ffi: couple of tests; assertion.

* ffi.c (make_ffi_type_struct): Add check for impossible condition.
The bits_alloc variable could only exceed bits_type (and thus
cause the room variable to have a nonsensical, large value)
if the bitfield allocation tried to continue allocating bits into
an aligned unit, whose alignment exceeds the size of the underlying
type. But in that case, tft->aligned would have to be true, and
so the offset would have been aligned prior to this code, rendering
bits_alloc zero.

* tests/017/bitfields.tl: New tests.

2 files changed, 15 insertions, 0 deletions

diff --git a/ffi.c b/ffi.c
index 1c44b442..db7a4c38 100644
--- a/ffi.c
+++ b/ffi.c
@@ -3817,6 +3817,8 @@ static val make_ffi_type_struct(val syntax, val lisp_type,
       ucnum bits_alloc = 8 * (offs - unit_offs) + bit_offs;
       ucnum room = bits_type - bits_alloc;
 
+      bug_unless (bits_type >= bits_alloc);
+
       if (bits == 0) {
         ucnum szmask = size - 1;
         ucnum unit_offs = offs & ~szmask;
diff --git a/tests/017/bitfields.tl b/tests/017/bitfields.tl
index 0dbb459d..dd0aab3c 100644
--- a/tests/017/bitfields.tl
+++ b/tests/017/bitfields.tl
@@ -585,3 +585,16 @@
                (b0 (bit 8 (pack 1 (align 1 (bit 8 le-uint32)))))))
 
 (conv-test #S(s13 x #x7f b0 #xff) #b'7fff0000')
+
+(typedef s14 (pack (struct s14
+               (a (bit 9 le-uint32))
+               (b (bit 7 le-uint32)))))
+
+(conv-test #S(s14 a #x1ff b #x7f) #b'ffff')
+
+(typedef s15 (pack (struct s15
+               (x uint8)
+               (a (bit 9 le-uint32))
+               (b (bit 7 le-uint32)))))
+
+(conv-test #S(s15 x 0 a #x1ff b #x7f) #b'00ffff')