wcc/ww: store through a *tagged pointer widens, both stages (#17)

The N_UN/TK_STAR plain-deref assign arm fell to a single fldstoreop for
every pointee, so `*p = v` with p:*tagged wrote the rhs into the tag word
and never the payload -- identically in both stages, leaving the byte-id
gate green while the store corrupted the tag (#263-class, gate-blind).

Gate on TY_TAGGED and route through cg_widen_tagged_store into a scratch
slot, then word-copy to the destination -- the proven runtime-index arm.
Scalar pointees keep the single-store path unchanged.
This commit is contained in:
2026-06-13 23:54:12 +09:00
parent 728d86518e
commit 1074239859
6 changed files with 399 additions and 0 deletions

View File

@@ -512,6 +512,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
$(BIN)/test_single_field_struct_zeroinit \ $(BIN)/test_single_field_struct_zeroinit \
$(BIN)/test_structvariant_largeunion_return \ $(BIN)/test_structvariant_largeunion_return \
$(BIN)/test_narrow_alias_deref_store \ $(BIN)/test_narrow_alias_deref_store \
$(BIN)/test_taggedderefstore_run \
$(BIN)/test_bufio_vstream_run \ $(BIN)/test_bufio_vstream_run \
$(BIN)/test_log_vstream_run \ $(BIN)/test_log_vstream_run \
$(BIN)/test_use_promote_alias \ $(BIN)/test_use_promote_alias \
@@ -821,6 +822,23 @@ $(BIN)/test_structcopytail_run: test/wcc/989_structcopytail_run.c \
$(LIB)/libwwrt.a | $(BIN) $(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $< $(CC) $(CFLAGS) -o $@ $<
# 989_taggedderefstore_run (#17): a deref-target store `*p = v` (p:*tagged)
# sized the write off the pointee and emitted ONE fldstoreop — rhs landed in
# the tag word, payload dropped, the union discriminant corrupted. BOTH-stage-
# wrong and byte-id-green (#263-class, gate-blind): cstage cmd/w6c/cgen.c #17
# deref else-branch + wwstage cgenexpr.ww #17 single-store tail emitted the
# SAME wrong asm. #17 routes the tagged-pointee deref store through the widener
# (cg_widen_tagged_store / cgwidentaggedstore) via the shared tag scratch, then
# word-copies scratch -> *p (mirror of the index-element tagged arm). Builds+
# runs on BOTH driver twins (rule-10), pinning the absolute 0; scalarctl pins
# the unchanged non-tagged single-store path.
$(BIN)/test_taggedderefstore_run: test/wcc/989_taggedderefstore_run.c \
$(BIN)/ww $(BIN)/ww_ww \
$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
$(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
# 989_arrlit_tail_zero_run (#13): an under-length array literal zero-fills the # 989_arrlit_tail_zero_run (#13): an under-length array literal zero-fills the
# unspecified tail, not the last value. Builds+runs on BOTH driver twins # unspecified tail, not the last value. Builds+runs on BOTH driver twins
# (rule-10), pinning the absolute value (pre-fix ww tail = last value). # (rule-10), pinning the absolute value (pre-fix ww tail = last value).

View File

@@ -7038,6 +7038,33 @@ cgexpr(Cg *c, Node *n, Local *locals)
Type *pu = type_chase_named(pt); Type *pu = type_chase_named(pt);
Type *vt = (pu && pu->kind == TY_PTR) ? pu->sub : NULL; Type *vt = (pu && pu->kind == TY_PTR) ? pu->sub : NULL;
vt = type_chase_named(vt); vt = type_chase_named(vt);
/* #17: tagged-union pointee. The scalar tail below stores
* only the first 8B (fldstoreop MOVQ) — rhs lands in the
* tag word and the payload is dropped, corrupting the
* union. Materialise the widened value (tag + payload
* words, nullable fold, tag remap) into a tag scratch via
* cg_widen_tagged_store, then word-copy scratch → *p.
* Mirrors the index-element tagged arm (cgen.c:6487-6531);
* the dest is just the pointer, so no base-addr dance. */
if (vt && vt->kind == TY_TAGGED) {
int ssz = (int)vt->size;
int scr = cg_tagscr_slot(c, &locals, ssz);
ins2(c, A_XORQ, areg(D_AX), areg(D_AX));
for (int k = 0; k < ssz; k += 8)
ins2(c, A_MOVQ, areg(D_AX),
amem(D_BP, scr + k));
cg_widen_tagged_store(c, &locals, vt, n->rhs,
D_BP, scr, ssz);
cgexpr(c, n->lhs->lhs, locals); /* AX = pointer */
ins2(c, A_MOVQ, areg(D_AX), areg(D_BX));
for (int k = 0; k < ssz; k += 8) {
ins2(c, A_MOVQ, amem(D_BP, scr + k),
areg(D_AX));
ins2(c, A_MOVQ, areg(D_AX),
amem(D_BX, k));
}
break;
}
/* `*p = v` for *f64 / *f32: cgexpr leaves the value in X0, /* `*p = v` for *f64 / *f32: cgexpr leaves the value in X0,
* not AX. Spill X0 to the stack, evaluate the pointer * not AX. Spill X0 to the stack, evaluate the pointer
* (clobbers AX/BX freely), then reload X0 and MOVSD/MOVSS * (clobbers AX/BX freely), then reload X0 and MOVSD/MOVSS

View File

@@ -31779,6 +31779,42 @@ fn cgassign(c: *cgen, n: *node) void = {
if (n.op == tkind.TK_ASSIGN && !placeslit if (n.op == tkind.TK_ASSIGN && !placeslit
&& !derefagg) { && !derefagg) {
let inner: *node = lhs.lhs; let inner: *node = lhs.lhs;
// #17: tagged-union pointee. The single-store
// tail below writes rhs into the tag word only,
// dropping the payload and corrupting the union.
// Materialise the widened value (tag + payload
// words, nullable fold, tag remap) into the shared
// @tagscr scratch via cgwidentaggedstore, then
// word-copy scratch -> *p. Mirror of the runtime-
// index tagged element arm (cgenexpr.ww:8768) and
// the cstage twin (cmd/w6c/cgen.c #17 deref arm).
let du: *tinfo = tichase(lhs.type_: *tinfo);
if (du != nil && du.kind == tykind.TY_TAGGED) {
let ssz: i32 = du.size: i32;
let scr: i32 = tagscradd(c, ssz);
emitline("\tXORQ\tAX, AX\n");
let zk: i32 = 0;
for (zk < ssz) {
emitline("\tMOVQ\tAX, ");
emitoff((scr + zk): i64);
emitline("(BP)\n");
zk += 8;
};
cgwidentaggedstore(c, du, n.rhs, "BP", scr, ssz);
cgexpr(c, inner);
emitline("\tMOVQ\tAX, BX\n");
let ck: i32 = 0;
for (ck < ssz) {
emitline("\tMOVQ\t");
emitoff((scr + ck): i64);
emitline("(BP), AX\n");
emitline("\tMOVQ\tAX, ");
emitoff(ck: i64);
emitline("(BX)\n");
ck += 8;
};
return;
};
let elemstr: bool = false; let elemstr: bool = false;
let elemfloat: bool = false; let elemfloat: bool = false;
let elemf32: bool = false; let elemf32: bool = false;

View File

@@ -8433,6 +8433,42 @@ fn cgassign(c: *cgen, n: *node) void = {
if (n.op == tkind.TK_ASSIGN && !placeslit if (n.op == tkind.TK_ASSIGN && !placeslit
&& !derefagg) { && !derefagg) {
let inner: *node = lhs.lhs; let inner: *node = lhs.lhs;
// #17: tagged-union pointee. The single-store
// tail below writes rhs into the tag word only,
// dropping the payload and corrupting the union.
// Materialise the widened value (tag + payload
// words, nullable fold, tag remap) into the shared
// @tagscr scratch via cgwidentaggedstore, then
// word-copy scratch -> *p. Mirror of the runtime-
// index tagged element arm (cgenexpr.ww:8768) and
// the cstage twin (cmd/w6c/cgen.c #17 deref arm).
let du: *tinfo = tichase(lhs.type_: *tinfo);
if (du != nil && du.kind == tykind.TY_TAGGED) {
let ssz: i32 = du.size: i32;
let scr: i32 = tagscradd(c, ssz);
emitline("\tXORQ\tAX, AX\n");
let zk: i32 = 0;
for (zk < ssz) {
emitline("\tMOVQ\tAX, ");
emitoff((scr + zk): i64);
emitline("(BP)\n");
zk += 8;
};
cgwidentaggedstore(c, du, n.rhs, "BP", scr, ssz);
cgexpr(c, inner);
emitline("\tMOVQ\tAX, BX\n");
let ck: i32 = 0;
for (ck < ssz) {
emitline("\tMOVQ\t");
emitoff((scr + ck): i64);
emitline("(BP), AX\n");
emitline("\tMOVQ\tAX, ");
emitoff(ck: i64);
emitline("(BX)\n");
ck += 8;
};
return;
};
let elemstr: bool = false; let elemstr: bool = false;
let elemfloat: bool = false; let elemfloat: bool = false;
let elemf32: bool = false; let elemf32: bool = false;

View File

@@ -31779,6 +31779,42 @@ fn cgassign(c: *cgen, n: *node) void = {
if (n.op == tkind.TK_ASSIGN && !placeslit if (n.op == tkind.TK_ASSIGN && !placeslit
&& !derefagg) { && !derefagg) {
let inner: *node = lhs.lhs; let inner: *node = lhs.lhs;
// #17: tagged-union pointee. The single-store
// tail below writes rhs into the tag word only,
// dropping the payload and corrupting the union.
// Materialise the widened value (tag + payload
// words, nullable fold, tag remap) into the shared
// @tagscr scratch via cgwidentaggedstore, then
// word-copy scratch -> *p. Mirror of the runtime-
// index tagged element arm (cgenexpr.ww:8768) and
// the cstage twin (cmd/w6c/cgen.c #17 deref arm).
let du: *tinfo = tichase(lhs.type_: *tinfo);
if (du != nil && du.kind == tykind.TY_TAGGED) {
let ssz: i32 = du.size: i32;
let scr: i32 = tagscradd(c, ssz);
emitline("\tXORQ\tAX, AX\n");
let zk: i32 = 0;
for (zk < ssz) {
emitline("\tMOVQ\tAX, ");
emitoff((scr + zk): i64);
emitline("(BP)\n");
zk += 8;
};
cgwidentaggedstore(c, du, n.rhs, "BP", scr, ssz);
cgexpr(c, inner);
emitline("\tMOVQ\tAX, BX\n");
let ck: i32 = 0;
for (ck < ssz) {
emitline("\tMOVQ\t");
emitoff((scr + ck): i64);
emitline("(BP), AX\n");
emitline("\tMOVQ\tAX, ");
emitoff(ck: i64);
emitline("(BX)\n");
ck += 8;
};
return;
};
let elemstr: bool = false; let elemstr: bool = false;
let elemfloat: bool = false; let elemfloat: bool = false;
let elemf32: bool = false; let elemf32: bool = false;

View File

@@ -0,0 +1,246 @@
/*
* 989_taggedderefstore_run — #17 teeth (recorded by impl-write, 2026-06-13).
*
* Deref-target store into a tagged-union pointee: `*p = v` where p:*tagged.
* The plain-deref store arm sized the write off the pointee type and emitted
* a SINGLE fldstoreop (one MOVQ) — rhs landed in the tag word, the payload
* was dropped, and the union's discriminant was corrupted. A subsequent
* `match (v)` then dispatched on garbage.
*
* THIS WAS BOTH-STAGE-WRONG AND BYTE-ID-GREEN (#263-class, gate-blind): the
* cstage (cmd/w6c/cgen.c #17 deref else-branch) and wwstage (cgenexpr.ww
* #17 single-store tail) emitted IDENTICAL wrong asm, so the byte-id gates
* never caught it. #17 routes both stages' tagged-pointee deref store
* through the widener (cstage cg_widen_tagged_store / ww cgwidentaggedstore)
* via the shared tag scratch, then word-copies scratch -> *p — mirroring the
* proven index-element tagged arm (cstage cgen.c:6487 / ww cgenexpr.ww:8768).
* Scalar pointees keep the single-store path untouched.
*
* Rows (each program self-checks and returns 0 on all-correct, a 1-based
* code on the first mismatch; both stages build+run, rule-10, pin 0):
* taglo: *(int|bool), *p=42 — tag-low (int) variant, read back 42.
* taghi: *(int|bool), *p=true — tag-high (bool) variant survives.
* str3w: *(int|str), *p="hello" — a str payload is a 3-word {ptr,len,
* cap} header (slot = tag + 3 payload words); proves the
* multi-payload-word copy is COMPLETE, not just word0/word1.
* struct2w: *(int|pair), *p=pair{...} — a 16B struct payload (slot = tag +
* 2 payload words, ssz 24); proves the mid-count copy loop moves
* BOTH payload words and the widener's struct-source arm fires.
* nullfold: *(*int|void), *p=&a — nullable fold (1-word slot, pointer IS
* the disc); the folded payload path widens correctly.
* scalarctl:*int, *p=42 — scalar control: the non-tagged single-store
* path is UNCHANGED (no scratch, no widen).
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
struct row {
const char *label;
const char *src;
int want_exit; /* >= 0: pin the absolute value; -1: cs==ww only */
};
static const struct row rows[] = {
/* taglo — tag-low (int) variant via *p=42; read back the int. */
{ "taglo",
"package main;\n"
"export fn main() int = {\n"
" let v: (int | bool) = false;\n"
" let p: *(int | bool) = &v;\n"
" *p = 42;\n"
" match (v) {\n"
" case let n: int => { if (n != 42) { return 1; }; return 0; };\n"
" case bool => { return 2; };\n"
" };\n"
"};\n",
0 },
/* taghi — tag-high (bool) variant via *p=true; the tag must remap. */
{ "taghi",
"package main;\n"
"export fn main() int = {\n"
" let v: (int | bool) = 0;\n"
" let p: *(int | bool) = &v;\n"
" *p = true;\n"
" match (v) {\n"
" case int => { return 1; };\n"
" case let b: bool => { if (!b) { return 2; }; return 0; };\n"
" };\n"
"};\n",
0 },
/* str3w — str payload (3-word header); the >2-word payload copy must
* be complete. Pre-fix only the tag word (or one payload word) moved. */
{ "str3w",
"package main;\n"
"export fn main() int = {\n"
" let v: (int | str) = 0;\n"
" let p: *(int | str) = &v;\n"
" *p = \"hello\";\n"
" match (v) {\n"
" case int => { return 1; };\n"
" case let s: str => { if (s.len: int != 5) { return 2; }; return 0; };\n"
" };\n"
"};\n",
0 },
/* struct2w — an aggregate (struct) payload: a 16B pair → slot = tag +
* 2 payload words (ssz 24, 3-word copy loop). Exercises the widener's
* struct-source arm through the deref path and proves the mid-count
* copy loop moves BOTH payload words, not word0 alone. */
{ "struct2w",
"package main;\n"
"type pair = struct { a: i64, b: i64 };\n"
"export fn main() int = {\n"
" let v: (int | pair) = 0;\n"
" let p: *(int | pair) = &v;\n"
" *p = pair { a = 0x1111, b = 0x2222 };\n"
" match (v) {\n"
" case int => { return 1; };\n"
" case let q: pair => {\n"
" if (q.a != 0x1111) { return 2; };\n"
" if (q.b != 0x2222) { return 3; };\n"
" return 0;\n"
" };\n"
" };\n"
"};\n",
0 },
/* nullfold — nullable fold (1-word slot): the pointer is the disc. */
{ "nullfold",
"package main;\n"
"export fn main() int = {\n"
" let a: int = 7;\n"
" let v: (*int | void) = void;\n"
" let p: *(*int | void) = &v;\n"
" *p = &a;\n"
" match (v) {\n"
" case let q: *int => { if (*q != 7) { return 1; }; return 0; };\n"
" case void => { return 2; };\n"
" };\n"
"};\n",
0 },
/* scalarctl — non-tagged pointee: the single-store path is unchanged. */
{ "scalarctl",
"package main;\n"
"export fn main() int = {\n"
" let v: int = 3;\n"
" let p: *int = &v;\n"
" *p = 42;\n"
" if (v != 42) { return 1; };\n"
" return 0;\n"
"};\n",
0 },
};
/* run_build — build+run `src` via `driver`; returns the binary's exit
* code, or -1 on a build failure. */
static int
run_build(const char *driver, const struct row *r, int i)
{
char src[64], tmpdir[64], cmd[1024];
snprintf(src, sizeof src, "/tmp/tagderef_%d_%d.ww", getpid(), i);
snprintf(tmpdir, sizeof tmpdir, "/tmp/tagderef_%d_d_%d", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -2;
fputs(r->src, f);
fclose(f);
mkdir(tmpdir, 0755);
snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
tmpdir, driver, src);
int brc = runwait(cmd);
const char *base = strrchr(src, '/');
base = base ? base + 1 : src;
char outbin[128];
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
char *dot = strrchr(outbin, '.');
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
int got = -1;
if (brc == 0) got = runwait(outbin);
unlink(src); unlink(outbin); rmdir(tmpdir);
return brc == 0 ? got : -1;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[1024];
if (bin[0] != '/') {
char cwd[1024];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char cdrv[1024], wdrv[1024];
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
int have_ww = (access(wdrv, X_OK) == 0);
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int i = 0; i < n; i++) {
total++;
int gc = run_build(cdrv, &rows[i], i);
if (gc < 0) {
fprintf(stderr, "taggedderefstore_run[cstage][%s]: build/run "
"failed (got %d)\n", rows[i].label, gc);
fail++;
continue;
}
if (rows[i].want_exit >= 0 && gc != rows[i].want_exit) {
fprintf(stderr, "taggedderefstore_run[cstage][%s]: exit=%d "
"want=%d (tag corrupt / payload dropped)\n",
rows[i].label, gc, rows[i].want_exit);
fail++;
}
if (!have_ww) {
fprintf(stderr, "taggedderefstore_run: skip wwstage (no %s)\n",
wdrv);
continue;
}
int gw = run_build(wdrv, &rows[i], i);
if (gw != gc) {
fprintf(stderr, "taggedderefstore_run[%s]: cs=%d != ww=%d "
"(#17 deref-store divergence)\n",
rows[i].label, gc, gw);
fail++;
}
if (rows[i].want_exit >= 0 && gw != rows[i].want_exit) {
fprintf(stderr, "taggedderefstore_run[wwstage][%s]: exit=%d "
"want=%d (tag corrupt / payload dropped)\n",
rows[i].label, gw, rows[i].want_exit);
fail++;
}
}
if (fail) {
fprintf(stderr, "taggedderefstore_run: %d/%d checks failed\n",
fail, total);
return 1;
}
printf("taggedderefstore_run: %d/%d ok\n", total, total);
return 0;
}