From 03fc7c7abe0df99973d703515612f9695ef5a022 Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Mon, 8 Jun 2026 20:17:05 +0900 Subject: [PATCH] wcc/check: #14 reject def-global scalar str index (silent segfault) (both stages) def S:str = "hi"; S[0] silently segfaulted: a def is a compile-time constant, never materialized as DATA (unlike let), so indexing it emitted an unbacked main.S(SB) reference -> cstage ran into frame garbage, wwstage link-failed. str[i] itself is valid ww (a deliberate Go-like str[i]->u8 byte-index that lib/strings compare/dup depend on), so the fix is narrow: the N_INDEX TY_STR arm now rejects an index whose operand is a bare SK_DEF scalar-str symbol, both stages -- 'cannot index a def-constant str; bind it to a let'. INDEX-ONLY: len(S) and &S are already loud, and a def's .len/.ptr field reads (the load-bearing w6l INTERP) are N_DOT, a different arm, and stay valid. A rule-9 WHY-comment records str[i]->u8 as a sanctioned divergence from Hare's strings.toutf8. The full make-it-work fold (len(S)->2, S[0]->byte) is deferred (#16). byte-id 990-997 8/8. test/wcc/821 table-driven. --- Makefile | 7 + cmd/wcc/check.c | 27 ++- selfhost/cmd/w6c/main.combined.ww | 25 +- selfhost/cmd/wcc/check.ww | 25 +- selfhost/cmd/wwdump/main.combined.ww | 25 +- test/wcc/821_def_str_index_reject.c | 335 +++++++++++++++++++++++++++ 6 files changed, 440 insertions(+), 4 deletions(-) create mode 100644 test/wcc/821_def_str_index_reject.c diff --git a/Makefile b/Makefile index 93a2bf2f..9323252e 100644 --- a/Makefile +++ b/Makefile @@ -249,6 +249,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_def_arr_len \ $(BIN)/test_def_str_table \ $(BIN)/test_arr_zero_vs_infer \ + $(BIN)/test_def_str_index_reject \ $(BIN)/test_slice_str_global_zero \ $(BIN)/test_slice_literal_global \ $(BIN)/test_global_arr_elem_field \ @@ -651,6 +652,12 @@ $(BIN)/test_arr_ptr_global: test/wcc/818_arr_ptr_global.c $(BIN)/ww \ $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +$(BIN)/test_def_str_index_reject: test/wcc/821_def_str_index_reject.c $(BIN)/ww \ + $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + $(BIN)/test_def_arr_infer_len: test/wcc/814_def_arr_infer_len.c $(BIN)/ww \ $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ $(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ diff --git a/cmd/wcc/check.c b/cmd/wcc/check.c index 189a5e22..081b55af 100644 --- a/cmd/wcc/check.c +++ b/cmd/wcc/check.c @@ -1437,8 +1437,33 @@ cexpr(Checker *c, Node *n) type_name(c->a, u->sub)); return n->type = u->sub; } - if (u && u->kind == TY_STR) + if (u && u->kind == TY_STR) { + /* rule-9 divergence-doc (drew .ai/drew-14-ruling.md): + * `str[i] -> u8` is a deliberate Go-like direct + * byte-index, a SANCTIONED ww divergence from Hare's + * `strings::toutf8(s)[i]` (the Hare reference checker + * rejects str-index, harec check.c:362). lib/strings + * is load-bearing on it (compare/dup/join). */ + /* #14: a `def` scalar str is an inline compile-time + * CONSTANT (def-as-constant; not storage-backed like a + * `let`), so it has no address to index — cgen would + * load a frame-garbage base and segfault. Only the bare + * def-global operand is unindexable; let/param/local + + * string-literal operands stay valid. The faithful + * def-as-constant splice-index is deferred (no + * consumer). */ + if (n->lhs->kind == N_IDENT) { + Sym *s = scope_lookup_prefer(c->cur, + c->cur_mod, n->lhs->str); + if (s && s->kind == SK_DEF) + return n->type = err(c, n->pos, + "cannot index a def-constant str " + "'%s'; bind it to a `let` (def " + "strings are inline constants, not " + "storage-backed)", n->lhs->str); + } return n->type = ty_u8; + } /* `*[N]T` auto-decays to `[N]T` indexing — drill into the * inner T so callers see the element type, matching C's * pointer-to-array semantics. `*[]T` does NOT auto-decay: diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index 2f2a8173..d669b8b9 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -12713,7 +12713,30 @@ fn indexresult(c: *checker, e: *node) *node = { if (u.kind == nkind.N_TSLICE) { return u.lhs; }; if (u.kind == nkind.N_TARRAY) { return u.lhs; }; if (u.kind == nkind.N_TNAME) { - if (streq(u.str, "str")) { return mktname(c, "u8"); }; + // rule-9 divergence-doc (drew .ai/drew-14-ruling.md): `str[i] -> + // u8` is a deliberate Go-like direct byte-index, a SANCTIONED ww + // divergence from Hare's `strings::toutf8(s)[i]` (the Hare + // reference checker rejects str-index, harec check.c:362). + // lib/strings is load-bearing on it (compare/dup/join). + if (streq(u.str, "str")) { + // #14: reject INDEX of a bare def-global scalar str — an + // inline compile-time constant with no storage to index + // (cgen refs an unbacked symbol -> link-fail ww / segfault + // cs). let/param/local + string-literal operands stay + // valid; only the SK_DEF scalar-str operand is + // unindexable. cstage twin: check.c N_INDEX TY_STR arm. + if (e.lhs != nil && e.lhs.kind == nkind.N_IDENT) { + let s: *sym = scopelookupprefer(c.cur, c.curmod, e.lhs.str); + if (s != nil && s.skind == skind.SK_DEF) { + cerr("error: cannot index a def-constant str '"); + cerr(e.lhs.str); + cerr("'; bind it to a `let` (def strings are inline constants, not storage-backed)\n"); + c.errs += 1; + return nil; + }; + }; + return mktname(c, "u8"); + }; }; if (u.kind == nkind.N_TPTR) { let inner: *node = u.lhs; diff --git a/selfhost/cmd/wcc/check.ww b/selfhost/cmd/wcc/check.ww index c942bda2..fe0db5ad 100644 --- a/selfhost/cmd/wcc/check.ww +++ b/selfhost/cmd/wcc/check.ww @@ -2432,7 +2432,30 @@ fn indexresult(c: *checker, e: *node) *node = { if (u.kind == nkind.N_TSLICE) { return u.lhs; }; if (u.kind == nkind.N_TARRAY) { return u.lhs; }; if (u.kind == nkind.N_TNAME) { - if (streq(u.str, "str")) { return mktname(c, "u8"); }; + // rule-9 divergence-doc (drew .ai/drew-14-ruling.md): `str[i] -> + // u8` is a deliberate Go-like direct byte-index, a SANCTIONED ww + // divergence from Hare's `strings::toutf8(s)[i]` (the Hare + // reference checker rejects str-index, harec check.c:362). + // lib/strings is load-bearing on it (compare/dup/join). + if (streq(u.str, "str")) { + // #14: reject INDEX of a bare def-global scalar str — an + // inline compile-time constant with no storage to index + // (cgen refs an unbacked symbol -> link-fail ww / segfault + // cs). let/param/local + string-literal operands stay + // valid; only the SK_DEF scalar-str operand is + // unindexable. cstage twin: check.c N_INDEX TY_STR arm. + if (e.lhs != nil && e.lhs.kind == nkind.N_IDENT) { + let s: *sym = scopelookupprefer(c.cur, c.curmod, e.lhs.str); + if (s != nil && s.skind == skind.SK_DEF) { + cerr("error: cannot index a def-constant str '"); + cerr(e.lhs.str); + cerr("'; bind it to a `let` (def strings are inline constants, not storage-backed)\n"); + c.errs += 1; + return nil; + }; + }; + return mktname(c, "u8"); + }; }; if (u.kind == nkind.N_TPTR) { let inner: *node = u.lhs; diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index e5d8939e..a760b746 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -12713,7 +12713,30 @@ fn indexresult(c: *checker, e: *node) *node = { if (u.kind == nkind.N_TSLICE) { return u.lhs; }; if (u.kind == nkind.N_TARRAY) { return u.lhs; }; if (u.kind == nkind.N_TNAME) { - if (streq(u.str, "str")) { return mktname(c, "u8"); }; + // rule-9 divergence-doc (drew .ai/drew-14-ruling.md): `str[i] -> + // u8` is a deliberate Go-like direct byte-index, a SANCTIONED ww + // divergence from Hare's `strings::toutf8(s)[i]` (the Hare + // reference checker rejects str-index, harec check.c:362). + // lib/strings is load-bearing on it (compare/dup/join). + if (streq(u.str, "str")) { + // #14: reject INDEX of a bare def-global scalar str — an + // inline compile-time constant with no storage to index + // (cgen refs an unbacked symbol -> link-fail ww / segfault + // cs). let/param/local + string-literal operands stay + // valid; only the SK_DEF scalar-str operand is + // unindexable. cstage twin: check.c N_INDEX TY_STR arm. + if (e.lhs != nil && e.lhs.kind == nkind.N_IDENT) { + let s: *sym = scopelookupprefer(c.cur, c.curmod, e.lhs.str); + if (s != nil && s.skind == skind.SK_DEF) { + cerr("error: cannot index a def-constant str '"); + cerr(e.lhs.str); + cerr("'; bind it to a `let` (def strings are inline constants, not storage-backed)\n"); + c.errs += 1; + return nil; + }; + }; + return mktname(c, "u8"); + }; }; if (u.kind == nkind.N_TPTR) { let inner: *node = u.lhs; diff --git a/test/wcc/821_def_str_index_reject.c b/test/wcc/821_def_str_index_reject.c new file mode 100644 index 00000000..aa576ca9 --- /dev/null +++ b/test/wcc/821_def_str_index_reject.c @@ -0,0 +1,335 @@ +/* + * 821_def_str_index_reject — indexing a bare DEF-GLOBAL scalar str is INVALID + * ww and BOTH stages must LOUDLY REJECT at check time (#14, the #8 sibling; + * drew ruling .ai/drew-14-ruling.md, rob spec .ai/rob-14-spec.md). + * + * `str[i] -> u8` itself is VALID ww — a sanctioned Go-like direct byte-index, + * a deliberate divergence from Hare's `strings::toutf8(s)[i]` (the Hare + * reference checker rejects str-index, harec check.c:362). lib/strings is + * load-bearing on it (compare/dup/join). The reject is SCOPED to ONE operand + * shape: a bare def-global SCALAR str. + * + * The bug (both-stage, but each side misbehaved DIFFERENTLY): + * - cstage: `def S:str="hi"; S[0]` BUILT and emitted an unbacked `main.S(SB)` + * base load — at runtime a frame-garbage base → SILENT SEGFAULT. + * - wwstage: the same source referenced an unbacked symbol → w6l LINK-FAIL. + * A `def` is an inline compile-time CONSTANT (def-as-constant; not storage- + * backed like a `let`), so it has no address to index. The fix REJECTS that + * one operand at the checker (N_IDENT operand + SK_DEF sym + scalar TY_STR + * base), surfacing a source error before cgen — segfault gone by construction. + * + * Mutation-sanity: the genuinely-silent pre-fix case is cstage's def-scalar + * index, which BUILT (then segfaulted) — neg rows assert BUILD-FAIL, so they + * FAIL pre-fix on cstage (built-ok) and pass post-fix. wwstage already + * link-failed pre-fix. + * + * neg row | shape | gate + * --------------------+----------------------------------------+---------- + * def_scalar_index | def S:str="hi", return S[0]:i32 | build FAIL + * def_scalar_varbind | def S:str="hi", let c=S[1] | build FAIL + * + * pos row | shape | want + * --------------------+----------------------------------------+------ + * let_scalar_index | module let S:str="hi", S[0]:i32 | 104 ('h') + * param_index | fn f(s:str) i32 = s[0]:i32; f("hi") | 104 ('h') + * local_index | local let s:str="hi", s[0]:i32 | 104 ('h') + * def_strarray_elem | def C:[2]str=["ab","cd"], C[1][0]:i32 | 99 ('c') + * + * The def_strarray_elem row pins the #8 materialised array-element str stays + * VALID: the outer operand `C[1]` is N_INDEX (not N_IDENT), so the scalar-str + * gate excludes it; and a bare def str-ARRAY operand's base is TY_ARRAY (not + * scalar str), also excluded. let/param/local + string-literal operands stay + * valid (the lib/strings compare/dup pattern). + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { const char *label; const char *src; int want; }; + +static const struct row rows[] = { + /* module-level `let` str is storage-backed (DATA) → indexable. */ + { "let_scalar_index", + "package main;\n" + "let S: str = \"hi\";\n" + "export fn main() i32 = {\n" + "\treturn S[0]: i32;\n" + "};\n", + 104 }, + + { "param_index", + "package main;\n" + "fn f(s: str) i32 = {\n" + "\treturn s[0]: i32;\n" + "};\n" + "export fn main() i32 = {\n" + "\treturn f(\"hi\");\n" + "};\n", + 104 }, + + { "local_index", + "package main;\n" + "export fn main() i32 = {\n" + "\tlet s: str = \"hi\";\n" + "\treturn s[0]: i32;\n" + "};\n", + 104 }, + + /* #8 materialised array-element str — `C[1]` is N_INDEX, not N_IDENT, + * so the def-scalar-str gate excludes it; must STAY valid. */ + { "def_strarray_elem", + "package main;\n" + "def C: [2]str = [\"ab\", \"cd\"];\n" + "export fn main() i32 = {\n" + "\treturn C[1][0]: i32;\n" + "};\n", + 99 }, + + /* CRITICAL PRESERVE — INTERP-style def-global scalar str `.len`/`.ptr` + * N_DOT FIELD read (lib w6l/dynout.ww INTERP, load-bearing in the ELF + * emit; bootstrap dies if this breaks). The #14 reject is on N_INDEX, + * NOT N_DOT — this field read must STAY valid. 3 + *"abc".ptr(='a'=97) + * = 100. */ + { "def_scalar_field", + "package main;\n" + "def S: str = \"abc\";\n" + "export fn main() i32 = {\n" + "\tlet n: i32 = S.len: i32;\n" + "\tlet p: *u8 = S.ptr;\n" + "\treturn n + (*p): i32;\n" + "};\n", + 100 }, + + /* def-global NON-str array index — the scalar-str gate (TY_STR only) + * must NOT over-catch a legit def-array index (the #8 array path). */ + { "def_arr_index", + "package main;\n" + "def A: [3]int = [10, 20, 30];\n" + "export fn main() i32 = {\n" + "\treturn A[1]: i32;\n" + "};\n", + 20 }, +}; + +/* Indexing a bare def-global scalar str — both stages must FAIL the build + * (loud checker diagnostic, not silent segfault / link-error). */ +static const char *neg[] = { + /* def_scalar_index */ + "package main;\n" + "def S: str = \"hi\";\n" + "export fn main() i32 = {\n" + "\treturn S[0]: i32;\n" + "};\n", + /* def_scalar_varbind */ + "package main;\n" + "def S: str = \"hi\";\n" + "export fn main() i32 = {\n" + "\tlet c = S[1];\n" + "\treturn c: i32;\n" + "};\n", +}; + +static int +run_driver(const char *driver, const struct row *r, int i) +{ + char src[64], tmpdir[64], cmd[1024]; + snprintf(src, sizeof src, "/tmp/dsi_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/dsi_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -1; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null", + tmpdir, driver, src); + if (runwait(cmd) != 0) { + fprintf(stderr, "row[%s]: build via %s failed\n", + r->label, driver); + unlink(src); rmdir(tmpdir); + return -1; + } + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[128]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + int got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return got; +} + +/* build_should_fail — indexing a def-global scalar str must error on + * `driver`; returns 0 when the build correctly FAILS, non-zero when it + * wrongly succeeded. */ +static int +build_should_fail(const char *driver, const char *src, int i) +{ + char s[64], tmpdir[64], cmd[1024]; + snprintf(s, sizeof s, "/tmp/dsin_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/dsin_%d_d_%d", getpid(), i); + + FILE *f = fopen(s, "wb"); + if (!f) return -1; + fputs(src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null", + tmpdir, driver, s); + int rc = runwait(cmd); + unlink(s); + /* clean any emitted binary */ + const char *base = strrchr(s, '/'); + base = base ? base + 1 : s; + char outbin[128]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + unlink(outbin); + rmdir(tmpdir); + return rc == 0 ? -1 : 0; /* build must NOT succeed */ +} + +/* asm_byte_identical — w6c vs w6c_ww .s for the same source must match. */ +static int +asm_byte_identical(const char *bin, const struct row *r, int i) +{ + char src[64], cs[64], ws[64], cmd[1024]; + snprintf(src, sizeof src, "/tmp/dsi_asm_%d_%d.ww", getpid(), i); + snprintf(cs, sizeof cs, "/tmp/dsi_asm_%d_%d_c.s", getpid(), i); + snprintf(ws, sizeof ws, "/tmp/dsi_asm_%d_%d_w.s", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -1; + fputs(r->src, f); + fclose(f); + + snprintf(cmd, sizeof cmd, "%s/w6c -o %s %s 2>/dev/null", bin, cs, src); + if (runwait(cmd) != 0) { + fprintf(stderr, "row[%s]: w6c errored\n", r->label); + unlink(src); + return -1; + } + snprintf(cmd, sizeof cmd, "%s/w6c_ww -o %s %s 2>/dev/null", + bin, ws, src); + if (runwait(cmd) != 0) { + fprintf(stderr, "row[%s]: w6c_ww errored\n", r->label); + unlink(src); unlink(cs); + return -1; + } + + FILE *fc = fopen(cs, "rb"); + FILE *fw = fopen(ws, "rb"); + int rc = 0; + if (!fc || !fw) { + rc = -1; + } else { + for (;;) { + int a = fgetc(fc); + int b = fgetc(fw); + if (a != b) { rc = -1; break; } + if (a == EOF) break; + } + } + if (fc) fclose(fc); + if (fw) fclose(fw); + if (rc != 0) + fprintf(stderr, "row[%s]: cstage vs wwstage asm differs\n", + r->label); + unlink(src); unlink(cs); unlink(ws); + return rc; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[1024]; + if (bin[0] != '/') { + char cwd[1024]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[1024]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + char wdrv[1024]; + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *path; int gated_on_existence; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int nn = (int)(sizeof neg / sizeof neg[0]); + int total = 0, fail = 0; + + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated_on_existence + && access(drivers[d].path, X_OK) != 0) { + fprintf(stderr, "def_str_index_reject: skip %s (no %s)\n", + drivers[d].name, drivers[d].path); + continue; + } + for (int i = 0; i < n; i++) { + int got = run_driver(drivers[d].path, &rows[i], i); + total++; + if (got != rows[i].want) { + fprintf(stderr, + "def_str_index_reject[%s][%s]: exit=%d want=%d\n", + drivers[d].name, rows[i].label, + got, rows[i].want); + fail++; + } + } + for (int i = 0; i < nn; i++) { + total++; + if (build_should_fail(drivers[d].path, neg[i], + 100 + i) != 0) { + fprintf(stderr, + "def_str_index_reject[%s][neg%d]: built ok, " + "expected a loud error\n", + drivers[d].name, i); + fail++; + } + } + } + + if (access(wdrv, X_OK) == 0) { + for (int i = 0; i < n; i++) { + total++; + if (asm_byte_identical(bin, &rows[i], i) != 0) + fail++; + } + } + + if (fail) { + fprintf(stderr, + "def_str_index_reject: %d/%d fixtures failed\n", fail, total); + return 1; + } + printf("def_str_index_reject: %d/%d ok\n", total, total); + return 0; +}