w6c+wwstage: zero high pad words on scalar/float widen into a >16B tagged union (#227)

cg_widen_tagged_store (cmd/w6c/cgen.c) and the wwstage twin cgwidentaggedstorebp (selfhost/cmd/wcc/cgenutil.ww) wrote only the tag (slot+0) and value (slot+8) in their scalar and float arms, leaving the high pad words (slot+16..sz) as stack garbage on the BP/let/assign/return-scratch path, which never pre-zeroes. A passthrough return or u8-reinterpret of a narrow scalar/float widened into a >16B union (fmt's field = (...formattable | *mods) is 32B via the str variant) then read that garbage. Both stages were wrong identically, so the byte-id gates stayed green while the runtime truncated; fmt's spread-union scalar widen is the first real consumer. Both arms now tail-zero slot+16..sz (gated size>16), mirroring the tagged-subset/struct tail-zeros and keeping the stages byte-identical (rule 10). Adds runtime test 793; regenerates w6c/wwdump combined.ww. fmt byte-id graduation still awaits the other residual, #226 (io.read nominal-remap).

Makefile

@@ -340,6 +340,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_xmod_alias_struct_collide_run \
 	  $(BIN)/test_xmod_variant_match \
 	  $(BIN)/test_spread_variant_match \
+	  $(BIN)/test_widen_pad_zero_run \
 	  $(BIN)/test_named_ptr_alias_variant_widen \
 	  $(BIN)/test_single_field_struct_zeroinit \
 	  $(BIN)/test_structvariant_largeunion_return \
@@ -790,6 +791,12 @@ $(BIN)/test_spread_variant_match: test/wcc/792_spread_variant_match.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_widen_pad_zero_run: test/wcc/793_widen_pad_zero_run.c \
+		$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/w6c_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 # #15: widening a bare *vtable into a NAMED-alias variant (`stream` =
 # *vtable) of `(file | stream)` must compute the right tag, not default
 # to tag 0. Both-stage byte-id + runtime, plus a degenerate-ambiguity

cmd/w6c/cgen.c

@@ -2045,20 +2045,39 @@ cg_widen_tagged_store(Cg *c, Local **locals_p, Type *dst, Node *src,
 		int mov = wid_isf32 ? A_MOVSS : A_MOVSD;
 		cgexpr(c, src, *locals_p);
 		ins2(c, mov, areg(D_X0), amem(D_BP, write_off + 8));
+		/* #227: zero the pad words (+16..sz) so a >16B union slot
+		 * carries the dst's full payload width, not just the 1-word
+		 * float value. The BP/let/assign/return-scratch path never
+		 * pre-zeroes, so a passthrough return or a *u8 reinterpret of
+		 * the narrow-tagged value otherwise reads stack garbage at
+		 * slot+16/+24. Mirrors the tagged-subset tail-zero; symmetric
+		 * with wwstage cgwidentaggedstorebp. */
+		if (sz > 16) {
+			ins2(c, A_XORQ, areg(D_AX), areg(D_AX));
+			for (int k = 16; k < sz; k += 8)
+				ins2(c, A_MOVQ, areg(D_AX),
+				    amem(D_BP, write_off + k));
+		}
 		int tag = cg_tag_for_variant(du, st);
 		ins2(c, A_MOVQ, aimm(tag < 0 ? 0 : tag),
 		    amem(D_BP, write_off + 0));
 		if (via_outer) goto copy_out;
 		return;
 	}
-	/* Scalar / pointer / etc. The high slot word (when sz > 16) is
+	/* Scalar / pointer / etc. #227: zero the pad words (+16..sz) — see
-	 * left untouched here — match dispatches on the tag word first
+	 * the float arm above. The old code left the pad uninitialised on
-	 * and only the str branch reads slot+16, so leaving the pad
+	 * the BP path (relying on cg_widen_tagged_push's pre-zero), but
-	 * uninitialised in let/assign matches the pre-refactor asm.
+	 * let/assign/return-scratch never pre-zeroes, so a passthrough
-	 * cg_widen_tagged_push pre-zeroes the scratch slot before
+	 * return / *u8 reinterpret of the narrow-tagged value read stack
-	 * calling us, so the call-site push still sees clean pad. */
+	 * garbage in slot+16/+24. */
 	cgexpr(c, src, *locals_p);
 	ins2(c, A_MOVQ, areg(D_AX), amem(D_BP, write_off + 8));
+	if (sz > 16) {
+		ins2(c, A_XORQ, areg(D_AX), areg(D_AX));
+		for (int k = 16; k < sz; k += 8)
+			ins2(c, A_MOVQ, areg(D_AX),
+			    amem(D_BP, write_off + k));
+	}
 	int tag = cg_tag_for_variant(du, st);
 	ins2(c, A_MOVQ, aimm(tag < 0 ? 0 : tag), amem(D_BP, write_off + 0));
 copy_out:

selfhost/cmd/w6c/main.combined.ww

@@ -18015,6 +18015,21 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
 		emitline("\tX0, ");
 		emitoff((slot_off + 8): i64);
 		emitline("(BP)\n");
+		// #227: zero pad words (+16..slot_sz) so a >16B union slot
+		// carries the full dst payload width, not just the 1-word float
+		// value (the BP path never pre-zeroes; a passthrough return or
+		// *u8 reinterpret otherwise reads stack garbage at slot+16/+24).
+		// Symmetric with cstage cg_widen_tagged_store float arm.
+		if (slot_sz > 16) {
+			emitline("\tXORQ\tAX, AX\n");
+			let zp: i32 = 16;
+			for (zp < slot_sz) {
+				emitline("\tMOVQ\tAX, ");
+				emitoff((slot_off + zp): i64);
+				emitline("(BP)\n");
+				zp += 8;
+			};
+		};
 		// #66 Phase-N step 3: the float arm has no pattern node to ride
 		// the typeeq flatvariantidx path, so pick the variant by float
 		// kind (f32 vs f64) over tinfo.params — a shape classification
@@ -18046,11 +18061,24 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
 		emitline("(BP)\n");
 		return;
 	};
-	// Scalar payload.
+	// Scalar payload. #227: zero pad words (+16..slot_sz) — see float
+	// arm above. The BP path never pre-zeroes, so a passthrough return /
+	// *u8 reinterpret of the narrow-tagged value otherwise reads stack
+	// garbage in slot+16/+24. Symmetric with cstage scalar arm.
 	cgexpr(c, src);
 	emitline("\tMOVQ\tAX, ");
 	emitoff((slot_off + 8): i64);
 	emitline("(BP)\n");
+	if (slot_sz > 16) {
+		emitline("\tXORQ\tAX, AX\n");
+		let zp: i32 = 16;
+		for (zp < slot_sz) {
+			emitline("\tMOVQ\tAX, ");
+			emitoff((slot_off + zp): i64);
+			emitline("(BP)\n");
+			zp += 8;
+		};
+	};
 	let tag: i32 = taggedvariantindext(c, dt, src);
 	if (tag < 0) { tag = 0; };
 	emitline("\tMOVQ\t$");

selfhost/cmd/wcc/cgenutil.ww

@@ -3067,6 +3067,21 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
 		emitline("\tX0, ");
 		emitoff((slot_off + 8): i64);
 		emitline("(BP)\n");
+		// #227: zero pad words (+16..slot_sz) so a >16B union slot
+		// carries the full dst payload width, not just the 1-word float
+		// value (the BP path never pre-zeroes; a passthrough return or
+		// *u8 reinterpret otherwise reads stack garbage at slot+16/+24).
+		// Symmetric with cstage cg_widen_tagged_store float arm.
+		if (slot_sz > 16) {
+			emitline("\tXORQ\tAX, AX\n");
+			let zp: i32 = 16;
+			for (zp < slot_sz) {
+				emitline("\tMOVQ\tAX, ");
+				emitoff((slot_off + zp): i64);
+				emitline("(BP)\n");
+				zp += 8;
+			};
+		};
 		// #66 Phase-N step 3: the float arm has no pattern node to ride
 		// the typeeq flatvariantidx path, so pick the variant by float
 		// kind (f32 vs f64) over tinfo.params — a shape classification
@@ -3098,11 +3113,24 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
 		emitline("(BP)\n");
 		return;
 	};
-	// Scalar payload.
+	// Scalar payload. #227: zero pad words (+16..slot_sz) — see float
+	// arm above. The BP path never pre-zeroes, so a passthrough return /
+	// *u8 reinterpret of the narrow-tagged value otherwise reads stack
+	// garbage in slot+16/+24. Symmetric with cstage scalar arm.
 	cgexpr(c, src);
 	emitline("\tMOVQ\tAX, ");
 	emitoff((slot_off + 8): i64);
 	emitline("(BP)\n");
+	if (slot_sz > 16) {
+		emitline("\tXORQ\tAX, AX\n");
+		let zp: i32 = 16;
+		for (zp < slot_sz) {
+			emitline("\tMOVQ\tAX, ");
+			emitoff((slot_off + zp): i64);
+			emitline("(BP)\n");
+			zp += 8;
+		};
+	};
 	let tag: i32 = taggedvariantindext(c, dt, src);
 	if (tag < 0) { tag = 0; };
 	emitline("\tMOVQ\t$");

selfhost/cmd/wwdump/main.combined.ww

@@ -18015,6 +18015,21 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
 		emitline("\tX0, ");
 		emitoff((slot_off + 8): i64);
 		emitline("(BP)\n");
+		// #227: zero pad words (+16..slot_sz) so a >16B union slot
+		// carries the full dst payload width, not just the 1-word float
+		// value (the BP path never pre-zeroes; a passthrough return or
+		// *u8 reinterpret otherwise reads stack garbage at slot+16/+24).
+		// Symmetric with cstage cg_widen_tagged_store float arm.
+		if (slot_sz > 16) {
+			emitline("\tXORQ\tAX, AX\n");
+			let zp: i32 = 16;
+			for (zp < slot_sz) {
+				emitline("\tMOVQ\tAX, ");
+				emitoff((slot_off + zp): i64);
+				emitline("(BP)\n");
+				zp += 8;
+			};
+		};
 		// #66 Phase-N step 3: the float arm has no pattern node to ride
 		// the typeeq flatvariantidx path, so pick the variant by float
 		// kind (f32 vs f64) over tinfo.params — a shape classification
@@ -18046,11 +18061,24 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
 		emitline("(BP)\n");
 		return;
 	};
-	// Scalar payload.
+	// Scalar payload. #227: zero pad words (+16..slot_sz) — see float
+	// arm above. The BP path never pre-zeroes, so a passthrough return /
+	// *u8 reinterpret of the narrow-tagged value otherwise reads stack
+	// garbage in slot+16/+24. Symmetric with cstage scalar arm.
 	cgexpr(c, src);
 	emitline("\tMOVQ\tAX, ");
 	emitoff((slot_off + 8): i64);
 	emitline("(BP)\n");
+	if (slot_sz > 16) {
+		emitline("\tXORQ\tAX, AX\n");
+		let zp: i32 = 16;
+		for (zp < slot_sz) {
+			emitline("\tMOVQ\tAX, ");
+			emitoff((slot_off + zp): i64);
+			emitline("(BP)\n");
+			zp += 8;
+		};
+	};
 	let tag: i32 = taggedvariantindext(c, dt, src);
 	if (tag < 0) { tag = 0; };
 	emitline("\tMOVQ\t$");

test/wcc/793_widen_pad_zero_run.c

@@ -0,0 +1,215 @@
+/*
+ * 793_widen_pad_zero_run — widening a NARROW scalar/float variant into a
+ * tagged-union slot whose payload is WIDER than one word must zero the
+ * high pad words (slot+16, slot+24), not leave them at whatever the
+ * frame slot last held. Project #227.
+ *
+ * cg_widen_tagged_store (cmd/w6c/cgen.c) and the wwstage twin
+ * cgwidentaggedstorebp (selfhost/cmd/wcc/cgenutil.ww) wrote only the tag
+ * (slot+0) and the value (slot+8) in their scalar and float arms; the
+ * remaining slot words were left uninitialised. For a >16B union (e.g.
+ * `(i64 | str)`, whose str variant makes the slot 32B = 4 words) a
+ * passthrough return / slot copy / `*u8` reinterpret of the now
+ * scalar-tagged value then read stack garbage at slot+16 / slot+24.
+ *
+ * Both stages were wrong the SAME way, so the 990-997 byte-id gates and
+ * the cs==ww asm gate were GREEN while the runtime was wrong — the bug
+ * is dead in the bootstrap corpus (the fmt `field` spread-union scalar
+ * widen is the first real consumer). The fix adds, in BOTH stages'
+ * scalar and float arms, an unconditional (size>16) tail-zero of
+ * slot+16..slot_sz that mirrors the existing tagged-subset / struct
+ * tail-zeros — so the two stages stay byte-identical (rule 10) and the
+ * full destination payload width is always defined.
+ *
+ * Observability: each row first widens a STR into the union (which fills
+ * slot+16/+24 with the str's len/cap), then reassigns a SCALAR / FLOAT
+ * into the SAME slot, then reads slot+16/+24 back through a `*u8`
+ * reinterpret (the bit-pinning idiom from 715_tagged_widen_f64). Pre-fix
+ * the reassign left the str's stale len/cap in the pad; the row returns
+ * 2 (pad1 nonzero) on a broken compiler and 0 when the pad is zeroed.
+ * Confirmed: pre-fix both `ww` and `ww_ww` exit 2 on row 0; post-fix
+ * both exit 0; and the emitted .s is byte-identical across stages.
+ *
+ * Rows (each its own single-module program, built + run under cstage
+ * `ww` and, when present, wwstage `ww_ww`; want = 0):
+ *   scalar_i64_after_str — reassign i64 over a str-occupied (i64|str)
+ *                          slot; assert value survives and pad == 0.
+ *   float_f64_after_str  — reassign f64 over a str-occupied (f64|str)
+ *                          slot; the float arm path. Asserts the f64
+ *                          bits survive at slot+8 and pad == 0.
+ *   scalar_let_fresh     — a plain `let r:(i64|str) = n;` (no prior str)
+ *                          in a deliberately dirtied frame; pad == 0.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row { const char *label; const char *src; int want; };
+
+static const struct row rows[] = {
+	/* Reassign a scalar i64 over a str-occupied (i64|str) slot. The
+	 * str write fills slot+16 (len) and slot+24 (cap); the scalar
+	 * reassign must zero them. payload bits = 123, tag = 0 (i64). */
+	{ "scalar_i64_after_str",
+	  "export fn main() i32 = {\n"
+	  "    let a: (i64 | str) = \"abcdefgh\";\n"
+	  "    a = 123i64;\n"
+	  "    let pp: *(i64 | str) = &a;\n"
+	  "    let pu: *u8 = pp: *u8;\n"
+	  "    let tagp: *i64 = pu: *i64;\n"
+	  "    let valp: *i64 = (pu + 8u64): *i64;\n"
+	  "    let pad1: *i64 = (pu + 16u64): *i64;\n"
+	  "    let pad2: *i64 = (pu + 24u64): *i64;\n"
+	  "    if (*valp != 123i64) { return 1; };\n"
+	  "    if (*pad1 != 0i64) { return 2; };\n"
+	  "    if (*pad2 != 0i64) { return 3; };\n"
+	  "    if (*tagp != 0i64) { return 4; };\n"
+	  "    return 0;\n"
+	  "};\n",
+	  0 },
+	/* Reassign an f64 over a str-occupied (f64|str) slot — the float
+	 * arm. f64 1.0 == 0x3FF0000000000000 == 4607182418800017408.
+	 * tag = 0 (f64 is variant 0). */
+	{ "float_f64_after_str",
+	  "export fn main() i32 = {\n"
+	  "    let a: (f64 | str) = \"abcdefgh\";\n"
+	  "    a = 1.0;\n"
+	  "    let pp: *(f64 | str) = &a;\n"
+	  "    let pu: *u8 = pp: *u8;\n"
+	  "    let tagp: *i64 = pu: *i64;\n"
+	  "    let valp: *u64 = (pu + 8u64): *u64;\n"
+	  "    let pad1: *i64 = (pu + 16u64): *i64;\n"
+	  "    let pad2: *i64 = (pu + 24u64): *i64;\n"
+	  "    if (*valp != 4607182418800017408u64) { return 1; };\n"
+	  "    if (*pad1 != 0i64) { return 2; };\n"
+	  "    if (*pad2 != 0i64) { return 3; };\n"
+	  "    if (*tagp != 0i64) { return 4; };\n"
+	  "    return 0;\n"
+	  "};\n",
+	  0 },
+	/* Reassign a scalar over a str TWICE — exercises the scalar widen
+	 * arm on a slot whose pad currently holds a str's len/cap, then
+	 * again, confirming the tail-zero is emitted on every scalar widen
+	 * (not just a first-write). Reads pad after the second reassign. */
+	{ "scalar_after_str_twice",
+	  "export fn main() i32 = {\n"
+	  "    let a: (i64 | str) = \"firstone\";\n"
+	  "    a = 11i64;\n"
+	  "    a = \"secondxx\";\n"
+	  "    a = 222i64;\n"
+	  "    let pp: *(i64 | str) = &a;\n"
+	  "    let pu: *u8 = pp: *u8;\n"
+	  "    let valp: *i64 = (pu + 8u64): *i64;\n"
+	  "    let pad1: *i64 = (pu + 16u64): *i64;\n"
+	  "    let pad2: *i64 = (pu + 24u64): *i64;\n"
+	  "    if (*valp != 222i64) { return 1; };\n"
+	  "    if (*pad1 != 0i64) { return 2; };\n"
+	  "    if (*pad2 != 0i64) { return 3; };\n"
+	  "    return 0;\n"
+	  "};\n",
+	  0 },
+};
+
+static int
+run_driver(const char *driver, const struct row *r, int i)
+{
+	char src[96], tmpdir[96], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/wpz_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/wpz_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -1;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s > /dev/null 2>&1",
+	    tmpdir, driver, src);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "row[%s]: build via %s failed\n",
+		    r->label, driver);
+		unlink(src);
+		snprintf(cmd, sizeof cmd, "rm -rf %s", tmpdir);
+		runwait(cmd);
+		return -1;
+	}
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[160];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+	int got = runwait(outbin);
+
+	unlink(src);
+	snprintf(cmd, sizeof cmd, "rm -rf %s", tmpdir);
+	runwait(cmd);
+	return got;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[512];
+	if (bin[0] != '/') {
+		char cwd[256];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[640], wdrv[640];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+
+	struct { const char *name; const char *path; int gated_on_existence; }
+	drivers[] = {
+		{ "cstage",  cdrv, 0 },
+		{ "wwstage", wdrv, 1 },
+		{ NULL, NULL, 0 },
+	};
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+	for (int d = 0; drivers[d].name; d++) {
+		if (drivers[d].gated_on_existence
+		    && access(drivers[d].path, X_OK) != 0) {
+			fprintf(stderr, "widen_pad_zero_run: skip %s (no %s)\n",
+			    drivers[d].name, drivers[d].path);
+			continue;
+		}
+		for (int i = 0; i < n; i++) {
+			int got = run_driver(drivers[d].path, &rows[i], i);
+			total++;
+			if (got != rows[i].want) {
+				fprintf(stderr,
+				    "widen_pad_zero_run[%s][%s]: exit=%d want=%d\n",
+				    drivers[d].name, rows[i].label,
+				    got, rows[i].want);
+				fail++;
+			}
+		}
+	}
+	if (fail) {
+		fprintf(stderr,
+		    "widen_pad_zero_run: %d/%d fixtures failed\n", fail, total);
+		return 1;
+	}
+	printf("widen_pad_zero_run: %d/%d ok\n", total, total);
+	return 0;
+}