Module verify 

The check that makes encoded bytes safe to execute without checking again.

Issue #245’s boundary: encode, verify once, then trust. After this answers Ok, a dispatch loop may read a, b and c as frame offsets and the payload as a table index without asking whether either is in range, because this asked. What stays a run-time question stays one — division by zero, an object’s layout against the layout the instruction names, element bounds, fuel, deadlines, cancellation, host failure.

This is not crate::verify, and the difference is the point

crate::verify checks a lowering: it reads Function::code as Insts and asks whether crate::lower produced a well formed program. A fault there is a bug in this compiler, it is reported by a panic, and it is about instructions that are Rust values and therefore cannot be malformed — an Inst::Copy always has a dst, a src and a layout, whatever they name.

This checks bytes. Sixteen bytes can say things no Inst can: an opcode that names nothing, a flags byte that is not zero, an operand in a field the opcode does not use. So this runs first over the structure — that is decode, which refuses anything that is not the canonical encoding of some instruction — and then over the same program-relative facts the other one checks, driven by Op::fields rather than by a match on an enum.

The two therefore overlap on purpose and neither replaces the other. One is a compiler’s self-check over its own output; the other is a loader’s check over an input, and it must be safe against arbitrary bytes even while the format is internal, because a verifier that is only safe against its own encoder is not a verifier. Nothing in this module indexes with a value it has not bounded, and nothing panics on any sixteen bytes at all.

Structs

Fault

A way in which encoded bytes are not something that may be run.

Functions

verify

Checks a whole encoded program against the program it was encoded from.

verify_function

Checks one run of encoded instructions against the frame it runs in.