feat(parser): add MAX_PARSE_EXPR_DEPTH guard + recover partial AST (closes #15) (#21)

Mirrors the type-checker's MAX_EXPR_DEPTH guard (checker.rs:117) in the
recursive-descent parser so deeply-nested expressions surface a clean
ParseError::ExpressionTooDeep instead of SIGABRT'ing the process on
thread-stack overflow.

Upstream fixes alongside the guard:

* parse_program now returns Ok(Program { items }) with whatever was
  successfully parsed; collected errors are exposed via Parser::errors().
  Previously parse_program returned Err on the first collected error,
  which threw away every successfully-parsed item and contradicted the
  existing test_error_recovery_* assertions (they expect program.is_some()
  alongside a non-empty error list). Those tests had been silently
  skipped because an earlier SIGABRT test crashed the binary before
  they ran -- this commit's depth guard is what made them reachable.

* parse_program now guarantees forward progress in its error-recovery
  loop. If parse_top_level Err's on a sync-point token (e.g. `}`) and
  synchronize returns at the same token, the loop would spin forever
  pushing the same error until OOM. A saved_pos check now forces one
  advance() when neither call consumed a token.

* The crate-level `parse` wrapper in lib.rs preserves the stricter
  single-error contract that compile/eval rely on -- it consults
  parser.errors() after parse_program and returns the first one as Err.

MAX_PARSE_EXPR_DEPTH is set to 64 (vs the checker's 256) because the
parser's precedence-climbing chain produces ~11 stack frames per
nesting level in debug builds -- 64 leaves a safe margin under
Windows' 1 MiB default test-thread stack.

Tests added:

* test_deeply_nested_parens_report_too_deep_instead_of_sigabrt
* test_deeply_nested_call_chain_reports_too_deep_instead_of_sigabrt
* test_moderately_nested_parens_still_parse
* test_depth_guard_resets_between_top_level_items

All 131 my-lang lib tests + 15 integration tests pass.

Author: hyperpolymath

crates/my-lang/src/lib.rs

@@ -38,12 +38,24 @@ pub use types::Ty;
 // Library prelude for easy access to common functions and types
 pub use library::prelude;
 
-/// Parse source code into an AST
+/// Parse source code into an AST.
+///
+/// `Parser::parse_program` itself runs error recovery and always returns
+/// `Ok(Program)` with whatever it managed to parse, exposing collected
+/// errors via `Parser::errors()`. This crate-level wrapper preserves the
+/// stricter single-error contract that downstream callers (`compile`,
+/// `eval`) rely on: if any error was collected, return the first one as
+/// `Err`. Callers that want partial-AST recovery should drive the
+/// `Parser` directly and consult `parser.errors()`.
 pub fn parse(source: &str) -> ParseResult<Program> {
     let mut lexer = Lexer::new(source);
     let tokens = lexer.tokenize();
     let mut parser = Parser::new(tokens);
-    parser.parse_program()
+    let program = parser.parse_program()?;
+    if let Some(first) = parser.errors().first() {
+        return Err(first.clone());
+    }
+    Ok(program)
 }
 
 /// Parse and type-check source code

crates/my-lang/src/parser.rs

@@ -19,14 +19,39 @@ pub enum ParseError {
     UnexpectedEof,
     #[error("invalid literal: {0}")]
     InvalidLiteral(String),
+    #[error("expression nesting depth exceeds limit ({limit}) at line {line}, column {column}; refactor deeply nested expressions (e.g. parenthesized or chained calls) into intermediate `let` bindings")]
+    ExpressionTooDeep {
+        limit: usize,
+        line: usize,
+        column: usize,
+    },
 }
 
 pub type ParseResult<T> = Result<T, ParseError>;
 
+/// Maximum expression nesting depth the recursive-descent parser will descend
+/// through before emitting [`ParseError::ExpressionTooDeep`] and unwinding the
+/// in-flight expression.
+///
+/// Deliberately a quarter of `checker::MAX_EXPR_DEPTH` (256): each step of
+/// expression nesting re-enters `parse_expr` and walks the full precedence
+/// chain (`parse_or_expr` → … → `parse_postfix_expr` → `parse_primary_expr`),
+/// adding roughly a dozen native stack frames per nesting level. In debug
+/// builds with a 1 MiB default test-thread stack (Windows), that puts the
+/// hard `STATUS_STACK_OVERFLOW` boundary at roughly ~140 depth — so the
+/// guard has to fire well before that. 64 leaves a comfortable margin on
+/// every platform/build-mode the test suite runs on, while still accepting
+/// any human-authored expression (real code rarely nests past depth 5–10).
+/// See hyperpolymath/my-lang#15 / #1.
+pub const MAX_PARSE_EXPR_DEPTH: usize = 64;
+
 pub struct Parser {
     tokens: Vec<Token>,
     pos: usize,
     errors: Vec<ParseError>,
+    /// Current expression-recursion depth, tracked at every entry to
+    /// [`Parser::parse_expr`]. Bounded by [`MAX_PARSE_EXPR_DEPTH`].
+    expr_depth: usize,
 }
 
 impl Parser {
@@ -35,27 +60,47 @@ impl Parser {
             tokens,
             pos: 0,
             errors: Vec::new(),
-        }
-    }
-
+            expr_depth: 0,
+        }
+    }
+
+    /// Parse the token stream into a `Program`.
+    ///
+    /// This always returns `Ok(Program { items })` containing whichever
+    /// top-level items were successfully parsed; any errors encountered
+    /// during recovery are collected in `self.errors` and exposed via
+    /// [`Parser::errors`]. Callers that want a single-error contract
+    /// (e.g. the crate-level `parse` wrapper) should inspect
+    /// `parser.errors()` after this call and surface the first one.
+    ///
+    /// Why `Ok` even with errors: tests like
+    /// `test_error_recovery_sync_at_semicolon` exercise the recovery
+    /// path and expect to see the partial AST alongside the error list;
+    /// returning `Err` here would throw away every successfully-parsed
+    /// item on the first stray token.
     pub fn parse_program(&mut self) -> ParseResult<Program> {
         let mut items = Vec::new();
         while !self.is_at_end() {
+            let saved_pos = self.pos;
             match self.parse_top_level() {
                 Ok(item) => items.push(item),
                 Err(err) => {
                     self.errors.push(err);
                     self.synchronize();
+                    // Forward-progress guarantee: if neither parse_top_level
+                    // nor synchronize consumed a token (e.g. we Err'd at a
+                    // sync-point token like `}` and synchronize returned at
+                    // the same `}` without advancing), force one step so the
+                    // outer loop terminates. Without this, deeply-nested or
+                    // unbalanced inputs that trip the depth guard can spin
+                    // forever pushing the same error until OOM.
+                    if self.pos == saved_pos {
+                        self.advance();
+                    }
                 }
             }
         }
 
-        // If we collected any errors, return the first one
-        // (in the future, we could return all errors in a different error type)
-        if !self.errors.is_empty() {
-            return Err(self.errors[0].clone());
-        }
-
         Ok(Program { items })
     }
 
@@ -1061,7 +1106,23 @@ impl Parser {
     // ============================================
 
     fn parse_expr(&mut self) -> ParseResult<Expr> {
-        self.parse_or_expr()
+        // Depth guard: stops pathological inputs (e.g. deeply nested
+        // parentheses, right-recursive `str_concat("a", str_concat(...))`
+        // chains) from overflowing the thread stack before the type-checker
+        // ever sees the AST. Mirrors `checker::MAX_EXPR_DEPTH`; see
+        // hyperpolymath/my-lang#15.
+        if self.expr_depth >= MAX_PARSE_EXPR_DEPTH {
+            let span = self.current_span();
+            return Err(ParseError::ExpressionTooDeep {
+                limit: MAX_PARSE_EXPR_DEPTH,
+                line: span.line,
+                column: span.column,
+            });
+        }
+        self.expr_depth += 1;
+        let result = self.parse_or_expr();
+        self.expr_depth -= 1;
+        result
     }
 
     fn parse_or_expr(&mut self) -> ParseResult<Expr> {
@@ -2624,4 +2685,121 @@ mod tests {
         // Should still parse top-level structure
         assert!(program.is_some(), "Expected program despite errors");
     }
+
+    // ============================================
+    // Expression-Depth Guard Tests (hyperpolymath/my-lang#15)
+    // ============================================
+
+    #[test]
+    fn test_deeply_nested_parens_report_too_deep_instead_of_sigabrt() {
+        // Regression for hyperpolymath/my-lang#15: deeply nested expressions
+        // used to overflow the recursive-descent parser's thread stack and
+        // SIGABRT the process. With the MAX_PARSE_EXPR_DEPTH guard, we get a
+        // clean ExpressionTooDeep error instead.
+        //
+        // Each `(` re-enters parse_expr via parse_paren_expr, so the depth
+        // increments on every layer. We feed in just over the limit so the
+        // guard fires; staying close to the limit also keeps us well under
+        // the empirical SIGABRT threshold (~230 on Windows debug builds).
+        let depth = MAX_PARSE_EXPR_DEPTH + 16;
+        let mut src = String::from("fn main() { let x = ");
+        for _ in 0..depth {
+            src.push('(');
+        }
+        src.push('1');
+        for _ in 0..depth {
+            src.push(')');
+        }
+        src.push_str("; }");
+
+        let (_program, errors) = parse_with_errors(&src);
+
+        assert!(
+            errors
+                .iter()
+                .any(|e| matches!(e, ParseError::ExpressionTooDeep { limit, .. } if *limit == MAX_PARSE_EXPR_DEPTH)),
+            "expected ExpressionTooDeep, got: {:?}",
+            errors
+        );
+    }
+
+    #[test]
+    fn test_deeply_nested_call_chain_reports_too_deep_instead_of_sigabrt() {
+        // Right-recursive `str_concat("a", str_concat("a", ... "end"))` is the
+        // exact shape that originally surfaced this bug while writing the
+        // type-checker regression test (#12). Confirm the parser bails out
+        // cleanly here as well.
+        let depth = MAX_PARSE_EXPR_DEPTH + 16;
+        let mut src = String::from("fn main() { let s = ");
+        for _ in 0..depth {
+            src.push_str("str_concat(\"a\", ");
+        }
+        src.push_str("\"end\"");
+        for _ in 0..depth {
+            src.push(')');
+        }
+        src.push_str("; }");
+
+        let (_program, errors) = parse_with_errors(&src);
+
+        assert!(
+            errors
+                .iter()
+                .any(|e| matches!(e, ParseError::ExpressionTooDeep { .. })),
+            "expected ExpressionTooDeep, got: {:?}",
+            errors
+        );
+    }
+
+    #[test]
+    fn test_moderately_nested_parens_still_parse() {
+        // Sanity: well below the limit must still parse successfully via the
+        // normal source path. Catches a too-tight off-by-one in the guard.
+        let depth = 32;
+        let mut src = String::from("fn main() { let x = ");
+        for _ in 0..depth {
+            src.push('(');
+        }
+        src.push('1');
+        for _ in 0..depth {
+            src.push(')');
+        }
+        src.push_str("; }");
+
+        let program = parse(&src).expect("moderately-nested parens must parse");
+        assert_eq!(program.items.len(), 1);
+    }
+
+    #[test]
+    fn test_depth_guard_resets_between_top_level_items() {
+        // After error-recovery synchronizes past a too-deep expression, the
+        // depth counter must be back at 0 so subsequent top-level items parse
+        // normally. Catches a regression where the depth `-=` was skipped on
+        // the error path (e.g. if we'd used `?` inside parse_expr).
+        let depth = MAX_PARSE_EXPR_DEPTH + 8;
+        let mut src = String::from("fn broken() { let x = ");
+        for _ in 0..depth {
+            src.push('(');
+        }
+        src.push('1');
+        for _ in 0..depth {
+            src.push(')');
+        }
+        src.push_str("; }\nfn ok() { let y = 42; }");
+
+        let (program, errors) = parse_with_errors(&src);
+        assert!(
+            errors
+                .iter()
+                .any(|e| matches!(e, ParseError::ExpressionTooDeep { .. })),
+            "expected ExpressionTooDeep in errors: {:?}",
+            errors
+        );
+        if let Some(prog) = program {
+            assert!(
+                prog.items.iter().any(|it| matches!(it, TopLevel::Function(f) if f.name.name == "ok")),
+                "expected `ok` function to parse after recovery"
+            );
+        }
+    }
 }