diff --git a/Makefile b/Makefile index 0f154be3..4e1207b5 100644 --- a/Makefile +++ b/Makefile @@ -512,6 +512,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_single_field_struct_zeroinit \ $(BIN)/test_structvariant_largeunion_return \ $(BIN)/test_narrow_alias_deref_store \ + $(BIN)/test_taggedderefstore_run \ $(BIN)/test_bufio_vstream_run \ $(BIN)/test_log_vstream_run \ $(BIN)/test_use_promote_alias \ @@ -821,6 +822,23 @@ $(BIN)/test_structcopytail_run: test/wcc/989_structcopytail_run.c \ $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +# 989_taggedderefstore_run (#17): a deref-target store `*p = v` (p:*tagged) +# sized the write off the pointee and emitted ONE fldstoreop — rhs landed in +# the tag word, payload dropped, the union discriminant corrupted. BOTH-stage- +# wrong and byte-id-green (#263-class, gate-blind): cstage cmd/w6c/cgen.c #17 +# deref else-branch + wwstage cgenexpr.ww #17 single-store tail emitted the +# SAME wrong asm. #17 routes the tagged-pointee deref store through the widener +# (cg_widen_tagged_store / cgwidentaggedstore) via the shared tag scratch, then +# word-copies scratch -> *p (mirror of the index-element tagged arm). Builds+ +# runs on BOTH driver twins (rule-10), pinning the absolute 0; scalarctl pins +# the unchanged non-tagged single-store path. +$(BIN)/test_taggedderefstore_run: test/wcc/989_taggedderefstore_run.c \ + $(BIN)/ww $(BIN)/ww_ww \ + $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + # 989_arrlit_tail_zero_run (#13): an under-length array literal zero-fills the # unspecified tail, not the last value. Builds+runs on BOTH driver twins # (rule-10), pinning the absolute value (pre-fix ww tail = last value). diff --git a/cmd/w6c/cgen.c b/cmd/w6c/cgen.c index 6552f3dd..fdcf2775 100644 --- a/cmd/w6c/cgen.c +++ b/cmd/w6c/cgen.c @@ -7038,6 +7038,33 @@ cgexpr(Cg *c, Node *n, Local *locals) Type *pu = type_chase_named(pt); Type *vt = (pu && pu->kind == TY_PTR) ? pu->sub : NULL; vt = type_chase_named(vt); + /* #17: tagged-union pointee. The scalar tail below stores + * only the first 8B (fldstoreop MOVQ) — rhs lands in the + * tag word and the payload is dropped, corrupting the + * union. Materialise the widened value (tag + payload + * words, nullable fold, tag remap) into a tag scratch via + * cg_widen_tagged_store, then word-copy scratch → *p. + * Mirrors the index-element tagged arm (cgen.c:6487-6531); + * the dest is just the pointer, so no base-addr dance. */ + if (vt && vt->kind == TY_TAGGED) { + int ssz = (int)vt->size; + int scr = cg_tagscr_slot(c, &locals, ssz); + ins2(c, A_XORQ, areg(D_AX), areg(D_AX)); + for (int k = 0; k < ssz; k += 8) + ins2(c, A_MOVQ, areg(D_AX), + amem(D_BP, scr + k)); + cg_widen_tagged_store(c, &locals, vt, n->rhs, + D_BP, scr, ssz); + cgexpr(c, n->lhs->lhs, locals); /* AX = pointer */ + ins2(c, A_MOVQ, areg(D_AX), areg(D_BX)); + for (int k = 0; k < ssz; k += 8) { + ins2(c, A_MOVQ, amem(D_BP, scr + k), + areg(D_AX)); + ins2(c, A_MOVQ, areg(D_AX), + amem(D_BX, k)); + } + break; + } /* `*p = v` for *f64 / *f32: cgexpr leaves the value in X0, * not AX. Spill X0 to the stack, evaluate the pointer * (clobbers AX/BX freely), then reload X0 and MOVSD/MOVSS diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index 11189299..f16e3bd8 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -31779,6 +31779,42 @@ fn cgassign(c: *cgen, n: *node) void = { if (n.op == tkind.TK_ASSIGN && !placeslit && !derefagg) { let inner: *node = lhs.lhs; + // #17: tagged-union pointee. The single-store + // tail below writes rhs into the tag word only, + // dropping the payload and corrupting the union. + // Materialise the widened value (tag + payload + // words, nullable fold, tag remap) into the shared + // @tagscr scratch via cgwidentaggedstore, then + // word-copy scratch -> *p. Mirror of the runtime- + // index tagged element arm (cgenexpr.ww:8768) and + // the cstage twin (cmd/w6c/cgen.c #17 deref arm). + let du: *tinfo = tichase(lhs.type_: *tinfo); + if (du != nil && du.kind == tykind.TY_TAGGED) { + let ssz: i32 = du.size: i32; + let scr: i32 = tagscradd(c, ssz); + emitline("\tXORQ\tAX, AX\n"); + let zk: i32 = 0; + for (zk < ssz) { + emitline("\tMOVQ\tAX, "); + emitoff((scr + zk): i64); + emitline("(BP)\n"); + zk += 8; + }; + cgwidentaggedstore(c, du, n.rhs, "BP", scr, ssz); + cgexpr(c, inner); + emitline("\tMOVQ\tAX, BX\n"); + let ck: i32 = 0; + for (ck < ssz) { + emitline("\tMOVQ\t"); + emitoff((scr + ck): i64); + emitline("(BP), AX\n"); + emitline("\tMOVQ\tAX, "); + emitoff(ck: i64); + emitline("(BX)\n"); + ck += 8; + }; + return; + }; let elemstr: bool = false; let elemfloat: bool = false; let elemf32: bool = false; diff --git a/selfhost/cmd/wcc/cgenexpr.ww b/selfhost/cmd/wcc/cgenexpr.ww index b52cddba..dfb34cc7 100644 --- a/selfhost/cmd/wcc/cgenexpr.ww +++ b/selfhost/cmd/wcc/cgenexpr.ww @@ -8433,6 +8433,42 @@ fn cgassign(c: *cgen, n: *node) void = { if (n.op == tkind.TK_ASSIGN && !placeslit && !derefagg) { let inner: *node = lhs.lhs; + // #17: tagged-union pointee. The single-store + // tail below writes rhs into the tag word only, + // dropping the payload and corrupting the union. + // Materialise the widened value (tag + payload + // words, nullable fold, tag remap) into the shared + // @tagscr scratch via cgwidentaggedstore, then + // word-copy scratch -> *p. Mirror of the runtime- + // index tagged element arm (cgenexpr.ww:8768) and + // the cstage twin (cmd/w6c/cgen.c #17 deref arm). + let du: *tinfo = tichase(lhs.type_: *tinfo); + if (du != nil && du.kind == tykind.TY_TAGGED) { + let ssz: i32 = du.size: i32; + let scr: i32 = tagscradd(c, ssz); + emitline("\tXORQ\tAX, AX\n"); + let zk: i32 = 0; + for (zk < ssz) { + emitline("\tMOVQ\tAX, "); + emitoff((scr + zk): i64); + emitline("(BP)\n"); + zk += 8; + }; + cgwidentaggedstore(c, du, n.rhs, "BP", scr, ssz); + cgexpr(c, inner); + emitline("\tMOVQ\tAX, BX\n"); + let ck: i32 = 0; + for (ck < ssz) { + emitline("\tMOVQ\t"); + emitoff((scr + ck): i64); + emitline("(BP), AX\n"); + emitline("\tMOVQ\tAX, "); + emitoff(ck: i64); + emitline("(BX)\n"); + ck += 8; + }; + return; + }; let elemstr: bool = false; let elemfloat: bool = false; let elemf32: bool = false; diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index 25fd852f..384ecb3c 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -31779,6 +31779,42 @@ fn cgassign(c: *cgen, n: *node) void = { if (n.op == tkind.TK_ASSIGN && !placeslit && !derefagg) { let inner: *node = lhs.lhs; + // #17: tagged-union pointee. The single-store + // tail below writes rhs into the tag word only, + // dropping the payload and corrupting the union. + // Materialise the widened value (tag + payload + // words, nullable fold, tag remap) into the shared + // @tagscr scratch via cgwidentaggedstore, then + // word-copy scratch -> *p. Mirror of the runtime- + // index tagged element arm (cgenexpr.ww:8768) and + // the cstage twin (cmd/w6c/cgen.c #17 deref arm). + let du: *tinfo = tichase(lhs.type_: *tinfo); + if (du != nil && du.kind == tykind.TY_TAGGED) { + let ssz: i32 = du.size: i32; + let scr: i32 = tagscradd(c, ssz); + emitline("\tXORQ\tAX, AX\n"); + let zk: i32 = 0; + for (zk < ssz) { + emitline("\tMOVQ\tAX, "); + emitoff((scr + zk): i64); + emitline("(BP)\n"); + zk += 8; + }; + cgwidentaggedstore(c, du, n.rhs, "BP", scr, ssz); + cgexpr(c, inner); + emitline("\tMOVQ\tAX, BX\n"); + let ck: i32 = 0; + for (ck < ssz) { + emitline("\tMOVQ\t"); + emitoff((scr + ck): i64); + emitline("(BP), AX\n"); + emitline("\tMOVQ\tAX, "); + emitoff(ck: i64); + emitline("(BX)\n"); + ck += 8; + }; + return; + }; let elemstr: bool = false; let elemfloat: bool = false; let elemf32: bool = false; diff --git a/test/wcc/989_taggedderefstore_run.c b/test/wcc/989_taggedderefstore_run.c new file mode 100644 index 00000000..7a60eb89 --- /dev/null +++ b/test/wcc/989_taggedderefstore_run.c @@ -0,0 +1,246 @@ +/* + * 989_taggedderefstore_run — #17 teeth (recorded by impl-write, 2026-06-13). + * + * Deref-target store into a tagged-union pointee: `*p = v` where p:*tagged. + * The plain-deref store arm sized the write off the pointee type and emitted + * a SINGLE fldstoreop (one MOVQ) — rhs landed in the tag word, the payload + * was dropped, and the union's discriminant was corrupted. A subsequent + * `match (v)` then dispatched on garbage. + * + * THIS WAS BOTH-STAGE-WRONG AND BYTE-ID-GREEN (#263-class, gate-blind): the + * cstage (cmd/w6c/cgen.c #17 deref else-branch) and wwstage (cgenexpr.ww + * #17 single-store tail) emitted IDENTICAL wrong asm, so the byte-id gates + * never caught it. #17 routes both stages' tagged-pointee deref store + * through the widener (cstage cg_widen_tagged_store / ww cgwidentaggedstore) + * via the shared tag scratch, then word-copies scratch -> *p — mirroring the + * proven index-element tagged arm (cstage cgen.c:6487 / ww cgenexpr.ww:8768). + * Scalar pointees keep the single-store path untouched. + * + * Rows (each program self-checks and returns 0 on all-correct, a 1-based + * code on the first mismatch; both stages build+run, rule-10, pin 0): + * taglo: *(int|bool), *p=42 — tag-low (int) variant, read back 42. + * taghi: *(int|bool), *p=true — tag-high (bool) variant survives. + * str3w: *(int|str), *p="hello" — a str payload is a 3-word {ptr,len, + * cap} header (slot = tag + 3 payload words); proves the + * multi-payload-word copy is COMPLETE, not just word0/word1. + * struct2w: *(int|pair), *p=pair{...} — a 16B struct payload (slot = tag + + * 2 payload words, ssz 24); proves the mid-count copy loop moves + * BOTH payload words and the widener's struct-source arm fires. + * nullfold: *(*int|void), *p=&a — nullable fold (1-word slot, pointer IS + * the disc); the folded payload path widens correctly. + * scalarctl:*int, *p=42 — scalar control: the non-tagged single-store + * path is UNCHANGED (no scratch, no widen). + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { + const char *label; + const char *src; + int want_exit; /* >= 0: pin the absolute value; -1: cs==ww only */ +}; + +static const struct row rows[] = { + /* taglo — tag-low (int) variant via *p=42; read back the int. */ + { "taglo", + "package main;\n" + "export fn main() int = {\n" + " let v: (int | bool) = false;\n" + " let p: *(int | bool) = &v;\n" + " *p = 42;\n" + " match (v) {\n" + " case let n: int => { if (n != 42) { return 1; }; return 0; };\n" + " case bool => { return 2; };\n" + " };\n" + "};\n", + 0 }, + + /* taghi — tag-high (bool) variant via *p=true; the tag must remap. */ + { "taghi", + "package main;\n" + "export fn main() int = {\n" + " let v: (int | bool) = 0;\n" + " let p: *(int | bool) = &v;\n" + " *p = true;\n" + " match (v) {\n" + " case int => { return 1; };\n" + " case let b: bool => { if (!b) { return 2; }; return 0; };\n" + " };\n" + "};\n", + 0 }, + + /* str3w — str payload (3-word header); the >2-word payload copy must + * be complete. Pre-fix only the tag word (or one payload word) moved. */ + { "str3w", + "package main;\n" + "export fn main() int = {\n" + " let v: (int | str) = 0;\n" + " let p: *(int | str) = &v;\n" + " *p = \"hello\";\n" + " match (v) {\n" + " case int => { return 1; };\n" + " case let s: str => { if (s.len: int != 5) { return 2; }; return 0; };\n" + " };\n" + "};\n", + 0 }, + + /* struct2w — an aggregate (struct) payload: a 16B pair → slot = tag + + * 2 payload words (ssz 24, 3-word copy loop). Exercises the widener's + * struct-source arm through the deref path and proves the mid-count + * copy loop moves BOTH payload words, not word0 alone. */ + { "struct2w", + "package main;\n" + "type pair = struct { a: i64, b: i64 };\n" + "export fn main() int = {\n" + " let v: (int | pair) = 0;\n" + " let p: *(int | pair) = &v;\n" + " *p = pair { a = 0x1111, b = 0x2222 };\n" + " match (v) {\n" + " case int => { return 1; };\n" + " case let q: pair => {\n" + " if (q.a != 0x1111) { return 2; };\n" + " if (q.b != 0x2222) { return 3; };\n" + " return 0;\n" + " };\n" + " };\n" + "};\n", + 0 }, + + /* nullfold — nullable fold (1-word slot): the pointer is the disc. */ + { "nullfold", + "package main;\n" + "export fn main() int = {\n" + " let a: int = 7;\n" + " let v: (*int | void) = void;\n" + " let p: *(*int | void) = &v;\n" + " *p = &a;\n" + " match (v) {\n" + " case let q: *int => { if (*q != 7) { return 1; }; return 0; };\n" + " case void => { return 2; };\n" + " };\n" + "};\n", + 0 }, + + /* scalarctl — non-tagged pointee: the single-store path is unchanged. */ + { "scalarctl", + "package main;\n" + "export fn main() int = {\n" + " let v: int = 3;\n" + " let p: *int = &v;\n" + " *p = 42;\n" + " if (v != 42) { return 1; };\n" + " return 0;\n" + "};\n", + 0 }, +}; + +/* run_build — build+run `src` via `driver`; returns the binary's exit + * code, or -1 on a build failure. */ +static int +run_build(const char *driver, const struct row *r, int i) +{ + char src[64], tmpdir[64], cmd[1024]; + snprintf(src, sizeof src, "/tmp/tagderef_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/tagderef_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -2; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null", + tmpdir, driver, src); + int brc = runwait(cmd); + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[128]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + + int got = -1; + if (brc == 0) got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return brc == 0 ? got : -1; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[1024]; + if (bin[0] != '/') { + char cwd[1024]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[1024], wdrv[1024]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + int have_ww = (access(wdrv, X_OK) == 0); + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + + for (int i = 0; i < n; i++) { + total++; + int gc = run_build(cdrv, &rows[i], i); + if (gc < 0) { + fprintf(stderr, "taggedderefstore_run[cstage][%s]: build/run " + "failed (got %d)\n", rows[i].label, gc); + fail++; + continue; + } + if (rows[i].want_exit >= 0 && gc != rows[i].want_exit) { + fprintf(stderr, "taggedderefstore_run[cstage][%s]: exit=%d " + "want=%d (tag corrupt / payload dropped)\n", + rows[i].label, gc, rows[i].want_exit); + fail++; + } + if (!have_ww) { + fprintf(stderr, "taggedderefstore_run: skip wwstage (no %s)\n", + wdrv); + continue; + } + int gw = run_build(wdrv, &rows[i], i); + if (gw != gc) { + fprintf(stderr, "taggedderefstore_run[%s]: cs=%d != ww=%d " + "(#17 deref-store divergence)\n", + rows[i].label, gc, gw); + fail++; + } + if (rows[i].want_exit >= 0 && gw != rows[i].want_exit) { + fprintf(stderr, "taggedderefstore_run[wwstage][%s]: exit=%d " + "want=%d (tag corrupt / payload dropped)\n", + rows[i].label, gw, rows[i].want_exit); + fail++; + } + } + + if (fail) { + fprintf(stderr, "taggedderefstore_run: %d/%d checks failed\n", + fail, total); + return 1; + } + printf("taggedderefstore_run: %d/%d ok\n", total, total); + return 0; +}