Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cgen: #35/#46 Family C — tagged transport from deref/cast/unwrap sources goes mem-based, both stages

Browse Source 
A tagged value reaching a transport consumer from a DEREF, CAST, or
UNWRAP source materialized as ONE scalar word — the N_UN(STAR) arm's
localloadop pulled word0 (the tag) and every cursor consumer then
transported garbage payload (cs pushed stale DX, ww stored 0/garbage;
divergent asm AND silent-wrong on both stages — ken f35 asm proof +
ken37v D3a/D3b). Consumers × sources × sizes all wrong: arg push,
let-init, assign, return, match scrutinee, as, widen — from *p at
16/24/32B, from identity/widening tagged casts, and from `?`/`!`
whose success variant is itself tagged (nested box: payload words
dropped). `is` and ww-match-16B passed only by stale-register luck.

Fix extends the #37 mem-based machinery (26d3754) below the 32B cap
instead of re-deriving:

  - cg_tagged_memread/taggedmemread: an N_UN(STAR) deref of a
    non-nullable tagged box is mem-based at ANY size — the pointer
    value IS the box address. The N_UN emitter skips the scalar load
    (joins the TY_FN/TY_ARRAY value-is-address skip); the existing
    size-generic memread arms in widen-store/match/as pick the source
    up unchanged, `is` loads the tag through the address.
  - arg push: the memread fatal becomes the mem-based push (words
    high→low from (AX)) — closes #35's word0-only push and wires the
    33-48B INDEX/DOT loud as a side effect. Pop side drains via
    pushargsrev's returned word count, unchanged.
  - cg_tagged_castpeel/taggedcastpeel: tagged→tagged casts are
    transport-transparent; peel at the call-arg widen decision and the
    widen-store entry so the ident/deref arms see the carrier and the
    remap keys on the operand type. The identity-only subset
    (cg_tagged_idcastpeel) applies at is/as/match, which key variant
    indices on the scrutinee's own type; surviving non-identity casts
    die LOUD there and at the widen cursor arms (rule 7) instead of
    word0 garbage. The peel also wires 929's >48B memarg same-type
    cast row (place resolves post-peel; loud pin flips to a run row).
  - tryprop/tryunw: IDENT sources load the cursor from their slot,
    memread sources from the box address (≤32B); >32B non-call and
    global tagged idents die loud (rule 7). A TAGGED success variant
    shifts the nested box past the outer tag (twin of the #241 tuple
    shift) — closes the unwrap-source half (ken unw16).
  - wwstage alignment UP to the cstage type-keyed routes:
    rhstaggedabicall admits N_UN deref + N_TRYPROP/N_TRYUNW (stamped
    type), matchscrutt carries the N_UN stamped type (spill size +
    variant indices; was nil → tag-0 clamp + mis-sized spill),
    cgreturn routes memread sources through the widener (the
    fall-through wrapped the un-deref'd POINTER as payload), and
    pushargsrev's aistagged gate admits the deref kind.

Emitters and consumers ship as ONE commit: they share the memread
contract, and splitting opens a transient window where a wired
emitter hands an address to an unwired consumer — the #61/#37
route-sharing fuse. The test flips ride along because they pin the
flip itself: 941's two #37 deref loud-symmetry pins become run rows
(the loud is now wired), 929's fail_rvalue_cast becomes
memarg_idcast_peeled.

No-drift bar held: ≤32B IDENT/INDEX/DOT sources emit byte-identical
asm vs master 4c46d3a (probe corpus nd1: ident let/match/arg,
struct-field, indexed element, call, nullable, ident-widen — both
stages IDENTICAL); is-on-deref is incidentally byte-identical too
(the tag load moved from the emitter to the consumer).

Tests: 941 grows 252→272 checks — ken's exact f35/D3a/D3b shapes,
each consumer × source × size cell (16/24/32/56B, str + struct
payloads), neighbor-guard row, identity-cast arg, widening-cast let
(payload checked — the old cs pass was is-only luck), success-first
unwrap-to-tagged + ident/deref unwrap, the 56B slice-deref let+match
flips (payload-pinned), and 2 rule-7 loud pins (global tagged `?`,
cast-to-third-union). Reviewer-C rows commit ken's remaining
adversarial shapes (gC1 deref-wrapped cast arg, gC2 void-variant
deref, gC3 slice-element-pointer deref, gC6 56B memarg-leg deref arg
— that one a regression pin, already place-resolved at base), a 40B
deref ARG (the 33-48B mem-push leg, silent word0 at base), and a
multi-arg pop-balance row (tagged-deref arg mid-list, called twice —
the original #35 1-push-2-pops symptom). At base 4c46d3a the impl
rows fail 53/254 (silent-wrong exits, cs≠ww asm, missing louds); the
reviewer rows kill at base too (flip rows LOUD, others wrong-exit)
except the gC6 pin. At HEAD 272/272 + 929 22 rows + test-unit 284.

Residuals (filed separately, pre-existing): #216 success-tag
divergence — error-FIRST unions emit CMPQ $1 (cs s_tag) vs CMPQ $0
(ww first-param) and ww's first-param success-type read misses the
tagged shift; match-expr tagged yield is cstage-checker-rejected
while ww runs it (the #34/#43 acceptance family); `as` binding a
STRUCT payload at let-init stays loud ("aggregate init from unhandled
rhs shape"); wwstage tagged-source arg-widen-into-WIDER-slot (the
pushargsrev #21-comment out-of-scope boundary, task #55) — the deref
leg of that family is now cstage-correct via the widen-store memread
arm but stays wwstage-silent-wrong (joins the pre-existing INDEX leg;
ident leg runs by prefix-luck under-push); truncating scalar cast as
a box payload drops the conversion (task #56, both stages, untouched
by the peel — scalar→scalar casts are never peeled).
This commit is contained in:
Hojun-Cho
2026-06-05 07:13:00 +09:00
parent 4c46d3afde
commit 322667b820
8 changed files with 1592 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files

182
selfhost/cmd/wcc/cgenexpr.ww
View File

@@ -183,6 +183,103 @@ fn cgtrytupleshift(c: *cgen, n: *node) bool = {
return true;
};
// cgtrytaggedshift — Family C (#35, unwrap source): if the `?`/`!`
// operand's success variant (tag 0) is itself a TAGGED union, the
// unwrapped value is a NESTED box (ww keeps nested unions
// un-flattened) riding the payload words intact — shift past the
// outer tag so consumers see the standard AX=tag cursor. The scalar
// MOVQ DX,AX tail carried only the inner tag and dropped the payload
// (ken unw16). Nullable folds to one word and stays on the scalar
// move. Twin of cgtrytupleshift; mirrors cstage N_TRYPROP/N_TRYUNW.
fn cgtrytaggedshift(c: *cgen, n: *node) bool = {
if (n.lhs == nil) { return false; };
let ou: *tinfo = n.lhs.type_: *tinfo;
for (ou != nil && ou.kind == tykind.TY_NAMED) { ou = ou.under; };
if (ou == nil) { return false; };
if (ou.kind != tykind.TY_TAGGED) { return false; };
if (ou.params == nil) { return false; };
let sv: *tinfo = ou.params.type_;
for (sv != nil && sv.kind == tykind.TY_NAMED) { sv = sv.under; };
if (sv == nil) { return false; };
if (sv.kind != tykind.TY_TAGGED) { return false; };
if (sv.nullable != 0) { return false; };
emitline("\tMOVQ\tDX, AX\n");
if (sv.size: i32 > 8) { emitline("\tMOVQ\tCX, DX\n"); };
if (sv.size: i32 > 16) { emitline("\tMOVQ\tR8, CX\n"); };
return true;
};
// cgtryunwcursor — Family C (#35/#46): land the `?`/`!` operand's
// tagged box in the AX/DX/CX/R8 cursor for the unwrap tail. Non-call
// sources don't fill the cursor on their own: an IDENT loads it from
// its frame slot, a mem-based read (deref at any size, >32B
// INDEX/DOT) from the box address cgexpr leaves in AX. Both were
// silent word0 unwraps pre-#35. >32B non-call stays loud (the cursor
// cannot carry it; #40 family). Mirrors cstage N_TRYPROP/N_TRYUNW.
fn cgtryunwcursor(c: *cgen, n: *node, opname: str) void = {
let u: *tinfo = nil;
if (n.lhs != nil) { u = n.lhs.type_: *tinfo; };
for (u != nil && u.kind == tykind.TY_NAMED) { u = u.under; };
let utag: bool = false;
if (u != nil) {
if (u.kind == tykind.TY_TAGGED && u.nullable == 0) {
utag = true;
};
};
if (utag && u.size: i32 > TUPLE_GPCAP * 8
&& n.lhs.kind != nkind.N_CALL) {
let p37: str = "#37: `";
os.write(2, p37.ptr, p37.len: u64);
os.write(2, opname.ptr, opname.len: u64);
let m37t: str = "` on a >32B mem-based tagged read unwired (#40-family follow-up)\n";
os.write(2, m37t.ptr, m37t.len: u64);
os.exit(1);
};
if (utag && n.lhs.kind == nkind.N_IDENT) {
let lc: *local = localfindnode(c, n.lhs.str);
if (lc == nil) {
let p35: str = "#35: `";
os.write(2, p35.ptr, p35.len: u64);
os.write(2, opname.ptr, opname.len: u64);
let m35g: str = "` on a global tagged ident unwired (rule 7)\n";
os.write(2, m35g.ptr, m35g.len: u64);
os.exit(1);
};
let boff: i32 = lc.off;
let bsz: i32 = u.size: i32;
if (bsz > 24) {
emitline("\tMOVQ\t");
emitoff((boff + 24): i64);
emitline("(BP), R8\n");
};
if (bsz > 16) {
emitline("\tMOVQ\t");
emitoff((boff + 16): i64);
emitline("(BP), CX\n");
};
if (bsz > 8) {
emitline("\tMOVQ\t");
emitoff((boff + 8): i64);
emitline("(BP), DX\n");
};
emitline("\tMOVQ\t");
emitoff(boff: i64);
emitline("(BP), AX\n");
return;
};
if (taggedmemread(c, n.lhs)) {
let bsz2: i32 = 0;
if (u != nil) { bsz2 = u.size: i32; };
cgexpr(c, n.lhs);
if (bsz2 > 24) { emitline("\tMOVQ\t24(AX), R8\n"); };
if (bsz2 > 16) { emitline("\tMOVQ\t16(AX), CX\n"); };
if (bsz2 > 8) { emitline("\tMOVQ\t8(AX), DX\n"); };
emitline("\tMOVQ\t(AX), AX\n");
return;
};
cgexpr(c, n.lhs);
};
// cgtryprop — `e?` propagates the error variant up the stack.
// Success tag = 0 (#216 tracks the legacy/flag-aware success-tag
// divergence — out of scope here, success check stays `CMPQ $0`).
@@ -201,19 +298,15 @@ fn cgtryprop(c: *cgen, n: *node) void = {
};
};
};
// #37 (rule 7): a >32B box read leaves AX = address, not the
// tag the unwrap below compares. Mirrors cstage.
if (taggedmemread(c, n.lhs)) {
let m37p: str = "#37: `?` on a >32B mem-based tagged read unwired (#40-family follow-up)\n";
os.write(2, m37p.ptr, m37p.len: u64);
os.exit(1);
};
if (sretretsize(c, c.fnret) > 0) {
let m38q: str = "#38b: `?` propagation into a >32B tagged return unwired (sret error-propagate is a #40-family follow-up)\n";
os.write(2, m38q.ptr, m38q.len: u64);
os.exit(1);
};
cgexpr(c, n.lhs);
// Family C (#35/#46): ident/deref sources land the box in the
// cursor here (was a silent word0 unwrap); call sources keep
// the plain cgexpr emission byte-for-byte.
cgtryunwcursor(c, n, "?");
// AX = tag. If non-zero, this is an error; pop frame and RET.
let cl: str = mklabel(c, "tryprop_ok");
emitline("\tCMPQ\t$0, AX\n");
@@ -276,6 +369,7 @@ fn cgtryprop(c: *cgen, n: *node) void = {
// (shift past the tag) so the destructure / let consumer reads every
// element, not just word0. Success variant = tag 0 (first param).
if (cgtrytupleshift(c, n)) { return; };
if (cgtrytaggedshift(c, n)) { return; };
// Success: unwrap value. Tag-only result was AX; the rest of
// the codegen expects the success value in AX (and BX for str).
// AX=tag, DX=val0, CX=val1 from the call ABI. For str success,
@@ -341,13 +435,8 @@ fn cgtryunw(c: *cgen, n: *node) void = {
};
};
};
// #37 (rule 7): see the cgtryprop twin.
if (taggedmemread(c, n.lhs)) {
let m37u: str = "#37: `!` on a >32B mem-based tagged read unwired (#40-family follow-up)\n";
os.write(2, m37u.ptr, m37u.len: u64);
os.exit(1);
};
cgexpr(c, n.lhs);
// Family C (#35/#46): see the cgtryprop twin.
cgtryunwcursor(c, n, "!");
let cl: str = mklabel(c, "tryunw_ok");
emitline("\tCMPQ\t$0, AX\n");
emitline("\tJE\t");
@@ -358,6 +447,7 @@ fn cgtryunw(c: *cgen, n: *node) void = {
// #241: tuple success payload fills the cursor (shift past the tag) —
// same rvalue-tuple-into-cursor story as cgtryprop.
if (cgtrytupleshift(c, n)) { return; };
if (cgtrytaggedshift(c, n)) { return; };
// Unwrap success value. (Same shuffle pattern as cgtryprop.)
let succisstr: bool = false;
if (n.lhs != nil) {
@@ -415,7 +505,11 @@ fn cgtypetest(c: *cgen, n: *node) void = {
// with output parameters): wwstage cgen has a trap with i32
// stored via *i32 in this context — direct assignment of the
// local works, indirection through &scrutoff drops sign bits.
let lhs: *node = n.lhs;
// Family C (#35): identity casts are transport no-ops — peel so
// the ident emission carries; a WIDENING tagged cast renumbers
// the tag the compare keys on and has no wired source arm —
// loud below, not a mis-keyed test. Mirrors cstage N_TYPETEST.
let lhs: *node = taggedidcastpeel(c, n.lhs);
// #38b residual (rule 7): an sret-class call result leaves AX =
// dest pointer, not the tag — mem-based test is a #40-family
// follow-up. Mirrors cstage cgen.c N_TYPETEST gate.
@@ -450,6 +544,21 @@ fn cgtypetest(c: *cgen, n: *node) void = {
// Pre-#45 this fell through to scrutoff=0 and the
// tag read landed on (BP) — the saved-BP word.
nonident = true;
// Family C catch-all (rule 7): a widening tagged
// cast source — loud. Mirrors cstage.
{
let icu: *tinfo = lhs.type_: *tinfo;
for (icu != nil && icu.kind == tykind.TY_NAMED) {
icu = icu.under;
};
if (lhs.kind == nkind.N_CAST && icu != nil
&& icu.kind == tykind.TY_TAGGED
&& icu.nullable == 0) {
let m35i: str = "#35: tagged cast source shape unwired at `is` (rule 7)\n";
os.write(2, m35i.ptr, m35i.len: u64);
os.exit(1);
};
};
cgexpr(c, lhs);
// #37: a >32B box read leaves its ADDRESS in AX —
// load the tag word from memory before the compare.
@@ -569,7 +678,8 @@ fn cgtypeassert(c: *cgen, n: *node) void = {
// index, otherwise unwrap to T's ABI: scalar/ptr → AX, 16B
// str → (AX, BX). Mirrors cgmatch's slot-based value load.
// Slot resolution inlined; see cgtypetest comment.
let lhs: *node = n.lhs;
// Family C (#35): identity-cast peel — see the cgtypetest twin.
let lhs: *node = taggedidcastpeel(c, n.lhs);
// #38b residual (rule 7): the spill below reads the cursor, which
// an sret-class call result never fills. Mirrors cstage cgen.c
// N_TYPEASSERT gate.
@@ -627,6 +737,21 @@ fn cgtypeassert(c: *cgen, n: *node) void = {
os.write(2, m37s.ptr, m37s.len: u64);
os.exit(1);
};
// Family C catch-all (rule 7): a widening tagged
// cast source — loud. Mirrors cstage.
{
let acu: *tinfo = lhs.type_: *tinfo;
for (acu != nil && acu.kind == tykind.TY_NAMED) {
acu = acu.under;
};
if (lhs.kind == nkind.N_CAST && acu != nil
&& acu.kind == tykind.TY_TAGGED
&& acu.nullable == 0) {
let m35s: str = "#35: tagged cast source shape unwired at `as` (rule 7)\n";
os.write(2, m35s.ptr, m35s.len: u64);
os.exit(1);
};
};
cgexpr(c, lhs);
emitline("\tMOVQ\tAX, ");
emitoff(scrutoff: i64);
@@ -2257,7 +2382,8 @@ fn cgmatch(c: *cgen, n: *node) void = {
// layout: [+0]=tag, [+8]=value0, [+16]=value1. Bindings
// (`case let v: T =>`) get a fresh local slot loaded from
// slot+8 (and slot+16 for str-typed payload).
let scrut: *node = n.lhs;
// Family C (#35): identity-cast peel — see the cgtypetest twin.
let scrut: *node = taggedidcastpeel(c, n.lhs);
let scrutoff: i32 = 0;
let scrutt: *node = nil;
if (scrut != nil) {
@@ -2335,6 +2461,16 @@ fn cgmatch(c: *cgen, n: *node) void = {
os.write(2, m37n.ptr, m37n.len: u64);
os.exit(1);
};
// Family C catch-all (rule 7): a widening tagged
// cast scrutinee has no cursor — loud. Mirrors
// cstage cgmatch.
if (scrut.kind == nkind.N_CAST && ms37 != nil
&& ms37.kind == tykind.TY_TAGGED
&& ms37.nullable == 0) {
let m35m: str = "#35: tagged cast source shape unwired at match (rule 7)\n";
os.write(2, m35m.ptr, m35m.len: u64);
os.exit(1);
};
cgexpr(c, scrut);
emitline("\tMOVQ\tAX, ");
emitoff(scrutoff: i64);
@@ -4431,6 +4567,16 @@ fn cgun(c: *cgen, n: *node) void = {
for (rti != nil && rti.kind == tykind.TY_NAMED) { rti = rti.under; };
if (rti != nil && rti.kind == tykind.TY_FN) { return; };
if (rti != nil && rti.kind == tykind.TY_ARRAY) { return; };
// Family C (#35/#46): a tagged box behind *p joins the
// mem-based class at ANY size (taggedmemread) — AX = p's
// value IS the box address. The scalar load below pulled
// word0 (the tag) and every cursor consumer transported
// garbage payload words — silent-wrong both stages (ken
// f35/D3a/D3b). The nullable one-word fold stays a scalar
// deref. Mirrors cstage N_UN TK_STAR.
if (rti != nil && rti.kind == tykind.TY_TAGGED) {
if (rti.nullable == 0 && rti.size: i32 > 8) { return; };
};
// f64/f32 result rides X0 (SSE), not AX — an integer MOVQ
// strands the value off the float ABI and the caller's
// MOVSD X0 reads stale bits (#96). Mirrors the float