Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wcc/cgen: #58 indexed tagged-field read+assign cursor arm (both-stage)

Browse Source 
Reading or writing a tagged field of an indexed array element
(xs[i].field) was broken on BOTH stages, byte-identically and
silently (#263 gate-blind): the arr[i].field branches had arms for
array/str/slice/float but no TY_TAGGED arm, so the tagged field fell
to the single-word scalar path. READ loaded only the tag word (stale
payload -> `xs[i].min as T` read garbage); ASSIGN stored the raw
unboxed scalar into the tag slot, corrupting the box.

Insert a TY_TAGGED cursor arm before each scalar fallback, both
sites both stages (cgen.c read + assign; cgenexpr.ww cgdot N_INDEX-lhs
read + cgassign indexed-field). READ mirrors cg_tagged_memread
(payload -> DX/CX/R8, tag -> AX last). ASSIGN synthesizes the tag for
the concrete variant (taggedvariantindext) and stores tag+payload via
the str/slice 3-word store spine -- not the source-remap widener
(concrete rhs has no source tag to remap).

>32B / multi-word / float payloads are loud-stopped at all four arms
(emission not yet wired; see #114). That shape is reachable today via
a narrow-variant ctor, so it louds rather than silently miscompiling.
Both stages get the same arm -> byte-id preserved (990-997 green; the
runtime is the net for this #263 class). Pin 944_idx_tagged_field_run
(read/assign runtime rows + >32B expect-loud rows).
This commit is contained in:
Hojun-Cho
2026-06-06 16:21:45 +09:00
parent cc896bd078
commit 351abb0ab3
6 changed files with 905 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Makefile
View File

@@ -310,6 +310,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
$(BIN)/test_alias_amp_idx_run \
$(BIN)/test_alias_def_addr_run \
$(BIN)/test_def_amp_idx_run \
$(BIN)/test_idx_tagged_field_run \
$(BIN)/test_tagged_widen_arg_run \
$(BIN)/test_alias_global_decl_run \
$(BIN)/test_alias_cgen_b5_run \
@@ -1519,6 +1520,12 @@ $(BIN)/test_def_amp_idx_run: test/wcc/944_def_amp_idx_run.c \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
$(BIN)/test_idx_tagged_field_run: test/wcc/944_idx_tagged_field_run.c \
$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
$(BIN)/test_tagged_widen_arg_run: test/wcc/944_tagged_widen_arg_run.c \
$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \

134
cmd/w6c/cgen.c
View File

@@ -5234,6 +5234,95 @@ cgexpr(Cg *c, Node *n, Local *locals)
amem(D_DX, foff + 16));
break;
}
/* #58: a TAGGED field of an indexed array
* element (`xs[i].f = v`). The scalar store
* below would write the raw unboxed rhs into
* the TAG slot — never boxing, never writing
* the payload (box-corruption, the #38a
* write-twin). BOX (mirror the #24 tagged-
* field-assign tag lookup, cg_tag_for_variant)
* + STORE spine (mirror the co-located str/
* slice 3-word arm above): cgexpr the payload,
* spill it across the index/address
* computation, compute &xs[i]->BX, then store
* the variant tag (constant) at foff+0 and the
* scalar payload at foff+8. Only a SCALAR-
* payload variant (box <=16B) store is wired
* here. A >16B / multi-word / float-payload
* union field IS constructible (a wide box,
* built via a NARROW variant — not unbuildable
* as earlier triage assumed; the #54/#23
* construction hole fires only on STRUCT-
* LITERAL payloads), but its box+memcpy store
* arm is not yet wired, so it LOUD-STOPS rather
* than silently corrupting the box (rule 7, the
* #41 untested-arm trap), byte-id-neutral.
* Reachable + pinned expect-loud (test/wcc/944
* cfail rows). When #114 wires them, that commit
* replaces these stops with the real str/slice/
* struct/float/>32B box+memcpy emission + value
* pin rows. */
if (n->op == TK_ASSIGN && fu
&& fu->kind == TY_TAGGED) {
int bsz = (int)fu->size;
Type *st = n->rhs
? n->rhs->type : NULL;
int h2_isf32 = 0;
if (bsz > TUPLE_GPCAP * 8)
fatal("#58: >32B tagged-"
"field indexed store "
"unreachable until #114");
if (bsz > 16)
fatal("#58: multi-word "
"tagged-field indexed "
"store unreachable "
"until #114");
if (fld_isfloat(st,
&h2_isf32))
fatal("#58: float-payload "
"tagged-field indexed "
"store unreachable "
"until #114");
cgexpr(c, n->rhs, locals);
ins1(c, A_PUSHQ,
areg(D_AX));
cgexpr(c, idx, locals);
if (esz > 1) {
ins2(c, A_MOVQ,
aimm(esz),
areg(D_CX));
ins2(c, A_IMULQ,
areg(D_CX),
areg(D_AX));
}
if (is_arr)
ins2(c, A_LEAQ,
amem(D_BP, off),
areg(D_BX));
else
ins2(c, A_MOVQ,
amem(D_BP, off),
areg(D_BX));
ins2(c, A_ADDQ,
areg(D_AX),
areg(D_BX));
if (viaptr)
ins2(c, A_MOVQ,
amem(D_BX, 0),
areg(D_BX));
ins1(c, A_POPQ,
areg(D_AX));
int v58tag =
cg_tag_for_variant(fu, st);
ins2(c, A_MOVQ,
aimm(v58tag < 0
? 0 : v58tag),
amem(D_BX, foff + 0));
ins2(c, A_MOVQ,
areg(D_AX),
amem(D_BX, foff + 8));
break;
}
if (n->op == TK_ASSIGN) {
cgexpr(c, n->rhs, locals);
ins1(c, A_PUSHQ,
@@ -11216,6 +11305,51 @@ cgexpr(Cg *c, Node *n, Local *locals)
areg(D_AX));
goto dot_done;
}
/* #58: a TAGGED field of an indexed array
* element (`xs[i].f`). AX holds &xs[i]; load
* the box cursor (AX=tag, DX/CX/R8=payload)
* mirroring cg_tagged_memread's ≤32B
* convention, tag LAST (it clobbers the base
* AX). Without this arm the field fell to the
* scalar load below, reading only the tag word
* and leaving the payload cursor (DX) stale
* (`xs[i].f as T` read garbage; #38a INDEX-
* spine residual). >32B box: a wide-box union
* (largest variant >32B) IS constructible via a
* NARROW variant (not unbuildable as earlier
* triage assumed; #54/#23 fires only on STRUCT-
* LITERAL payloads), but the mem-based read (LEAQ
* foff(AX),AX, cg_tagged_memread:639) is not yet
* wired here — so this arm LOUD-STOPS rather than
* silently reading a truncated box (rule 7, the
* #41 untested-arm trap), byte-id-neutral.
* Reachable + pinned expect-loud (test/wcc/944
* cfail rows). When #114 wires it, that commit
* replaces this with the LEAQ box-address
* emission + a >32B value pin row. */
if (fu && fu->kind == TY_TAGGED) {
int bsz = (int)fu->size;
if (bsz > TUPLE_GPCAP * 8)
fatal("#58: >32B tagged-field "
"indexed read unreachable "
"until #114");
if (bsz > 24)
ins2(c, A_MOVQ,
amem(D_AX, foff + 24),
areg(D_R8));
if (bsz > 16)
ins2(c, A_MOVQ,
amem(D_AX, foff + 16),
areg(D_CX));
if (bsz > 8)
ins2(c, A_MOVQ,
amem(D_AX, foff + 8),
areg(D_DX));
ins2(c, A_MOVQ,
amem(D_AX, foff + 0),
areg(D_AX));
goto dot_done;
}
int g_isf32 = 0;
if (fld_isfloat(ft, &g_isf32)) {
int mov = g_isf32

132
selfhost/cmd/w6c/main.combined.ww
View File

@@ -24894,6 +24894,55 @@ fn cgdot(c: *cgen, n: *node) void = {
emitline(", X0\n");
return;
};
// #58: a TAGGED field of an indexed array
// element (`xs[i].f`). AX holds &xs[i]; load
// the box cursor (AX=tag, DX/CX/R8=payload)
// mirroring taggedmemread's <=32B convention,
// tag LAST (it clobbers the base AX). Without
// this arm the field fell to the scalar load
// below, reading only the tag word and leaving
// the payload cursor (DX) stale (`xs[i].f as
// T` read garbage; #38a INDEX-spine residual).
// >32B box: a wide-box union (largest variant
// >32B) IS constructible via a NARROW variant
// (not unbuildable as earlier triage assumed;
// #54/#23 fires only on STRUCT-LITERAL
// payloads), but the mem-based read (LEAQ
// foff(AX),AX) is not yet wired here — so this
// arm LOUD-STOPS rather than silently reading a
// truncated box (rule 7, the #41 untested-arm
// trap), byte-id-neutral. Reachable + pinned
// expect-loud (test/wcc/944 cfail rows). When
// #114 wires it, that commit replaces this with
// the LEAQ box-address emission + a >32B value
// pin row. Mirrors cstage cgen.c.
if (fu != nil && fu.kind == tykind.TY_TAGGED) {
let bsz: i32 = fu.size: i32;
if (bsz > TUPLE_GPCAP * 8) {
let m58r: str = "#58: >32B tagged-field indexed read unreachable until #114\n";
os.write(2, m58r.ptr, m58r.len: u64);
os.exit(1);
};
if (bsz > 24) {
emitline("\tMOVQ\t");
emitdispreg(foff + 24, "AX");
emitline(", R8\n");
};
if (bsz > 16) {
emitline("\tMOVQ\t");
emitdispreg(foff + 16, "AX");
emitline(", CX\n");
};
if (bsz > 8) {
emitline("\tMOVQ\t");
emitdispreg(foff + 8, "AX");
emitline(", DX\n");
};
emitline("\tMOVQ\t");
emitdispreg(foff, "AX");
emitline(", AX\n");
return;
};
let fsz: i32 = 8;
if (ft != nil) { fsz = ft.size: i32; };
let lop: str = loadopsz(typeissigned(ft), fsz);
@@ -29950,6 +29999,89 @@ fn cgassign(c: *cgen, n: *node) void = {
emitline("\n");
return;
};
// #58: a TAGGED field of an indexed
// array element (`xs[i].f = v`). The
// scalar store below would write the
// raw unboxed rhs into the TAG slot —
// never boxing, never writing the
// payload (box-corruption, the #38a
// write-twin). BOX (mirror the #24
// tagged-field-assign tag lookup,
// taggedvariantindext) + STORE spine
// (mirror the co-located str/slice
// 3-word arm above): cgexpr the
// payload, spill across the index/
// address computation, compute
// &xs[i]->BX, store the variant tag
// (constant) at foff+0 and the scalar
// payload at foff+8. Only a SCALAR-
// payload variant (box <=16B) store
// is wired here. A >16B / multi-word /
// float-payload union field IS
// constructible (a wide box, built via
// a NARROW variant — not unbuildable as
// earlier triage assumed; #54/#23 fires
// only on STRUCT-LITERAL payloads), but
// its box+memcpy store arm is not yet
// wired, so it LOUD-STOPS rather than
// silently corrupting the box (rule 7,
// the #41 untested-arm trap), byte-id-
// neutral. Reachable + pinned expect-
// loud (test/wcc/944 cfail rows). When
// #114 wires them, that commit replaces
// these stops with the real box+memcpy
// emission + value pin rows. Mirrors
// cstage cgen.c.
if (istaggedtype(c, fi.tnode)) {
let bsz: i32 = slotsize(c, fi.tnode);
if (bsz > TUPLE_GPCAP * 8) {
let m58s: str = "#58: >32B tagged-field indexed store unreachable until #114\n";
os.write(2, m58s.ptr, m58s.len: u64);
os.exit(1);
};
if (bsz > 16) {
let m58m: str = "#58: multi-word tagged-field indexed store unreachable until #114\n";
os.write(2, m58m.ptr, m58m.len: u64);
os.exit(1);
};
if (typeisfloat(n.rhs.type_: *tinfo)) {
let m58f: str = "#58: float-payload tagged-field indexed store unreachable until #114\n";
os.write(2, m58f.ptr, m58f.len: u64);
os.exit(1);
};
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tAX\n");
cgexpr(c, idx);
if (esz > 1) {
emitline("\tMOVQ\t$");
emitint(esz: i64);
emitline(", CX\n");
emitline("\tIMULQ\tCX, AX\n");
};
if (baseisarray) {
emitline("\tLEAQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
} else {
emitline("\tMOVQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
};
emitline("\tADDQ\tAX, BX\n");
if (viaptr) { emitline("\tMOVQ\t(BX), BX\n"); };
emitline("\tPOPQ\tAX\n");
let v58tag: i32 = taggedvariantindext(c, fi.tnode.type_: *tinfo, n.rhs);
if (v58tag < 0) { v58tag = 0; };
emitline("\tMOVQ\t$");
emitint(v58tag: i64);
emitline(", ");
emitdispreg(fi.foff: i64, "BX");
emitline("\n");
emitline("\tMOVQ\tAX, ");
emitdispreg((fi.foff + 8): i64, "BX");
emitline("\n");
return;
};
// scalar plain `=`
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tAX\n");

132
selfhost/cmd/wcc/cgenexpr.ww
View File

@@ -3655,6 +3655,55 @@ fn cgdot(c: *cgen, n: *node) void = {
emitline(", X0\n");
return;
};
// #58: a TAGGED field of an indexed array
// element (`xs[i].f`). AX holds &xs[i]; load
// the box cursor (AX=tag, DX/CX/R8=payload)
// mirroring taggedmemread's <=32B convention,
// tag LAST (it clobbers the base AX). Without
// this arm the field fell to the scalar load
// below, reading only the tag word and leaving
// the payload cursor (DX) stale (`xs[i].f as
// T` read garbage; #38a INDEX-spine residual).
// >32B box: a wide-box union (largest variant
// >32B) IS constructible via a NARROW variant
// (not unbuildable as earlier triage assumed;
// #54/#23 fires only on STRUCT-LITERAL
// payloads), but the mem-based read (LEAQ
// foff(AX),AX) is not yet wired here — so this
// arm LOUD-STOPS rather than silently reading a
// truncated box (rule 7, the #41 untested-arm
// trap), byte-id-neutral. Reachable + pinned
// expect-loud (test/wcc/944 cfail rows). When
// #114 wires it, that commit replaces this with
// the LEAQ box-address emission + a >32B value
// pin row. Mirrors cstage cgen.c.
if (fu != nil && fu.kind == tykind.TY_TAGGED) {
let bsz: i32 = fu.size: i32;
if (bsz > TUPLE_GPCAP * 8) {
let m58r: str = "#58: >32B tagged-field indexed read unreachable until #114\n";
os.write(2, m58r.ptr, m58r.len: u64);
os.exit(1);
};
if (bsz > 24) {
emitline("\tMOVQ\t");
emitdispreg(foff + 24, "AX");
emitline(", R8\n");
};
if (bsz > 16) {
emitline("\tMOVQ\t");
emitdispreg(foff + 16, "AX");
emitline(", CX\n");
};
if (bsz > 8) {
emitline("\tMOVQ\t");
emitdispreg(foff + 8, "AX");
emitline(", DX\n");
};
emitline("\tMOVQ\t");
emitdispreg(foff, "AX");
emitline(", AX\n");
return;
};
let fsz: i32 = 8;
if (ft != nil) { fsz = ft.size: i32; };
let lop: str = loadopsz(typeissigned(ft), fsz);
@@ -8711,6 +8760,89 @@ fn cgassign(c: *cgen, n: *node) void = {
emitline("\n");
return;
};
// #58: a TAGGED field of an indexed
// array element (`xs[i].f = v`). The
// scalar store below would write the
// raw unboxed rhs into the TAG slot —
// never boxing, never writing the
// payload (box-corruption, the #38a
// write-twin). BOX (mirror the #24
// tagged-field-assign tag lookup,
// taggedvariantindext) + STORE spine
// (mirror the co-located str/slice
// 3-word arm above): cgexpr the
// payload, spill across the index/
// address computation, compute
// &xs[i]->BX, store the variant tag
// (constant) at foff+0 and the scalar
// payload at foff+8. Only a SCALAR-
// payload variant (box <=16B) store
// is wired here. A >16B / multi-word /
// float-payload union field IS
// constructible (a wide box, built via
// a NARROW variant — not unbuildable as
// earlier triage assumed; #54/#23 fires
// only on STRUCT-LITERAL payloads), but
// its box+memcpy store arm is not yet
// wired, so it LOUD-STOPS rather than
// silently corrupting the box (rule 7,
// the #41 untested-arm trap), byte-id-
// neutral. Reachable + pinned expect-
// loud (test/wcc/944 cfail rows). When
// #114 wires them, that commit replaces
// these stops with the real box+memcpy
// emission + value pin rows. Mirrors
// cstage cgen.c.
if (istaggedtype(c, fi.tnode)) {
let bsz: i32 = slotsize(c, fi.tnode);
if (bsz > TUPLE_GPCAP * 8) {
let m58s: str = "#58: >32B tagged-field indexed store unreachable until #114\n";
os.write(2, m58s.ptr, m58s.len: u64);
os.exit(1);
};
if (bsz > 16) {
let m58m: str = "#58: multi-word tagged-field indexed store unreachable until #114\n";
os.write(2, m58m.ptr, m58m.len: u64);
os.exit(1);
};
if (typeisfloat(n.rhs.type_: *tinfo)) {
let m58f: str = "#58: float-payload tagged-field indexed store unreachable until #114\n";
os.write(2, m58f.ptr, m58f.len: u64);
os.exit(1);
};
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tAX\n");
cgexpr(c, idx);
if (esz > 1) {
emitline("\tMOVQ\t$");
emitint(esz: i64);
emitline(", CX\n");
emitline("\tIMULQ\tCX, AX\n");
};
if (baseisarray) {
emitline("\tLEAQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
} else {
emitline("\tMOVQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
};
emitline("\tADDQ\tAX, BX\n");
if (viaptr) { emitline("\tMOVQ\t(BX), BX\n"); };
emitline("\tPOPQ\tAX\n");
let v58tag: i32 = taggedvariantindext(c, fi.tnode.type_: *tinfo, n.rhs);
if (v58tag < 0) { v58tag = 0; };
emitline("\tMOVQ\t$");
emitint(v58tag: i64);
emitline(", ");
emitdispreg(fi.foff: i64, "BX");
emitline("\n");
emitline("\tMOVQ\tAX, ");
emitdispreg((fi.foff + 8): i64, "BX");
emitline("\n");
return;
};
// scalar plain `=`
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tAX\n");

132
selfhost/cmd/wwdump/main.combined.ww
View File

@@ -24894,6 +24894,55 @@ fn cgdot(c: *cgen, n: *node) void = {
emitline(", X0\n");
return;
};
// #58: a TAGGED field of an indexed array
// element (`xs[i].f`). AX holds &xs[i]; load
// the box cursor (AX=tag, DX/CX/R8=payload)
// mirroring taggedmemread's <=32B convention,
// tag LAST (it clobbers the base AX). Without
// this arm the field fell to the scalar load
// below, reading only the tag word and leaving
// the payload cursor (DX) stale (`xs[i].f as
// T` read garbage; #38a INDEX-spine residual).
// >32B box: a wide-box union (largest variant
// >32B) IS constructible via a NARROW variant
// (not unbuildable as earlier triage assumed;
// #54/#23 fires only on STRUCT-LITERAL
// payloads), but the mem-based read (LEAQ
// foff(AX),AX) is not yet wired here — so this
// arm LOUD-STOPS rather than silently reading a
// truncated box (rule 7, the #41 untested-arm
// trap), byte-id-neutral. Reachable + pinned
// expect-loud (test/wcc/944 cfail rows). When
// #114 wires it, that commit replaces this with
// the LEAQ box-address emission + a >32B value
// pin row. Mirrors cstage cgen.c.
if (fu != nil && fu.kind == tykind.TY_TAGGED) {
let bsz: i32 = fu.size: i32;
if (bsz > TUPLE_GPCAP * 8) {
let m58r: str = "#58: >32B tagged-field indexed read unreachable until #114\n";
os.write(2, m58r.ptr, m58r.len: u64);
os.exit(1);
};
if (bsz > 24) {
emitline("\tMOVQ\t");
emitdispreg(foff + 24, "AX");
emitline(", R8\n");
};
if (bsz > 16) {
emitline("\tMOVQ\t");
emitdispreg(foff + 16, "AX");
emitline(", CX\n");
};
if (bsz > 8) {
emitline("\tMOVQ\t");
emitdispreg(foff + 8, "AX");
emitline(", DX\n");
};
emitline("\tMOVQ\t");
emitdispreg(foff, "AX");
emitline(", AX\n");
return;
};
let fsz: i32 = 8;
if (ft != nil) { fsz = ft.size: i32; };
let lop: str = loadopsz(typeissigned(ft), fsz);
@@ -29950,6 +29999,89 @@ fn cgassign(c: *cgen, n: *node) void = {
emitline("\n");
return;
};
// #58: a TAGGED field of an indexed
// array element (`xs[i].f = v`). The
// scalar store below would write the
// raw unboxed rhs into the TAG slot —
// never boxing, never writing the
// payload (box-corruption, the #38a
// write-twin). BOX (mirror the #24
// tagged-field-assign tag lookup,
// taggedvariantindext) + STORE spine
// (mirror the co-located str/slice
// 3-word arm above): cgexpr the
// payload, spill across the index/
// address computation, compute
// &xs[i]->BX, store the variant tag
// (constant) at foff+0 and the scalar
// payload at foff+8. Only a SCALAR-
// payload variant (box <=16B) store
// is wired here. A >16B / multi-word /
// float-payload union field IS
// constructible (a wide box, built via
// a NARROW variant — not unbuildable as
// earlier triage assumed; #54/#23 fires
// only on STRUCT-LITERAL payloads), but
// its box+memcpy store arm is not yet
// wired, so it LOUD-STOPS rather than
// silently corrupting the box (rule 7,
// the #41 untested-arm trap), byte-id-
// neutral. Reachable + pinned expect-
// loud (test/wcc/944 cfail rows). When
// #114 wires them, that commit replaces
// these stops with the real box+memcpy
// emission + value pin rows. Mirrors
// cstage cgen.c.
if (istaggedtype(c, fi.tnode)) {
let bsz: i32 = slotsize(c, fi.tnode);
if (bsz > TUPLE_GPCAP * 8) {
let m58s: str = "#58: >32B tagged-field indexed store unreachable until #114\n";
os.write(2, m58s.ptr, m58s.len: u64);
os.exit(1);
};
if (bsz > 16) {
let m58m: str = "#58: multi-word tagged-field indexed store unreachable until #114\n";
os.write(2, m58m.ptr, m58m.len: u64);
os.exit(1);
};
if (typeisfloat(n.rhs.type_: *tinfo)) {
let m58f: str = "#58: float-payload tagged-field indexed store unreachable until #114\n";
os.write(2, m58f.ptr, m58f.len: u64);
os.exit(1);
};
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tAX\n");
cgexpr(c, idx);
if (esz > 1) {
emitline("\tMOVQ\t$");
emitint(esz: i64);
emitline(", CX\n");
emitline("\tIMULQ\tCX, AX\n");
};
if (baseisarray) {
emitline("\tLEAQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
} else {
emitline("\tMOVQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
};
emitline("\tADDQ\tAX, BX\n");
if (viaptr) { emitline("\tMOVQ\t(BX), BX\n"); };
emitline("\tPOPQ\tAX\n");
let v58tag: i32 = taggedvariantindext(c, fi.tnode.type_: *tinfo, n.rhs);
if (v58tag < 0) { v58tag = 0; };
emitline("\tMOVQ\t$");
emitint(v58tag: i64);
emitline(", ");
emitdispreg(fi.foff: i64, "BX");
emitline("\n");
emitline("\tMOVQ\tAX, ");
emitdispreg((fi.foff + 8): i64, "BX");
emitline("\n");
return;
};
// scalar plain `=`
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tAX\n");

368
test/wcc/944_idx_tagged_field_run.c Normal file
View File

@@ -0,0 +1,368 @@
/*
* 944_idx_tagged_field_run — #58 INDEXED-element TAGGED-field read+assign.
*
* `xs[i].f` where f is a TAGGED union field of a struct array element was
* broken on BOTH stages, byte-IDENTICAL and SILENT (#263 gate-blind; the
* byte-id gate cannot see it, runtime is the only net). The `arr[i].field`
* spine had arms for array / str/slice / float but NO TY_TAGGED arm, so a
* tagged field fell to the single-word scalar fallback:
* READ: loaded only the tag word; the payload cursor (DX/CX/R8) was
* never loaded -> `xs[i].f as T` read stale DX (#38a residual).
* ASSIGN: DOUBLY broken -- stored the raw unboxed scalar into the TAG
* slot, corrupting the box (never boxed, never wrote payload).
* The fix inserts a TY_TAGGED arm before each scalar fallback, both
* stages (align-BOTH, one commit). READ: AX=&xs[i] -> cursor (AX=tag,
* DX/CX/R8=payload), tag LAST. ASSIGN: box the concrete scalar variant
* (tag-index + payload), store over the indexed dest spine.
*
* row | shape | want
* -------------+------------------------------------------------+-----
* const_read | xs[0].m as size ((void|size), tag1) | 0
* var_read | xs[i].m as size variable index | 0
* tag2_read | xs[k].m as size ((void|bool|size), TAG2) | 0
* assign_back | xs[0].m = 8:size; readback via *row ptr | 0
*
* Pre-fix (base cc896bd): const_read/var_read/tag2_read read stale DX
* (payload dropped); assign_back corrupts the box (scalar-into-tag) so
* the ptr-readback control sees the un-overwritten constructed payload
* (99, not 8) -- all four FAIL both stages, cs==ww byte-id (the teeth).
* MULTIPLE tag positions (tag1-of-2 + tag2-of-3) are mandatory: an
* aligned-tag-only pin false-greens the assign scalar-into-tag-slot
* corruption. Post-fix: all four 0/0, cs/ww still byte-identical.
*
* The >32B / multi-word / float-payload arms LOUD-STOP (their real emission
* is not yet wired — #114). These shapes are NOT unconstructible: a wide-box
* union is built via a NARROW variant, so each tripwire is REACHABLE and is
* pinned expect-loud by the cfrows[] rows below. #114 wires the real emission
* and graduates those rows to runtime-value pins.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
static int
slurp_eq(const char *a, const char *b)
{
FILE *fa = fopen(a, "rb");
FILE *fb = fopen(b, "rb");
if (!fa || !fb) { if (fa) fclose(fa); if (fb) fclose(fb); return -1; }
int rc = 0;
for (;;) {
int ca = fgetc(fa), cb = fgetc(fb);
if (ca != cb) { rc = -1; break; }
if (ca == EOF) break;
}
fclose(fa); fclose(fb);
return rc;
}
struct row { const char *label; const char *src; int want; };
static const struct row rows[] = {
{ "const_read",
"package main;\n"
"type opt = (void | size);\n"
"type row = struct { id: int, m: opt };\n"
"export fn main() i32 = {\n"
" let xs: [2]row = [\n"
" row { id = 1, m = 7: size },\n"
" row { id = 2, m = 8: size },\n"
" ];\n"
" let v: size = xs[0].m as size;\n"
" if (v != 7) { return 1; };\n"
" return 0;\n"
"};\n", 0 },
{ "var_read",
"package main;\n"
"type opt = (void | size);\n"
"type row = struct { id: int, m: opt };\n"
"export fn main() i32 = {\n"
" let xs: [2]row = [\n"
" row { id = 1, m = 7: size },\n"
" row { id = 2, m = 8: size },\n"
" ];\n"
" let i: size = 1;\n"
" let v: size = xs[i].m as size;\n"
" if (v != 8) { return 1; };\n"
" return 0;\n"
"};\n", 0 },
{ "tag2_read",
"package main;\n"
"type opt3 = (void | bool | size);\n"
"type row = struct { id: int, m: opt3 };\n"
"export fn main() i32 = {\n"
" let xs: [2]row = [\n"
" row { id = 1, m = 5: size },\n"
" row { id = 2, m = 9: size },\n"
" ];\n"
" let i: size = 1;\n"
" let v: size = xs[i].m as size;\n"
" if (v != 9) { return 1; };\n"
" return 0;\n"
"};\n", 0 },
{ "assign_back",
"package main;\n"
"type opt = (void | size);\n"
"type row = struct { id: int, m: opt };\n"
"export fn main() i32 = {\n"
" let xs: [2]row = [\n"
" row { id = 1, m = 99: size },\n"
" row { id = 2, m = 2: size },\n"
" ];\n"
" xs[0].m = 8: size;\n"
" let p: *row = &xs[0];\n"
" let v: size = p.m as size;\n"
" if (v != 8) { return 1; };\n"
" return 0;\n"
"};\n", 0 },
};
/*
* #58 LOUD-STOP TRIPWIRES — expect-compile-fail rows.
*
* The >32B / multi-word / float-payload arms of the indexed tagged-field
* read+store are NOT silently miscompiled: they LOUD-STOP (rule 7). Earlier
* triage believed these shapes were "unconstructible at HEAD" — they are NOT.
* A wide-box union (largest variant >32B) is constructible via a NARROW/scalar
* variant: `(void | size | [5]size)` initialised `m = 7: size` builds and runs
* fine; only reading/assigning that field via the indexed spine reaches the
* tripwire. So each tripwire is REACHABLE and must be pinned as expect-loud:
* a build that SUCCEEDS here would mean the loud-stop regressed into a silent
* miscompile. Each row must (a) fail the build and (b) emit a "#58" tripwire on
* stderr, attributing the CFAIL to this fold (not the #54/#23 construction
* hole, which only fires on STRUCT-LITERAL payloads). When #114 wires real
* >32B box+memcpy emission, it replaces the tripwires AND graduates these rows
* to runtime-value pins.
*/
struct cfrow { const char *label; const char *src; };
static const struct cfrow cfrows[] = {
{ "big_read", /* >32B box read tripwire */
"package main;\n"
"type big = (void | size | [5]size);\n"
"type row = struct { id: int, m: big };\n"
"export fn main() i32 = {\n"
" let xs: [2]row = [\n"
" row { id = 1, m = 7: size },\n"
" row { id = 2, m = 8: size },\n"
" ];\n"
" let v: size = xs[0].m as size;\n"
" if (v != 7) { return 1; };\n"
" return 0;\n"
"};\n" },
{ "big_assign", /* >32B box store tripwire */
"package main;\n"
"type big = (void | size | [5]size);\n"
"type row = struct { id: int, m: big };\n"
"export fn main() i32 = {\n"
" let xs: [2]row = [\n"
" row { id = 1, m = 7: size },\n"
" row { id = 2, m = 8: size },\n"
" ];\n"
" xs[0].m = 9: size;\n"
" return 0;\n"
"};\n" },
{ "midword_assign", /* multi-word (>16B, <=32B box) store tripwire */
"package main;\n"
"type mid = (void | size | [3]size);\n"
"type row = struct { id: int, m: mid };\n"
"export fn main() i32 = {\n"
" let xs: [2]row = [\n"
" row { id = 1, m = 7: size },\n"
" row { id = 2, m = 8: size },\n"
" ];\n"
" xs[0].m = 9: size;\n"
" return 0;\n"
"};\n" },
{ "float_assign", /* float-payload store tripwire */
"package main;\n"
"type fo = (void | f64);\n"
"type row = struct { id: int, m: fo };\n"
"export fn main() i32 = {\n"
" let xs: [2]row = [\n"
" row { id = 1, m = 1.0: f64 },\n"
" row { id = 2, m = 2.0: f64 },\n"
" ];\n"
" xs[0].m = 3.0: f64;\n"
" return 0;\n"
"};\n" },
};
static int
file_has(const char *path, const char *needle)
{
FILE *f = fopen(path, "rb");
if (!f) return 0;
char buf[8192];
size_t n = fread(buf, 1, sizeof buf - 1, f);
fclose(f);
buf[n] = '\0';
return strstr(buf, needle) != NULL;
}
static int
run_cfail(const char *driver, const struct cfrow *r, int i)
{
char src[96], errf[96], cmd[1024];
snprintf(src, sizeof src, "/tmp/itf_cf_%d_%d.ww", getpid(), i);
snprintf(errf, sizeof errf, "/tmp/itf_cf_%d_e_%d", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
snprintf(cmd, sizeof cmd,
"timeout 20 %s build %s >/dev/null 2>%s", driver, src, errf);
int brc = runwait(cmd);
int ok = (brc != 0) && file_has(errf, "#58");
if (!ok)
fprintf(stderr,
"row[%s]: %s build rc=%d, want CFAIL with \"#58\" tripwire\n",
r->label, driver, brc);
unlink(src); unlink(errf);
return ok ? 0 : 1;
}
static int
run_driver(const char *driver, const struct row *r, int i)
{
char src[96], tmpdir[96], errf[96], cmd[1024];
snprintf(src, sizeof src, "/tmp/itf_%d_%d.ww", getpid(), i);
snprintf(tmpdir, sizeof tmpdir, "/tmp/itf_%d_d_%d", getpid(), i);
snprintf(errf, sizeof errf, "/tmp/itf_%d_e_%d", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
mkdir(tmpdir, 0755);
snprintf(cmd, sizeof cmd,
"cd %s && timeout 20 %s build %s >/dev/null 2>%s",
tmpdir, driver, src, errf);
int brc = runwait(cmd);
if (brc != 0) {
fprintf(stderr, "row[%s]: build via %s failed\n",
r->label, driver);
unlink(src); unlink(errf); rmdir(tmpdir);
return -1;
}
const char *base = strrchr(src, '/');
base = base ? base + 1 : src;
char outbin[256];
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
char *dot = strrchr(outbin, '.');
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
int got = runwait(outbin);
unlink(src); unlink(outbin); unlink(errf); rmdir(tmpdir);
if (got != r->want) {
fprintf(stderr, "row[%s]: %s exit %d, want %d\n",
r->label, driver, got, r->want);
return 1;
}
return 0;
}
static int
asm_byte_identical(const char *bin, const struct row *r, int i)
{
char src[96], cs[96], ws[96], cmd[1024];
snprintf(src, sizeof src, "/tmp/itf_asm_%d_%d.ww", getpid(), i);
snprintf(cs, sizeof cs, "/tmp/itf_asm_%d_%d_c.s", getpid(), i);
snprintf(ws, sizeof ws, "/tmp/itf_asm_%d_%d_w.s", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
snprintf(cmd, sizeof cmd, "%s/w6c -o %s %s 2>/dev/null", bin, cs, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: w6c errored\n", r->label);
unlink(src);
return -1;
}
snprintf(cmd, sizeof cmd, "%s/w6c_ww -o %s %s 2>/dev/null",
bin, ws, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: w6c_ww errored\n", r->label);
unlink(src); unlink(cs);
return -1;
}
int rc = slurp_eq(cs, ws);
if (rc != 0)
fprintf(stderr, "row[%s]: cstage vs wwstage asm differs\n",
r->label);
unlink(src); unlink(cs); unlink(ws);
return rc;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[2080];
if (bin[0] != '/') {
char cwd[1024];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char cdrv[2120], wdrv[2120];
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
int n = (int)(sizeof rows / sizeof rows[0]);
int cn = (int)(sizeof cfrows / sizeof cfrows[0]);
int total = 0, fail = 0;
for (int i = 0; i < n; i++) {
total++;
if (run_driver(cdrv, &rows[i], i) != 0) fail++;
}
/* cstage loud-stop tripwires (cgen.c) — expect CFAIL with "#58". */
for (int i = 0; i < cn; i++) {
total++;
if (run_cfail(cdrv, &cfrows[i], i) != 0) fail++;
}
if (access(wdrv, X_OK) == 0) {
for (int i = 0; i < n; i++) {
total++;
if (run_driver(wdrv, &rows[i], i) != 0) fail++;
}
for (int i = 0; i < n; i++) {
total++;
if (asm_byte_identical(bin, &rows[i], i) != 0) fail++;
}
/* wwstage loud-stop tripwires (cgenexpr.ww). */
for (int i = 0; i < cn; i++) {
total++;
if (run_cfail(wdrv, &cfrows[i], cn + i) != 0) fail++;
}
}
if (fail) {
fprintf(stderr, "idx_tagged_field: %d/%d checks failed\n",
fail, total);
return 1;
}
printf("idx_tagged_field: %d/%d ok\n", total, total);
return 0;
}