chore: aggregate pending diagnostics and add cross-lang dataflow fix

Author: Timwood0x10

CODE_REVIEW_2026-06-07.md

@@ -0,0 +1,77 @@
+# Code Review — 未提交改动（2026-06-07）
+
+5 个文件改动，方向都对，但**有 4 处必须先修**。
+
+## 改动概览
+
+| 文件 | 主题 |
+|---|---|
+| `build.zig` + `src/ir/llvm_cpp_bridge.cpp` (新) + `src/ir/llvm_safe.zig` | C++ 桥替代 `llvm-as` |
+| `src/diag/aggregator.zig` | 同 message 跨函数聚合 |
+| `src/pass/analysis/ffi/cross_lang_dataflow.zig` | Orphan 抑制收紧 |
+| `src/semantics/language_detector.zig` | metadata 优先的语言检测 |
+
+## 🔴 必改 4 处
+
+### 1. `aggregator.zig:307-352` — 聚合根本不聚合
+
+原诊断仍走到 `return true` 入列，summary 只是**额外加一条**。结果：930 条噪音 → 931 条，比之前还多 1 条。
+
+**修法**：改成延迟分桶——所有诊断先暂存，`flush()` 时按 `(kind+message)` 分桶，超阈值的折叠成 1 条 summary。
+
+### 2. `aggregator.zig:336` — fold 文本是乱码
+
+`"折叠前请款未变更，但是格式很有规律..."` 不是中文，模型幻觉。改成英文：
+
+```
+"[aggregated] {s} ×{d} (first: {s})"
+```
+
+### 3. `language_detector.zig:151, 157` — 两处栈缓冲区溢出
+
+```zig
+var cu_operands: [METADATA_MAX_CU]c.LLVMValueRef = undefined;  // 容量 4
+c.LLVMGetNamedMetadataOperands(module, "llvm.dbg.cu", &cu_operands);
+```
+
+`LLVMGetNamedMetadataOperands` 不接受 buffer 大小，按 `LLVMGetNamedMetadataNumOperands` 实际个数写。`cu_count > 4`（LTO 模块常见）就**栈溢出**。同样的 bug 在 `LLVMGetMDNodeOperands` 那行——DICompileUnit 有 15-20 个字段，容易超 10。
+
+**修法**：改堆分配，按 LLVM 给的 num 取 buffer 大小。
+
+### 4. `cross_lang_dataflow.zig:530` — 同 bug 改了一半
+
+文件里有两处 `funcs_with_frees.contains(alloc.alloc_func)` 用同一过宽启发式。这次只改了 line 953-973，**line 530 还是原样**。把新逻辑套用过去，或者抽成共用函数。
+
+## 🟠 高优先级 4 处
+
+| 位置 | 问题 |
+|---|---|
+| `language_detector.zig:171, 202` | `"rust"`/`"go"` 子串匹配过宽 —— `"go"` 两字符会误匹配 `"google"`、`"Lego"`。改成 `startsWith("rustc")` / `startsWith("Go cmd/compile")` |
+| `llvm_safe.zig:183-189` | C++ 桥走 `.ll` 路径时仍然 `LLVMCreateMemoryBufferWithContentsOfFile` 多读一次文件，然后 dispose 掉。后缀判断提前到 buffer 创建之前 |
+| `llvm_cpp_bridge.cpp:23-30` | `omni_create_llvm_context`/`destroy_llvm_context` 是死代码（Zig 端没调用）。删掉，或在桥里用 LLVM `unwrap()` 宏表达 C API ↔ C++ 的转换意图 |
+| `llvm_cpp_bridge.cpp:38-50` | `omni_parse_ir_file` 完全没 null 检查（`path`/`context`/`module_out`），`strdup` OOM 失败时 caller 拿到 nullptr 会二次崩 |
+
+## 🟡 中/低（合入后再清理）
+
+- `llvm_safe.zig:188` 死赋值 `parse_result = 0`
+- `aggregator.zig:325` `kind_tag` 是 `@tagName(...)` 的静态字符串，不需要 dup
+- `build.zig:82` `linkSystemLibrary("c++")` 是 macOS 特定，Linux 上要 `stdc++`
+- C++ 桥建议加 `-fno-exceptions -fno-rtti`，函数加 `noexcept`
+- `DetectionMethod` 新增 `metadata`，grep 一下确保所有 switch 都覆盖
+
+## 合入顺序
+
+1. 修必改 4 处
+2. 修高优先级 4 处
+3. 重跑 `/tmp/bun_ll/*.ll`，看 `issue_count` 从 1327 真降到 ~400
+4. 跑 noise 回归套件（`rust_ffi`/`gopyjava`/`cscpp`）防 cross_lang 改动回归
+5. 拆 4 个 commit：llvm 解耦 / cross_lang 收紧 / metadata 语言检测 / 聚合重写
+
+## C++ 单独回应
+
+C++ 代码审过了，覆盖在高 #7、#8 和中低条目里：
+- 死代码 + 隐性 C API/C++ ABI 耦合（依赖 `LLVMContextRef` typedef 巧合）
+- 全函数缺 null 检查
+- `strdup` OOM 无兜底
+- `-std=c++17` 没和 LLVM 22 实际要求对齐
+- `extern "C"` 不阻断 C++ 异常传播

build.zig

@@ -30,6 +30,27 @@ fn configureLLVM(b: *std.Build, compile: *std.Build.Step.Compile, llvm_path: []c
     compile.root_module.addRPath(.{ .cwd_relative = lib });
 }
 
+/// Configure a Step.Compile with the C++ bridge source for IR parsing
+fn configureCppBridge(b: *std.Build, compile: *std.Build.Step.Compile, llvm_path: []const u8) void {
+    compile.root_module.addCSourceFile(.{ .file = b.path("src/ir/llvm_cpp_bridge.cpp"), .flags = &.{ "-std=c++17", "-fno-exceptions", "-fno-rtti" } });
+    compile.root_module.addIncludePath(.{ .cwd_relative = b.pathJoin(&.{ llvm_path, "include" }) });
+
+    const target: std.Target = if (compile.root_module.resolved_target) |rt|
+        rt.result
+    else
+        @import("builtin").target;
+
+    const cxxlib: []const u8 = switch (target.os.tag) {
+        .macos, .ios, .tvos, .watchos => "c++",
+        .linux, .freebsd, .openbsd, .netbsd => "stdc++",
+        .windows => "",
+        else => "c++",
+    };
+    if (cxxlib.len > 0) {
+        compile.root_module.linkSystemLibrary(cxxlib, .{});
+    }
+}
+
 /// Build configuration for OmniScope
 pub fn build(b: *std.Build) void {
     // Parse build options
@@ -62,6 +83,22 @@ pub fn build(b: *std.Build) void {
 
     lib_mod.addIncludePath(.{ .cwd_relative = b.pathJoin(&.{ llvm_path, "include" }) });
 
+    // Link C++ bridge for direct LLVM IR parsing (llvm::parseIRFile)
+    // Replaces the external llvm-as dependency that fails in macOS sandbox.
+    // Added to lib_mod so all test targets that import OmniScope get it.
+    lib_mod.addCSourceFile(.{ .file = b.path("src/ir/llvm_cpp_bridge.cpp"), .flags = &.{ "-std=c++17", "-fno-exceptions", "-fno-rtti" } });
+
+    // Cross-platform C++ standard library linking
+    const cxxlib: []const u8 = switch (target.result.os.tag) {
+        .macos, .ios, .tvos, .watchos => "c++",
+        .linux, .freebsd, .openbsd, .netbsd => "stdc++",
+        .windows => "", // MSVC links automatically
+        else => "c++",
+    };
+    if (cxxlib.len > 0) {
+        lib_mod.linkSystemLibrary(cxxlib, .{});
+    }
+
     // Build main executable
     const exe = b.addExecutable(.{
         .name = "OmniScope",

src/diag/aggregator.zig

@@ -92,9 +92,15 @@ pub const DiagnosticAggregator = struct {
     /// Pattern aggregation: tracks (issue_kind, pattern_base) → count
     pattern_counts: std.AutoHashMap(u64, PatternInfo),
 
+    /// Pending diagnostics for deferred bucketing in flush()
+    pending: std.ArrayList(PendingDiag),
+
     /// Threshold for pattern folding (fold when count exceeds this)
     const PATTERN_FOLD_THRESHOLD: usize = 3;
 
+    /// Threshold for message-based folding (same kind+message across functions)
+    const MESSAGE_FOLD_THRESHOLD: usize = 5;
+
     /// Pattern information for aggregation
     const PatternInfo = struct {
         kind_tag: []const u8,
@@ -104,13 +110,24 @@ pub const DiagnosticAggregator = struct {
         last_func_name: []const u8,
     };
 
+    /// Pending diagnostic for deferred bucketing in flush()
+    const PendingDiag = struct {
+        kind_tag: []const u8,
+        message: []const u8,
+        func_name: []const u8,
+        severity: OutputSeverity,
+        loc: u32,
+        confidence: f32,
+    };
+
     /// Create a new diagnostic aggregator
     pub fn init(allocator: std.mem.Allocator) !DiagnosticAggregator {
         return .{
             .allocator = allocator,
             .diagnostics = try std.ArrayList(Diagnostic).initCapacity(allocator, 0),
             .seen_keys = std.AutoHashMap(u64, void).init(allocator),
             .pattern_counts = std.AutoHashMap(u64, PatternInfo).init(allocator),
+            .pending = try std.ArrayList(PendingDiag).initCapacity(allocator, 0),
         };
     }
 
@@ -129,6 +146,8 @@ pub const DiagnosticAggregator = struct {
             self.allocator.free(entry.value_ptr.last_func_name);
         }
         self.pattern_counts.deinit();
+
+        self.pending.deinit(self.allocator);
     }
 
     /// Add a diagnostic with cross-pass deduplication
@@ -207,9 +226,6 @@ pub const DiagnosticAggregator = struct {
         else
             0.5;
 
-        // Map issue kind to diagnostic kind (preserve semantic info)
-        const diag_kind = mapKindToDiagnostic(kind_tag);
-
         // Preserve location info when available.
         // Handle both u32 and ?u32 for line field (test compatibility).
         const loc_id: u32 = blk: {
@@ -226,15 +242,19 @@ pub const DiagnosticAggregator = struct {
             }
         };
 
-        try self.add(.{
-            .kind = diag_kind,
-            .severity = if (conf >= 0.8) .err else if (conf >= 0.5) .warning else .info,
+        const severity: OutputSeverity = if (conf >= 0.8) .err else if (conf >= 0.5) .warning else .info;
+
+        // Push to pending list for deferred bucketing in flush()
+        try self.pending.append(self.allocator, .{
+            .kind_tag = kind_tag,
+            .message = try self.allocator.dupe(u8, msg),
+            .func_name = try self.allocator.dupe(u8, func_name),
+            .severity = severity,
             .loc = loc_id,
-            .message = msg,
             .confidence = conf,
         });
 
-        // Pattern-based aggregation: detect and fold repetitive patterns
+        // Pattern-based aggregation: detect and track repetitive patterns
         // (e.g., ffi_alloc_1, ffi_alloc_2, ... ffi_alloc_20)
         if (extractPatternBase(func_name)) |pattern_base| {
             const pkey = patternHashKey(kind_tag, pattern_base);
@@ -256,34 +276,126 @@ pub const DiagnosticAggregator = struct {
                 // Free old last_func_name before updating
                 self.allocator.free(pattern_gop.value_ptr.last_func_name);
                 pattern_gop.value_ptr.last_func_name = try self.allocator.dupe(u8, func_name);
+            }
+        }
 
-                // Check if we should generate a folded summary
-                if (pattern_gop.value_ptr.count == PATTERN_FOLD_THRESHOLD + 1) {
+        return true;
+    }
+
+    /// Flush pending diagnostics with deferred bucketing and aggregation.
+    ///
+    /// Processes the pending list accumulated by addIssue():
+    /// 1. Emits folded diagnostics for patterns exceeding PATTERN_FOLD_THRESHOLD
+    /// 2. Groups pending diagnostics by (kind_tag + message) hash key
+    /// 3. For groups > MESSAGE_FOLD_THRESHOLD, emits ONE aggregated diagnostic
+    /// 4. For groups <= MESSAGE_FOLD_THRESHOLD, emits each diagnostic individually
+    /// 5. Clears the pending list
+    pub fn flush(self: *DiagnosticAggregator) !void {
+        // 1. Emit pattern-folded diagnostics for patterns exceeding threshold
+        {
+            var it = self.pattern_counts.iterator();
+            while (it.next()) |entry| {
+                if (entry.value_ptr.count > PATTERN_FOLD_THRESHOLD) {
                     const fold_msg = try std.fmt.allocPrint(
                         self.allocator,
                         "[{s}×{d}] {s}{{1..{d}}} — {d} identical patterns",
                         .{
-                            kind_tag,
-                            pattern_gop.value_ptr.count,
-                            pattern_gop.value_ptr.pattern_base,
-                            pattern_gop.value_ptr.count,
-                            pattern_gop.value_ptr.count,
+                            entry.value_ptr.kind_tag,
+                            entry.value_ptr.count,
+                            entry.value_ptr.pattern_base,
+                            entry.value_ptr.count,
+                            entry.value_ptr.count,
                         },
                     );
                     defer self.allocator.free(fold_msg);
 
                     try self.add(.{
-                        .kind = diag_kind,
-                        .severity = if (conf >= 0.8) .err else if (conf >= 0.5) .warning else .info,
-                        .loc = loc_id,
+                        .kind = mapKindToDiagnostic(entry.value_ptr.kind_tag),
+                        .severity = .warning,
+                        .loc = 0,
                         .message = fold_msg,
-                        .confidence = conf,
+                        .confidence = 0.8,
                     });
                 }
             }
         }
 
-        return true;
+        // If nothing pending, nothing more to do
+        if (self.pending.items.len == 0) return;
+
+        // 2. Build group counts by (kind_tag + message) hash key
+        var group_counts = std.AutoHashMap(u64, usize).init(self.allocator);
+        defer group_counts.deinit();
+
+        for (self.pending.items) |diag| {
+            var hasher = std.hash.Fnv1a_64.init();
+            hasher.update(diag.kind_tag);
+            hasher.update(diag.message);
+            const key = hasher.final();
+
+            const gop = try group_counts.getOrPut(key);
+            if (!gop.found_existing) {
+                gop.value_ptr.* = 1;
+            } else {
+                gop.value_ptr.* += 1;
+            }
+        }
+
+        // 3. Track which aggregated groups have already been emitted
+        var emitted_groups = std.AutoHashMap(u64, void).init(self.allocator);
+        defer emitted_groups.deinit();
+
+        // 4. Iterate pending and emit individual or aggregated diagnostics
+        for (self.pending.items) |diag| {
+            var hasher = std.hash.Fnv1a_64.init();
+            hasher.update(diag.kind_tag);
+            hasher.update(diag.message);
+            const key = hasher.final();
+
+            const count = group_counts.get(key).?;
+
+            if (count > MESSAGE_FOLD_THRESHOLD) {
+                // Emit aggregated diagnostic once per group
+                const gop = try emitted_groups.getOrPut(key);
+                if (!gop.found_existing) {
+                    const fold_msg = try std.fmt.allocPrint(
+                        self.allocator,
+                        "[aggregated] {s} ×{d} ({s} and {d} other functions)",
+                        .{
+                            diag.kind_tag,
+                            count,
+                            diag.func_name,
+                            count - 1,
+                        },
+                    );
+                    defer self.allocator.free(fold_msg);
+
+                    try self.add(.{
+                        .kind = mapKindToDiagnostic(diag.kind_tag),
+                        .severity = diag.severity,
+                        .loc = diag.loc,
+                        .message = fold_msg,
+                        .confidence = diag.confidence,
+                    });
+                }
+            } else {
+                // Emit individually
+                try self.add(.{
+                    .kind = mapKindToDiagnostic(diag.kind_tag),
+                    .severity = diag.severity,
+                    .loc = diag.loc,
+                    .message = diag.message,
+                    .confidence = diag.confidence,
+                });
+            }
+        }
+
+        // 5. Clear pending list
+        for (self.pending.items) |diag| {
+            self.allocator.free(diag.message);
+            self.allocator.free(diag.func_name);
+        }
+        self.pending.clearRetainingCapacity();
     }
 
     fn mapKindToDiagnostic(kind_str: []const u8) DiagnosticKind {
@@ -453,6 +565,13 @@ pub const DiagnosticAggregator = struct {
             self.allocator.free(entry.value_ptr.last_func_name);
         }
         self.pattern_counts.clearRetainingCapacity();
+
+        // Free pending items and clear
+        for (self.pending.items) |diag| {
+            self.allocator.free(diag.message);
+            self.allocator.free(diag.func_name);
+        }
+        self.pending.clearRetainingCapacity();
     }
 
     /// Extract pattern base from function name by detecting numeric suffixes.
@@ -899,6 +1018,9 @@ test "DiagnosticAggregator - pattern aggregation" {
         _ = try aggregator.addIssue(issue);
     }
 
+    // Flush pending to process pattern folding
+    try aggregator.flush();
+
     // Should have individual issues + 1 folded summary
     const all_diags = aggregator.getAll();