WIP: fix Cwd taint, typeglob slot semantics, and caller line metadata (#1125, #1119, #1135)

[fglock]

Summary

Work in progress — fixes compatibility defects found by the CPAN random tester,
plus adjacent divergences discovered while investigating them.

Issue	Area	Status
#1125	Cwd::* results not tainted under -T	landed
#1135	caller line metadata for multiline chained calls	landed (see caveat)
—	cwd/fastgetcwd logical vs physical path (found via #1125)	landed
—	File::Spec argument taint (found via #1125)	landed
#1119	Typeglob slot / package-stash semantics (Symbol::Util)	in progress

Every fix was reproduced against system perl first, verified on both the JVM
and interpreter backends, and carries a regression test. Each claim in this
description was re-verified against system perl independently of the change
author.

#1125 — taint Cwd results under -T

Internals::getcwd and Internals::abs_path returned untainted scalars, so
every entry point Cwd.pm aliases to them produced a clean value under -T.
They now use the existing taintFromExternalInput() helper (the same one
%ENV, readline, and readdir use), which is a no-op outside taint mode.
This covers getcwd, cwd, fastcwd, fastgetcwd, abs_path, realpath,
fast_abs_path, and fast_realpath.

The jar:PERL5LIB branch of abs_path echoes its argument back rather than
consulting the file system, so it propagates the caller's taint instead of
asserting OS taint — this keeps Inline's -I flag derivation working.

Verified correct against system perl: Data::Compare's unless tainted(getcwd())
guard now disables plugin discovery, and File::Find's Insecure dependency in chdir error under -T matches standard Perl exactly. That error was not
suppressed.

#1135 — report the statement source line for multiline call expressions

-> and ( AST nodes were constructed with the post-parse parser.tokenIndex
(the token the parser finished on), and the call emitters derived the caller
line from node.left.getIndex(). For a chained call the invocant is the inner
Foo->new(...) node, whose index is the closing ) — so caller reported the
closing line. Nothing in the AST carried the enclosing statement's first token.

The statement's first token index is now stamped on each statement node in
ParseBlock and threaded through both backends, so sub and method call sites
report the statement line. Existing override precedence is preserved
(callerLineTokenOverride > short-circuit/argument context > statement line >
expression start).

Perl's rule was derived empirically over 96 generated cases (16 expression
shapes × 6 preceding-statement contexts) against perl 5.42.2: a statement's
reported line is the line of its first token, for every call inside it. In
non-quirk contexts mismatches went 36 → 0; overall agreement 30 → 63. Both
backends agree everywhere.

Caveat — #1119's stated acceptance criterion for #1135 is not met, deliberately.
The issue's reproducer prints 10 here, not perl's 11. Perl's 11 is an
artifact of the preceding block-terminated statement ({ package ... } with no
;), not the general rule — adding a ; after that block, or any plain
statement before the chain, makes perl report 10 too. The shift is triggered
by a preceding if {}, for {}, while {}, or bare block, but not by
sub name {}, a plain statement, or };. Reproducing it would mean emulating
perl's PL_parser->copline bookkeeping and injecting an off-by-one after every
such block. Left out pending a maintainer decision.

cwd logical vs physical (discovered while fixing #1125)

Cwd.pm aliased all four current-directory functions to one physical
(symlink-resolved) builtin. Real Perl splits them: cwd/fastgetcwd are
logical (_backtick_pwd, i.e. /bin/pwd in its default logical mode) and
getcwd/fastcwd are physical.

A new Internals::logical_cwd returns a validated $ENV{PWD}, accepted only
when it is defined, non-empty, NUL-free, absolute, and Files.isSameFile to the
physical path — the device+inode check pwd performs — falling back to the
physical path otherwise. A stale or hostile PWD therefore cannot make cwd()
lie. Cwd.pm follows real Perl's %METHOD_MAP for platforms with no split.

Regression risk is low because the physical form kept the name canonical-path
consumers already use: File::Find, File::Spec, and FindBin all call
getcwd/fastcwd.

File::Spec argument taint (discovered while fixing #1125)

The original premise — that FileSpec.java's rel2abs/abs2rel needed OS
taint — was wrong, and worth recording: those Java methods are dead code.
File/Spec/Unix.pm defines those subs unconditionally and shadows the Java
registrations; only canonpath, catdir, and catfile survive, because the
.pm installs those with unless defined &name.

The real defect was that those three live methods dropped argument taint.
Every downstream divergence followed, since the Perl paths feed Cwd::getcwd()
through catdir/canonpath. They now propagate taint from their arguments.

Deliberately left clean, matching real perl: tmpdir (_tmpdir filters tainted
candidates under -T and falls back to literal /tmp), splitpath (regexp
captures launder), abs2rel when the cwd components cancel, and the
constant/boolean accessors. Over-tainting causes spurious Insecure dependency
failures and is worse than under-tainting.

Test plan

• Mark Cwd::getcwd results as tainted under -T #1125 reproducer matches system perl on both backends
• Match Perl caller line metadata for multiline chained calls #1135 line-number matrix matches system perl on both backends (non-quirk contexts)
• cwd matrix byte-identical to system perl on both backends, incl. stale/invalid PWD
• File::Spec taint matrix byte-identical to system perl on both backends
• Fix symbol-table and typeglob slot semantics exposed by Symbol::Util #1119 reproducers
• make green on the integration branch (all fixes combined)
• CI green
• UAT

🤖 Generated with Claude Code