selfhost+test: route composite CALL return through nodeisslice (#24)

Wwstage call-arg-emit recognized slice args only when source was
IDENT/SLICE/CAST/DOT. For N_CALL returning []T the natural-push
fallthrough emitted one PUSHQ AX (lost .len/.cap) and cgcall's
pop-count under-drained by 2 words — corrupting R8/R9 and every
subsequent arg. Class A runtime miscompile with stack misalignment
and 3-POPs-of-garbage at the receiving call. Sister to #21
(tagged-CALL arg) but for plain []u8 slice, not tagged-variant —
wwstage's pushargsrev grew the tagged-CALL arm at #21 and never
grew the plain-composite arm.

Surfaced by lib/strings landing's `bytes.X(toutf8(in), p)` call
sites: 995_self_rebuild's wwstage rebuild tripped on byte-id
divergence at w6c_ww + wwdump_ww emit. 967_bytes_run was green
because `ww run` exercises the cstage path. Corpus-coverage-blind
on the wwstage side until lib/strings pulled the chain through
wwstage compilation.

Fix is minimal: `nodeisslice` (selfhost/cmd/wcc/cgenutil.ww) gains
an N_CALL arm structurally identical to the existing N_CALL arm in
`nodeisstr` (only swap: isslicetype for isstrtype). The downstream
natural-push slice path (PUSHQ CX/BX/AX, extra=2 pop-count) was
already correct — it just needed the N_CALL-of-slice-return shape
to be recognized as a slice. pushargsrev and cgcall untouched.

Polarity catalog: wwstage UNDER — missing N_CALL arm in slice
shape recognition. Convergence wwstage → cstage per rule 10
(cstage reads typed-AST `type_isslice` natively).

Tests:
  - 723_composite_call_arg pins the 3-PUSH order (CX, BX, AX)
    between `CALL view` and next CALL on canonical `f(g())` shape,
    plus cstage vs wwstage cmp -s byte-id.
  - 927_composite_call_arg_run runtime-pins 7 rows × 2 stages =
    14 fixtures: canonical, slice-CALL + let-slice (hasprefix
    shape), two composite-CALL args (arg-shift collision),
    middle-argpos, nested composite-in-composite, slice + scalar
    pop-count mix, tagged-CALL regression alongside (confirms
    #21 still holds).

95/95 ok. 995_self_rebuild stays green (ww2==ww3==ww4 byte-id).
This commit is contained in:
2026-05-18 02:20:42 +09:00
parent 53c9e46c21
commit 0e2c6cd893
6 changed files with 570 additions and 0 deletions

View File

@@ -0,0 +1,221 @@
/*
* 723_composite_call_arg — sentinel for #24. Pins that wwstage emits
* three PUSHQs (CX, BX, AX) after a CALL whose return type is a 3-reg
* composite (`[]u8` slice, ptr/len/cap = AX/BX/CX) when that call's
* result is fed directly as a composite arg to another call. Pre-fix
* `nodeisslice` in cgenutil.ww had no N_CALL arm, so the natural-push
* branch in pushargsrev fell through to a single `PUSHQ AX` and the
* receiver's R8/R9 stayed unset (and arg2's pop drained off residual
* stack words, shifting all subsequent args).
*
* Cstage already had the right shape via typed-AST `node_isslice`
* (cmd/w6c/cgen.c:node_isslice). Fix aligns wwstage DOWN to cstage
* (rule 10): add an N_CALL arm to `nodeisslice` that mirrors the
* existing N_CALL arm in `nodeisstr` (cgenutil.ww:574+).
*
* 927_composite_call_arg_run pins the runtime behaviour; this row
* pins the asm shape so a future cgen refactor that re-routes
* pushargsrev can't silently regress back to the dropped-len/cap
* sequence.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
struct row { const char *label; const char *src; };
/* Canonical row: f(g()) with g returning `[]u8`, f taking 2x `[]u8`.
* Mirrors strings.hasprefix(bytes.X(toutf8(in), p)) shape. */
static const struct row rows[] = {
{ "slice_call_into_2slice_arg",
"fn view(s: str) []u8 = {\n"
" let r: []u8;\n"
" r.ptr = s.ptr;\n"
" r.len = s.len;\n"
" r.cap = s.len;\n"
" return r;\n"
"};\n"
"fn check(a: []u8, b: []u8) bool = {\n"
" if (a.len != b.len) { return false; };\n"
" return true;\n"
"};\n"
"export fn caller(in: str, p: []u8) bool = {\n"
" return check(view(in), p);\n"
"};\n" },
};
static int
slurp(const char *path, char *buf, size_t cap)
{
FILE *f = fopen(path, "rb");
if (!f) return -1;
size_t n = fread(buf, 1, cap - 1, f);
fclose(f);
buf[n] = '\0';
return (int)n;
}
static long
find_after(const char *buf, long start, const char *needle)
{
const char *p = strstr(buf + start, needle);
if (!p) return -1;
return (long)(p - buf);
}
/* After every `CALL\tview` site within caller, three PUSHQs (CX, BX,
* AX in that order) must appear before the next CALL site. Pre-fix
* wwstage emitted only one PUSHQ AX. */
static int
check_three_push_after_call(const char *spath, const struct row *r)
{
char buf[1 << 16];
if (slurp(spath, buf, sizeof buf) < 0) return -1;
long call = find_after(buf, 0, "CALL\tview");
if (call < 0) {
fprintf(stderr, "row[%s]: no CALL view site\n", r->label);
return -1;
}
long nextcall = find_after(buf, call + 1, "CALL\t");
if (nextcall < 0) {
fprintf(stderr, "row[%s]: no follow-up CALL\n", r->label);
return -1;
}
long pcx = find_after(buf, call, "PUSHQ\tCX");
long pbx = find_after(buf, call, "PUSHQ\tBX");
long pax = find_after(buf, call, "PUSHQ\tAX");
if (pcx < 0 || pcx > nextcall) {
fprintf(stderr,
"row[%s]: no PUSHQ CX between CALL view and next CALL\n",
r->label);
return -1;
}
if (pbx < 0 || pbx > nextcall) {
fprintf(stderr,
"row[%s]: no PUSHQ BX between CALL view and next CALL\n",
r->label);
return -1;
}
if (pax < 0 || pax > nextcall) {
fprintf(stderr,
"row[%s]: no PUSHQ AX between CALL view and next CALL\n",
r->label);
return -1;
}
/* High → low order: CX first, then BX, then AX. */
if (!(pcx < pbx && pbx < pax)) {
fprintf(stderr,
"row[%s]: PUSHQ order != CX,BX,AX (%ld,%ld,%ld)\n",
r->label, pcx, pbx, pax);
return -1;
}
return 0;
}
static int
emit_s(const char *w6c, const struct row *r, int i, char *out_s, size_t cap)
{
char src[64], cmd[1024];
snprintf(src, sizeof src, "/tmp/cca_asm_%d_%d.ww", getpid(), i);
snprintf(out_s, cap, "/tmp/cca_asm_%d_%d_%s.s",
getpid(), i, w6c[strlen(w6c) - 1] == 'w' ? "ww" : "c");
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null", w6c, out_s, src);
int rc = runwait(cmd);
unlink(src);
return rc;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[512];
if (bin[0] != '/') {
char cwd[256];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char w6c[640], w6c_ww[640];
snprintf(w6c, sizeof w6c, "%s/w6c", bin);
snprintf(w6c_ww, sizeof w6c_ww, "%s/w6c_ww", bin);
int have_ww = (access(w6c_ww, X_OK) == 0);
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int i = 0; i < n; i++) {
char cs_path[128], ws_path[128];
if (emit_s(w6c, &rows[i], i, cs_path, sizeof cs_path) != 0) {
fprintf(stderr,
"composite_call_arg[cstage][%s]: w6c failed\n",
rows[i].label);
fail++; total++; continue;
}
total++;
if (check_three_push_after_call(cs_path, &rows[i]) != 0) {
fail++;
}
if (!have_ww) { unlink(cs_path); continue; }
if (emit_s(w6c_ww, &rows[i], i, ws_path, sizeof ws_path) != 0) {
fprintf(stderr,
"composite_call_arg[wwstage][%s]: w6c_ww failed\n",
rows[i].label);
fail++; total++;
unlink(cs_path);
continue;
}
total++;
if (check_three_push_after_call(ws_path, &rows[i]) != 0) {
fail++;
}
/* Byte-id diff: this canonical row has no !void / no tagged
* variants, so it is not gated by #22 or #21 and must
* cmp -s clean post-#24. */
total++;
char cmd[512];
snprintf(cmd, sizeof cmd, "cmp -s %s %s", cs_path, ws_path);
if (runwait(cmd) != 0) {
fprintf(stderr,
"composite_call_arg[%s]: cstage vs wwstage asm differs\n",
rows[i].label);
fail++;
}
unlink(cs_path); unlink(ws_path);
}
if (fail) {
fprintf(stderr,
"composite_call_arg: %d/%d fixtures failed\n", fail, total);
return 1;
}
printf("composite_call_arg: %d/%d ok\n", total, total);
return 0;
}

View File

@@ -0,0 +1,289 @@
/*
* 927_composite_call_arg_run — runtime sentinel for #24 (Class A
* wwstage cgen miscompile). When a 3-reg composite (`[]u8` slice)
* CALL result is passed inline as a composite arg to another call,
* pre-fix wwstage emitted a single `PUSHQ AX` (loses .len/.cap) and
* under-popped the receiver's arg-regs by two words. Net: arg-shift
* collision corrupts every subsequent arg; the receiver reads the
* caller's spilled `p.ptr` as its own `s.len`, etc.
*
* Fix-site: `nodeisslice` in selfhost/cmd/wcc/cgenutil.ww gained an
* N_CALL arm mirroring `nodeisstr`'s existing one. Both the push side
* (pushargsrev's 3-PUSH `CX, BX, AX` arm) and the pop side (cgcall's
* `extra = 2`) then fire for slice-returning CALLs as args.
*
* Rows pin the runtime semantics across the matrix rob-pike outlined:
* (a) canonical `f(g())` with g returning `[]u8`.
* (b) slice-CALL then let-slice `f(g(), p)` (strings.hasprefix shape).
* (c) two composite CALLs `f(g(in1), g(in2))` (arg-shift collision).
* (d) slice-CALL in middle arg position `f(p, g(), q)`.
* (e) slice-CALL as last arg `f(p, q, g())` (stack-spill region).
* (f) nested composite `f(g(h(s)))` (composite-in-composite).
* (g) tagged-CALL regression alongside slice-CALL — confirm #21
* still holds and the two natural-push arms compose.
* (h) slice-CALL followed by a scalar `f(g(), 42)` (pop-count mix).
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
struct row { const char *label; const char *src; int want; };
static const struct row rows[] = {
/* (a) canonical: f(g()) with g returning `[]u8`. Pre-fix wwstage
* dispatches via fewer PUSHes; check.len reads .ptr-low (a tiny
* non-13 number) → return 11. */
{ "canonical_slice_call",
"fn view(s: str) []u8 = {\n"
" let r: []u8;\n"
" r.ptr = s.ptr;\n"
" r.len = s.len;\n"
" r.cap = s.len;\n"
" return r;\n"
"};\n"
"fn check(a: []u8) i32 = {\n"
" if (a.len == 13) { return 0; };\n"
" return 11;\n"
"};\n"
"export fn main() i32 = {\n"
" let s: str = \"hello, world!\";\n"
" return check(view(s));\n"
"};\n",
0 },
/* (b) f(g(), p) — strings.hasprefix shape: slice-CALL into 6-reg
* argpack, let-slice as second. Pre-fix p.ptr lands in DI/SI
* instead of R8/R9; check2 sees garbage for `b.len`. */
{ "slice_call_then_letslice",
"fn view(s: str) []u8 = {\n"
" let r: []u8;\n"
" r.ptr = s.ptr;\n"
" r.len = s.len;\n"
" r.cap = s.len;\n"
" return r;\n"
"};\n"
"fn check2(a: []u8, b: []u8) i32 = {\n"
" if (a.len != 13) { return 11; };\n"
" if (b.len != 5) { return 12; };\n"
" return 0;\n"
"};\n"
"export fn main() i32 = {\n"
" let s: str = \"hello, world!\";\n"
" let p: []u8;\n"
" p.ptr = s.ptr;\n"
" p.len = 5;\n"
" p.cap = 5;\n"
" return check2(view(s), p);\n"
"};\n",
0 },
/* (c) f(g(in1), g(in2)) — two composite CALLs back-to-back. The
* second call's pushargsrev runs first (right-to-left), so the
* stack must hold (a.cap,a.len,a.ptr,b.cap,b.len,b.ptr) before
* the 6-POP drain. Pre-fix only `a.ptr` and `b.ptr` made it. */
{ "two_composite_calls_args",
"fn view(s: str) []u8 = {\n"
" let r: []u8;\n"
" r.ptr = s.ptr;\n"
" r.len = s.len;\n"
" r.cap = s.len;\n"
" return r;\n"
"};\n"
"fn check2(a: []u8, b: []u8) i32 = {\n"
" if (a.len != 3) { return 11; };\n"
" if (b.len != 5) { return 12; };\n"
" return 0;\n"
"};\n"
"export fn main() i32 = {\n"
" let s1: str = \"foo\";\n"
" let s2: str = \"hello\";\n"
" return check2(view(s1), view(s2));\n"
"};\n",
0 },
/* (d) slice-CALL in middle of three args. Composite arg-shift
* collision pulls scalar arg2 into the wrong reg-class window. */
{ "slice_call_middle_arg",
"fn view(s: str) []u8 = {\n"
" let r: []u8;\n"
" r.ptr = s.ptr;\n"
" r.len = s.len;\n"
" r.cap = s.len;\n"
" return r;\n"
"};\n"
"fn check3(k0: i32, a: []u8, k1: i32) i32 = {\n"
" if (k0 != 7) { return 11; };\n"
" if (a.len != 4) { return 12; };\n"
" if (k1 != 9) { return 13; };\n"
" return 0;\n"
"};\n"
"export fn main() i32 = {\n"
" let s: str = \"abcd\";\n"
" return check3(7, view(s), 9);\n"
"};\n",
0 },
/* (e) f(g(h(s))) — composite-in-composite nesting. Both inner and
* outer calls must route slice CALL → slice arg through the same
* pushargsrev path. */
{ "nested_composite_calls",
"fn view(s: str) []u8 = {\n"
" let r: []u8;\n"
" r.ptr = s.ptr;\n"
" r.len = s.len;\n"
" r.cap = s.len;\n"
" return r;\n"
"};\n"
"fn passthrough(a: []u8) []u8 = {\n"
" return a;\n"
"};\n"
"fn check(a: []u8) i32 = {\n"
" if (a.len == 6) { return 0; };\n"
" return 11;\n"
"};\n"
"export fn main() i32 = {\n"
" let s: str = \"abcdef\";\n"
" return check(passthrough(view(s)));\n"
"};\n",
0 },
/* (f) slice-CALL followed by scalar — pop-count mix; pre-fix the
* scalar would land off-by-2 in the int-stream. */
{ "slice_call_then_scalar",
"fn view(s: str) []u8 = {\n"
" let r: []u8;\n"
" r.ptr = s.ptr;\n"
" r.len = s.len;\n"
" r.cap = s.len;\n"
" return r;\n"
"};\n"
"fn use2(a: []u8, k: i32) i32 = {\n"
" if (a.len != 13) { return 11; };\n"
" if (k != 99) { return 12; };\n"
" return 0;\n"
"};\n"
"export fn main() i32 = {\n"
" let s: str = \"hello, world!\";\n"
" return use2(view(s), 99);\n"
"};\n",
0 },
/* (g) tagged-CALL regression alongside the slice path. Confirms
* #21's natural-push arm composes with #24's. The dispatch shape
* mirrors lib/encoding/utf8.next's call-chain in selfhost. */
{ "tagged_call_regression",
"type oserror = !i32;\n"
"fn yield_ptr() (*u8 | oserror) = {\n"
" let p: *u8 = nil;\n"
" return p;\n"
"};\n"
"fn dispatch(v: (*u8 | oserror)) i32 = {\n"
" match (v) {\n"
" case let p: *u8 => return 7;\n"
" case let e: oserror => return e: i32;\n"
" };\n"
" return -99;\n"
"};\n"
"export fn main() i32 = {\n"
" if (dispatch(yield_ptr()) != 7) { return 11; };\n"
" return 0;\n"
"};\n",
0 },
};
static int
run_driver(const char *driver, const struct row *r, int i)
{
char src[64], tmpdir[64], cmd[1024];
snprintf(src, sizeof src, "/tmp/cca_%d_%d.ww", getpid(), i);
snprintf(tmpdir, sizeof tmpdir, "/tmp/cca_%d_d_%d", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
mkdir(tmpdir, 0755);
snprintf(cmd, sizeof cmd, "cd %s && %s build %s",
tmpdir, driver, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: build via %s failed\n",
r->label, driver);
unlink(src); rmdir(tmpdir);
return -1;
}
const char *base = strrchr(src, '/');
base = base ? base + 1 : src;
char outbin[128];
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
char *dot = strrchr(outbin, '.');
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
int got = runwait(outbin);
unlink(src); unlink(outbin); rmdir(tmpdir);
return got;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[512];
if (bin[0] != '/') {
char cwd[256];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char cdrv[640];
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
char wdrv[640];
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
struct { const char *name; const char *path; int gated_on_existence; }
drivers[] = {
{ "cstage", cdrv, 0 },
{ "wwstage", wdrv, 1 },
{ NULL, NULL, 0 },
};
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int d = 0; drivers[d].name; d++) {
if (drivers[d].gated_on_existence
&& access(drivers[d].path, X_OK) != 0) {
fprintf(stderr,
"composite_call_arg_run: skip %s (no %s)\n",
drivers[d].name, drivers[d].path);
continue;
}
for (int i = 0; i < n; i++) {
int got = run_driver(drivers[d].path, &rows[i], i);
total++;
if (got != rows[i].want) {
fprintf(stderr,
"composite_call_arg_run[%s][%s]: exit=%d want=%d\n",
drivers[d].name, rows[i].label,
got, rows[i].want);
fail++;
}
}
}
if (fail) {
fprintf(stderr,
"composite_call_arg_run: %d/%d fixtures failed\n",
fail, total);
return 1;
}
printf("composite_call_arg_run: %d/%d ok\n", total, total);
return 0;
}