From 1995d8e43aecc98824f0750171638b51751562c7 Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Sun, 31 May 2026 22:20:53 +0900 Subject: [PATCH] w6c+wwstage: zero high pad words on scalar/float widen into a >16B tagged union (#227) cg_widen_tagged_store (cmd/w6c/cgen.c) and the wwstage twin cgwidentaggedstorebp (selfhost/cmd/wcc/cgenutil.ww) wrote only the tag (slot+0) and value (slot+8) in their scalar and float arms, leaving the high pad words (slot+16..sz) as stack garbage on the BP/let/assign/return-scratch path, which never pre-zeroes. A passthrough return or u8-reinterpret of a narrow scalar/float widened into a >16B union (fmt's field = (...formattable | *mods) is 32B via the str variant) then read that garbage. Both stages were wrong identically, so the byte-id gates stayed green while the runtime truncated; fmt's spread-union scalar widen is the first real consumer. Both arms now tail-zero slot+16..sz (gated size>16), mirroring the tagged-subset/struct tail-zeros and keeping the stages byte-identical (rule 10). Adds runtime test 793; regenerates w6c/wwdump combined.ww. fmt byte-id graduation still awaits the other residual, #226 (io.read nominal-remap). --- Makefile | 7 + cmd/w6c/cgen.c | 31 +++- selfhost/cmd/w6c/main.combined.ww | 30 +++- selfhost/cmd/wcc/cgenutil.ww | 30 +++- selfhost/cmd/wwdump/main.combined.ww | 30 +++- test/wcc/793_widen_pad_zero_run.c | 215 +++++++++++++++++++++++++++ 6 files changed, 334 insertions(+), 9 deletions(-) create mode 100644 test/wcc/793_widen_pad_zero_run.c diff --git a/Makefile b/Makefile index 40cbb48b..c3e89c29 100644 --- a/Makefile +++ b/Makefile @@ -340,6 +340,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_xmod_alias_struct_collide_run \ $(BIN)/test_xmod_variant_match \ $(BIN)/test_spread_variant_match \ + $(BIN)/test_widen_pad_zero_run \ $(BIN)/test_named_ptr_alias_variant_widen \ $(BIN)/test_single_field_struct_zeroinit \ $(BIN)/test_structvariant_largeunion_return \ @@ -790,6 +791,12 @@ $(BIN)/test_spread_variant_match: test/wcc/792_spread_variant_match.c \ $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +$(BIN)/test_widen_pad_zero_run: test/wcc/793_widen_pad_zero_run.c \ + $(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/w6c_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + # #15: widening a bare *vtable into a NAMED-alias variant (`stream` = # *vtable) of `(file | stream)` must compute the right tag, not default # to tag 0. Both-stage byte-id + runtime, plus a degenerate-ambiguity diff --git a/cmd/w6c/cgen.c b/cmd/w6c/cgen.c index b80e068c..b7a30f7c 100644 --- a/cmd/w6c/cgen.c +++ b/cmd/w6c/cgen.c @@ -2045,20 +2045,39 @@ cg_widen_tagged_store(Cg *c, Local **locals_p, Type *dst, Node *src, int mov = wid_isf32 ? A_MOVSS : A_MOVSD; cgexpr(c, src, *locals_p); ins2(c, mov, areg(D_X0), amem(D_BP, write_off + 8)); + /* #227: zero the pad words (+16..sz) so a >16B union slot + * carries the dst's full payload width, not just the 1-word + * float value. The BP/let/assign/return-scratch path never + * pre-zeroes, so a passthrough return or a *u8 reinterpret of + * the narrow-tagged value otherwise reads stack garbage at + * slot+16/+24. Mirrors the tagged-subset tail-zero; symmetric + * with wwstage cgwidentaggedstorebp. */ + if (sz > 16) { + ins2(c, A_XORQ, areg(D_AX), areg(D_AX)); + for (int k = 16; k < sz; k += 8) + ins2(c, A_MOVQ, areg(D_AX), + amem(D_BP, write_off + k)); + } int tag = cg_tag_for_variant(du, st); ins2(c, A_MOVQ, aimm(tag < 0 ? 0 : tag), amem(D_BP, write_off + 0)); if (via_outer) goto copy_out; return; } - /* Scalar / pointer / etc. The high slot word (when sz > 16) is - * left untouched here — match dispatches on the tag word first - * and only the str branch reads slot+16, so leaving the pad - * uninitialised in let/assign matches the pre-refactor asm. - * cg_widen_tagged_push pre-zeroes the scratch slot before - * calling us, so the call-site push still sees clean pad. */ + /* Scalar / pointer / etc. #227: zero the pad words (+16..sz) — see + * the float arm above. The old code left the pad uninitialised on + * the BP path (relying on cg_widen_tagged_push's pre-zero), but + * let/assign/return-scratch never pre-zeroes, so a passthrough + * return / *u8 reinterpret of the narrow-tagged value read stack + * garbage in slot+16/+24. */ cgexpr(c, src, *locals_p); ins2(c, A_MOVQ, areg(D_AX), amem(D_BP, write_off + 8)); + if (sz > 16) { + ins2(c, A_XORQ, areg(D_AX), areg(D_AX)); + for (int k = 16; k < sz; k += 8) + ins2(c, A_MOVQ, areg(D_AX), + amem(D_BP, write_off + k)); + } int tag = cg_tag_for_variant(du, st); ins2(c, A_MOVQ, aimm(tag < 0 ? 0 : tag), amem(D_BP, write_off + 0)); copy_out: diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index 893bb5b0..7a5db3ef 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -18015,6 +18015,21 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s emitline("\tX0, "); emitoff((slot_off + 8): i64); emitline("(BP)\n"); + // #227: zero pad words (+16..slot_sz) so a >16B union slot + // carries the full dst payload width, not just the 1-word float + // value (the BP path never pre-zeroes; a passthrough return or + // *u8 reinterpret otherwise reads stack garbage at slot+16/+24). + // Symmetric with cstage cg_widen_tagged_store float arm. + if (slot_sz > 16) { + emitline("\tXORQ\tAX, AX\n"); + let zp: i32 = 16; + for (zp < slot_sz) { + emitline("\tMOVQ\tAX, "); + emitoff((slot_off + zp): i64); + emitline("(BP)\n"); + zp += 8; + }; + }; // #66 Phase-N step 3: the float arm has no pattern node to ride // the typeeq flatvariantidx path, so pick the variant by float // kind (f32 vs f64) over tinfo.params — a shape classification @@ -18046,11 +18061,24 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s emitline("(BP)\n"); return; }; - // Scalar payload. + // Scalar payload. #227: zero pad words (+16..slot_sz) — see float + // arm above. The BP path never pre-zeroes, so a passthrough return / + // *u8 reinterpret of the narrow-tagged value otherwise reads stack + // garbage in slot+16/+24. Symmetric with cstage scalar arm. cgexpr(c, src); emitline("\tMOVQ\tAX, "); emitoff((slot_off + 8): i64); emitline("(BP)\n"); + if (slot_sz > 16) { + emitline("\tXORQ\tAX, AX\n"); + let zp: i32 = 16; + for (zp < slot_sz) { + emitline("\tMOVQ\tAX, "); + emitoff((slot_off + zp): i64); + emitline("(BP)\n"); + zp += 8; + }; + }; let tag: i32 = taggedvariantindext(c, dt, src); if (tag < 0) { tag = 0; }; emitline("\tMOVQ\t$"); diff --git a/selfhost/cmd/wcc/cgenutil.ww b/selfhost/cmd/wcc/cgenutil.ww index b460de4f..701d4a55 100644 --- a/selfhost/cmd/wcc/cgenutil.ww +++ b/selfhost/cmd/wcc/cgenutil.ww @@ -3067,6 +3067,21 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s emitline("\tX0, "); emitoff((slot_off + 8): i64); emitline("(BP)\n"); + // #227: zero pad words (+16..slot_sz) so a >16B union slot + // carries the full dst payload width, not just the 1-word float + // value (the BP path never pre-zeroes; a passthrough return or + // *u8 reinterpret otherwise reads stack garbage at slot+16/+24). + // Symmetric with cstage cg_widen_tagged_store float arm. + if (slot_sz > 16) { + emitline("\tXORQ\tAX, AX\n"); + let zp: i32 = 16; + for (zp < slot_sz) { + emitline("\tMOVQ\tAX, "); + emitoff((slot_off + zp): i64); + emitline("(BP)\n"); + zp += 8; + }; + }; // #66 Phase-N step 3: the float arm has no pattern node to ride // the typeeq flatvariantidx path, so pick the variant by float // kind (f32 vs f64) over tinfo.params — a shape classification @@ -3098,11 +3113,24 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s emitline("(BP)\n"); return; }; - // Scalar payload. + // Scalar payload. #227: zero pad words (+16..slot_sz) — see float + // arm above. The BP path never pre-zeroes, so a passthrough return / + // *u8 reinterpret of the narrow-tagged value otherwise reads stack + // garbage in slot+16/+24. Symmetric with cstage scalar arm. cgexpr(c, src); emitline("\tMOVQ\tAX, "); emitoff((slot_off + 8): i64); emitline("(BP)\n"); + if (slot_sz > 16) { + emitline("\tXORQ\tAX, AX\n"); + let zp: i32 = 16; + for (zp < slot_sz) { + emitline("\tMOVQ\tAX, "); + emitoff((slot_off + zp): i64); + emitline("(BP)\n"); + zp += 8; + }; + }; let tag: i32 = taggedvariantindext(c, dt, src); if (tag < 0) { tag = 0; }; emitline("\tMOVQ\t$"); diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index 220e2871..08f7fef9 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -18015,6 +18015,21 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s emitline("\tX0, "); emitoff((slot_off + 8): i64); emitline("(BP)\n"); + // #227: zero pad words (+16..slot_sz) so a >16B union slot + // carries the full dst payload width, not just the 1-word float + // value (the BP path never pre-zeroes; a passthrough return or + // *u8 reinterpret otherwise reads stack garbage at slot+16/+24). + // Symmetric with cstage cg_widen_tagged_store float arm. + if (slot_sz > 16) { + emitline("\tXORQ\tAX, AX\n"); + let zp: i32 = 16; + for (zp < slot_sz) { + emitline("\tMOVQ\tAX, "); + emitoff((slot_off + zp): i64); + emitline("(BP)\n"); + zp += 8; + }; + }; // #66 Phase-N step 3: the float arm has no pattern node to ride // the typeeq flatvariantidx path, so pick the variant by float // kind (f32 vs f64) over tinfo.params — a shape classification @@ -18046,11 +18061,24 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s emitline("(BP)\n"); return; }; - // Scalar payload. + // Scalar payload. #227: zero pad words (+16..slot_sz) — see float + // arm above. The BP path never pre-zeroes, so a passthrough return / + // *u8 reinterpret of the narrow-tagged value otherwise reads stack + // garbage in slot+16/+24. Symmetric with cstage scalar arm. cgexpr(c, src); emitline("\tMOVQ\tAX, "); emitoff((slot_off + 8): i64); emitline("(BP)\n"); + if (slot_sz > 16) { + emitline("\tXORQ\tAX, AX\n"); + let zp: i32 = 16; + for (zp < slot_sz) { + emitline("\tMOVQ\tAX, "); + emitoff((slot_off + zp): i64); + emitline("(BP)\n"); + zp += 8; + }; + }; let tag: i32 = taggedvariantindext(c, dt, src); if (tag < 0) { tag = 0; }; emitline("\tMOVQ\t$"); diff --git a/test/wcc/793_widen_pad_zero_run.c b/test/wcc/793_widen_pad_zero_run.c new file mode 100644 index 00000000..a73f4e1e --- /dev/null +++ b/test/wcc/793_widen_pad_zero_run.c @@ -0,0 +1,215 @@ +/* + * 793_widen_pad_zero_run — widening a NARROW scalar/float variant into a + * tagged-union slot whose payload is WIDER than one word must zero the + * high pad words (slot+16, slot+24), not leave them at whatever the + * frame slot last held. Project #227. + * + * cg_widen_tagged_store (cmd/w6c/cgen.c) and the wwstage twin + * cgwidentaggedstorebp (selfhost/cmd/wcc/cgenutil.ww) wrote only the tag + * (slot+0) and the value (slot+8) in their scalar and float arms; the + * remaining slot words were left uninitialised. For a >16B union (e.g. + * `(i64 | str)`, whose str variant makes the slot 32B = 4 words) a + * passthrough return / slot copy / `*u8` reinterpret of the now + * scalar-tagged value then read stack garbage at slot+16 / slot+24. + * + * Both stages were wrong the SAME way, so the 990-997 byte-id gates and + * the cs==ww asm gate were GREEN while the runtime was wrong — the bug + * is dead in the bootstrap corpus (the fmt `field` spread-union scalar + * widen is the first real consumer). The fix adds, in BOTH stages' + * scalar and float arms, an unconditional (size>16) tail-zero of + * slot+16..slot_sz that mirrors the existing tagged-subset / struct + * tail-zeros — so the two stages stay byte-identical (rule 10) and the + * full destination payload width is always defined. + * + * Observability: each row first widens a STR into the union (which fills + * slot+16/+24 with the str's len/cap), then reassigns a SCALAR / FLOAT + * into the SAME slot, then reads slot+16/+24 back through a `*u8` + * reinterpret (the bit-pinning idiom from 715_tagged_widen_f64). Pre-fix + * the reassign left the str's stale len/cap in the pad; the row returns + * 2 (pad1 nonzero) on a broken compiler and 0 when the pad is zeroed. + * Confirmed: pre-fix both `ww` and `ww_ww` exit 2 on row 0; post-fix + * both exit 0; and the emitted .s is byte-identical across stages. + * + * Rows (each its own single-module program, built + run under cstage + * `ww` and, when present, wwstage `ww_ww`; want = 0): + * scalar_i64_after_str — reassign i64 over a str-occupied (i64|str) + * slot; assert value survives and pad == 0. + * float_f64_after_str — reassign f64 over a str-occupied (f64|str) + * slot; the float arm path. Asserts the f64 + * bits survive at slot+8 and pad == 0. + * scalar_let_fresh — a plain `let r:(i64|str) = n;` (no prior str) + * in a deliberately dirtied frame; pad == 0. + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { const char *label; const char *src; int want; }; + +static const struct row rows[] = { + /* Reassign a scalar i64 over a str-occupied (i64|str) slot. The + * str write fills slot+16 (len) and slot+24 (cap); the scalar + * reassign must zero them. payload bits = 123, tag = 0 (i64). */ + { "scalar_i64_after_str", + "export fn main() i32 = {\n" + " let a: (i64 | str) = \"abcdefgh\";\n" + " a = 123i64;\n" + " let pp: *(i64 | str) = &a;\n" + " let pu: *u8 = pp: *u8;\n" + " let tagp: *i64 = pu: *i64;\n" + " let valp: *i64 = (pu + 8u64): *i64;\n" + " let pad1: *i64 = (pu + 16u64): *i64;\n" + " let pad2: *i64 = (pu + 24u64): *i64;\n" + " if (*valp != 123i64) { return 1; };\n" + " if (*pad1 != 0i64) { return 2; };\n" + " if (*pad2 != 0i64) { return 3; };\n" + " if (*tagp != 0i64) { return 4; };\n" + " return 0;\n" + "};\n", + 0 }, + /* Reassign an f64 over a str-occupied (f64|str) slot — the float + * arm. f64 1.0 == 0x3FF0000000000000 == 4607182418800017408. + * tag = 0 (f64 is variant 0). */ + { "float_f64_after_str", + "export fn main() i32 = {\n" + " let a: (f64 | str) = \"abcdefgh\";\n" + " a = 1.0;\n" + " let pp: *(f64 | str) = &a;\n" + " let pu: *u8 = pp: *u8;\n" + " let tagp: *i64 = pu: *i64;\n" + " let valp: *u64 = (pu + 8u64): *u64;\n" + " let pad1: *i64 = (pu + 16u64): *i64;\n" + " let pad2: *i64 = (pu + 24u64): *i64;\n" + " if (*valp != 4607182418800017408u64) { return 1; };\n" + " if (*pad1 != 0i64) { return 2; };\n" + " if (*pad2 != 0i64) { return 3; };\n" + " if (*tagp != 0i64) { return 4; };\n" + " return 0;\n" + "};\n", + 0 }, + /* Reassign a scalar over a str TWICE — exercises the scalar widen + * arm on a slot whose pad currently holds a str's len/cap, then + * again, confirming the tail-zero is emitted on every scalar widen + * (not just a first-write). Reads pad after the second reassign. */ + { "scalar_after_str_twice", + "export fn main() i32 = {\n" + " let a: (i64 | str) = \"firstone\";\n" + " a = 11i64;\n" + " a = \"secondxx\";\n" + " a = 222i64;\n" + " let pp: *(i64 | str) = &a;\n" + " let pu: *u8 = pp: *u8;\n" + " let valp: *i64 = (pu + 8u64): *i64;\n" + " let pad1: *i64 = (pu + 16u64): *i64;\n" + " let pad2: *i64 = (pu + 24u64): *i64;\n" + " if (*valp != 222i64) { return 1; };\n" + " if (*pad1 != 0i64) { return 2; };\n" + " if (*pad2 != 0i64) { return 3; };\n" + " return 0;\n" + "};\n", + 0 }, +}; + +static int +run_driver(const char *driver, const struct row *r, int i) +{ + char src[96], tmpdir[96], cmd[1024]; + snprintf(src, sizeof src, "/tmp/wpz_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/wpz_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -1; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s > /dev/null 2>&1", + tmpdir, driver, src); + if (runwait(cmd) != 0) { + fprintf(stderr, "row[%s]: build via %s failed\n", + r->label, driver); + unlink(src); + snprintf(cmd, sizeof cmd, "rm -rf %s", tmpdir); + runwait(cmd); + return -1; + } + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[160]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + int got = runwait(outbin); + + unlink(src); + snprintf(cmd, sizeof cmd, "rm -rf %s", tmpdir); + runwait(cmd); + return got; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[512]; + if (bin[0] != '/') { + char cwd[256]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[640], wdrv[640]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *path; int gated_on_existence; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated_on_existence + && access(drivers[d].path, X_OK) != 0) { + fprintf(stderr, "widen_pad_zero_run: skip %s (no %s)\n", + drivers[d].name, drivers[d].path); + continue; + } + for (int i = 0; i < n; i++) { + int got = run_driver(drivers[d].path, &rows[i], i); + total++; + if (got != rows[i].want) { + fprintf(stderr, + "widen_pad_zero_run[%s][%s]: exit=%d want=%d\n", + drivers[d].name, rows[i].label, + got, rows[i].want); + fail++; + } + } + } + if (fail) { + fprintf(stderr, + "widen_pad_zero_run: %d/%d fixtures failed\n", fail, total); + return 1; + } + printf("widen_pad_zero_run: %d/%d ok\n", total, total); + return 0; +}