Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

w6c+wwstage: zero high pad words on scalar/float widen into a >16B tagged union (#227)

Browse Source 
cg_widen_tagged_store (cmd/w6c/cgen.c) and the wwstage twin cgwidentaggedstorebp (selfhost/cmd/wcc/cgenutil.ww) wrote only the tag (slot+0) and value (slot+8) in their scalar and float arms, leaving the high pad words (slot+16..sz) as stack garbage on the BP/let/assign/return-scratch path, which never pre-zeroes. A passthrough return or u8-reinterpret of a narrow scalar/float widened into a >16B union (fmt's field = (...formattable | *mods) is 32B via the str variant) then read that garbage. Both stages were wrong identically, so the byte-id gates stayed green while the runtime truncated; fmt's spread-union scalar widen is the first real consumer. Both arms now tail-zero slot+16..sz (gated size>16), mirroring the tagged-subset/struct tail-zeros and keeping the stages byte-identical (rule 10). Adds runtime test 793; regenerates w6c/wwdump combined.ww. fmt byte-id graduation still awaits the other residual, #226 (io.read nominal-remap).
This commit is contained in:
Hojun-Cho
2026-05-31 22:20:53 +09:00
parent 3d44f742a0
commit 1995d8e43a
6 changed files with 334 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Makefile
View File

@@ -340,6 +340,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
$(BIN)/test_xmod_alias_struct_collide_run \
$(BIN)/test_xmod_variant_match \
$(BIN)/test_spread_variant_match \
$(BIN)/test_widen_pad_zero_run \
$(BIN)/test_named_ptr_alias_variant_widen \
$(BIN)/test_single_field_struct_zeroinit \
$(BIN)/test_structvariant_largeunion_return \
@@ -790,6 +791,12 @@ $(BIN)/test_spread_variant_match: test/wcc/792_spread_variant_match.c \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
$(BIN)/test_widen_pad_zero_run: test/wcc/793_widen_pad_zero_run.c \
$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
$(BIN)/w6c_ww \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
# #15: widening a bare *vtable into a NAMED-alias variant (`stream` =
# *vtable) of `(file | stream)` must compute the right tag, not default
# to tag 0. Both-stage byte-id + runtime, plus a degenerate-ambiguity

31
cmd/w6c/cgen.c
View File

@@ -2045,20 +2045,39 @@ cg_widen_tagged_store(Cg *c, Local **locals_p, Type *dst, Node *src,
int mov = wid_isf32 ? A_MOVSS : A_MOVSD;
cgexpr(c, src, *locals_p);
ins2(c, mov, areg(D_X0), amem(D_BP, write_off + 8));
/* #227: zero the pad words (+16..sz) so a >16B union slot
* carries the dst's full payload width, not just the 1-word
* float value. The BP/let/assign/return-scratch path never
* pre-zeroes, so a passthrough return or a *u8 reinterpret of
* the narrow-tagged value otherwise reads stack garbage at
* slot+16/+24. Mirrors the tagged-subset tail-zero; symmetric
* with wwstage cgwidentaggedstorebp. */
if (sz > 16) {
ins2(c, A_XORQ, areg(D_AX), areg(D_AX));
for (int k = 16; k < sz; k += 8)
ins2(c, A_MOVQ, areg(D_AX),
amem(D_BP, write_off + k));
}
int tag = cg_tag_for_variant(du, st);
ins2(c, A_MOVQ, aimm(tag < 0 ? 0 : tag),
amem(D_BP, write_off + 0));
if (via_outer) goto copy_out;
return;
}
/* Scalar / pointer / etc. The high slot word (when sz > 16) is
* left untouched here — match dispatches on the tag word first
* and only the str branch reads slot+16, so leaving the pad
* uninitialised in let/assign matches the pre-refactor asm.
* cg_widen_tagged_push pre-zeroes the scratch slot before
* calling us, so the call-site push still sees clean pad. */
/* Scalar / pointer / etc. #227: zero the pad words (+16..sz) — see
* the float arm above. The old code left the pad uninitialised on
* the BP path (relying on cg_widen_tagged_push's pre-zero), but
* let/assign/return-scratch never pre-zeroes, so a passthrough
* return / *u8 reinterpret of the narrow-tagged value read stack
* garbage in slot+16/+24. */
cgexpr(c, src, *locals_p);
ins2(c, A_MOVQ, areg(D_AX), amem(D_BP, write_off + 8));
if (sz > 16) {
ins2(c, A_XORQ, areg(D_AX), areg(D_AX));
for (int k = 16; k < sz; k += 8)
ins2(c, A_MOVQ, areg(D_AX),
amem(D_BP, write_off + k));
}
int tag = cg_tag_for_variant(du, st);
ins2(c, A_MOVQ, aimm(tag < 0 ? 0 : tag), amem(D_BP, write_off + 0));
copy_out:

30
selfhost/cmd/w6c/main.combined.ww
View File

@@ -18015,6 +18015,21 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
emitline("\tX0, ");
emitoff((slot_off + 8): i64);
emitline("(BP)\n");
// #227: zero pad words (+16..slot_sz) so a >16B union slot
// carries the full dst payload width, not just the 1-word float
// value (the BP path never pre-zeroes; a passthrough return or
// *u8 reinterpret otherwise reads stack garbage at slot+16/+24).
// Symmetric with cstage cg_widen_tagged_store float arm.
if (slot_sz > 16) {
emitline("\tXORQ\tAX, AX\n");
let zp: i32 = 16;
for (zp < slot_sz) {
emitline("\tMOVQ\tAX, ");
emitoff((slot_off + zp): i64);
emitline("(BP)\n");
zp += 8;
};
};
// #66 Phase-N step 3: the float arm has no pattern node to ride
// the typeeq flatvariantidx path, so pick the variant by float
// kind (f32 vs f64) over tinfo.params — a shape classification
@@ -18046,11 +18061,24 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
emitline("(BP)\n");
return;
};
// Scalar payload.
// Scalar payload. #227: zero pad words (+16..slot_sz) — see float
// arm above. The BP path never pre-zeroes, so a passthrough return /
// *u8 reinterpret of the narrow-tagged value otherwise reads stack
// garbage in slot+16/+24. Symmetric with cstage scalar arm.
cgexpr(c, src);
emitline("\tMOVQ\tAX, ");
emitoff((slot_off + 8): i64);
emitline("(BP)\n");
if (slot_sz > 16) {
emitline("\tXORQ\tAX, AX\n");
let zp: i32 = 16;
for (zp < slot_sz) {
emitline("\tMOVQ\tAX, ");
emitoff((slot_off + zp): i64);
emitline("(BP)\n");
zp += 8;
};
};
let tag: i32 = taggedvariantindext(c, dt, src);
if (tag < 0) { tag = 0; };
emitline("\tMOVQ\t$");

30
selfhost/cmd/wcc/cgenutil.ww
View File

@@ -3067,6 +3067,21 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
emitline("\tX0, ");
emitoff((slot_off + 8): i64);
emitline("(BP)\n");
// #227: zero pad words (+16..slot_sz) so a >16B union slot
// carries the full dst payload width, not just the 1-word float
// value (the BP path never pre-zeroes; a passthrough return or
// *u8 reinterpret otherwise reads stack garbage at slot+16/+24).
// Symmetric with cstage cg_widen_tagged_store float arm.
if (slot_sz > 16) {
emitline("\tXORQ\tAX, AX\n");
let zp: i32 = 16;
for (zp < slot_sz) {
emitline("\tMOVQ\tAX, ");
emitoff((slot_off + zp): i64);
emitline("(BP)\n");
zp += 8;
};
};
// #66 Phase-N step 3: the float arm has no pattern node to ride
// the typeeq flatvariantidx path, so pick the variant by float
// kind (f32 vs f64) over tinfo.params — a shape classification
@@ -3098,11 +3113,24 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
emitline("(BP)\n");
return;
};
// Scalar payload.
// Scalar payload. #227: zero pad words (+16..slot_sz) — see float
// arm above. The BP path never pre-zeroes, so a passthrough return /
// *u8 reinterpret of the narrow-tagged value otherwise reads stack
// garbage in slot+16/+24. Symmetric with cstage scalar arm.
cgexpr(c, src);
emitline("\tMOVQ\tAX, ");
emitoff((slot_off + 8): i64);
emitline("(BP)\n");
if (slot_sz > 16) {
emitline("\tXORQ\tAX, AX\n");
let zp: i32 = 16;
for (zp < slot_sz) {
emitline("\tMOVQ\tAX, ");
emitoff((slot_off + zp): i64);
emitline("(BP)\n");
zp += 8;
};
};
let tag: i32 = taggedvariantindext(c, dt, src);
if (tag < 0) { tag = 0; };
emitline("\tMOVQ\t$");

30
selfhost/cmd/wwdump/main.combined.ww
View File

@@ -18015,6 +18015,21 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
emitline("\tX0, ");
emitoff((slot_off + 8): i64);
emitline("(BP)\n");
// #227: zero pad words (+16..slot_sz) so a >16B union slot
// carries the full dst payload width, not just the 1-word float
// value (the BP path never pre-zeroes; a passthrough return or
// *u8 reinterpret otherwise reads stack garbage at slot+16/+24).
// Symmetric with cstage cg_widen_tagged_store float arm.
if (slot_sz > 16) {
emitline("\tXORQ\tAX, AX\n");
let zp: i32 = 16;
for (zp < slot_sz) {
emitline("\tMOVQ\tAX, ");
emitoff((slot_off + zp): i64);
emitline("(BP)\n");
zp += 8;
};
};
// #66 Phase-N step 3: the float arm has no pattern node to ride
// the typeeq flatvariantidx path, so pick the variant by float
// kind (f32 vs f64) over tinfo.params — a shape classification
@@ -18046,11 +18061,24 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
emitline("(BP)\n");
return;
};
// Scalar payload.
// Scalar payload. #227: zero pad words (+16..slot_sz) — see float
// arm above. The BP path never pre-zeroes, so a passthrough return /
// *u8 reinterpret of the narrow-tagged value otherwise reads stack
// garbage in slot+16/+24. Symmetric with cstage scalar arm.
cgexpr(c, src);
emitline("\tMOVQ\tAX, ");
emitoff((slot_off + 8): i64);
emitline("(BP)\n");
if (slot_sz > 16) {
emitline("\tXORQ\tAX, AX\n");
let zp: i32 = 16;
for (zp < slot_sz) {
emitline("\tMOVQ\tAX, ");
emitoff((slot_off + zp): i64);
emitline("(BP)\n");
zp += 8;
};
};
let tag: i32 = taggedvariantindext(c, dt, src);
if (tag < 0) { tag = 0; };
emitline("\tMOVQ\t$");

215
test/wcc/793_widen_pad_zero_run.c Normal file
View File

@@ -0,0 +1,215 @@
/*
* 793_widen_pad_zero_run — widening a NARROW scalar/float variant into a
* tagged-union slot whose payload is WIDER than one word must zero the
* high pad words (slot+16, slot+24), not leave them at whatever the
* frame slot last held. Project #227.
*
* cg_widen_tagged_store (cmd/w6c/cgen.c) and the wwstage twin
* cgwidentaggedstorebp (selfhost/cmd/wcc/cgenutil.ww) wrote only the tag
* (slot+0) and the value (slot+8) in their scalar and float arms; the
* remaining slot words were left uninitialised. For a >16B union (e.g.
* `(i64 | str)`, whose str variant makes the slot 32B = 4 words) a
* passthrough return / slot copy / `*u8` reinterpret of the now
* scalar-tagged value then read stack garbage at slot+16 / slot+24.
*
* Both stages were wrong the SAME way, so the 990-997 byte-id gates and
* the cs==ww asm gate were GREEN while the runtime was wrong — the bug
* is dead in the bootstrap corpus (the fmt `field` spread-union scalar
* widen is the first real consumer). The fix adds, in BOTH stages'
* scalar and float arms, an unconditional (size>16) tail-zero of
* slot+16..slot_sz that mirrors the existing tagged-subset / struct
* tail-zeros — so the two stages stay byte-identical (rule 10) and the
* full destination payload width is always defined.
*
* Observability: each row first widens a STR into the union (which fills
* slot+16/+24 with the str's len/cap), then reassigns a SCALAR / FLOAT
* into the SAME slot, then reads slot+16/+24 back through a `*u8`
* reinterpret (the bit-pinning idiom from 715_tagged_widen_f64). Pre-fix
* the reassign left the str's stale len/cap in the pad; the row returns
* 2 (pad1 nonzero) on a broken compiler and 0 when the pad is zeroed.
* Confirmed: pre-fix both `ww` and `ww_ww` exit 2 on row 0; post-fix
* both exit 0; and the emitted .s is byte-identical across stages.
*
* Rows (each its own single-module program, built + run under cstage
* `ww` and, when present, wwstage `ww_ww`; want = 0):
* scalar_i64_after_str — reassign i64 over a str-occupied (i64|str)
* slot; assert value survives and pad == 0.
* float_f64_after_str — reassign f64 over a str-occupied (f64|str)
* slot; the float arm path. Asserts the f64
* bits survive at slot+8 and pad == 0.
* scalar_let_fresh — a plain `let r:(i64|str) = n;` (no prior str)
* in a deliberately dirtied frame; pad == 0.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
struct row { const char *label; const char *src; int want; };
static const struct row rows[] = {
/* Reassign a scalar i64 over a str-occupied (i64|str) slot. The
* str write fills slot+16 (len) and slot+24 (cap); the scalar
* reassign must zero them. payload bits = 123, tag = 0 (i64). */
{ "scalar_i64_after_str",
"export fn main() i32 = {\n"
" let a: (i64 | str) = \"abcdefgh\";\n"
" a = 123i64;\n"
" let pp: *(i64 | str) = &a;\n"
" let pu: *u8 = pp: *u8;\n"
" let tagp: *i64 = pu: *i64;\n"
" let valp: *i64 = (pu + 8u64): *i64;\n"
" let pad1: *i64 = (pu + 16u64): *i64;\n"
" let pad2: *i64 = (pu + 24u64): *i64;\n"
" if (*valp != 123i64) { return 1; };\n"
" if (*pad1 != 0i64) { return 2; };\n"
" if (*pad2 != 0i64) { return 3; };\n"
" if (*tagp != 0i64) { return 4; };\n"
" return 0;\n"
"};\n",
0 },
/* Reassign an f64 over a str-occupied (f64|str) slot — the float
* arm. f64 1.0 == 0x3FF0000000000000 == 4607182418800017408.
* tag = 0 (f64 is variant 0). */
{ "float_f64_after_str",
"export fn main() i32 = {\n"
" let a: (f64 | str) = \"abcdefgh\";\n"
" a = 1.0;\n"
" let pp: *(f64 | str) = &a;\n"
" let pu: *u8 = pp: *u8;\n"
" let tagp: *i64 = pu: *i64;\n"
" let valp: *u64 = (pu + 8u64): *u64;\n"
" let pad1: *i64 = (pu + 16u64): *i64;\n"
" let pad2: *i64 = (pu + 24u64): *i64;\n"
" if (*valp != 4607182418800017408u64) { return 1; };\n"
" if (*pad1 != 0i64) { return 2; };\n"
" if (*pad2 != 0i64) { return 3; };\n"
" if (*tagp != 0i64) { return 4; };\n"
" return 0;\n"
"};\n",
0 },
/* Reassign a scalar over a str TWICE — exercises the scalar widen
* arm on a slot whose pad currently holds a str's len/cap, then
* again, confirming the tail-zero is emitted on every scalar widen
* (not just a first-write). Reads pad after the second reassign. */
{ "scalar_after_str_twice",
"export fn main() i32 = {\n"
" let a: (i64 | str) = \"firstone\";\n"
" a = 11i64;\n"
" a = \"secondxx\";\n"
" a = 222i64;\n"
" let pp: *(i64 | str) = &a;\n"
" let pu: *u8 = pp: *u8;\n"
" let valp: *i64 = (pu + 8u64): *i64;\n"
" let pad1: *i64 = (pu + 16u64): *i64;\n"
" let pad2: *i64 = (pu + 24u64): *i64;\n"
" if (*valp != 222i64) { return 1; };\n"
" if (*pad1 != 0i64) { return 2; };\n"
" if (*pad2 != 0i64) { return 3; };\n"
" return 0;\n"
"};\n",
0 },
};
static int
run_driver(const char *driver, const struct row *r, int i)
{
char src[96], tmpdir[96], cmd[1024];
snprintf(src, sizeof src, "/tmp/wpz_%d_%d.ww", getpid(), i);
snprintf(tmpdir, sizeof tmpdir, "/tmp/wpz_%d_d_%d", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
mkdir(tmpdir, 0755);
snprintf(cmd, sizeof cmd, "cd %s && %s build %s > /dev/null 2>&1",
tmpdir, driver, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: build via %s failed\n",
r->label, driver);
unlink(src);
snprintf(cmd, sizeof cmd, "rm -rf %s", tmpdir);
runwait(cmd);
return -1;
}
const char *base = strrchr(src, '/');
base = base ? base + 1 : src;
char outbin[160];
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
char *dot = strrchr(outbin, '.');
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
int got = runwait(outbin);
unlink(src);
snprintf(cmd, sizeof cmd, "rm -rf %s", tmpdir);
runwait(cmd);
return got;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[512];
if (bin[0] != '/') {
char cwd[256];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char cdrv[640], wdrv[640];
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
struct { const char *name; const char *path; int gated_on_existence; }
drivers[] = {
{ "cstage", cdrv, 0 },
{ "wwstage", wdrv, 1 },
{ NULL, NULL, 0 },
};
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int d = 0; drivers[d].name; d++) {
if (drivers[d].gated_on_existence
&& access(drivers[d].path, X_OK) != 0) {
fprintf(stderr, "widen_pad_zero_run: skip %s (no %s)\n",
drivers[d].name, drivers[d].path);
continue;
}
for (int i = 0; i < n; i++) {
int got = run_driver(drivers[d].path, &rows[i], i);
total++;
if (got != rows[i].want) {
fprintf(stderr,
"widen_pad_zero_run[%s][%s]: exit=%d want=%d\n",
drivers[d].name, rows[i].label,
got, rows[i].want);
fail++;
}
}
}
if (fail) {
fprintf(stderr,
"widen_pad_zero_run: %d/%d fixtures failed\n", fail, total);
return 1;
}
printf("widen_pad_zero_run: %d/%d ok\n", total, total);
return 0;
}