Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

w6c+w6c_ww: for-range over a non-ident slice base — bound from len, base ptr spilled (#70)

Browse Source 
The N_FORRANGE header's non-ident arm stored cgexpr's AX into the
single bound temp — but a slice-valued cgexpr leaves AX=ptr, BX=len,
CX=cap, so the loop compared i against the DATA POINTER; and the
per-iteration element address had no non-ident base arm at all, so
the bound reload doubled as the base. One slot, two roles, holding
the wrong word. An empty slice coincidentally exited (ptr==0), which
is how regex.finish's `for (let charset .. re.charsets)` — planted
verbatim in fold 1 — stayed latent until fold 4 produced the first
non-empty charsets and SEGV'd. Byte-id both stages (the 989 M_ID
entry held on both-wrong-identical); first-consumer surfacing, the
kwtab/#8 pattern.

Fix mirrors the correct local-base arm: bound = BX (len), base ptr
spilled to a dedicated .rgb slot and reloaded per iteration. Covers
field-chain, indexed-element (the task-#57 shape) and call-result
bases. Two shapes whose cgexpr does NOT deliver the header convention
stay LOUD instead of silently wrong (rule 7): deref bases (*p — the
#11 deref-spine family) and non-ident ARRAY bases.

test/937: field (value+ptr roots), 24B-str-header field (the finish
shape), indexed, call, empty-header, eval-once (header captured at
loop entry, not re-read per iteration) rows + the two reject pins,
per-row cs==ww byte-id; verified failing 14/22 at the #66 parent
bb8a44a.
This commit is contained in:
Hojun-Cho
2026-06-04 21:08:59 +09:00
parent bb8a44a564
commit 0055ac2cd3
6 changed files with 596 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
cmd/w6c/cgen.c
View File

@@ -12012,11 +12012,33 @@ cgstmt(Cg *c, Node *n, Local **locals, int *frame)
? u->sub->under : (u ? u->sub : NULL);
int destruct = (n->list != NULL);
/* allocate temp slots: _i (8B), _len (8B) */
/* allocate temp slots: _i (8B), _len (8B). #70: a NON-IDENT
* slice/str base (field chain, indexed element, call) also
* needs a _base spill — pre-#70 the init stored cgexpr's AX
* (the DATA POINTER — a slice-valued cgexpr leaves AX=ptr,
* BX=len, CX=cap) into _len, and the per-iteration code had
* no non-ident base arm at all, so the bound-reload BX
* doubled as the base: i was compared against the POINTER
* and walked off the end (regex.finish, SEGV on the first
* non-empty charsets; empty slices coincidentally exited on
* ptr==0 — latent since fold 1, byte-id both stages). */
char *iname = aprintf(c->a, ".rgi_%d", c->labelseq++);
char *lname = aprintf(c->a, ".rgl_%d", c->labelseq++);
int ioff = localoff(c, locals, iname, 8, frame);
int loff = localoff(c, locals, lname, 8, frame);
/* #11: cgexpr on a slice DEREF (*p) does not deliver the
* AX/BX/CX header convention the spill below assumes (the
* deref-spine load family) — pre-#70 this shape crashed or
* mis-summed; keep it LOUD until #11 wires the deref load. */
if (slc && slc->kind == N_UN && slc->op == TK_STAR
&& u && (u->kind == TY_SLICE || u->kind == TY_STR))
fatal("for-range over a deref base unwired (#11)");
int baseoff = 0;
if (slc && slc->kind != N_IDENT
&& !(u && u->kind == TY_ARRAY)) {
char *bname = aprintf(c->a, ".rgb_%d", c->labelseq++);
baseoff = localoff(c, locals, bname, 8, frame);
}
/* allocate per-name slots */
struct { int off, sz, foff; Type *ftype; } binds[8] = {0};
@@ -12053,11 +12075,29 @@ cgstmt(Cg *c, Node *n, Local **locals, int *frame)
ins2(c, A_MOVQ, amem(D_BP, boff + 8), areg(D_AX));
ins2(c, A_MOVQ, areg(D_AX), amem(D_BP, loff));
} else if (u && u->kind == TY_ARRAY) {
/* #70: a non-ident ARRAY base has no base spill and
* its cgexpr register shape is not the slice header —
* the per-iteration base would be garbage. Loud (rule
* 7) until a consumer wires it. */
if (slc->kind != N_IDENT)
fatal("for-range over a non-ident array base "
"unwired (#70)");
ins2(c, A_MOVQ, aimm((long long)u->alen),
amem(D_BP, loff));
} else {
cgexpr(c, slc, *locals);
ins2(c, A_MOVQ, areg(D_AX), amem(D_BP, loff));
if (baseoff != 0) {
/* #70: slice/str header from cgexpr is AX=ptr,
* BX=len, CX=cap — bound is LEN; spill the base
* ptr for the per-iteration element address. */
ins2(c, A_MOVQ, areg(D_BX), amem(D_BP, loff));
ins2(c, A_MOVQ, areg(D_AX), amem(D_BP, baseoff));
} else {
/* ident with unresolved type — legacy path,
* unchanged (per-iteration base loads the
* ident's own slot). */
ins2(c, A_MOVQ, areg(D_AX), amem(D_BP, loff));
}
}
char *loop = mklabel(c, "rloop");
@@ -12092,6 +12132,10 @@ cgstmt(Cg *c, Node *n, Local **locals, int *frame)
} else if (slc->kind == N_IDENT) {
int boff = localfind(*locals, slc->str);
ins2(c, A_MOVQ, amem(D_BP, boff), areg(D_BX));
} else {
/* #70: non-ident slice/str base — reload the spilled
* data pointer (pre-#70 BX held the bound reload). */
ins2(c, A_MOVQ, amem(D_BP, baseoff), areg(D_BX));
}
ins2(c, A_ADDQ, areg(D_AX), areg(D_BX));
/* load each binding from BX + foff into its slot. C4 (F5/FC0,