From 037d59cf4e1f155f31116f17150b5c8f27abe18f Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Sat, 13 Jun 2026 13:18:21 +0900 Subject: [PATCH] wcc/ww: registerstruct field offset is the checker's natural tfield.offset MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit wwstage carried TWO struct-layout sources. registerstruct (cgenutil.ww) recomputed each field's `fi.foff` via fieldsize — slot-padded, round-8 — for the WRITE (construction / field store) path, while the READ path (cgplaceaddr / dotbaseaddr) used the checker's natural `tfield.offset`. They diverged iff a struct had a nested sub-8 composite field (slotsize != size) plus a successor: ww wrote the successor at the slot-padded offset and read it at the natural offset, mis-addressing its own field. cstage has no structinfo and reads tfield directly, self- consistently natural (cmd/w6c/cgen.c). Fix: make `fi.foff` a VIEW of the checker's already-built natural layout. Lock-step walk tstruct.list (AST N_TFIELD) and ti.fields (tfield) — both head-first declared order, both skip non-TFIELD identically — and copy foff = tf.offset, fsz = tf.type_.size. si.totsize keeps the slot-padded stack-slot number (ti.slotsize, already 8-rounded at check.ww:2259). fieldsize is no longer called here (its `*p OP=` scalar-width caller is untouched). LOUD nil-guards on tstruct.type_ / tichase / a tfield walk desync — all unreachable post-check, never silent. fi.tnode stays the AST node (its node-keyed readers need it); repointing the ~60 fi.foff readers to tfield is the out-of-scope (ii-b) follow-up. This unifies ww's second source onto the value cstage already emits, so cs==ww is preserved, not newly created (wwstage-cgen only; no cstage edit). The shape is corpus-absent — ww uses both sources on its own structs, so a divergent struct would have broken the bootstrap — hence gate-blind; 989_nestfield_run is the proof (nested inner{x:u8,y:u8} in outer{a:u8,p:inner[,z:i64]}, every field read back == written, dual-stage cs==ww). It also makes 681 ragged_tail_12B genuinely correct: the predecessor #71 already shrank the whole-struct copy to the source's natural length, so packing mark at natural offset 12 no longer clobbers. --- Makefile | 15 ++ selfhost/cmd/w6c/main.combined.ww | 50 ++++--- selfhost/cmd/wcc/cgenutil.ww | 50 ++++--- selfhost/cmd/wwdump/main.combined.ww | 50 ++++--- test/wcc/989_nestfield_run.c | 208 +++++++++++++++++++++++++++ 5 files changed, 322 insertions(+), 51 deletions(-) create mode 100644 test/wcc/989_nestfield_run.c diff --git a/Makefile b/Makefile index 5e42629f..217ce3ec 100644 --- a/Makefile +++ b/Makefile @@ -256,6 +256,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_chainidx_run \ $(BIN)/test_tupfieldsize_run \ $(BIN)/test_tagtupfieldsize_run \ + $(BIN)/test_nestfield_run \ $(BIN)/test_arrlit_tail_zero_run \ $(BIN)/test_defdim_slice_run \ $(BIN)/test_trystr_run \ @@ -761,6 +762,20 @@ $(BIN)/test_tagtupfieldsize_run: test/wcc/989_tagtupfieldsize_run.c \ $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +# 989_nestfield_run (#44/#55): a struct with a nested sub-8 composite field +# (inner{x:u8,y:u8}, slotsize 8 != size 2) plus a successor must address +# every field at the checker's NATURAL offset on BOTH the write +# (construction) and read (field-access) paths. wwstage's registerstruct +# rebuilt fi.foff slot-padded for the write while the read used tfield +# natural — gate-blind (the shape is corpus-absent). Builds+runs on BOTH +# driver twins (rule-10), pinning the absolute 0 (all fields read back). +$(BIN)/test_nestfield_run: test/wcc/989_nestfield_run.c \ + $(BIN)/ww $(BIN)/ww_ww \ + $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + # 989_arrlit_tail_zero_run (#13): an under-length array literal zero-fills the # unspecified tail, not the last value. Builds+runs on BOTH driver twins # (rule-10), pinning the absolute value (pre-fix ww tail = last value). diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index b865e53c..093c573e 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -20402,44 +20402,60 @@ fn fieldsize(c: *cgen, tnode: *node) i32 = { return 8; }; +// #44/#55: fi.foff is a VIEW of the checker's already-built NATURAL +// `tfield.offset` (check.ww N_TSTRUCT L2234), NOT a second slot-padded +// layout recomputed via fieldsize. The two sources diverged iff a struct +// had a nested sub-8 composite field (slotsize != size) plus a successor: +// the WRITE path used this slot-padded foff, the READ path +// (cgplaceaddr/dotbaseaddr) read tfield.offset natural — ww mis-addressed +// its own fields. cstage has no structinfo and reads tfield directly +// (self-consistently natural); this unifies ww's second source onto it, +// preserving cs==ww. Lock-step walk: tstruct.list N_TFIELD AST nodes and +// ti.fields tfields share one head-first declared order (both skip +// non-TFIELD identically), so they advance in exact step. si.totsize keeps +// the slot-padded total (stack-slot allocator's number) from ti.slotsize, +// already 8-rounded at check.ww:2259-2261. fn registerstruct(c: *cgen, name: str, srcmod: str, tstruct: *node) void = { let si: *structinfo = alloc(structinfo{ sname = name, smod = srcmod, })!; + if (tstruct.type_ == nil) { + let msg: str = "#44/#55: registerstruct: struct node has no stamped tinfo\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); + }; + let ti: *tinfo = tichase(tstruct.type_: *tinfo); + if (ti == nil) { + let msg: str = "#44/#55: registerstruct: tichase yielded nil tinfo\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); + }; let head: *fieldinfo = nil; let tail: *fieldinfo = nil; - let off: i32 = 0; let f: *node = tstruct.list; + let tf: *tfield = ti.fields; for (f != nil) { if (f.kind == nkind.N_TFIELD) { - let sz: i32 = fieldsize(c, f.lhs); - // Align to 8 for any field >= 4 bytes (matches our other - // cgen choices). i8/u8/bool may sit on odd byte offsets; - // the C cgen does similar best-effort packing. - let aln: i32 = 1; - if (sz >= 8) { aln = 8; } - else { if (sz >= 4) { aln = 4; } - else { if (sz >= 2) { aln = 2; }; }; }; - if ((off & (aln - 1)) != 0) { - off = (off + aln - 1) & ~(aln - 1); + if (tf == nil) { + let msg: str = "#44/#55: registerstruct: AST/tfield walk desync (more TFIELDs than tinfo.fields)\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); }; let fi: *fieldinfo = alloc(fieldinfo{ fname = f.str, - foff = off, - fsz = sz, + foff = tf.offset: i32, + fsz = tf.type_.size: i32, tnode = f.lhs, })!; if (head == nil) { head = fi; tail = fi; } else { tail.finext = fi; tail = fi; }; - off += sz; + tf = tf.tnext; }; f = f.next; }; - // Round total to 8 for stack-slot use. - if ((off & 7) != 0) { off = (off + 7) & ~7; }; si.fields = head; - si.totsize = off; + si.totsize = ti.slotsize: i32; si.sinext = c.structs; c.structs = si; }; diff --git a/selfhost/cmd/wcc/cgenutil.ww b/selfhost/cmd/wcc/cgenutil.ww index 3b52b782..bdb3d5ef 100644 --- a/selfhost/cmd/wcc/cgenutil.ww +++ b/selfhost/cmd/wcc/cgenutil.ww @@ -2608,44 +2608,60 @@ fn fieldsize(c: *cgen, tnode: *node) i32 = { return 8; }; +// #44/#55: fi.foff is a VIEW of the checker's already-built NATURAL +// `tfield.offset` (check.ww N_TSTRUCT L2234), NOT a second slot-padded +// layout recomputed via fieldsize. The two sources diverged iff a struct +// had a nested sub-8 composite field (slotsize != size) plus a successor: +// the WRITE path used this slot-padded foff, the READ path +// (cgplaceaddr/dotbaseaddr) read tfield.offset natural — ww mis-addressed +// its own fields. cstage has no structinfo and reads tfield directly +// (self-consistently natural); this unifies ww's second source onto it, +// preserving cs==ww. Lock-step walk: tstruct.list N_TFIELD AST nodes and +// ti.fields tfields share one head-first declared order (both skip +// non-TFIELD identically), so they advance in exact step. si.totsize keeps +// the slot-padded total (stack-slot allocator's number) from ti.slotsize, +// already 8-rounded at check.ww:2259-2261. fn registerstruct(c: *cgen, name: str, srcmod: str, tstruct: *node) void = { let si: *structinfo = alloc(structinfo{ sname = name, smod = srcmod, })!; + if (tstruct.type_ == nil) { + let msg: str = "#44/#55: registerstruct: struct node has no stamped tinfo\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); + }; + let ti: *tinfo = tichase(tstruct.type_: *tinfo); + if (ti == nil) { + let msg: str = "#44/#55: registerstruct: tichase yielded nil tinfo\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); + }; let head: *fieldinfo = nil; let tail: *fieldinfo = nil; - let off: i32 = 0; let f: *node = tstruct.list; + let tf: *tfield = ti.fields; for (f != nil) { if (f.kind == nkind.N_TFIELD) { - let sz: i32 = fieldsize(c, f.lhs); - // Align to 8 for any field >= 4 bytes (matches our other - // cgen choices). i8/u8/bool may sit on odd byte offsets; - // the C cgen does similar best-effort packing. - let aln: i32 = 1; - if (sz >= 8) { aln = 8; } - else { if (sz >= 4) { aln = 4; } - else { if (sz >= 2) { aln = 2; }; }; }; - if ((off & (aln - 1)) != 0) { - off = (off + aln - 1) & ~(aln - 1); + if (tf == nil) { + let msg: str = "#44/#55: registerstruct: AST/tfield walk desync (more TFIELDs than tinfo.fields)\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); }; let fi: *fieldinfo = alloc(fieldinfo{ fname = f.str, - foff = off, - fsz = sz, + foff = tf.offset: i32, + fsz = tf.type_.size: i32, tnode = f.lhs, })!; if (head == nil) { head = fi; tail = fi; } else { tail.finext = fi; tail = fi; }; - off += sz; + tf = tf.tnext; }; f = f.next; }; - // Round total to 8 for stack-slot use. - if ((off & 7) != 0) { off = (off + 7) & ~7; }; si.fields = head; - si.totsize = off; + si.totsize = ti.slotsize: i32; si.sinext = c.structs; c.structs = si; }; diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index d4e5cc1c..bfbf6552 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -20402,44 +20402,60 @@ fn fieldsize(c: *cgen, tnode: *node) i32 = { return 8; }; +// #44/#55: fi.foff is a VIEW of the checker's already-built NATURAL +// `tfield.offset` (check.ww N_TSTRUCT L2234), NOT a second slot-padded +// layout recomputed via fieldsize. The two sources diverged iff a struct +// had a nested sub-8 composite field (slotsize != size) plus a successor: +// the WRITE path used this slot-padded foff, the READ path +// (cgplaceaddr/dotbaseaddr) read tfield.offset natural — ww mis-addressed +// its own fields. cstage has no structinfo and reads tfield directly +// (self-consistently natural); this unifies ww's second source onto it, +// preserving cs==ww. Lock-step walk: tstruct.list N_TFIELD AST nodes and +// ti.fields tfields share one head-first declared order (both skip +// non-TFIELD identically), so they advance in exact step. si.totsize keeps +// the slot-padded total (stack-slot allocator's number) from ti.slotsize, +// already 8-rounded at check.ww:2259-2261. fn registerstruct(c: *cgen, name: str, srcmod: str, tstruct: *node) void = { let si: *structinfo = alloc(structinfo{ sname = name, smod = srcmod, })!; + if (tstruct.type_ == nil) { + let msg: str = "#44/#55: registerstruct: struct node has no stamped tinfo\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); + }; + let ti: *tinfo = tichase(tstruct.type_: *tinfo); + if (ti == nil) { + let msg: str = "#44/#55: registerstruct: tichase yielded nil tinfo\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); + }; let head: *fieldinfo = nil; let tail: *fieldinfo = nil; - let off: i32 = 0; let f: *node = tstruct.list; + let tf: *tfield = ti.fields; for (f != nil) { if (f.kind == nkind.N_TFIELD) { - let sz: i32 = fieldsize(c, f.lhs); - // Align to 8 for any field >= 4 bytes (matches our other - // cgen choices). i8/u8/bool may sit on odd byte offsets; - // the C cgen does similar best-effort packing. - let aln: i32 = 1; - if (sz >= 8) { aln = 8; } - else { if (sz >= 4) { aln = 4; } - else { if (sz >= 2) { aln = 2; }; }; }; - if ((off & (aln - 1)) != 0) { - off = (off + aln - 1) & ~(aln - 1); + if (tf == nil) { + let msg: str = "#44/#55: registerstruct: AST/tfield walk desync (more TFIELDs than tinfo.fields)\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); }; let fi: *fieldinfo = alloc(fieldinfo{ fname = f.str, - foff = off, - fsz = sz, + foff = tf.offset: i32, + fsz = tf.type_.size: i32, tnode = f.lhs, })!; if (head == nil) { head = fi; tail = fi; } else { tail.finext = fi; tail = fi; }; - off += sz; + tf = tf.tnext; }; f = f.next; }; - // Round total to 8 for stack-slot use. - if ((off & 7) != 0) { off = (off + 7) & ~7; }; si.fields = head; - si.totsize = off; + si.totsize = ti.slotsize: i32; si.sinext = c.structs; c.structs = si; }; diff --git a/test/wcc/989_nestfield_run.c b/test/wcc/989_nestfield_run.c new file mode 100644 index 00000000..d74c7165 --- /dev/null +++ b/test/wcc/989_nestfield_run.c @@ -0,0 +1,208 @@ +/* + * 989_nestfield_run — #44/#55 struct-layout SSoT: a struct with a nested + * sub-8 composite field plus a successor must address EVERY field at the + * checker's natural offset, identically on the write (construction) and + * read (field-access) paths. + * + * THE BUG (cat-A silent miscompile, gate-blind): wwstage had TWO struct- + * layout sources. `registerstruct` (selfhost/cmd/wcc/cgenutil.ww) rebuilt + * each field's `fi.foff` via `fieldsize` — SLOT-padded, so a nested + * `inner{x:u8,y:u8}` (size 2, slotsize 8) pushed every successor to an 8B + * boundary. The READ path (cgplaceaddr/dotbaseaddr) reads the checker's + * tfield.offset — NATURAL (inner align 1 → p at offset 1, z packed right + * after). So ww WROTE p/z at the slot-padded offset and READ them at the + * natural offset → garbage. The shape (nested sub-8 composite + a field + * after it) is corpus-ABSENT — ww uses both sources on its OWN structs, so + * if such a struct existed the bootstrap would mis-address itself and + * 400-green would be impossible; the gate cannot see it, this repro is the + * proof. cstage has no structinfo — it reads tfield directly, self- + * consistently natural (cmd/w6c/cgen.c). THE FIX: make ww's `fi.foff` a + * VIEW of tfield.offset (lock-step walk tstruct.list + ti.fields), so the + * second source collapses onto cstage's natural one (cs==ww preserved). + * + * Each program self-checks every field (write 1/2/3/.., read back, return + * the 1-based index of the first mismatch, 0 on all-correct). Pre-fix ww + * constructs at slot offsets and reads at natural → a non-zero return on + * the first composite-or-successor field, so cs(=0) != ww(!=0) AND ww != + * want. Both stages build+run (rule-10); the want is the absolute 0. + * + * This is a RUNTIME cs==ww check (both stages exit 0): it proves field + * offsets are natural and instruction-correct RELATIVE TO the struct base. + * It deliberately does NOT gate the absolute .s frame, which is still + * cs!=ww on this shape via a SEPARATE pre-existing producer — wwstage + * reserves the struct LOCAL's stack slot at slot-padded slotsize, cstage + * at natural (task #75). The frame-absolute teeth belong to #75's fix. + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { + const char *label; + const char *src; + int want_exit; /* >= 0: pin the absolute value; -1: cs==ww only */ +}; + +static const struct row rows[] = { + /* (1) nested2 — outer2{a:u8, p:inner}: the core divergence. Natural + * p at offset 1; pre-fix slot-padded p at offset 8. Construction + * (write) vs field-access (read) disagree → o.p.x / o.p.y read wrong. + * Returns the 1-based index of the first mismatched field, 0 on ok. */ + { "nested2", + "package main;\n" + "type inner = struct { x: u8, y: u8 };\n" + "type outer2 = struct { a: u8, p: inner };\n" + "export fn main() int = {\n" + " let o: outer2 = outer2 { a = 5, p = inner { x = 6, y = 7 } };\n" + " if (o.a: int != 5) { return 1; };\n" + " if (o.p.x: int != 6) { return 2; };\n" + " if (o.p.y: int != 7) { return 3; };\n" + " return 0;\n" + "};\n", + 0 }, + + /* (2) nested3 — outer{a:u8, p:inner, z:i64}: z proves post-composite + * accumulation stays natural. Pre-fix z sat at the slot-padded offset + * past the 8B-padded inner; the natural read undershoots. The wide z + * value (0x44444444) is verified inside the program (the exit channel + * is 8-bit), so a truncated/mis-addressed z fails the in-program cmp. */ + { "nested3", + "package main;\n" + "type inner = struct { x: u8, y: u8 };\n" + "type outer = struct { a: u8, p: inner, z: i64 };\n" + "export fn main() int = {\n" + " let o: outer = outer { a = 1, p = inner { x = 2, y = 3 }, z = 0x44444444i64 };\n" + " if (o.a: int != 1) { return 1; };\n" + " if (o.p.x: int != 2) { return 2; };\n" + " if (o.p.y: int != 3) { return 3; };\n" + " if (o.z != 0x44444444i64) { return 4; };\n" + " return 0;\n" + "};\n", + 0 }, + + /* (3) control — flat struct {a:u8, b:i64}, no sub-8 composite field. + * Natural and slot-padded layouts coincide (b lands at 8 either way); + * proves the fix leaves the common case unmoved. */ + { "flat_ctl", + "package main;\n" + "type flat = struct { a: u8, b: i64 };\n" + "export fn main() int = {\n" + " let o: flat = flat { a = 9, b = 0x33333333i64 };\n" + " if (o.a: int != 9) { return 1; };\n" + " if (o.b != 0x33333333i64) { return 2; };\n" + " return 0;\n" + "};\n", + 0 }, +}; + +/* run_build — build+run `src` via `driver`; returns the binary's exit + * code, or -1 on a build failure. */ +static int +run_build(const char *driver, const struct row *r, int i) +{ + char src[64], tmpdir[64], cmd[1024]; + snprintf(src, sizeof src, "/tmp/nestfld_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/nestfld_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -2; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null", + tmpdir, driver, src); + int brc = runwait(cmd); + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[128]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + + int got = -1; + if (brc == 0) got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return brc == 0 ? got : -1; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[1024]; + if (bin[0] != '/') { + char cwd[1024]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[1024], wdrv[1024]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + int have_ww = (access(wdrv, X_OK) == 0); + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + + for (int i = 0; i < n; i++) { + total++; + int gc = run_build(cdrv, &rows[i], i); + /* cstage must build+run */ + if (gc < 0) { + fprintf(stderr, "nestfield_run[cstage][%s]: build/run " + "failed (got %d)\n", rows[i].label, gc); + fail++; + continue; + } + if (rows[i].want_exit >= 0 && gc != rows[i].want_exit) { + fprintf(stderr, "nestfield_run[cstage][%s]: exit=%d " + "want=%d (field mismatch)\n", + rows[i].label, gc, rows[i].want_exit); + fail++; + } + if (!have_ww) { + fprintf(stderr, "nestfield_run: skip wwstage (no %s)\n", + wdrv); + continue; + } + int gw = run_build(wdrv, &rows[i], i); + /* rule-10: the cat-A invariant is cs == ww */ + if (gw != gc) { + fprintf(stderr, "nestfield_run[%s]: cs=%d != ww=%d " + "(struct field-offset divergence — #44/#55)\n", + rows[i].label, gc, gw); + fail++; + } + if (rows[i].want_exit >= 0 && gw != rows[i].want_exit) { + fprintf(stderr, "nestfield_run[wwstage][%s]: exit=%d " + "want=%d (field mismatch)\n", + rows[i].label, gw, rows[i].want_exit); + fail++; + } + } + + if (fail) { + fprintf(stderr, "nestfield_run: %d/%d checks failed\n", + fail, total); + return 1; + } + printf("nestfield_run: %d/%d ok\n", total, total); + return 0; +}