Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cgen: #35/#46 Family C — tagged transport from deref/cast/unwrap sources goes mem-based, both stages

Browse Source 
A tagged value reaching a transport consumer from a DEREF, CAST, or
UNWRAP source materialized as ONE scalar word — the N_UN(STAR) arm's
localloadop pulled word0 (the tag) and every cursor consumer then
transported garbage payload (cs pushed stale DX, ww stored 0/garbage;
divergent asm AND silent-wrong on both stages — ken f35 asm proof +
ken37v D3a/D3b). Consumers × sources × sizes all wrong: arg push,
let-init, assign, return, match scrutinee, as, widen — from *p at
16/24/32B, from identity/widening tagged casts, and from `?`/`!`
whose success variant is itself tagged (nested box: payload words
dropped). `is` and ww-match-16B passed only by stale-register luck.

Fix extends the #37 mem-based machinery (26d3754) below the 32B cap
instead of re-deriving:

  - cg_tagged_memread/taggedmemread: an N_UN(STAR) deref of a
    non-nullable tagged box is mem-based at ANY size — the pointer
    value IS the box address. The N_UN emitter skips the scalar load
    (joins the TY_FN/TY_ARRAY value-is-address skip); the existing
    size-generic memread arms in widen-store/match/as pick the source
    up unchanged, `is` loads the tag through the address.
  - arg push: the memread fatal becomes the mem-based push (words
    high→low from (AX)) — closes #35's word0-only push and wires the
    33-48B INDEX/DOT loud as a side effect. Pop side drains via
    pushargsrev's returned word count, unchanged.
  - cg_tagged_castpeel/taggedcastpeel: tagged→tagged casts are
    transport-transparent; peel at the call-arg widen decision and the
    widen-store entry so the ident/deref arms see the carrier and the
    remap keys on the operand type. The identity-only subset
    (cg_tagged_idcastpeel) applies at is/as/match, which key variant
    indices on the scrutinee's own type; surviving non-identity casts
    die LOUD there and at the widen cursor arms (rule 7) instead of
    word0 garbage. The peel also wires 929's >48B memarg same-type
    cast row (place resolves post-peel; loud pin flips to a run row).
  - tryprop/tryunw: IDENT sources load the cursor from their slot,
    memread sources from the box address (≤32B); >32B non-call and
    global tagged idents die loud (rule 7). A TAGGED success variant
    shifts the nested box past the outer tag (twin of the #241 tuple
    shift) — closes the unwrap-source half (ken unw16).
  - wwstage alignment UP to the cstage type-keyed routes:
    rhstaggedabicall admits N_UN deref + N_TRYPROP/N_TRYUNW (stamped
    type), matchscrutt carries the N_UN stamped type (spill size +
    variant indices; was nil → tag-0 clamp + mis-sized spill),
    cgreturn routes memread sources through the widener (the
    fall-through wrapped the un-deref'd POINTER as payload), and
    pushargsrev's aistagged gate admits the deref kind.

Emitters and consumers ship as ONE commit: they share the memread
contract, and splitting opens a transient window where a wired
emitter hands an address to an unwired consumer — the #61/#37
route-sharing fuse. The test flips ride along because they pin the
flip itself: 941's two #37 deref loud-symmetry pins become run rows
(the loud is now wired), 929's fail_rvalue_cast becomes
memarg_idcast_peeled.

No-drift bar held: ≤32B IDENT/INDEX/DOT sources emit byte-identical
asm vs master 4c46d3a (probe corpus nd1: ident let/match/arg,
struct-field, indexed element, call, nullable, ident-widen — both
stages IDENTICAL); is-on-deref is incidentally byte-identical too
(the tag load moved from the emitter to the consumer).

Tests: 941 grows 252→272 checks — ken's exact f35/D3a/D3b shapes,
each consumer × source × size cell (16/24/32/56B, str + struct
payloads), neighbor-guard row, identity-cast arg, widening-cast let
(payload checked — the old cs pass was is-only luck), success-first
unwrap-to-tagged + ident/deref unwrap, the 56B slice-deref let+match
flips (payload-pinned), and 2 rule-7 loud pins (global tagged `?`,
cast-to-third-union). Reviewer-C rows commit ken's remaining
adversarial shapes (gC1 deref-wrapped cast arg, gC2 void-variant
deref, gC3 slice-element-pointer deref, gC6 56B memarg-leg deref arg
— that one a regression pin, already place-resolved at base), a 40B
deref ARG (the 33-48B mem-push leg, silent word0 at base), and a
multi-arg pop-balance row (tagged-deref arg mid-list, called twice —
the original #35 1-push-2-pops symptom). At base 4c46d3a the impl
rows fail 53/254 (silent-wrong exits, cs≠ww asm, missing louds); the
reviewer rows kill at base too (flip rows LOUD, others wrong-exit)
except the gC6 pin. At HEAD 272/272 + 929 22 rows + test-unit 284.

Residuals (filed separately, pre-existing): #216 success-tag
divergence — error-FIRST unions emit CMPQ $1 (cs s_tag) vs CMPQ $0
(ww first-param) and ww's first-param success-type read misses the
tagged shift; match-expr tagged yield is cstage-checker-rejected
while ww runs it (the #34/#43 acceptance family); `as` binding a
STRUCT payload at let-init stays loud ("aggregate init from unhandled
rhs shape"); wwstage tagged-source arg-widen-into-WIDER-slot (the
pushargsrev #21-comment out-of-scope boundary, task #55) — the deref
leg of that family is now cstage-correct via the widen-store memread
arm but stays wwstage-silent-wrong (joins the pre-existing INDEX leg;
ident leg runs by prefix-luck under-push); truncating scalar cast as
a box payload drops the conversion (task #56, both stages, untouched
by the peel — scalar→scalar casts are never peeled).
This commit is contained in:
Hojun-Cho
2026-06-05 07:13:00 +09:00
parent 4c46d3afde
commit 322667b820
8 changed files with 1592 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files

147
selfhost/cmd/wcc/cgenutil.ww
View File

@@ -111,6 +111,15 @@ fn pushargsrev(c: *cgen, arg: *node, param: *node, memphase: bool) i32 = {
let nextparam: *node = nil;
if (param != nil) { nextparam = param.next; };
let rest: i32 = pushargsrev(c, arg.next, nextparam, memphase);
// Family C (#35): peel tagged→tagged casts FIRST so every gate
// below keys on the operand — an identity cast reduces to the
// ident fast path, a widening cast trips the widen branch with
// the operand as source. cgexpr on the cast node collapses to
// one word (silent word0 push pre-#35). Mirrors cstage's
// args[i] = cg_tagged_castpeel(args[i]) pre-pass; the cgcall
// pop side counts via pushargsrev's return, so the drain stays
// balanced.
arg = taggedcastpeel(c, arg);
// #38b MEMORY-class detection: keyed off the declared param's
// type (so widening into a >48B slot is caught), else the arg's
// own stamped type (fn-ptr callee carries no param nodes).
@@ -304,6 +313,19 @@ fn pushargsrev(c: *cgen, arg: *node, param: *node, memphase: bool) i32 = {
};
};
};
// Family C (#35): a DEREF source is a
// tagged box too (mem-based, any size)
// — without this gate the widening
// scalar branch boxed the box. Same
// slotsize key as the N_INDEX/N_DOT
// stamped-carrier arms above.
if (arg.kind == nkind.N_UN && arg.op == tkind.TK_STAR) {
if (istaggedtype(c, arg)) {
if (slotsize(c, arg) == slotsize(c, ptype)) {
aistagged = true;
};
};
};
if (!aistagged) {
widensz = slotsize(c, ptype);
let tagged: *node = resolvetagged(c, ptype);
@@ -897,17 +919,26 @@ fn pushargsrev(c: *cgen, arg: *node, param: *node, memphase: bool) i32 = {
// keeps the stamped-carrier kind gate (#67 pattern) — the
// remaining kinds (deref/cast/unwrap) are word0-only reads today,
// filed residual.
if (arg.kind == nkind.N_INDEX || arg.kind == nkind.N_DOT) {
if (arg.kind == nkind.N_INDEX || arg.kind == nkind.N_DOT
|| (arg.kind == nkind.N_UN && arg.op == tkind.TK_STAR)) {
if (istaggedtype(c, arg)) {
let isz: i32 = slotsize(c, arg);
// #37 (rule 7): a 33-48B box from an INDEX/DOT read
// is mem-based (AX = addr, no cursor to push) — was
// silent cursor truncation pre-#37; the mem-based
// push is the #35 family. Mirrors cstage.
// #35 (Family C): a mem-based read left the box
// ADDRESS in AX — push the words from memory
// high→low, the mem twin of the cursor push below.
// Covers the any-size deref source and the 33-48B
// INDEX/DOT reads that loud-stopped here pre-#35.
// Mirrors cstage.
if (taggedmemread(c, arg)) {
let m37g: str = "#37: >32B tagged arg from a mem-based read unwired (#35/#40-family follow-up)\n";
os.write(2, m37g.ptr, m37g.len: u64);
os.exit(1);
let mk35: i32 = isz - 8;
for (mk35 >= 0) {
emitline("\tMOVQ\t");
emitdispreg(mk35: i64, "AX");
emitline(", DX\n");
emitline("\tPUSHQ\tDX\n");
mk35 -= 8;
};
return rest + isz / 8;
};
if (isz > 24) { emitline("\tPUSHQ\tR8\n"); };
if (isz > 16) { emitline("\tPUSHQ\tCX\n"); };
@@ -2380,6 +2411,14 @@ fn matchscrutt(c: *cgen, scrut: *node) *node = {
if (!istaggedtype(c, scrut)) { return nil; };
return scrut;
};
// Family C (#46): a DEREF scrutinee — stamped-carrier like the
// non-ident N_INDEX/N_DOT arms (`match (*p)` spill size + variant
// indices key off scrut.type_; pre-#46 nil here clamped the
// variant to 0 and mis-sized @match_spill).
if (k == nkind.N_UN && scrut.op == tkind.TK_STAR) {
if (!istaggedtype(c, scrut)) { return nil; };
return scrut;
};
return nil;
};
@@ -3043,6 +3082,17 @@ fn rhstaggedabicall(c: *cgen, src: *node) bool = {
if (src.kind == nkind.N_DOT) {
if (typeistagged(src.type_: *tinfo)) { return true; };
};
// Family C (#35/#46): a DEREF source is mem-based (taggedmemread,
// any size) — the widen-store's memread arm copies the box from
// the address cgexpr leaves in AX. An unwrap (`?`/`!`) source
// fills the cursor after the tagged-success payload shift (the
// cgtryprop/cgtryunw twin of cstage's kind-blind su-tagged arm).
if (src.kind == nkind.N_UN && src.op == tkind.TK_STAR) {
if (typeistagged(src.type_: *tinfo)) { return true; };
};
if (src.kind == nkind.N_TRYPROP || src.kind == nkind.N_TRYUNW) {
if (typeistagged(src.type_: *tinfo)) { return true; };
};
return false;
};
@@ -3053,8 +3103,21 @@ fn rhstaggedabicall(c: *cgen, src: *node) bool = {
// gates key separately on callsretsize). Every cursor-spill consumer
// must branch on this before reading AX as the tag. Mirrors cstage
// cg_tagged_memread.
// Family C (#35/#46): a DEREF source is mem-based at ANY size — the
// pointer value IS the box address, so cgun skips the scalar load
// (which carried only the tag) and consumers copy from memory. ≤32B
// INDEX/DOT keep the cursor byte-for-byte (the #37 no-drift bar);
// the nullable one-word fold stays a scalar deref.
fn taggedmemread(c: *cgen, e: *node) bool = {
if (e == nil) { return false; };
if (e.kind == nkind.N_UN && e.op == tkind.TK_STAR) {
let du: *tinfo = e.type_: *tinfo;
for (du != nil && du.kind == tykind.TY_NAMED) { du = du.under; };
if (du == nil) { return false; };
if (du.kind != tykind.TY_TAGGED) { return false; };
if (du.nullable != 0) { return false; };
return du.size: i32 > 8;
};
if (e.kind != nkind.N_INDEX && e.kind != nkind.N_DOT) { return false; };
let u: *tinfo = e.type_: *tinfo;
for (u != nil && u.kind == tykind.TY_NAMED) { u = u.under; };
@@ -3063,6 +3126,49 @@ fn taggedmemread(c: *cgen, e: *node) bool = {
return u.size: i32 > TUPLE_GPCAP * 8;
};
// taggedcastpeel — Family C (#35): a tagged→tagged cast is transport-
// transparent — the operand's box IS the value; transport consumers
// (widen-store, arg push) derive the remap from the operand's type.
// Peeling exposes the ident/deref carrier their source arms key on;
// cgexpr on the cast node itself collapses to one word. Concrete-
// variant casts (`7: size`) keep their node for variant-tag lookup;
// the nullable one-word fold never spills a cursor — excluded.
// Mirrors cstage cg_tagged_castpeel.
fn taggedcastpeel(c: *cgen, e: *node) *node = {
for (e != nil && e.kind == nkind.N_CAST && e.lhs != nil) {
let cu: *tinfo = e.type_: *tinfo;
for (cu != nil && cu.kind == tykind.TY_NAMED) { cu = cu.under; };
if (cu == nil) { return e; };
if (cu.kind != tykind.TY_TAGGED) { return e; };
if (cu.nullable != 0) { return e; };
let iu: *tinfo = e.lhs.type_: *tinfo;
for (iu != nil && iu.kind == tykind.TY_NAMED) { iu = iu.under; };
if (iu == nil) { return e; };
if (iu.kind != tykind.TY_TAGGED) { return e; };
if (iu.nullable != 0) { return e; };
e = e.lhs;
};
return e;
};
// taggedidcastpeel — the IDENTITY-only subset of the peel for
// consumers that key variant indices on the scrutinee's own type
// (is/as/match): same-type casts are no-ops there, but a WIDENING
// cast changes the tag numbering and must NOT be peeled — those die
// loud at the consumer's cast catch-all instead. Mirrors cstage
// cg_tagged_idcastpeel.
fn taggedidcastpeel(c: *cgen, e: *node) *node = {
for (e != nil && e.kind == nkind.N_CAST && e.lhs != nil) {
if (!typeeq(e.type_: *tinfo, e.lhs.type_: *tinfo)) { return e; };
let cu: *tinfo = e.type_: *tinfo;
for (cu != nil && cu.kind == tykind.TY_NAMED) { cu = cu.under; };
if (cu == nil) { return e; };
if (cu.kind != tykind.TY_TAGGED) { return e; };
e = e.lhs;
};
return e;
};
// cgloadtaggedfield — load a tagged-union slot at `basereg`+foff
// into the tagged-return ABI registers (AX=tag, DX=word0, CX=word1,
// R8=word2). Slot sizes: 16B = (tag, word0), 24B = + word1, 32B
@@ -3201,6 +3307,12 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
emitline("(BP)\n");
return;
};
// Family C (#35): a tagged→tagged cast is transport-transparent
// — peel it so the ident/deref/memread source arms below see the
// carrier and the remap keys on the operand's type. Pre-#35 the
// cast node fell to the scalar arm (`let w: un3 = (v: un3)`
// stored tag 0 + word0). Mirrors cstage cg_widen_tagged_store.
src = taggedcastpeel(c, src);
// `expr: TaggedAlias` where the cast's destination IS the union
// itself is a widening, not a re-interpret. cgexpr on a CAST
// produces the inner's register shape (str: AX=ptr, BX=len), not
@@ -3354,6 +3466,15 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
os.write(2, m37a.ptr, m37a.len: u64);
os.exit(1);
};
// Family C catch-all (rule 7): a tagged cast
// surviving taggedcastpeel (cast to a THIRD
// union) has no cursor — loud, not word0
// garbage. Mirrors cstage.
if (src.kind == nkind.N_CAST) {
let m35a: str = "#35: tagged cast source shape unwired at the widen nested arm (rule 7)\n";
os.write(2, m35a.ptr, m35a.len: u64);
os.exit(1);
};
cgexpr(c, src);
emitline("\tMOVQ\tAX, ");
emitoff((slot_off + 8): i64);
@@ -3499,6 +3620,16 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
os.write(2, m37f.ptr, m37f.len: u64);
os.exit(1);
};
// Family C catch-all (rule 7): a tagged cast surviving
// taggedcastpeel (cast to a THIRD union) would fall to the
// scalar arm below and silently truncate — loud. Mirrors
// cstage's widen subset-arm cast bound.
if (src.kind == nkind.N_CAST && sf37 != nil
&& sf37.kind == tykind.TY_TAGGED && sf37.nullable == 0) {
let m35b: str = "#35: tagged cast source shape unwired at the widen subset arm (rule 7)\n";
os.write(2, m35b.ptr, m35b.len: u64);
os.exit(1);
};
// #242: tuple payload. Each element rides ONE register-ABI
// eightbyte — scalar/float a single 8B word, a slice/str its 3-word
// {ptr,len,cap} header (24B) — matching the tagged-return load