Files
regorus/tests/rvm/vm
Anand Krishnamoorthi 83891d7782 RVM compiler & runtime optimizations: caching, instruction fusion, constant hoisting, and correctness fixes (#626)
* perf!: add LRU caches for compiled regex and glob patterns

Add bounded LRU caches for compiled regex and glob patterns used by
Rego builtins, avoiding repeated recompilation of the same patterns
during policy evaluation.

New `cache` feature (included in `full-opa` and `opa-no-std`) backed by
the `lru` crate (no_std compatible) with `spin::Mutex` for thread safety.

- `src/cache.rs`: generic `LruCache<V>` wrapper, global `REGEX_CACHE`
  (default capacity 256) and `GLOB_CACHE` (default capacity 128)
- `src/builtins/regex.rs`: all regex builtins route through the cache
- `src/builtins/glob.rs`: glob.match routes through the cache
- Public API: `regorus::cache::{Config, configure, clear}`

Compilation costs avoided per cache hit:
  regex  10-55 µs  (simple to complex patterns)
  glob   10-12 µs
  LRU hit   ~10 ns

BREAKING CHANGE: new `cache` Cargo feature added to `full-opa` and
`opa-no-std` feature sets; adds `lru` as a dependency.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* perf(vm): amortize per-instruction memory and time limit checks

Deduplicate per-instruction memory_check calls by hoisting them to the
main dispatch loop, and amortize monotonic_now() syscalls in the
execution timer by checking elapsed time every N instructions instead
of on every tick.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* fix(vm): correct object membership to check values only, not keys

The Contains instruction for objects was checking both keys and values:

    object_fields.contains_key(v) || object_fields.values().any(|v| ...)

Per the Rego specification, `x in obj` tests whether x is a VALUE of
the object, not a key. The two-argument form `k, v in obj` is needed
to access keys. The interpreter already implemented this correctly
(values-only scan), but the RVM had the extra contains_key() check
which would incorrectly return true when the search value happened to
match a key name.

Remove the contains_key() branch so the behavior matches the interpreter
and the Rego spec. Add two regression tests:
- object_membership_checks_values_not_keys: "foo" in {"foo": "bar"}
  must be false (key, not a value)
- object_membership_finds_value: "bar" in {"foo": "bar"} must be true

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* perf(compiler): hoist all-constant collection literals to the literal table

When an array, set, or object literal consists entirely of compile-time
constant expressions (numbers, strings, bools, null, and nested constant
collections), the compiler now evaluates them at compile time and emits a
single Load instruction from the literal table instead of generating
per-element instructions at runtime.

Previously, a Rego expression like `x in [1, 2, 3]` would emit
ArrayCreate + three Load + three ArrayAppend instructions, allocating a
new Vec and Rc on every evaluation. With this change, the entire array
is built once during compilation and loaded as a single constant.

This optimization applies to all three collection types:
- Array literals: avoids ArrayCreate + N x (Load + ArrayAppend)
- Set literals: avoids SetCreate + N x (Load + SetAdd)
- Object literals: avoids ObjectCreate + N x (Load + Load + ObjectInsert)

The implementation adds a try_eval_const() helper that recursively
evaluates an AST expression as a constant Value, returning None if any
sub-expression is non-constant. Each compile method for collection
literals attempts the all-constant fast path first and falls through to
the existing instruction-by-instruction codegen otherwise.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* perf(compiler): fuse Eq + AssertCondition into AssertEq instruction

Add a new `AssertEq { left, right }` instruction that combines equality
comparison and condition assertion into a single operation. This replaces
the previous two-instruction pattern of `Eq { dest, left, right }` followed
by `AssertCondition { condition: dest }`, saving one instruction and one
register per equality assertion.

The fused instruction checks two registers for equality and directly calls
handle_condition with the result, avoiding the intermediate boolean
register entirely. If either operand is undefined or the values differ,
the condition fails and the rule/loop backtracks.

The optimization applies to four destructuring sites:
- EqualityCheck (assignment re-binding with `x = expr; x = expr`)
- EqualityExpr (destructuring against an expression)
- EqualityValue (destructuring against a literal value)
- assert_array_length (array length validation in destructuring)

In soft_assert_mode the compiler still emits the original Eq instruction
since the boolean result register is needed by callers.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* perf(compiler): fuse Not + AssertCondition into AssertNot instruction

Add a new `AssertNot { operand }` instruction that combines logical
negation and condition assertion into a single operation. This replaces
the previous two-instruction pattern of `Not { dest, operand }` followed
by `AssertCondition { condition: dest }`, saving one instruction and one
register allocation.

The fused instruction checks the operand register and passes the
condition if the value is false or undefined (per Rego semantics where
`not expr` succeeds when the expression has no results or is false),
and fails the condition if the value is true or any non-boolean truthy
value.

This was the only emission site for the Not+AssertCondition pair,
occurring in the compilation of `Literal::NotExpr` statements.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* perf(vm): early exit for same-value multi-definition rules

When a rule has multiple definitions that all produce the same value
(e.g. implicit true, or identical literal), set early_exit_on_first_success
on RuleInfo so the VM can stop after the first successful definition.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* feat!: expose cache configuration API to all language bindings

Add `set_cache_config` and `clear_cache` functions to every binding
so callers can tune or reset the global regex/glob pattern caches
introduced in the cache feature.

Bindings updated:
- FFI (C): `regorus_set_cache_config`, `regorus_clear_cache`
- C++ header: free functions `regorus::set_cache_config`, `regorus::clear_cache`
- Python: module-level `set_cache_config(*, regex, glob)`, `clear_cache()`
- Java: static methods on new `CacheConfig` class
- Go: package-level `SetCacheConfig`, `ClearCache`
- Ruby: module functions `Regorus.set_cache_config`, `Regorus.clear_cache`
- WASM: free functions `setCacheConfig`, `clearCache`
- C#: static methods `Engine.SetCacheConfig`, `Engine.ClearCache`

BREAKING CHANGE: Bump SERIALIZATION_VERSION from 4 to 5 due to new
AssertEq and AssertNot instruction variants added in the instruction
fusion commits. Programs serialized with version 5 cannot be loaded
by older versions of regorus.

* fix: address PR review feedback

Cache subsystem:
- Gate REGEX_CACHE and related imports behind #[cfg(feature = "regex")]
  so that building with --features cache without regex compiles correctly.
- Gate LruCache struct behind #[cfg(any(feature = "regex", feature = "glob"))].
- Add Config::MAX_CAPACITY (2^16) hard upper bound; clamp values in
  configure() to prevent unbounded cache growth.
- Use parking_lot::Mutex for std builds and spin::Mutex for no_std to
  avoid CPU spinning under contention in tight regex/glob eval loops.
- Narrow lock scopes in regex/glob builtins: release the mutex before
  compiling a pattern, then re-acquire to insert.

Java JNI binding:
- Fix cache config overflow: negative jlong values now saturate to 0
  and positive overflow saturates to usize::MAX (then clamped by
  MAX_CAPACITY) instead of silently disabling the cache.
- Gate JNI cache config/clear functions behind #[cfg(feature = "cache")].

Compiler:
- Refactor static_value_of_expr to delegate to try_eval_const,
  gaining support for negated numbers and constant collections.
- Make try_eval_const pub(in crate::languages::rego::compiler) and
  re-export through expressions.rs.
- Handle Expr::UnaryExpr with numeric literals in try_eval_const so
  collections containing negated numbers (e.g. [-1, 2]) are hoisted.

VM correctness:
- Fix Not instruction to follow Rego semantics: not expr yields
  true when expr is undefined or false, false for any other defined
  value (including non-booleans) -- no longer errors on non-boolean
  operands.
- Add enforce_memory_check() call at execute_suspendable_entry to
  ensure memory limits are checked before the first instruction.
- Update AssertNot listing comment to "exit if any defined truthy
  value" to match actual VM behaviour.
- Add doc comment on Not instruction clarifying Rego negation
  semantics.

Bindings:
- Fix C++ header indentation for set_cache_config / clear_cache.
- Propagate Cargo.lock parking_lot addition across ffi, java, python,
  and wasm binding lockfiles.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

---------

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2026-03-23 21:00:51 -05:00
..

Regorus VM Test Suites

This directory hosts YAML-driven regression suites for the Regorus virtual machine. Each YAML file is converted into parameterised Rust tests by src/rvm/tests/vm.rs, so the contents here define the end-to-end VM coverage.

Prerequisites

  • Enable the rvm feature (it pulls in std and the VM runtime) whenever you run these tests:
    • cargo test --features rvm run_vm_test_file
    • cargo test --features rvm run_loop_test_file
  • Append -- --nocapture to surface per-test diagnostics when a failure occurs.
  • Individual generated tests follow the pattern run_vm_test_file_tests_rvm_vm_suites_<suite>_yaml, so you can use that fragment with cargo test to run a single suite.

Layout

  • suites/*.yaml — primary instruction, control-flow, and integration suites.
  • suites/loops/*.yaml — dedicated loop/comprehension suites.
  • Mirror the comment headers inside each suite when adding new files; the descriptions are surfaced in this README for quick reference.

Main Suites (suites/*.yaml)

Suite Focus
arithmetic_operations.yaml Arithmetic opcodes (Add, Sub, Mul, Div, Mod) and simple expressions.
assertions.yaml AssertCondition semantics, including success/failure and loop control interactions.
basic_instructions.yaml Core load/move/return instructions that underpin every program.
boolean_literals.yaml LoadBool, LoadTrue, LoadFalse, and their interaction with logical operators.
builtin_functions.yaml Builtin dispatch covering argument marshalling, return handling, and error cases.
call_rule.yaml CallRule execution, rule caches, defaults, and fallbacks.
comparison_operations.yaml Relational operators plus logical combining (Eq, Ne, Lt, Le, Gt, Ge, And, Or, Not).
complex.yaml Deeply nested hybrid loops, comprehensions, and rule calls that stress the scheduler.
constructed_collections.yaml ArrayCreate/SetCreate success paths, undefined propagation, and deduplication.
control_flow.yaml Conditional branching patterns, nested assertions, and selection logic.
core_semantics.yaml Broad regression coverage for arithmetic, comparisons, loops, assertions, and collection helpers.
data_structures.yaml Array/object/set creation, access, and mutation instructions.
deep_nesting.yaml Three-plus levels of mixed loop modes validating register pressure and control flow correctness.
default_rules.yaml Complete rule execution with default literals and failure fallbacks.
destructuring_rules.yaml Destructuring metadata handling, success/early-exit semantics.
function_calls.yaml User function invocation plumbing, argument passing, and returns.
halt.yaml Halt instruction returning register 0 and stopping execution.
host_await.yaml Successful HostAwait responses across execution modes and run-to-completion flows.
host_await_failures.yaml Error signalling and ignore-flag behaviour for HostAwait.
indexed_access.yaml Literal/register indexing, chained accesses, and undefined propagation.
integration_scenarios.yaml Real-world policy shapes (RBAC, filtering, transforms, workflows).
interpreter_operator_compatibility.yaml Ensures VM operators match interpreter behaviour on edge cases.
invalid_collection_ops.yaml Error paths for object/set/array mutations with incorrect types.
load_data_input.yaml LoadData and LoadInput instructions across nested/empty/undefined sources.
loop_invalid_iteration.yaml Loop errors for non-iterables plus instruction-limit enforcement.
null_undefined_handling.yaml Null/undefined behaviour across arithmetic, comparisons, indexing, loops, and comprehensions.
object_operations.yaml Advanced object templates, dynamic keys, collisions, and validation.
predefined.yaml Global data and input bindings, including nested access patterns.
resource_limits.yaml Instruction counts, recursion depth, and other resource exhaustion scenarios.
serialization.yaml Round-trip binary serialization for compiled programs covering all instruction families.
set_operations.yaml Set creation, deduplication, membership checks, and nested values.
type_errors.yaml Graceful error reporting for cross-family type mismatches.
virtual_data_lookup.yaml VirtualDataDocumentLookup with base data, rule overrides, and invalid indices.

Loop Suites (suites/loops/*.yaml)

Suite Focus
array_comprehensions.yaml Mapping, filtering, and edge cases for array comprehensions.
empty.yaml Behaviour of every loop mode over empty collections (vacuous truth/falsehood).
existential.yaml some-style (Any) quantification including early exits and complex predicates.
loop_comprehension_interactions.yaml Interplay between nested loops and comprehensions emitting structured data.
nested.yaml Mixed nesting patterns for loops and comprehensions with varying depth.
nested_fixed.yaml Placeholder for future fixed-nesting scenarios (no cases yet).
object_comprehensions.yaml Key/value emission, collision handling, and filtering in object comprehensions.
set_comprehensions.yaml Deduplication and uniqueness guarantees in set comprehensions.
universal.yaml every-style (Every) quantification, early failure, and vacuous truth cases.

Adding or Updating Suites

  1. Place the new YAML file under suites/ (or the relevant suites/loops/ subdirectory).
  2. Add a concise comment block at the top describing the intent and scenarios.
  3. Update the tables above so the catalog stays accurate.
  4. Run cargo test --features rvm run_vm_test_file to ensure the suite loads and all cases pass.

Keeping this README current makes it easier to discover coverage gaps and reason about the generated tests.