From 08ccb734b22c3422c87520f322454cf5015d74f9 Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Tue, 9 Jun 2026 19:07:40 +0900 Subject: [PATCH] wcc/check: reject untyped-float + nil into a tagged dst with no matching variant (wwstage align to cstage) isassignable's untyped-float (A4) and nil (A5) arms over-accepted a source into a tagged dst where no variant accepts it -> silent over-accept then tag-0 miscompile; cstage louds. Reject (cerr + c.errs+=1). Part of the isassignable tagged-dst over-accept class (#23 fixed arm3; A6/A7 deferred to the B-full nominal arc). test/wcc/836. --- Makefile | 7 + selfhost/cmd/w6c/main.combined.ww | 38 +++- selfhost/cmd/wcc/check.ww | 38 +++- selfhost/cmd/wwdump/main.combined.ww | 38 +++- test/wcc/836_tagged_assignable_cluster.c | 270 +++++++++++++++++++++++ 5 files changed, 385 insertions(+), 6 deletions(-) create mode 100644 test/wcc/836_tagged_assignable_cluster.c diff --git a/Makefile b/Makefile index 59a4fe95..65040e7a 100644 --- a/Makefile +++ b/Makefile @@ -260,6 +260,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_tuple_elem_overlong \ $(BIN)/test_tagged_arr_variant \ $(BIN)/test_nested_union_int_box \ + $(BIN)/test_tagged_assignable_cluster \ $(BIN)/test_inferred_array_global \ $(BIN)/test_slice_str_global_arg \ $(BIN)/test_slice_str_global_zero \ @@ -737,6 +738,12 @@ $(BIN)/test_nested_union_int_box: test/wcc/835_nested_union_int_box.c $(BIN)/ww $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +$(BIN)/test_tagged_assignable_cluster: test/wcc/836_tagged_assignable_cluster.c $(BIN)/ww \ + $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + $(BIN)/test_inferred_array_global: test/wcc/833_inferred_array_global.c $(BIN)/ww \ $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ $(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index 8eee2e83..f83275d4 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -14123,6 +14123,30 @@ fn isassignable(c: *checker, dst: *node, src: *node, confident: *bool) bool = { if (streq(du.str, "void")) { return false; }; if (streq(du.str, "str")) { return false; }; }; + // A4 (#23 float-twin): (T | ...) tagged dst — accept iff a DIRECT + // variant is a float type. cstage type_assignable for an + // untyped_float src uses type_isfloat (type.c:376 — f32/f64 ONLY, + // NOT type_isnum), so an int/enum variant does NOT accept an + // untyped float. No direct float variant -> confident reject + // (cstage type.c:316 loop returns 0); ww does NOT flatten a + // nested-union float variant (#199-alpha). *confident is already + // true (:3777). Without it the catch-all (:3972) over-accepts an + // untyped float into ANY tagged (silent tag=0). Faithful + // flatten+rebox deferred post-CSP (nominal id, #23/#40). + if (du.kind == nkind.N_TTAGGED) { + let v: *node = du.list; + for (v != nil) { + let vu: *node = resolvealias(c, unwrapbang(v)); + if (vu != nil) { + if (vu.kind == nkind.N_TNAME) { + if (streq(vu.str, "f32")) { return true; }; + if (streq(vu.str, "f64")) { return true; }; + }; + }; + v = v.next; + }; + return false; + }; *confident = false; return true; }; @@ -14137,10 +14161,20 @@ fn isassignable(c: *checker, dst: *node, src: *node, confident: *bool) bool = { if (du.kind == nkind.N_TTAGGED) { let v: *node = du.list; for (v != nil) { - if (v.kind == nkind.N_TPTR) { return true; }; - if (v.kind == nkind.N_TSLICE){ return true; }; + if (v.kind == nkind.N_TPTR) { return true; }; + if (v.kind == nkind.N_TSLICE) { return true; }; + if (v.kind == nkind.N_TCHAN) { return true; }; + if (v.kind == nkind.N_TFN) { return true; }; v = v.next; }; + // A5: no nullable (ptr/slice/chan/fn) variant -> confident + // reject (cstage type.c:316 loop returns 0; nil accepts only + // into ptr/slice/chan/fn per type.c:382-385). *confident is + // already true (:3777). Without it the catch-all (:3972) + // over-accepts nil into ANY tagged (silent). The trailing + // fallthrough below stays for a NON-tagged du (nil into a bare + // scalar — a separate non-family over-accept, SIBLINGS). + return false; }; *confident = false; return true; diff --git a/selfhost/cmd/wcc/check.ww b/selfhost/cmd/wcc/check.ww index e43b306a..50dc6dd3 100644 --- a/selfhost/cmd/wcc/check.ww +++ b/selfhost/cmd/wcc/check.ww @@ -3842,6 +3842,30 @@ fn isassignable(c: *checker, dst: *node, src: *node, confident: *bool) bool = { if (streq(du.str, "void")) { return false; }; if (streq(du.str, "str")) { return false; }; }; + // A4 (#23 float-twin): (T | ...) tagged dst — accept iff a DIRECT + // variant is a float type. cstage type_assignable for an + // untyped_float src uses type_isfloat (type.c:376 — f32/f64 ONLY, + // NOT type_isnum), so an int/enum variant does NOT accept an + // untyped float. No direct float variant -> confident reject + // (cstage type.c:316 loop returns 0); ww does NOT flatten a + // nested-union float variant (#199-alpha). *confident is already + // true (:3777). Without it the catch-all (:3972) over-accepts an + // untyped float into ANY tagged (silent tag=0). Faithful + // flatten+rebox deferred post-CSP (nominal id, #23/#40). + if (du.kind == nkind.N_TTAGGED) { + let v: *node = du.list; + for (v != nil) { + let vu: *node = resolvealias(c, unwrapbang(v)); + if (vu != nil) { + if (vu.kind == nkind.N_TNAME) { + if (streq(vu.str, "f32")) { return true; }; + if (streq(vu.str, "f64")) { return true; }; + }; + }; + v = v.next; + }; + return false; + }; *confident = false; return true; }; @@ -3856,10 +3880,20 @@ fn isassignable(c: *checker, dst: *node, src: *node, confident: *bool) bool = { if (du.kind == nkind.N_TTAGGED) { let v: *node = du.list; for (v != nil) { - if (v.kind == nkind.N_TPTR) { return true; }; - if (v.kind == nkind.N_TSLICE){ return true; }; + if (v.kind == nkind.N_TPTR) { return true; }; + if (v.kind == nkind.N_TSLICE) { return true; }; + if (v.kind == nkind.N_TCHAN) { return true; }; + if (v.kind == nkind.N_TFN) { return true; }; v = v.next; }; + // A5: no nullable (ptr/slice/chan/fn) variant -> confident + // reject (cstage type.c:316 loop returns 0; nil accepts only + // into ptr/slice/chan/fn per type.c:382-385). *confident is + // already true (:3777). Without it the catch-all (:3972) + // over-accepts nil into ANY tagged (silent). The trailing + // fallthrough below stays for a NON-tagged du (nil into a bare + // scalar — a separate non-family over-accept, SIBLINGS). + return false; }; *confident = false; return true; diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index c7808377..d5d928b6 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -14123,6 +14123,30 @@ fn isassignable(c: *checker, dst: *node, src: *node, confident: *bool) bool = { if (streq(du.str, "void")) { return false; }; if (streq(du.str, "str")) { return false; }; }; + // A4 (#23 float-twin): (T | ...) tagged dst — accept iff a DIRECT + // variant is a float type. cstage type_assignable for an + // untyped_float src uses type_isfloat (type.c:376 — f32/f64 ONLY, + // NOT type_isnum), so an int/enum variant does NOT accept an + // untyped float. No direct float variant -> confident reject + // (cstage type.c:316 loop returns 0); ww does NOT flatten a + // nested-union float variant (#199-alpha). *confident is already + // true (:3777). Without it the catch-all (:3972) over-accepts an + // untyped float into ANY tagged (silent tag=0). Faithful + // flatten+rebox deferred post-CSP (nominal id, #23/#40). + if (du.kind == nkind.N_TTAGGED) { + let v: *node = du.list; + for (v != nil) { + let vu: *node = resolvealias(c, unwrapbang(v)); + if (vu != nil) { + if (vu.kind == nkind.N_TNAME) { + if (streq(vu.str, "f32")) { return true; }; + if (streq(vu.str, "f64")) { return true; }; + }; + }; + v = v.next; + }; + return false; + }; *confident = false; return true; }; @@ -14137,10 +14161,20 @@ fn isassignable(c: *checker, dst: *node, src: *node, confident: *bool) bool = { if (du.kind == nkind.N_TTAGGED) { let v: *node = du.list; for (v != nil) { - if (v.kind == nkind.N_TPTR) { return true; }; - if (v.kind == nkind.N_TSLICE){ return true; }; + if (v.kind == nkind.N_TPTR) { return true; }; + if (v.kind == nkind.N_TSLICE) { return true; }; + if (v.kind == nkind.N_TCHAN) { return true; }; + if (v.kind == nkind.N_TFN) { return true; }; v = v.next; }; + // A5: no nullable (ptr/slice/chan/fn) variant -> confident + // reject (cstage type.c:316 loop returns 0; nil accepts only + // into ptr/slice/chan/fn per type.c:382-385). *confident is + // already true (:3777). Without it the catch-all (:3972) + // over-accepts nil into ANY tagged (silent). The trailing + // fallthrough below stays for a NON-tagged du (nil into a bare + // scalar — a separate non-family over-accept, SIBLINGS). + return false; }; *confident = false; return true; diff --git a/test/wcc/836_tagged_assignable_cluster.c b/test/wcc/836_tagged_assignable_cluster.c new file mode 100644 index 00000000..8aee0afd --- /dev/null +++ b/test/wcc/836_tagged_assignable_cluster.c @@ -0,0 +1,270 @@ +/* + * 836_tagged_assignable_cluster — checker isassignable tagged-dst over-accept + * cluster (drew2 spec .ai/drew2-family-spec.md). Arms that silently + * over-accepted a NON-variant source into a tagged union where cstage + * confident-rejects. SILENT-in-ww / cstage-LOUD (category A), aligned DOWN to + * cstage's `return 0` per arm. + * + * LANDED here: A4 + A5 (the two arms build-proven byte-id-NEUTRAL on the full + * 990-997 bootstrap gate). + * A4 untyped-float into a tagged dst with no DIRECT float variant. The arm + * had no tagged sub-loop (the #23 fix only covered untyped-int) so it + * fell to the permissive catch-all. Now: accept iff a direct f32/f64 + * variant exists (cstage type_isfloat, type.c:376), else confident + * reject. + * A5 nil into a tagged dst with no nullable (ptr/slice/chan/fn) variant. + * The tagged loop only checked ptr/slice and on miss fell through to a + * permissive accept. Now: chan/fn added (cstage type.c:382-385) and a + * miss confident-rejects. (The NON-tagged nil fallthrough is left for a + * separate sibling.) + * + * DEFERRED (escalated): A6 (concrete->tagged innerconf) and A7 (tagged->tagged + * subset loop = S2). Both OVER-REJECT real bootstrap forwards that cstage + * accepts — A7 on `(i64 | oserror)` -> `(i64 | os.oserror)` (typeeqast does + * not equate the unqualified vs module-qualified spelling of the same nominal + * type; cstage type_eq does — the #199b cross-module nominal gap), A6 on a + * concrete return into `(fast_parsed_float | invalid)` and `opaque_ -> error` + * (ww's isassignable confidence model diverges from cstage type_assignable). + * Landing them needs the typeeqast nominal fix first; deferred per rule 7 + * (no loosening to rescue, which would re-open S2). The valid-form POS rows + * below keep working with A6/A7 in their PRE-task permissive state. + * + * neg row | shape | gate + * -------------+------------------------------------------------+------ + * A4_float | (int|str) <- 3.5 | FAIL + * A5_nil | (int|str) <- nil | FAIL + * + * pos row | shape | want + * -------------+------------------------------------------------+------ + * A4_f64ok | (f64|str) <- 3.5; match f64 -> 35 | 35 + * A5_ptrok | (*int|void) <- nil (nullable) | 0 + * A6_directstr | (inner|str) <- str (direct variant) | 0 + * A6_intbool | (int|bool) <- 5 (numeric variant) | 0 + * A7_subset | sup(int|uint|str) <- sub(int|uint) | 0 + * + * Diagnostic TEXT is byte-id-blind (both stages REJECT, no asm). 990-997 + * byte-id untouched (A4/A5 are NEUTRAL: cstage runs the same predicate on a + * green bootstrap, which contains no rejected shape). + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { const char *label; const char *src; int want; }; + +static const struct row rows[] = { + /* A4 — float into a dst WITH an f64 variant: live runtime proof the + * accept path still builds a correct box (match f64 -> 35). */ + { "A4_f64ok", + "package main;\n" + "type u = (f64 | str);\n" + "fn mk() u = { return 3.5; };\n" + "export fn main() i32 = {\n" + "\tlet v = mk();\n" + "\tmatch (v) {\n" + "\tcase let f: f64 => return 35;\n" + "\tcase str => return 1;\n" + "\t};\n" + "\treturn 9;\n" + "};\n", + 35 }, + + /* A5 — nil into a nullable (*int | void): the ptr variant accepts. + * Compile-only (main returns 0). */ + { "A5_ptrok", + "package main;\n" + "type u = (*int | void);\n" + "fn mk() u = { return nil; };\n" + "export fn main() i32 = { return 0; };\n", + 0 }, + + /* A6 valid — direct str variant (the permissive arm still accepts a + * VALID variant; only the SILENT over-accept is what A6 would close). + * Compile-only. */ + { "A6_directstr", + "package main;\n" + "type inner = (int | bool);\n" + "type u = (inner | str);\n" + "fn mk(s: str) u = { return s; };\n" + "export fn main() i32 = { return 0; };\n", + 0 }, + + /* A6 valid — numeric variant (untyped-int arm, unaffected). + * Compile-only. */ + { "A6_intbool", + "package main;\n" + "type u = (int | bool);\n" + "fn mk() u = { return 5; };\n" + "export fn main() i32 = { return 0; };\n", + 0 }, + + /* A7 valid — proper-subset union widen (every src variant a direct dst + * variant). Accepts on both today. Compile-only. */ + { "A7_subset", + "package main;\n" + "type sub = (int | uint);\n" + "type sup = (int | uint | str);\n" + "fn w(x: sub) sup = { return x; };\n" + "export fn main() i32 = { return 0; };\n", + 0 }, +}; + +/* Each neg must FAIL the build on both stages (loud confident reject). */ +static const char *neg[] = { + /* A4 — untyped float into a dst with NO float variant. */ + "package main;\n" + "type u = (int | str);\n" + "fn mk() u = { return 3.5; };\n" + "export fn main() i32 = { return 0; };\n", + /* A5 — nil into a dst with NO nullable variant. */ + "package main;\n" + "type u = (int | str);\n" + "fn mk() u = { return nil; };\n" + "export fn main() i32 = { return 0; };\n", +}; + +static int +run_driver(const char *driver, const struct row *r, int i) +{ + char src[64], tmpdir[64], cmd[1024]; + snprintf(src, sizeof src, "/tmp/tac_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/tac_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -1; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null", + tmpdir, driver, src); + if (runwait(cmd) != 0) { + fprintf(stderr, "row[%s]: build via %s failed\n", + r->label, driver); + unlink(src); rmdir(tmpdir); + return -1; + } + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[128]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + int got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return got; +} + +/* build_should_fail — the construct must error on `driver`; returns 0 when + * the build correctly FAILS, non-zero when it wrongly succeeded. */ +static int +build_should_fail(const char *driver, const char *src, int i) +{ + char s[64], tmpdir[64], cmd[1024]; + snprintf(s, sizeof s, "/tmp/tacn_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/tacn_%d_d_%d", getpid(), i); + + FILE *f = fopen(s, "wb"); + if (!f) return -1; + fputs(src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null", + tmpdir, driver, s); + int rc = runwait(cmd); + unlink(s); + const char *base = strrchr(s, '/'); + base = base ? base + 1 : s; + char outbin[128]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + unlink(outbin); + rmdir(tmpdir); + return rc == 0 ? -1 : 0; /* build must NOT succeed */ +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[1024]; + if (bin[0] != '/') { + char cwd[1024]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[1024]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + char wdrv[1024]; + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *path; int gated_on_existence; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int nn = (int)(sizeof neg / sizeof neg[0]); + int total = 0, fail = 0; + + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated_on_existence + && access(drivers[d].path, X_OK) != 0) { + fprintf(stderr, "tagged_assignable_cluster: skip %s (no %s)\n", + drivers[d].name, drivers[d].path); + continue; + } + for (int i = 0; i < n; i++) { + int got = run_driver(drivers[d].path, &rows[i], i); + total++; + if (got != rows[i].want) { + fprintf(stderr, + "tagged_assignable_cluster[%s][%s]: exit=%d want=%d\n", + drivers[d].name, rows[i].label, + got, rows[i].want); + fail++; + } + } + for (int i = 0; i < nn; i++) { + total++; + if (build_should_fail(drivers[d].path, neg[i], + 100 + i) != 0) { + fprintf(stderr, + "tagged_assignable_cluster[%s][neg%d]: built ok, " + "expected a loud reject\n", + drivers[d].name, i); + fail++; + } + } + } + + if (fail) { + fprintf(stderr, + "tagged_assignable_cluster: %d/%d fixtures failed\n", + fail, total); + return 1; + } + printf("tagged_assignable_cluster: %d/%d ok\n", total, total); + return 0; +}