#279 &key argument validation missing: no program-error on odd/unknown keyword args (CLHS 3.5.1.4-6)
open
Opened by atgreen
funcl's &key lowering (ag-rewrite-key-defun → &rest kwargs + %key-arg extractions, src/cold/compiler.lisp ~1128-1245) is LENIENT: %key-arg ignores any keyword the lambda-list didn't declare, and nothing checks the arg count. So:
- (flet ((%f (&key a) a)) (%f 1)) -> NIL [should signal program-error: odd # of key args, CLHS 3.5.1.6]
- (flet ((%f (&key a) a)) (%f :b 2)) -> NIL [should signal program-error: unknown keyword :b, CLHS 3.5.1.5, unless &allow-other-keys or runtime :allow-other-keys t]
Required-arg count IS validated (too-few/too-many both signal program-error correctly, for funcall/named/lambda). Only KEYWORD validation is missing.
Fix: inject a %check-kwargs call at the key body-wrap point (ag-key-specs-wrap-body and the &optional+&key combo path). %check-kwargs (new prelude defun) walks kwargs by 2s: signal program-error on odd length; signal program-error on a key not in the declared set UNLESS the lambda declared &allow-other-keys OR the runtime plist contains :allow-other-keys with a true value. Cold-path change — needs full self-host validation.
Affects the signals-error keyword tests: data-and-control-flow flet.12/13/16, labels.12/13/16, and similar in every &key-using test file (~10-30 tests).
Confirmed 2026-07-11 on build/funcl (verified via handler-case program-error probes). Filed under the correctness push (funcl core — sequences/strings/chars/conditions/arity/loop/setf/flet-labels/handler-case — all verified robust; this is a genuine remaining gap).
ASSESSMENT 2026-07-11: unchanged — no program-error on odd-length or unknown keyword args (CLHS 3.5.1.4-6). Two layers: (a) the &key prologue (ag-key-specs-wrap-body) could emit an oddness check + allow-other-keys-aware unknown-key scan cheaply; (b) the arity guard skips FUNCALLED lambdas entirely (dacf finding), so the check must live in the callee prologue, not the caller. (a) is a contained stdlib/compiler change; suggest doing it when next in the &key prologue code, and pair with the ANSI dacf keyword tests as the gate.