypassed detection (6ca00ce)
orelse: typeof_var reentry after fix produced wrong test result (c13effd)
orelse: attr-raw VLA safety bypass: attributes between raw and VLA dimensions bypassed CFG check (e966190)
zeroinit: __extension__ prefix bypassed zero-initialization: __extension__ int x; emitted without = 0 (edae040)
zeroinit: for-init typedef type system desync: TT_TYPEDEF routing missing in p1_scan_init_shadows (ae8a43f)
raw: keyword leak in cast/sizeof/compound-literal: walk_balanced and emit_range_ex missing try_strip_raw (edae040)
raw: per-declarator raw hidden behind attributes: int x, __attribute__((unused)) raw y; leaked raw into output (e32bdc2)
raw: bitfield raw leak at colon: raw int x : 4; leaked keyword past colon (60fc35e)
emit_type_range SUE body strip fooled by __attribute__ arguments: packed matched as struct name, stripping anonymous struct body (2ac2200)
O(N²) in p1d_scan_balanced_group on nested parentheses containing statement expressions (40b6fbc)
sizeof((arr)[n]) VLA false positive: ) predecessor falsely signaled type context in expression position (6e926ac)
skip_one_stmt else-transition trail flush poisoning: parent cache entries corrupted by true-branch token caching (6e926ac)
skip_one_stmt tn=0 on do-while entry destroyed parent trail: O(N²) rescans and incorrect cache values (6e926ac)
] VLA false positive on multidimensional subscripts: arr[1][n] inner ] falsely signaled type context (a694cb6)
MSVC diagnostic push/pop emitted nothing: #pragma warning(push) / pop pair missing (e32bdc2)
_Float128 suffix silent precision loss: 1.0f128 suffix not preserved during emission (e32bdc2)
Braceless typedef scope poison: typedef registered in braceless control-flow body persisted past body end (452a220)
VLA multi-declarator sequence point split: VLA dimension expressions evaluated in wrong order after declaration splitting (452a220)
typeof_unqual off-by-one const-stripping: qualifier removal consumed one token too few (3410f7d)
C23 enum Color : int { ... } fixed underlying type not parsed: colon consumed as label (60fc35e)
C23 constexpr declarations silently skipped by TT_SKIP_DECL flag: transpiler never processed constexpr variables (c13effd)
out_str large token flush tracking: out_total_flushed not updated for tokens exceeding 128KB buffer, corrupting absolute byte positions (e41533c)
p1d_scan_balanced_group flat inner_depth counter didn't distinguish stmt-expr ( from regular (: false error on valid code (e41533c)
Typedef array const-stripping removed is_const for array typedefs; added missing is_volatile/TDF_VOLATILE tracking (ae8a43f)

#Stats

69 issues fixed (67 bugs, 2 crashes), 7 security vulnerabilities patched
+53 new test functions, +307 formal compliance tests, total: 4,679 tests passing
+6,066 lines of new test coverage
13 files changed, +8,165 insertions, −1,141 deletions

#v1.0.4

GitHub ↗

Prism 1.0.4: no new features. Internal cleanup, refactoring, and bug fixes.

#Bug Fixes

orelse: ternary expression only caught by Pass 2 two-pass invariant breach (cf274c1)
orelse: scan_decl_orelse paren unlinking miscompile inside larger expressions (5a4243d)
orelse: stmt-expr LHS flat-emitted in condition wrap, bypassing defer/zeroinit (5a4243d)
orelse: bare cast accepted non-lvalue (5a4243d)
orelse: inside ctrl-flow condition parens two-pass violation (7fa5c85)
orelse: p1d_decl_has_bracket_orelse paren-skip desync (7fa5c85)
orelse: bare orelse without LHS expression leaks to Pass 2 (c4c9311)
raw: raw * expr at statement start misclassified as pointer declaration, stripping token (c4c9311)
zeroinit: parenthesized function typedef false positive (5a4243d)
zeroinit: typeof(param) bypass when param shadows function name (c4c9311)
zeroinit: param shadow registration missing p1_func_proto_map check (c4c9311)
zeroinit: noreturn attribute argument poisoning: __attribute__((cleanup(noreturn))) injected __builtin_unreachable (8abb51e)
zeroinit: VLA deref paren adjacency: sizeof(*(param)) hid * from backward look (8abb51e)
defer: braceless defer shadow false positive: p1d_ctrl_pending leaked into shadow checker (8abb51e)
defer: O(N²) defer/decl shadow check via bloom filter saturation (c4c9311)

#Refactoring

Moved ~1,375 lines of parsing infrastructure from prism.c to parse.c
Replaced defer_name_bloom (64-bit bloom filter) with defer_name_set (exact HashMap)
Extracted defer_body_refs_name, is_stmt_expr_open (13 call sites) shared helpers
Deleted dead code: defer_name_bloom_bit, INITIAL_ARRAY_CAP, has_zeroinit_decl, tok_name_eq, orelse guard code
Fixed -Wsign-compare in equal_n

#Stats

15 bugs fixed
+11 new test functions, total: 4,147 tests passing
prism.c: 10,829 → 8,867 lines (−1,962)
parse.c: 2,094 → 3,609 lines (+1,515)
Net: −447 lines of source code
9 files changed, +2,525 insertions, −2,627 deletions

#v1.0.3

GitHub ↗

Prism 1.0.3 adds no new features. Focus is correctness and security: 33 bugs fixed across the two-pass architecture, including two-pass invariant violations, security-critical data corruption paths, and denial-of-service vectors.

#Security

typeof((func)) parenthesized function name bypassed function-type detection, emitting memset on .text segment: memory corruption (a5d566e)
sizeof(n * int[n]) commutative VLA rewriting bypassed the VLA detector: silent stack corruption (0abd764)
Deeply nested braceless do statements caused unbounded recursion in skip_one_stmt: stack overflow DoS (a945663)

#Bug Fixes

defer: stmt-expr false positive in defer shadow checker (72fcf86)
defer: braceless switch find_switch_scope() leaked to outer switch, wiping its defer count (75ecedf)
defer: C23 attribute bypassed defer stmt-expr chain check two-pass violation (a945663)
defer: case/default p1d_ctrl_pending leak bypassed CFG goto-over-declaration check (270b1fa)
defer: shadow same-block two-pass violation between Phase 1D and Pass 2 (0abd764)
orelse: typeof bit-field in bare orelse produced invalid temporary type (8888ae3)
orelse: chained assignment a = b = f() orelse 5 split-brain found wrong = (a850967)
orelse: VLA param decay false positive: sizeof(arr) on multidim VLA parameter (c2372aa)
orelse: __auto_type cast in orelse temporary declaration (c2372aa)
orelse: const-VLA orelse duplicated the VLA size expression (acf026b)
orelse: GNU stmt-expr ({...}) in orelse fallback position not recognized (acf026b)
orelse: ctrl-paren bracket orelse two-pass violation (acf026b)
orelse: typeof orelse side-effect two-pass violation (acf026b)
orelse: parenthesized (expr orelse val) two-pass violation (acf026b)
orelse: bare orelse preprocessor conditional check two-pass violation (0abd764)
orelse: volatile double-write via compound literal orelse fallback (270b1fa)
zeroinit: block-scope function prototype typeof emitted spurious memset on function type (a850967)
zeroinit: for-init VLA memset two-pass violation (0abd764)
zeroinit: param multidimensional VLA sizeof false positive (25cbe72)
zeroinit: complex return type attribute consumed into typedef synthesis (25cbe72)
raw: raw token leak past GNU/C23 attributes (a945663)
Nested stmt-expr ctrl_save_stack hijack: inner ({...}) popped outer's save entry (a5d566e)
skip_one_stmt cache poisoning false positive on if-else trail (270b1fa)
skip_one_stmt label swallowing: L: if(1) {} overran statement boundary (75ecedf)
array_size_is_vla exponential blowup on nested bracket patterns (8888ae3)
emit_type_range stmt-expr bypass in struct bodies (0ea1478)
File-scope typeof scope_tree NULL dereference (acf026b)
VM-type multi-declarator split two-pass violation (acf026b)
Dead const_td_is_array code removal (75ecedf)

#Stats

33 bugs fixed, 3 security vulnerabilities patched
+50 new test functions, total: 4,053 tests passing
+2,293 lines of new test coverage
13 files changed, +2,934 insertions, −971 deletions

#v1.0.2

GitHub ↗

Prism 1.0.2 adds no new features. Focus is quality, performance, and correctness.

#Performance

Prism's transpiler throughput improved by 13.4% (measured by retired instructions on self-transpile). Six hot paths were optimized with bloom filters, O(1) post-annotation typedef rejection, consolidated token metadata access, and a pure-C early exit for files with no orelse usage. (4650fc8)

#Algorithmic Improvements

Noreturn function tagging reduced from O(N·K) to O(N+K) via single-pass token annotation (46bb2a5)
Typeof func-proto scanning reduced from O(N²) to O(N) per declarator (12ff66f)
Nested bracket orelse scanning reduced from O(N²) to O(N) via iterative stack (6bb82d1)
Noreturn taint propagation reduced from O(D×T) to O(T+D×E) edge-based fixed-point (2b422a8)

#Bug Fixes

defer: orelse fallback block bypassed defer cleanup at scope exit (46bb2a5, fc098bb)
defer: stmt-expr goto/return inside orelse bypassed defer cleanup (6bb82d1)
defer: scope/block depth confusion over-unwound defers across goto boundaries (4e79cd5)
defer: stmt-expr goto bypassed defer cleanup in bare orelse comma expressions (4e79cd5)
defer: braceless control-flow in defer/orelse bodies broke brace injection (fc098bb)
orelse: raw string literal R"(...)" inside #if 0 desynchronized block-comment state (46bb2a5)
orelse: __attribute__ bracket orelse queue desynchronization (5942783)
orelse: keyword leak via static raw verbatim bypass (19032bc)
orelse: init-cast VLA orelse crash on variably-modified types (12ff66f)
orelse: bare comma split escaped braceless control flow (4e79cd5)
orelse: preprocessor conditional mangling in bracket orelse rejected in Phase 1D (2b422a8)
orelse: paren comma corruption in chained expressions (fc098bb)
orelse/defer: shadowed keywords suppressed by variable, enum, or typedef names (3f6e7c3)
orelse/defer: braceless control-flow body wrapping conflicts with orelse handler (fc098bb)
MSVC test compatibility fixes (fc098bb)
Recursion regression in deeply nested braceless if chains (2ec6a01)

#Stats

23 bugs fixed, 6 performance optimizations
+21 new test functions, total: 4,020 tests passing
+1,246 lines of new test coverage
9 files changed, +2,502 insertions, −1,040 deletions

#v1.0.1

GitHub ↗

Prism leaves the 1.0 stabilization phase and moves to a more frequent release cadence.

Prism now also applies progressive enhancements to plain C, not only explicit features like defer and orelse. Passing unmodified source through Prism can produce safer defaults and smaller binaries without source edits.

#Progressive Enhancement: Auto-Unreachable Insertion

Prism now automatically tracks _Noreturn, [[noreturn]], and standard library exit functions across your entire translation unit. It now silently injects __builtin_unreachable() (or __assume(0) on MSVC) after these calls. (b3a6981)

#Performance & Binary Size

Feeding explicit control-flow termination data to the backend C compiler enables aggressive dead-code elimination (DCE), allows the backend to drop unnecessary function epilogues, reduces register pressure, and improves branch prediction. Your binaries get smaller and faster automatically.

#Bug Fixes

defer: cross-branch goto dropped cleanups: LCA exit gated behind flawed depth comparison (c3b824a)
defer: braceless for-body if/else prematurely cleared shadow scope (8017af3)
defer: noreturn member namespace pollution injected false __builtin_unreachable() (6a0140e)
zeroinit: typeof func-type scanner ignored paren depth in _Static_assert(sizeof(...)) (c180878)
zeroinit: CFG verifier missed braceless-scope declarations in switch (3da543b)
orelse: static/extern persistence corruption: runtime re-init destroyed static semantics (05c61e2)
orelse: typeof(RHS) double-evaluated VM-type expressions in bare assignment (10cf638)
orelse: preprocessor directive in fallback concatenated if branches (887766d)

#Stats

8 bugs fixed, 1 feature added
+26 new test functions, total: 3,902 tests passing
+758 lines of new test coverage
10 files changed, +935 insertions, −240 deletions

#v1.0.0

GitHub ↗

This release rewrites the transpiler from a single-pass prototype into a two-pass design. It adds the orelse keyword, full native Windows (MSVC) support, and a larger test suite.

Prism is now self-hosting.

#Major Highlights

New Language Feature: The orelse keyword for fallback values and control flow.
Native Windows Support: Full compatibility with MSVC (cl.exe).
Two-Pass Architecture: A rewrite of the internal transpilation pipeline for better maintainability.
Parser hardening: Closed categories of parsing edge-case bugs.
Test expansion: Over 2,700 new tests added.
Formal Specifications: Technical SPEC.md & DRAFT_SPEC.md documentation.

#Two-pass architecture

Before, Prism used a single-pass architecture: it walked the token stream once, building the typedef table on the fly and emitting C as it went. Typedefs were popped from a mutable table on scope exit. Labels were scanned per-function right before emission. Goto safety was checked inline during code generation. It worked, but every edge case was a new special case bolted onto the emitter, and the emitter was already doing too much.

Now there are two distinct passes:

Pass 1 walks every token at every depth before a single byte is emitted. It builds an immutable symbol table of every typedef, enum constant, parameter shadow, and VLA tag. It constructs a full scope tree: every {/} pair with parent links and classification (loop, switch, function body, statement expression). It collects every label, goto, defer, case, and declaration into per-function entry arrays. Then a CFG verifier checks every goto→label and switch→case pair against defers and declarations. If your code is unsafe, Prism errors before writing a single byte.
Pass 2 is purely mechanical: it reads the immutable tables from Pass 1 and emits C. No typedef mutations, no scope tracking, no error decisions. Just output.

This separation closed entire categories of bugs. The old architecture had ~20 different places where the emitter had to make semantic decisions mid-output. Now it just reads annotations.

#Architecture Comparison

Execution: Single-pass emitter → two-pass (7 analysis phases + CFG verification + emission)
Symbol Table: Mutable typedef table with scope-depth popping → immutable symbol table with token-position-based range lookups
Label Scanning: Per-function label scan at emit time → all labels/gotos/defers collected in Pass 1, verified in Phase 2A
Goto Safety: Inline goto safety checks during emission → O(N) snapshot-and-sweep CFG verifier with hash-based label lookup
Scope Tracking: Ad-hoc scope tracking → full scope tree with parent links, classification, and ancestor queries

#Scale

The Codebase: 13,132 insertions and 7,287 deletions across 287 commits. The core transpiler grew from 5,839 to 13,494 lines of C (prism.c + parse.c + windows.c) to accommodate the deep semantic analysis phases.
The Test Suite: Expanded from ~1,000 to 3,795 tests across 9 suites (adding over 37,916 new lines of test code).
CI/CD Pipeline: Now continuously tested across 6 diverse platforms: Linux x86_64, macOS x86_64, macOS ARM64, Windows build-only, Linux ARM64, Linux RISC-V64.
Self-Hosting: Prism transpiles itself, the output compiles, that binary transpiles Prism again, and the two outputs match byte-for-byte.

#Documentation & Specs

SPEC.md: 785-line transpiler specification. Every item corresponds 1:1 to implemented behavior exercised by the test suite. This is not aspirational: it describes what the transpiler does.
DRAFT_SPEC.md: Ideas under consideration. Nothing here is implemented. Items may be adopted, modified, or rejected. Once implemented, they move to SPEC.md.

#v0.110.0

GitHub ↗

Prism v0.110.0 adds native Windows support (MSVC), performance gains, and hardening across the transpiler and parser.

#1.60× faster end-to-end.

Version	Mean	Range
v0.105.0	317.4 ms ± 7.0 ms	303.7 ms … 330.7 ms
v1.1	198.0 ms ± 3.1 ms	192.0 ms … 207.6 ms

Full compile pipeline, prism prism.c -o /dev/null, 30 runs (hyperfine)

Binary size (Linux): 79K → 99K (+25%)
Tests: 1,032 → 1,276 (+244)

#Performance

Fixed ~10× performance regression in token walker (750179f)
Pipe-based preprocessing: transpiler pipes directly to system compiler, skips preprocessor on second pass (f194f56)
Walker brace optimization + inline hot functions (emit_tok, new_token, walker) (76872b4)
Tag dispatch for faster token classification (76872b4)
Big optimization pass with fast paths throughout (c4104bb, cc44676)

#Fixed

Label zero-init bypass: : now treated as statement boundary (eac1eb1)
POSIX macro force-override: checks user #defines before appending defaults (eac1eb1)
typeof(volatile) memset: scans inside typeof() for volatile qualifier (eac1eb1)
Block comment and raw string newline tracking (29c951b)
scan_line_directive integer overflow (29c951b)
emit_expr_to_semicolon ternary : safety via depth tracking (29c951b)
scan_pp_number rejecting ' before non-hex letters (e2a27af)
Silently skipped zero-init in edge cases (48a4830)
Void typedef return bug (b9b6883)
Hashmap zombie resize corruption (2e29aca)
make_temp_file template truncation (2e29aca)
Typedef de-duplication (949f805)
typeof vars hard limit removed: dynamic allocation (6b72b4f)
assert.h emitted twice (f58464f)
path_basename separator ordering (3c2e355)
Pipe deadlock (949f805)
__builtin_memset used without string.h dependency (949f805)
Parser depth limit to prevent stack overflow (5ec9f63)
And many more

#Hardened

ENSURE_ARRAY_CAP: int → size_t overflow prevention, capacity reset on OOM (0823077)
new_file: free contents before error return, strdup NULL check (0823077)
argv_builder_add: strdup NULL check (f58464f)
tokenizer_teardown: NULL guard on input_files (228561a)
system_includes_reset: NULL guard on system_include_list (228561a)
error(): NULL guard on ctx in PRISM_LIB_MODE (29c951b)
warn_tok suppressed in lib mode (eac1eb1)
Lib mode OOM leak: init_keyword_map moved before pp_buf allocation (0823077)
TOCTOU removed in make_temp_file (0823077)
realloc/setjmp handling hardened (6b72b4f)
Hashmap tombstone handling (5ec9f63)
File view cache memory fix (1e66c01)
Per-transpilation memory leak in lib mode (1e66c01)

#Testing

1,276 tests (up from 1,032)
Regression tests for K&R defer, label zero-init, typeof(volatile), raw *ptr declarations, VLA zero-init, scan_pp_number, typedef edge cases (e2a27af, 48a4830, 0823077, eac1eb1, 5ec9f63)

#Misc

K&R-style functions now get defer and label support (eac1eb1)

#v0.105.0

GitHub ↗

Prism v0.105.0 is a consolidation release: harden the core and shrink it. It refactors large parts of the parser for speed and maintainability, and closes control-flow safety holes.

Code (prism.c + parse.c): 7,649 → 5,518 LOC (-27.9%)
Binary size (Linux): 107K → 79K (-26.2%)

#Fixed

goto skipping for-init declarations during mixed CLI flags
Scope-leak bugs hardened
defer edge cases bulletproofed

#Changed

Unified token walker with speedup in classification (1dabdde, 99568a6)
Tag-based token system with unified declaration parser (a06201b, ee08aea)
Table-driven CLI parsing, token spacing, and loop handling (ee08aea, d09b376, 23deede)
Merged control-flow state tracking (1d17dd4, 85f12cf)
Algebraic token spacing logic (23deede)
Simplified VLA logic (a1808d0, 6cc5aa0)
Simplified UTF-8 identifier handling (2d99fff)
Simplified output buffering with setvbuf (06b7886)
Simplified feature flags and control state reset (85f12cf)
Merged type parsing (b5b1525)
Merged VLA and defer handling (6cc5aa0)
Unified temporary file creation (d09b376)
Consolidated switch-scope handling (23deede)
Merged goto skip logic (d09b376)
Less verbose error messages (18a9980)

#Removed

Parsing not needed for Prism core (967aa9d)
Dead typedef fallback code (23deede)
Old CLI logic (5e9453b)
Duplicate array handling code (18a9980)
Duplicate error handling (1d17dd4)
Refactored globals towards thread safe lib mode (e67265b)

#Testing

Added 823 lines of test coverage
Total: 1,032 tests

#v0.100.0

GitHub ↗

First single-pass version of Prism. Unsafe early prototype; do not use.