wcc/ww: store through a *tagged pointer widens, both stages (#17)
The N_UN/TK_STAR plain-deref assign arm fell to a single fldstoreop for every pointee, so `*p = v` with p:*tagged wrote the rhs into the tag word and never the payload -- identically in both stages, leaving the byte-id gate green while the store corrupted the tag (#263-class, gate-blind). Gate on TY_TAGGED and route through cg_widen_tagged_store into a scratch slot, then word-copy to the destination -- the proven runtime-index arm. Scalar pointees keep the single-store path unchanged.
This commit is contained in:
246
test/wcc/989_taggedderefstore_run.c
Normal file
246
test/wcc/989_taggedderefstore_run.c
Normal file
@@ -0,0 +1,246 @@
|
||||
/*
|
||||
* 989_taggedderefstore_run — #17 teeth (recorded by impl-write, 2026-06-13).
|
||||
*
|
||||
* Deref-target store into a tagged-union pointee: `*p = v` where p:*tagged.
|
||||
* The plain-deref store arm sized the write off the pointee type and emitted
|
||||
* a SINGLE fldstoreop (one MOVQ) — rhs landed in the tag word, the payload
|
||||
* was dropped, and the union's discriminant was corrupted. A subsequent
|
||||
* `match (v)` then dispatched on garbage.
|
||||
*
|
||||
* THIS WAS BOTH-STAGE-WRONG AND BYTE-ID-GREEN (#263-class, gate-blind): the
|
||||
* cstage (cmd/w6c/cgen.c #17 deref else-branch) and wwstage (cgenexpr.ww
|
||||
* #17 single-store tail) emitted IDENTICAL wrong asm, so the byte-id gates
|
||||
* never caught it. #17 routes both stages' tagged-pointee deref store
|
||||
* through the widener (cstage cg_widen_tagged_store / ww cgwidentaggedstore)
|
||||
* via the shared tag scratch, then word-copies scratch -> *p — mirroring the
|
||||
* proven index-element tagged arm (cstage cgen.c:6487 / ww cgenexpr.ww:8768).
|
||||
* Scalar pointees keep the single-store path untouched.
|
||||
*
|
||||
* Rows (each program self-checks and returns 0 on all-correct, a 1-based
|
||||
* code on the first mismatch; both stages build+run, rule-10, pin 0):
|
||||
* taglo: *(int|bool), *p=42 — tag-low (int) variant, read back 42.
|
||||
* taghi: *(int|bool), *p=true — tag-high (bool) variant survives.
|
||||
* str3w: *(int|str), *p="hello" — a str payload is a 3-word {ptr,len,
|
||||
* cap} header (slot = tag + 3 payload words); proves the
|
||||
* multi-payload-word copy is COMPLETE, not just word0/word1.
|
||||
* struct2w: *(int|pair), *p=pair{...} — a 16B struct payload (slot = tag +
|
||||
* 2 payload words, ssz 24); proves the mid-count copy loop moves
|
||||
* BOTH payload words and the widener's struct-source arm fires.
|
||||
* nullfold: *(*int|void), *p=&a — nullable fold (1-word slot, pointer IS
|
||||
* the disc); the folded payload path widens correctly.
|
||||
* scalarctl:*int, *p=42 — scalar control: the non-tagged single-store
|
||||
* path is UNCHANGED (no scratch, no widen).
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/wait.h>
|
||||
|
||||
static int
|
||||
runwait(const char *cmd)
|
||||
{
|
||||
int rc = system(cmd);
|
||||
if (rc == -1) return -1;
|
||||
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
|
||||
return -1;
|
||||
}
|
||||
|
||||
struct row {
|
||||
const char *label;
|
||||
const char *src;
|
||||
int want_exit; /* >= 0: pin the absolute value; -1: cs==ww only */
|
||||
};
|
||||
|
||||
static const struct row rows[] = {
|
||||
/* taglo — tag-low (int) variant via *p=42; read back the int. */
|
||||
{ "taglo",
|
||||
"package main;\n"
|
||||
"export fn main() int = {\n"
|
||||
" let v: (int | bool) = false;\n"
|
||||
" let p: *(int | bool) = &v;\n"
|
||||
" *p = 42;\n"
|
||||
" match (v) {\n"
|
||||
" case let n: int => { if (n != 42) { return 1; }; return 0; };\n"
|
||||
" case bool => { return 2; };\n"
|
||||
" };\n"
|
||||
"};\n",
|
||||
0 },
|
||||
|
||||
/* taghi — tag-high (bool) variant via *p=true; the tag must remap. */
|
||||
{ "taghi",
|
||||
"package main;\n"
|
||||
"export fn main() int = {\n"
|
||||
" let v: (int | bool) = 0;\n"
|
||||
" let p: *(int | bool) = &v;\n"
|
||||
" *p = true;\n"
|
||||
" match (v) {\n"
|
||||
" case int => { return 1; };\n"
|
||||
" case let b: bool => { if (!b) { return 2; }; return 0; };\n"
|
||||
" };\n"
|
||||
"};\n",
|
||||
0 },
|
||||
|
||||
/* str3w — str payload (3-word header); the >2-word payload copy must
|
||||
* be complete. Pre-fix only the tag word (or one payload word) moved. */
|
||||
{ "str3w",
|
||||
"package main;\n"
|
||||
"export fn main() int = {\n"
|
||||
" let v: (int | str) = 0;\n"
|
||||
" let p: *(int | str) = &v;\n"
|
||||
" *p = \"hello\";\n"
|
||||
" match (v) {\n"
|
||||
" case int => { return 1; };\n"
|
||||
" case let s: str => { if (s.len: int != 5) { return 2; }; return 0; };\n"
|
||||
" };\n"
|
||||
"};\n",
|
||||
0 },
|
||||
|
||||
/* struct2w — an aggregate (struct) payload: a 16B pair → slot = tag +
|
||||
* 2 payload words (ssz 24, 3-word copy loop). Exercises the widener's
|
||||
* struct-source arm through the deref path and proves the mid-count
|
||||
* copy loop moves BOTH payload words, not word0 alone. */
|
||||
{ "struct2w",
|
||||
"package main;\n"
|
||||
"type pair = struct { a: i64, b: i64 };\n"
|
||||
"export fn main() int = {\n"
|
||||
" let v: (int | pair) = 0;\n"
|
||||
" let p: *(int | pair) = &v;\n"
|
||||
" *p = pair { a = 0x1111, b = 0x2222 };\n"
|
||||
" match (v) {\n"
|
||||
" case int => { return 1; };\n"
|
||||
" case let q: pair => {\n"
|
||||
" if (q.a != 0x1111) { return 2; };\n"
|
||||
" if (q.b != 0x2222) { return 3; };\n"
|
||||
" return 0;\n"
|
||||
" };\n"
|
||||
" };\n"
|
||||
"};\n",
|
||||
0 },
|
||||
|
||||
/* nullfold — nullable fold (1-word slot): the pointer is the disc. */
|
||||
{ "nullfold",
|
||||
"package main;\n"
|
||||
"export fn main() int = {\n"
|
||||
" let a: int = 7;\n"
|
||||
" let v: (*int | void) = void;\n"
|
||||
" let p: *(*int | void) = &v;\n"
|
||||
" *p = &a;\n"
|
||||
" match (v) {\n"
|
||||
" case let q: *int => { if (*q != 7) { return 1; }; return 0; };\n"
|
||||
" case void => { return 2; };\n"
|
||||
" };\n"
|
||||
"};\n",
|
||||
0 },
|
||||
|
||||
/* scalarctl — non-tagged pointee: the single-store path is unchanged. */
|
||||
{ "scalarctl",
|
||||
"package main;\n"
|
||||
"export fn main() int = {\n"
|
||||
" let v: int = 3;\n"
|
||||
" let p: *int = &v;\n"
|
||||
" *p = 42;\n"
|
||||
" if (v != 42) { return 1; };\n"
|
||||
" return 0;\n"
|
||||
"};\n",
|
||||
0 },
|
||||
};
|
||||
|
||||
/* run_build — build+run `src` via `driver`; returns the binary's exit
|
||||
* code, or -1 on a build failure. */
|
||||
static int
|
||||
run_build(const char *driver, const struct row *r, int i)
|
||||
{
|
||||
char src[64], tmpdir[64], cmd[1024];
|
||||
snprintf(src, sizeof src, "/tmp/tagderef_%d_%d.ww", getpid(), i);
|
||||
snprintf(tmpdir, sizeof tmpdir, "/tmp/tagderef_%d_d_%d", getpid(), i);
|
||||
|
||||
FILE *f = fopen(src, "wb");
|
||||
if (!f) return -2;
|
||||
fputs(r->src, f);
|
||||
fclose(f);
|
||||
|
||||
mkdir(tmpdir, 0755);
|
||||
snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
|
||||
tmpdir, driver, src);
|
||||
int brc = runwait(cmd);
|
||||
|
||||
const char *base = strrchr(src, '/');
|
||||
base = base ? base + 1 : src;
|
||||
char outbin[128];
|
||||
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
|
||||
char *dot = strrchr(outbin, '.');
|
||||
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
|
||||
|
||||
int got = -1;
|
||||
if (brc == 0) got = runwait(outbin);
|
||||
|
||||
unlink(src); unlink(outbin); rmdir(tmpdir);
|
||||
return brc == 0 ? got : -1;
|
||||
}
|
||||
|
||||
int
|
||||
main(void)
|
||||
{
|
||||
const char *bin = getenv("BIN");
|
||||
if (!bin) bin = "out/bin";
|
||||
char absbin[1024];
|
||||
if (bin[0] != '/') {
|
||||
char cwd[1024];
|
||||
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
|
||||
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
|
||||
bin = absbin;
|
||||
}
|
||||
|
||||
char cdrv[1024], wdrv[1024];
|
||||
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
|
||||
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
|
||||
int have_ww = (access(wdrv, X_OK) == 0);
|
||||
|
||||
int n = (int)(sizeof rows / sizeof rows[0]);
|
||||
int total = 0, fail = 0;
|
||||
|
||||
for (int i = 0; i < n; i++) {
|
||||
total++;
|
||||
int gc = run_build(cdrv, &rows[i], i);
|
||||
if (gc < 0) {
|
||||
fprintf(stderr, "taggedderefstore_run[cstage][%s]: build/run "
|
||||
"failed (got %d)\n", rows[i].label, gc);
|
||||
fail++;
|
||||
continue;
|
||||
}
|
||||
if (rows[i].want_exit >= 0 && gc != rows[i].want_exit) {
|
||||
fprintf(stderr, "taggedderefstore_run[cstage][%s]: exit=%d "
|
||||
"want=%d (tag corrupt / payload dropped)\n",
|
||||
rows[i].label, gc, rows[i].want_exit);
|
||||
fail++;
|
||||
}
|
||||
if (!have_ww) {
|
||||
fprintf(stderr, "taggedderefstore_run: skip wwstage (no %s)\n",
|
||||
wdrv);
|
||||
continue;
|
||||
}
|
||||
int gw = run_build(wdrv, &rows[i], i);
|
||||
if (gw != gc) {
|
||||
fprintf(stderr, "taggedderefstore_run[%s]: cs=%d != ww=%d "
|
||||
"(#17 deref-store divergence)\n",
|
||||
rows[i].label, gc, gw);
|
||||
fail++;
|
||||
}
|
||||
if (rows[i].want_exit >= 0 && gw != rows[i].want_exit) {
|
||||
fprintf(stderr, "taggedderefstore_run[wwstage][%s]: exit=%d "
|
||||
"want=%d (tag corrupt / payload dropped)\n",
|
||||
rows[i].label, gw, rows[i].want_exit);
|
||||
fail++;
|
||||
}
|
||||
}
|
||||
|
||||
if (fail) {
|
||||
fprintf(stderr, "taggedderefstore_run: %d/%d checks failed\n",
|
||||
fail, total);
|
||||
return 1;
|
||||
}
|
||||
printf("taggedderefstore_run: %d/%d ok\n", total, total);
|
||||
return 0;
|
||||
}
|
||||
Reference in New Issue
Block a user