From 33f940e17c1c2db7ab19bf50be40bb3f90d1ba67 Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Sun, 14 Jun 2026 01:14:51 +0900 Subject: [PATCH] wcc/ww: compound OP= on a tagged index/ident is a loud reject (#20/#21) Compound `OP=` through an index (gs[i]/a[i]) or a bare ident (g) on a tagged union silently misbehaved: cstage dropped the index compound and plain-stored, and BOTH stages compiled an ident compound into an add on the tag word -- byte-identical, so the gate stayed green while the tag was corrupted. A compound op on a whole union is nonsense. Gate the index plain-store arm on TK_ASSIGN so a compound falls to the existing #133 reject (wwstage's byte-id twin); add a dedicated #21 ident reject in both stages. This closes the compound half of the tagged-payload write class (deref #18, dot #34 already reject). #19 (global tagged-array static-init DATA) is a separate emitter, still open. --- Makefile | 19 ++ cmd/w6c/cgen.c | 26 +- selfhost/cmd/w6c/main.combined.ww | 19 ++ selfhost/cmd/wcc/cgenexpr.ww | 19 ++ selfhost/cmd/wwdump/main.combined.ww | 19 ++ test/wcc/989_taggedcompoundplace_reject.c | 327 ++++++++++++++++++++++ 6 files changed, 427 insertions(+), 2 deletions(-) create mode 100644 test/wcc/989_taggedcompoundplace_reject.c diff --git a/Makefile b/Makefile index 32790b61..d031737e 100644 --- a/Makefile +++ b/Makefile @@ -254,6 +254,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_unknowndecl_reject \ $(BIN)/test_nullableglobal_reject \ $(BIN)/test_taggedcompoundderef_reject \ + $(BIN)/test_taggedcompoundplace_reject \ $(BIN)/test_idxarg_run \ $(BIN)/test_chainidx_run \ $(BIN)/test_tupfieldsize_run \ @@ -754,6 +755,24 @@ $(BIN)/test_taggedcompoundderef_reject: test/wcc/989_taggedcompoundderef_reject. $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +# 989_taggedcompoundplace_reject (#20/#21, last two members of the +# compound-OP-on-tagged-place reject class): `gs[i] OP= v` / `a[i] OP= v` +# (INDEX, #20) and `g OP= v` (IDENT, #21) on a tagged-union place are +# nonsense and must loud-reject. cstage silently dropped the indexed compound +# (cs!=ww); BOTH stages silently corrupted the tag word for the ident +# compound (byte-id-green). The fix gates the cstage indexed plain-store arm +# on TK_ASSIGN (compound falls to the #133 reject) and adds a tagged-ident +# compound guard to both stages. Reject rows assert build-fail + the +# per-place-kind diagnostic (#133 for index, #21 for ident); control rows +# (scalar ident/index compound + plain tagged ident/local-index/global-index +# store) build + run. Needs both tool sets + libwwrt for the control links. +$(BIN)/test_taggedcompoundplace_reject: test/wcc/989_taggedcompoundplace_reject.c \ + $(BIN)/ww $(BIN)/ww_ww \ + $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + # 989_idxarg_run (F7-c2, #45/#46): an indexed slice/str element passed as # a call arg must push its full multi-word header. Builds+runs each fixture # on BOTH the cstage `ww` and wwstage `ww_ww` drivers (rule-10), so it needs diff --git a/cmd/w6c/cgen.c b/cmd/w6c/cgen.c index 0c2cde8e..d50a7769 100644 --- a/cmd/w6c/cgen.c +++ b/cmd/w6c/cgen.c @@ -6483,8 +6483,16 @@ cgexpr(Cg *c, Node *n, Local *locals) * the full cg_widen_tagged_store machinery — scalar / * str / struct / subset payloads, tag remap, nullable * fold — without duplicating it. The scratch lives in - * the function frame; no cleanup needed. */ - if ((is_arr || is_sl || is_ptr) && elem_tagged) { + * the function frame; no cleanup needed. + * #20: only a PLAIN `=` widens. A COMPOUND `gs[i] OP= v` + * on a tagged element is nonsense — without the + * TK_ASSIGN gate it dropped the OP and plain-stored the + * RHS (silent miscompile, cs!=ww). The gate lets a + * compound fall to the #133 indexed-compound arm below, + * whose elem_tagged guard rejects loud (the byte-id + * twin of wwstage, which already rejected via #133). */ + if ((is_arr || is_sl || is_ptr) && elem_tagged + && n->op == TK_ASSIGN) { int ssz = esz; int scr = cg_tagscr_slot(c, &locals, ssz); ins2(c, A_XORQ, areg(D_AX), areg(D_AX)); @@ -6972,6 +6980,20 @@ cgexpr(Cg *c, Node *n, Local *locals) break; } } + /* #21: a COMPOUND op on a whole tagged-union IDENT (`g OP= v` + * with g:(int|bool)) is nonsense — the ident load-combine- + * store tail below (the N_IDENT compound arm) reads and writes + * one word of the {payload,tag} box, corrupting the tag. Reject + * loud here, the ident twin of the #18 deref / #133 index + * rejects; the byte-id twin of the wwstage guard. Plain `=` + * (the tagged-ident reassign arm just below) is untouched. */ + if (n->lhs && n->lhs->kind == N_IDENT && n->op != TK_ASSIGN + && n->lhs->type) { + Type *itu = type_chase_named(n->lhs->type); + if (itu && itu->kind == TY_TAGGED) + fatal("ident compound on tagged not wired " + "(#21/rule-7)"); + } /* Plain `r = expr;` where r is a tagged-union local. * Delegates to cg_widen_tagged_store: covers nullable fold, * tagged→tagged (with tag remap), struct payload (ident or diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index 98edff6a..b4986eeb 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -31677,6 +31677,25 @@ fn cgassign(c: *cgen, n: *node) void = { }; }; }; + // #21: a COMPOUND op on a whole tagged-union IDENT (`g OP= v` + // with g:(int|bool)) is nonsense — the ident load-combine-store + // tail below reads and writes one word of the {payload,tag} box, + // corrupting the tag. Reject loud here, the ident twin of the #18 + // deref / #133 index rejects; the byte-id twin of the cstage + // guard. Plain `=` (the tagged-ident reassign arm just below) is + // untouched. + if (lhs != nil) { + if (lhs.kind == nkind.N_IDENT && n.op != tkind.TK_ASSIGN) { + let itu: *tinfo = tichase(lhs.type_: *tinfo); + if (itu != nil) { + if (itu.kind == tykind.TY_TAGGED) { + let m21: str = "ident compound on tagged not wired (#21/rule-7)\n"; + os.write(2, m21.ptr, m21.len: u64); + os.exit(1); + }; + }; + }; + }; // Tagged-union local reassignment: `r = expr;` where r has a // tagged-union type. Delegate to cgwidentaggedstore (same path // as cglet's tagged-init). Covers nullable fold, tagged source, diff --git a/selfhost/cmd/wcc/cgenexpr.ww b/selfhost/cmd/wcc/cgenexpr.ww index 26e86265..78dfe76e 100644 --- a/selfhost/cmd/wcc/cgenexpr.ww +++ b/selfhost/cmd/wcc/cgenexpr.ww @@ -8331,6 +8331,25 @@ fn cgassign(c: *cgen, n: *node) void = { }; }; }; + // #21: a COMPOUND op on a whole tagged-union IDENT (`g OP= v` + // with g:(int|bool)) is nonsense — the ident load-combine-store + // tail below reads and writes one word of the {payload,tag} box, + // corrupting the tag. Reject loud here, the ident twin of the #18 + // deref / #133 index rejects; the byte-id twin of the cstage + // guard. Plain `=` (the tagged-ident reassign arm just below) is + // untouched. + if (lhs != nil) { + if (lhs.kind == nkind.N_IDENT && n.op != tkind.TK_ASSIGN) { + let itu: *tinfo = tichase(lhs.type_: *tinfo); + if (itu != nil) { + if (itu.kind == tykind.TY_TAGGED) { + let m21: str = "ident compound on tagged not wired (#21/rule-7)\n"; + os.write(2, m21.ptr, m21.len: u64); + os.exit(1); + }; + }; + }; + }; // Tagged-union local reassignment: `r = expr;` where r has a // tagged-union type. Delegate to cgwidentaggedstore (same path // as cglet's tagged-init). Covers nullable fold, tagged source, diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index a67e0b35..4332a4e7 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -31677,6 +31677,25 @@ fn cgassign(c: *cgen, n: *node) void = { }; }; }; + // #21: a COMPOUND op on a whole tagged-union IDENT (`g OP= v` + // with g:(int|bool)) is nonsense — the ident load-combine-store + // tail below reads and writes one word of the {payload,tag} box, + // corrupting the tag. Reject loud here, the ident twin of the #18 + // deref / #133 index rejects; the byte-id twin of the cstage + // guard. Plain `=` (the tagged-ident reassign arm just below) is + // untouched. + if (lhs != nil) { + if (lhs.kind == nkind.N_IDENT && n.op != tkind.TK_ASSIGN) { + let itu: *tinfo = tichase(lhs.type_: *tinfo); + if (itu != nil) { + if (itu.kind == tykind.TY_TAGGED) { + let m21: str = "ident compound on tagged not wired (#21/rule-7)\n"; + os.write(2, m21.ptr, m21.len: u64); + os.exit(1); + }; + }; + }; + }; // Tagged-union local reassignment: `r = expr;` where r has a // tagged-union type. Delegate to cgwidentaggedstore (same path // as cglet's tagged-init). Covers nullable fold, tagged source, diff --git a/test/wcc/989_taggedcompoundplace_reject.c b/test/wcc/989_taggedcompoundplace_reject.c new file mode 100644 index 00000000..44847b08 --- /dev/null +++ b/test/wcc/989_taggedcompoundplace_reject.c @@ -0,0 +1,327 @@ +/* + * 989_taggedcompoundplace_reject — #20/#21, the last two members of the + * "compound-OP on a whole tagged place" reject class (siblings: #18 deref, + * #34 dot). A compound-assign `place OP= v` where `place` has a tagged-union + * type is semantically nonsense — you cannot `+=` a whole tagged value — so + * it MUST be a loud compile-time reject on BOTH stages. + * + * Two place-kinds remained after #18 closed the deref member: + * + * INDEX (#20): `gs[i] OP= v` (global tagged array) / `a[i] OP= v` (local + * tagged array). cstage SILENTLY MISCOMPILED: its indexed-tagged element + * arm (cmd/w6c/cgen.c) had no `n->op == TK_ASSIGN` gate, so a compound + * dropped the OP and plain-stored `(tagged)v` (cs!=ww). wwstage already + * rejected via its #133 indexed-compound arm. The fix gates the cstage + * plain-store arm on TK_ASSIGN so a compound falls to the same #133 + * indexed-compound reject — the byte-id twin of wwstage. cstage align-UP. + * + * IDENT (#21): `g OP= v` where g is a tagged-union local/global. BOTH + * stages SILENTLY MISCOMPILED, byte-identically — the ident + * load-combine-store tail read+wrote one word of the {payload,tag} box + * and ADDED to the TAG word (gate-blind, #17/#263-class). The fix adds a + * tagged-ident compound guard to BOTH stages (cmd/w6c/cgen.c and + * selfhost/cmd/wcc/cgenexpr.ww) that rejects loud. + * + * The reject diagnostics follow the established per-place-kind family + * (#34 "single-dot field ... (#34/rule-7)", #133 "indexed-lvalue ... + * (#133/rule-7)") rather than one uniform string: INDEX rows reach the + * #133 indexed-compound reject; IDENT rows reach the new #21 ident-compound + * reject. Each row carries its own diagnostic substring, asserted on every + * driver alongside rc!=0. cstage's fatal() prefixes "ww: " that err.ww does + * not — the same per-stage prefix asymmetry every both-stage reject carries; + * the matrix matches on the shared CORE substring only. + * + * Reject-matrix idiom (sibling 989_taggedcompoundderef_reject.c): a REJECT + * row must FAIL to build with its diagnostic on every driver; an ACCEPT + * control must build + run to its expected exit. Rows run on cstage `ww` + * and, when present, wwstage `ww_ww`; both must agree. + */ +#include +#include +#include +#include +#include +#include + +static const char *DIAG_INDEX = "indexed-lvalue compound on tagged element not wired (#133/rule-7)"; +static const char *DIAG_IDENT = "ident compound on tagged not wired (#21/rule-7)"; + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { + const char *label; + const char *src; + int expect_build; /* 1 = build+run to want_exit; 0 = must REJECT */ + int want_exit; + const char *diag; /* reject rows only: required core substring */ +}; + +/* `g` is a (int|bool) local; `g OP= 1` compounds the WHOLE tagged value. */ +#define IDENTCOMPOUND(OP) \ + "package main;\n" \ + "export fn main() int = {\n" \ + "\tlet g: (int | bool) = 7;\n" \ + "\tg " OP " 1;\n" \ + "\treturn 0;\n" \ + "};\n" + +/* a:[3](int|bool) local; `a[0] OP= 1` compounds the WHOLE tagged element. */ +#define LIDXCOMPOUND(OP) \ + "package main;\n" \ + "export fn main() int = {\n" \ + "\tlet a: [3](int | bool) = [1, 2, 3];\n" \ + "\ta[0] " OP " 1;\n" \ + "\treturn 0;\n" \ + "};\n" + +/* gs:[3](int|bool) global; `gs[0] OP= 1` compounds the WHOLE tagged element. */ +#define GIDXCOMPOUND(OP) \ + "package main;\n" \ + "let gs: [3](int | bool) = [1, 2, 3];\n" \ + "export fn main() int = {\n" \ + "\tgs[0] " OP " 1;\n" \ + "\treturn 0;\n" \ + "};\n" + +static const struct row rows[] = { + /* IDENT (#21) — every compound OP on a tagged local rejects on both + * stages (was a byte-identical tag-word corruption). */ + { "ident_pluseq", IDENTCOMPOUND("+="), 0, 0, NULL }, + { "ident_minuseq", IDENTCOMPOUND("-="), 0, 0, NULL }, + { "ident_stareq", IDENTCOMPOUND("*="), 0, 0, NULL }, + { "ident_pipeeq", IDENTCOMPOUND("|="), 0, 0, NULL }, + { "ident_careteq", IDENTCOMPOUND("^="), 0, 0, NULL }, + { "ident_lshifteq", IDENTCOMPOUND("<<="), 0, 0, NULL }, + { "ident_slasheq", IDENTCOMPOUND("/="), 0, 0, NULL }, + + /* IDENT (#21) — a tagged GLOBAL compound rejects too. */ + { "gident_pluseq", "package main;\n" + "let g: (int | bool) = 7;\n" + "export fn main() int = {\n" + "\tg += 1;\n" + "\treturn 0;\n" + "};\n", 0, 0, NULL }, + + /* INDEX (#20) — local tagged-array element compound rejects on both + * stages (cstage was silently dropping the OP, plain-storing the RHS). */ + { "lidx_pluseq", LIDXCOMPOUND("+="), 0, 0, NULL }, + { "lidx_minuseq", LIDXCOMPOUND("-="), 0, 0, NULL }, + { "lidx_pipeeq", LIDXCOMPOUND("|="), 0, 0, NULL }, + { "lidx_lshifteq", LIDXCOMPOUND("<<="), 0, 0, NULL }, + + /* INDEX (#20) — global tagged-array element compound rejects too. */ + { "gidx_pluseq", GIDXCOMPOUND("+="), 0, 0, NULL }, + { "gidx_stareq", GIDXCOMPOUND("*="), 0, 0, NULL }, + { "gidx_careteq", GIDXCOMPOUND("^="), 0, 0, NULL }, + + /* CONTROL — scalar IDENT compound (`g += 1` on g:int) still compiles + + * runs (the guard keys on a tagged type only). 7 += 1 -> 8. */ + { "scalar_ident_ok", + "package main;\n" + "export fn main() int = {\n" + "\tlet g: int = 7;\n" + "\tg += 1;\n" + "\treturn g;\n" + "};\n", + 1, 8, NULL }, + + /* CONTROL — scalar INDEX compound (`a[0] += 1` on a:[3]int) still + * compiles + runs (the #133 arm wires the scalar element). 7 += 1 -> 8. */ + { "scalar_index_ok", + "package main;\n" + "export fn main() int = {\n" + "\tlet a: [3]int = [7, 0, 0];\n" + "\ta[0] += 1;\n" + "\treturn a[0];\n" + "};\n", + 1, 8, NULL }, + + /* CONTROL — the #41/#32 PLAIN tagged-ident reassign still compiles + + * runs (only the COMPOUND form is nonsense; `g = v` widens). `g is int` + * -> 0. */ + { "plain_tagged_ident_ok", + "package main;\n" + "export fn main() int = {\n" + "\tlet g: (int | bool) = 7;\n" + "\tg = 9;\n" + "\tif (g is int) { return 0; };\n" + "\treturn 1;\n" + "};\n", + 1, 0, NULL }, + + /* CONTROL — the #16 PLAIN tagged-index store (local) still compiles + + * runs (`a[0] = v` widens the element). `a[0] is int` -> 0. */ + { "plain_tagged_lidx_ok", + "package main;\n" + "export fn main() int = {\n" + "\tlet a: [3](int | bool) = [1, 2, 3];\n" + "\ta[0] = 9;\n" + "\tif (a[0] is int) { return 0; };\n" + "\treturn 1;\n" + "};\n", + 1, 0, NULL }, + + /* CONTROL — the #16 PLAIN tagged-index store (global) still compiles + + * runs (`gs[0] = v` widens; the store precedes the read so the #19 + * static-init gap is not exercised). `gs[0] is int` -> 0. */ + { "plain_tagged_gidx_ok", + "package main;\n" + "let gs: [3](int | bool) = [1, 2, 3];\n" + "export fn main() int = {\n" + "\tgs[0] = 9;\n" + "\tif (gs[0] is int) { return 0; };\n" + "\treturn 1;\n" + "};\n", + 1, 0, NULL }, +}; + +static int +run_build(const char *driver, const struct row *r, int i) +{ + char src[64], tmpdir[64], cmd[1024]; + snprintf(src, sizeof src, "/tmp/tcp_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/tcp_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -2; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null", + tmpdir, driver, src); + int brc = runwait(cmd); + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[128]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + + int got = -1; + if (brc == 0) got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return brc == 0 ? got : -1; +} + +/* A reject row must (a) fail to build and (b) emit its diagnostic core text. + * Returns 0 on the expected reject, -1 otherwise. */ +static int +build_should_reject(const char *driver, const char *src, const char *diag, int i) +{ + char s[64], tmpdir[64], errf[80], cmd[1280]; + snprintf(s, sizeof s, "/tmp/tcq_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/tcq_%d_d_%d", getpid(), i); + snprintf(errf, sizeof errf, "/tmp/tcq_%d_%d.err", getpid(), i); + + FILE *f = fopen(s, "wb"); + if (!f) return -1; + fputs(src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>%s", + tmpdir, driver, s, errf); + int rc = runwait(cmd); + + int have_diag = 0; + FILE *e = fopen(errf, "rb"); + if (e) { + char buf[4096]; + size_t n = fread(buf, 1, sizeof buf - 1, e); + buf[n] = '\0'; + fclose(e); + have_diag = (strstr(buf, diag) != NULL); + } + + unlink(s); unlink(errf); + const char *base = strrchr(s, '/'); + base = base ? base + 1 : s; + char outbin[128]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + unlink(outbin); + rmdir(tmpdir); + + /* build must NOT succeed AND the diagnostic must appear. */ + return (rc != 0 && have_diag) ? 0 : -1; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[1024]; + if (bin[0] != '/') { + char cwd[1024]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[1024], wdrv[1024]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *drv; int gated; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated && access(drivers[d].drv, X_OK) != 0) { + fprintf(stderr, "taggedcompoundplace_reject: skip %s (no %s)\n", + drivers[d].name, drivers[d].drv); + continue; + } + for (int i = 0; i < n; i++) { + total++; + if (rows[i].expect_build) { + int got = run_build(drivers[d].drv, &rows[i], i); + if (got != rows[i].want_exit) { + fprintf(stderr, "taggedcompoundplace_reject[%s][%s]: " + "exit=%d want=%d\n", drivers[d].name, + rows[i].label, got, rows[i].want_exit); + fail++; + } + } else { + const char *diag = rows[i].diag; + if (!diag) + diag = (strncmp(rows[i].label, "ident", 5) == 0 + || strncmp(rows[i].label, "gident", 6) == 0) + ? DIAG_IDENT : DIAG_INDEX; + if (build_should_reject(drivers[d].drv, rows[i].src, + diag, 100 + i) != 0) { + fprintf(stderr, "taggedcompoundplace_reject[%s][%s]: " + "expected a loud reject with \"%s\"\n", + drivers[d].name, rows[i].label, diag); + fail++; + } + } + } + } + + if (fail) { + fprintf(stderr, "taggedcompoundplace_reject: %d/%d fixtures failed\n", + fail, total); + return 1; + } + printf("taggedcompoundplace_reject: %d/%d ok\n", total, total); + return 0; +}