w6c: set variadic-call AL to XMM-reg count, not hardcoded 0 (catB-54 C1)

SysV §3.5.7 requires a variadic call to set AL = number of vector (XMM) regs used for the variable float args; the C callee gates its xmm-save-area stores on `test %al,%al`, so the old hardcoded XORQ AX,AX (AL=0) made va_arg(double) read garbage for any float-bearing C variadic call. Emit MOVQ $fi,AX (fi = the in-scope XMM cursor, ≤8); w6a has no MOVL-immediate encoding so MOVQ is the assemblable form and sets AL=fi identically. fi==0 keeps XORQ → byte-identical to pre-fix for no-float variadic calls. Runtime test 989_ffivariadic links a cc-compiled va_arg(double) fixture (zero relocs/undefined, w6l-linkable) and sweeps N=3/5/8 floats (N=2 is vacuous via stale-stack aliasing). C1 of the C-FFI-variadic align-up (USER ruling); C2 wwstage + C3 bodiless gate follow. ref/qbe/amd64/sysv.c:384. 454 green.

Makefile

@@ -264,6 +264,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_taggedcompoundplace_reject \
 	  $(BIN)/test_libprecond_abort \
 	  $(BIN)/test_idxarg_run \
+	  $(BIN)/test_ffivariadic_run \
 	  $(BIN)/test_chainidx_run \
 	  $(BIN)/test_m1mangle_run \
 	  $(BIN)/test_m1mangle_sym \
@@ -828,6 +829,26 @@ $(BIN)/test_idxarg_run: test/wcc/989_idxarg_run.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+# 989_ffivariadic_run (C1, catB-54): a ww caller of a C variadic fn must set
+# the SysV AL register to the count of XMM regs used for the variadic float
+# args — a RUNTIME-only correctness property (byte-id is blind to AL). The cc
+# fixture is built self-contained (zero relocs + zero undef syms, verified via
+# readelf -r / nm) so w6l links it with no libc, then wrapped in libffifix.a
+# under $(OUT)/ffivariadic (the harness finds it via $(BIN)/../ffivariadic).
+# cstage `ww` ONLY — wwstage AL is C2. Fixture flags are fixed (NOT $(CFLAGS),
+# which is -O0/-std=c99) to match ken's verified self-contained build.
+$(OUT)/ffivariadic/libffifix.a: test/wcc/data/ffivariadic/fixture.c
+	@mkdir -p $(OUT)/ffivariadic
+	$(CC) -O1 -fno-stack-protector -fno-asynchronous-unwind-tables \
+		-fcf-protection=none -c -o $(OUT)/ffivariadic/fixture.o $<
+	$(AR) rcs $@ $(OUT)/ffivariadic/fixture.o
+
+$(BIN)/test_ffivariadic_run: test/wcc/989_ffivariadic_run.c \
+		$(OUT)/ffivariadic/libffifix.a \
+		$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 # 989_chainidx_run (F7-c3, #22): a chained index `m[i][k]` whose element is
 # a str/slice must load the full 24B/16B header. Builds+runs each fixture on
 # BOTH the cstage `ww` and wwstage `ww_ww` drivers (rule-10).

cmd/w6c/cgen.c

@@ -10215,11 +10215,20 @@ cgexpr(Cg *c, Node *n, Local *locals)
 				    areg(D_DI));
 			}
 		}
-		/* SysV: variadic callees require AL to hold the count of
-		 * XMM regs used in the variable portion. We don't pass
-		 * floats yet, so AL=0 covers every case we emit. */
-		if (cu && cu->kind == TY_FN && cu->variadic)
-			ins2(c, A_XORQ, areg(D_AX), areg(D_AX));
+		/* SysV §3.5.7: a variadic call must set AL to the number of
+		 * vector (XMM) regs used to pass the variable float args — the
+		 * callee gates its xmm-save-area stores on `test %al,%al`, so a
+		 * wrong AL makes va_arg(double) read garbage. fi is the XMM
+		 * cursor (capped at 8 above). cstage formerly hardcoded AL=0,
+		 * correct only for zero-float variadic calls. Ref ref/qbe/
+		 * amd64/sysv.c:384. MOVL-imm has no w6a encoding, so the imm→reg
+		 * MOVQ idiom carries it (AL = low byte, fi ≤ 8). */
+		if (cu && cu->kind == TY_FN && cu->variadic) {
+			if (fi > 0)
+				ins2(c, A_MOVQ, aimm(fi), areg(D_AX));
+			else
+				ins2(c, A_XORQ, areg(D_AX), areg(D_AX));
+		}
 		if (n->lhs->kind == N_IDENT) {
 			/* If the callee names a local variable holding a
 			 * function pointer, load it and call indirect. Without

test/wcc/989_ffivariadic_run.c

@@ -0,0 +1,157 @@
+/*
+ * 989_ffivariadic_run — C1 (catB-54): a ww caller of a C variadic function
+ * (`@symbol("f") fn f(a: i64, ...) f64;`) must set the SysV AL register to
+ * the number of XMM regs used to pass the variadic FLOAT args. The C callee
+ * gates its xmm-save-area stores on `test %al,%al`, so a wrong AL makes
+ * va_arg(double) read garbage.
+ *
+ * THE BUG (cat-A silent miscompile, byte-id-blind): cgen.c hardcoded AL=0
+ * (`XORQ AX,AX`) at the variadic-call site — correct only for a zero-float
+ * variadic call. THE FIX: emit AL = the XMM cursor `fi` (the count of float
+ * args placed in XMM regs). Ref SysV §3.5.7, ref/qbe/amd64/sysv.c:384.
+ *
+ * RUNTIME gate (byte-id can never see AL correctness): each row builds a ww
+ * caller that calls the C fixture `double fixture(long n, ...)` (a
+ * va_arg(double) summer, test/wcc/data/ffivariadic/fixture.c, linked from
+ * libffifix.a) and asserts the returned sum. cstage `ww` ONLY — wwstage AL
+ * is C2.
+ *
+ * NON-VACUITY DEVIATION (reported to lead): the spec's `fixture(2,1.0,2.0)`
+ * is VACUOUS on this box — with AL=0 the two skipped xmm slots happen to
+ * alias stale stack that already holds 1.0/2.0, so the 2-float call returns
+ * the correct 3.0 even unfixed. At 3+ floats the coincidence breaks: AL=0
+ * deterministically returns the wrong sum. Every row below uses >=3 floats,
+ * so reverting the fix to `XORQ AX,AX` FAILS this test (proven). A 2-float
+ * row would pass both ways and prove nothing.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row {
+	const char *label;
+	const char *src;
+	int want_exit;	/* 0 == sum matched */
+};
+
+static const struct row rows[] = {
+	/* 3 floats: 1+2+3 == 6. The smallest non-vacuous count (see header). */
+	{ "three",
+	  "package main;\n"
+	  "@symbol(\"fixture\") fn fixture(n: i64, ...) f64;\n"
+	  "export fn main() int = {\n"
+	  "	let r: f64 = fixture(3, 1.0, 2.0, 3.0);\n"
+	  "	if (r == 6.0) { return 0; };\n"
+	  "	return 1;\n"
+	  "};\n",
+	  0 },
+
+	/* 5 floats, fewer than the 8 XMM arg regs: 1+2+3+4+5 == 15. */
+	{ "five",
+	  "package main;\n"
+	  "@symbol(\"fixture\") fn fixture(n: i64, ...) f64;\n"
+	  "export fn main() int = {\n"
+	  "	let r: f64 = fixture(5, 1.0, 2.0, 3.0, 4.0, 5.0);\n"
+	  "	if (r == 15.0) { return 0; };\n"
+	  "	return 1;\n"
+	  "};\n",
+	  0 },
+
+	/* 8 floats == all XMM arg regs (AL caps at 8): 1+..+8 == 36. */
+	{ "eight",
+	  "package main;\n"
+	  "@symbol(\"fixture\") fn fixture(n: i64, ...) f64;\n"
+	  "export fn main() int = {\n"
+	  "	let r: f64 = fixture(8, 1.0, 2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0);\n"
+	  "	if (r == 36.0) { return 0; };\n"
+	  "	return 1;\n"
+	  "};\n",
+	  0 },
+};
+
+/* run_build — build+run `src` via cstage `driver`, linking libffifix.a from
+ * `libdir`. Returns the binary's exit code, or -1 on a build failure. */
+static int
+run_build(const char *driver, const char *libdir, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/ffivar_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/ffivar_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -2;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd,
+	    "cd %s && %s build -L%s -lffifix %s 2>/dev/null",
+	    tmpdir, driver, libdir, src);
+	int brc = runwait(cmd);
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+	int got = -1;
+	if (brc == 0) got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return brc == 0 ? got : -1;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024], libdir[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	/* libffifix.a lives beside $(BIN) under $(OUT)/ffivariadic — the
+	 * Makefile builds it there as a prereq of this test binary. */
+	snprintf(libdir, sizeof libdir, "%s/../ffivariadic", bin);
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int i = 0; i < n; i++) {
+		total++;
+		int got = run_build(cdrv, libdir, &rows[i], i);
+		if (got != rows[i].want_exit) {
+			fprintf(stderr, "ffivariadic[%s]: exit=%d want=%d\n",
+			    rows[i].label, got, rows[i].want_exit);
+			fail++;
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "ffivariadic: %d/%d fixtures failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("ffivariadic: %d/%d ok\n", total, total);
+	return 0;
+}

test/wcc/data/ffivariadic/fixture.c

@@ -0,0 +1,26 @@
+/*
+ * C-FFI variadic test fixture (C1, catB-54). A va_arg(double) summer the
+ * ww caller links against to prove the SysV AL=XMM-count fix: the callee
+ * gates its xmm-save-area stores on `test %al,%al`, so a wrong AL makes
+ * these va_arg(double) reads pull garbage.
+ *
+ * Built self-contained (zero relocs, zero undef syms) so w6l can link it
+ * with no libc — verified via readelf -r / nm. Do not add any call that
+ * pulls in a libc symbol.
+ */
+#include <stdarg.h>
+
+double
+fixture(long n, ...)
+{
+	va_list ap;
+	double s;
+	long i;
+
+	va_start(ap, n);
+	s = 0;
+	for(i = 0; i < n; i++)
+		s += va_arg(ap, double);
+	va_end(ap);
+	return s;
+}