Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

w6c+wwstage: zero high pad words on scalar/float widen into a >16B tagged union (#227)

Browse Source 
cg_widen_tagged_store (cmd/w6c/cgen.c) and the wwstage twin cgwidentaggedstorebp (selfhost/cmd/wcc/cgenutil.ww) wrote only the tag (slot+0) and value (slot+8) in their scalar and float arms, leaving the high pad words (slot+16..sz) as stack garbage on the BP/let/assign/return-scratch path, which never pre-zeroes. A passthrough return or u8-reinterpret of a narrow scalar/float widened into a >16B union (fmt's field = (...formattable | *mods) is 32B via the str variant) then read that garbage. Both stages were wrong identically, so the byte-id gates stayed green while the runtime truncated; fmt's spread-union scalar widen is the first real consumer. Both arms now tail-zero slot+16..sz (gated size>16), mirroring the tagged-subset/struct tail-zeros and keeping the stages byte-identical (rule 10). Adds runtime test 793; regenerates w6c/wwdump combined.ww. fmt byte-id graduation still awaits the other residual, #226 (io.read nominal-remap).
This commit is contained in:
Hojun-Cho
2026-05-31 22:20:53 +09:00
parent 3d44f742a0
commit 1995d8e43a
6 changed files with 334 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
cmd/w6c/cgen.c
View File

@@ -2045,20 +2045,39 @@ cg_widen_tagged_store(Cg *c, Local **locals_p, Type *dst, Node *src,
int mov = wid_isf32 ? A_MOVSS : A_MOVSD;
cgexpr(c, src, *locals_p);
ins2(c, mov, areg(D_X0), amem(D_BP, write_off + 8));
/* #227: zero the pad words (+16..sz) so a >16B union slot
* carries the dst's full payload width, not just the 1-word
* float value. The BP/let/assign/return-scratch path never
* pre-zeroes, so a passthrough return or a *u8 reinterpret of
* the narrow-tagged value otherwise reads stack garbage at
* slot+16/+24. Mirrors the tagged-subset tail-zero; symmetric
* with wwstage cgwidentaggedstorebp. */
if (sz > 16) {
ins2(c, A_XORQ, areg(D_AX), areg(D_AX));
for (int k = 16; k < sz; k += 8)
ins2(c, A_MOVQ, areg(D_AX),
amem(D_BP, write_off + k));
}
int tag = cg_tag_for_variant(du, st);
ins2(c, A_MOVQ, aimm(tag < 0 ? 0 : tag),
amem(D_BP, write_off + 0));
if (via_outer) goto copy_out;
return;
}
/* Scalar / pointer / etc. The high slot word (when sz > 16) is
* left untouched here — match dispatches on the tag word first
* and only the str branch reads slot+16, so leaving the pad
* uninitialised in let/assign matches the pre-refactor asm.
* cg_widen_tagged_push pre-zeroes the scratch slot before
* calling us, so the call-site push still sees clean pad. */
/* Scalar / pointer / etc. #227: zero the pad words (+16..sz) — see
* the float arm above. The old code left the pad uninitialised on
* the BP path (relying on cg_widen_tagged_push's pre-zero), but
* let/assign/return-scratch never pre-zeroes, so a passthrough
* return / *u8 reinterpret of the narrow-tagged value read stack
* garbage in slot+16/+24. */
cgexpr(c, src, *locals_p);
ins2(c, A_MOVQ, areg(D_AX), amem(D_BP, write_off + 8));
if (sz > 16) {
ins2(c, A_XORQ, areg(D_AX), areg(D_AX));
for (int k = 16; k < sz; k += 8)
ins2(c, A_MOVQ, areg(D_AX),
amem(D_BP, write_off + k));
}
int tag = cg_tag_for_variant(du, st);
ins2(c, A_MOVQ, aimm(tag < 0 ? 0 : tag), amem(D_BP, write_off + 0));
copy_out: