Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wcc/cgen: #58 indexed tagged-field read+assign cursor arm (both-stage)

Browse Source 
Reading or writing a tagged field of an indexed array element
(xs[i].field) was broken on BOTH stages, byte-identically and
silently (#263 gate-blind): the arr[i].field branches had arms for
array/str/slice/float but no TY_TAGGED arm, so the tagged field fell
to the single-word scalar path. READ loaded only the tag word (stale
payload -> `xs[i].min as T` read garbage); ASSIGN stored the raw
unboxed scalar into the tag slot, corrupting the box.

Insert a TY_TAGGED cursor arm before each scalar fallback, both
sites both stages (cgen.c read + assign; cgenexpr.ww cgdot N_INDEX-lhs
read + cgassign indexed-field). READ mirrors cg_tagged_memread
(payload -> DX/CX/R8, tag -> AX last). ASSIGN synthesizes the tag for
the concrete variant (taggedvariantindext) and stores tag+payload via
the str/slice 3-word store spine -- not the source-remap widener
(concrete rhs has no source tag to remap).

>32B / multi-word / float payloads are loud-stopped at all four arms
(emission not yet wired; see #114). That shape is reachable today via
a narrow-variant ctor, so it louds rather than silently miscompiling.
Both stages get the same arm -> byte-id preserved (990-997 green; the
runtime is the net for this #263 class). Pin 944_idx_tagged_field_run
(read/assign runtime rows + >32B expect-loud rows).
This commit is contained in:
Hojun-Cho
2026-06-06 16:21:45 +09:00
parent cc896bd078
commit 351abb0ab3
6 changed files with 905 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

132
selfhost/cmd/w6c/main.combined.ww
View File

@@ -24894,6 +24894,55 @@ fn cgdot(c: *cgen, n: *node) void = {
emitline(", X0\n");
return;
};
// #58: a TAGGED field of an indexed array
// element (`xs[i].f`). AX holds &xs[i]; load
// the box cursor (AX=tag, DX/CX/R8=payload)
// mirroring taggedmemread's <=32B convention,
// tag LAST (it clobbers the base AX). Without
// this arm the field fell to the scalar load
// below, reading only the tag word and leaving
// the payload cursor (DX) stale (`xs[i].f as
// T` read garbage; #38a INDEX-spine residual).
// >32B box: a wide-box union (largest variant
// >32B) IS constructible via a NARROW variant
// (not unbuildable as earlier triage assumed;
// #54/#23 fires only on STRUCT-LITERAL
// payloads), but the mem-based read (LEAQ
// foff(AX),AX) is not yet wired here — so this
// arm LOUD-STOPS rather than silently reading a
// truncated box (rule 7, the #41 untested-arm
// trap), byte-id-neutral. Reachable + pinned
// expect-loud (test/wcc/944 cfail rows). When
// #114 wires it, that commit replaces this with
// the LEAQ box-address emission + a >32B value
// pin row. Mirrors cstage cgen.c.
if (fu != nil && fu.kind == tykind.TY_TAGGED) {
let bsz: i32 = fu.size: i32;
if (bsz > TUPLE_GPCAP * 8) {
let m58r: str = "#58: >32B tagged-field indexed read unreachable until #114\n";
os.write(2, m58r.ptr, m58r.len: u64);
os.exit(1);
};
if (bsz > 24) {
emitline("\tMOVQ\t");
emitdispreg(foff + 24, "AX");
emitline(", R8\n");
};
if (bsz > 16) {
emitline("\tMOVQ\t");
emitdispreg(foff + 16, "AX");
emitline(", CX\n");
};
if (bsz > 8) {
emitline("\tMOVQ\t");
emitdispreg(foff + 8, "AX");
emitline(", DX\n");
};
emitline("\tMOVQ\t");
emitdispreg(foff, "AX");
emitline(", AX\n");
return;
};
let fsz: i32 = 8;
if (ft != nil) { fsz = ft.size: i32; };
let lop: str = loadopsz(typeissigned(ft), fsz);
@@ -29950,6 +29999,89 @@ fn cgassign(c: *cgen, n: *node) void = {
emitline("\n");
return;
};
// #58: a TAGGED field of an indexed
// array element (`xs[i].f = v`). The
// scalar store below would write the
// raw unboxed rhs into the TAG slot —
// never boxing, never writing the
// payload (box-corruption, the #38a
// write-twin). BOX (mirror the #24
// tagged-field-assign tag lookup,
// taggedvariantindext) + STORE spine
// (mirror the co-located str/slice
// 3-word arm above): cgexpr the
// payload, spill across the index/
// address computation, compute
// &xs[i]->BX, store the variant tag
// (constant) at foff+0 and the scalar
// payload at foff+8. Only a SCALAR-
// payload variant (box <=16B) store
// is wired here. A >16B / multi-word /
// float-payload union field IS
// constructible (a wide box, built via
// a NARROW variant — not unbuildable as
// earlier triage assumed; #54/#23 fires
// only on STRUCT-LITERAL payloads), but
// its box+memcpy store arm is not yet
// wired, so it LOUD-STOPS rather than
// silently corrupting the box (rule 7,
// the #41 untested-arm trap), byte-id-
// neutral. Reachable + pinned expect-
// loud (test/wcc/944 cfail rows). When
// #114 wires them, that commit replaces
// these stops with the real box+memcpy
// emission + value pin rows. Mirrors
// cstage cgen.c.
if (istaggedtype(c, fi.tnode)) {
let bsz: i32 = slotsize(c, fi.tnode);
if (bsz > TUPLE_GPCAP * 8) {
let m58s: str = "#58: >32B tagged-field indexed store unreachable until #114\n";
os.write(2, m58s.ptr, m58s.len: u64);
os.exit(1);
};
if (bsz > 16) {
let m58m: str = "#58: multi-word tagged-field indexed store unreachable until #114\n";
os.write(2, m58m.ptr, m58m.len: u64);
os.exit(1);
};
if (typeisfloat(n.rhs.type_: *tinfo)) {
let m58f: str = "#58: float-payload tagged-field indexed store unreachable until #114\n";
os.write(2, m58f.ptr, m58f.len: u64);
os.exit(1);
};
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tAX\n");
cgexpr(c, idx);
if (esz > 1) {
emitline("\tMOVQ\t$");
emitint(esz: i64);
emitline(", CX\n");
emitline("\tIMULQ\tCX, AX\n");
};
if (baseisarray) {
emitline("\tLEAQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
} else {
emitline("\tMOVQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
};
emitline("\tADDQ\tAX, BX\n");
if (viaptr) { emitline("\tMOVQ\t(BX), BX\n"); };
emitline("\tPOPQ\tAX\n");
let v58tag: i32 = taggedvariantindext(c, fi.tnode.type_: *tinfo, n.rhs);
if (v58tag < 0) { v58tag = 0; };
emitline("\tMOVQ\t$");
emitint(v58tag: i64);
emitline(", ");
emitdispreg(fi.foff: i64, "BX");
emitline("\n");
emitline("\tMOVQ\tAX, ");
emitdispreg((fi.foff + 8): i64, "BX");
emitline("\n");
return;
};
// scalar plain `=`
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tAX\n");

132
selfhost/cmd/wcc/cgenexpr.ww
View File

@@ -3655,6 +3655,55 @@ fn cgdot(c: *cgen, n: *node) void = {
emitline(", X0\n");
return;
};
// #58: a TAGGED field of an indexed array
// element (`xs[i].f`). AX holds &xs[i]; load
// the box cursor (AX=tag, DX/CX/R8=payload)
// mirroring taggedmemread's <=32B convention,
// tag LAST (it clobbers the base AX). Without
// this arm the field fell to the scalar load
// below, reading only the tag word and leaving
// the payload cursor (DX) stale (`xs[i].f as
// T` read garbage; #38a INDEX-spine residual).
// >32B box: a wide-box union (largest variant
// >32B) IS constructible via a NARROW variant
// (not unbuildable as earlier triage assumed;
// #54/#23 fires only on STRUCT-LITERAL
// payloads), but the mem-based read (LEAQ
// foff(AX),AX) is not yet wired here — so this
// arm LOUD-STOPS rather than silently reading a
// truncated box (rule 7, the #41 untested-arm
// trap), byte-id-neutral. Reachable + pinned
// expect-loud (test/wcc/944 cfail rows). When
// #114 wires it, that commit replaces this with
// the LEAQ box-address emission + a >32B value
// pin row. Mirrors cstage cgen.c.
if (fu != nil && fu.kind == tykind.TY_TAGGED) {
let bsz: i32 = fu.size: i32;
if (bsz > TUPLE_GPCAP * 8) {
let m58r: str = "#58: >32B tagged-field indexed read unreachable until #114\n";
os.write(2, m58r.ptr, m58r.len: u64);
os.exit(1);
};
if (bsz > 24) {
emitline("\tMOVQ\t");
emitdispreg(foff + 24, "AX");
emitline(", R8\n");
};
if (bsz > 16) {
emitline("\tMOVQ\t");
emitdispreg(foff + 16, "AX");
emitline(", CX\n");
};
if (bsz > 8) {
emitline("\tMOVQ\t");
emitdispreg(foff + 8, "AX");
emitline(", DX\n");
};
emitline("\tMOVQ\t");
emitdispreg(foff, "AX");
emitline(", AX\n");
return;
};
let fsz: i32 = 8;
if (ft != nil) { fsz = ft.size: i32; };
let lop: str = loadopsz(typeissigned(ft), fsz);
@@ -8711,6 +8760,89 @@ fn cgassign(c: *cgen, n: *node) void = {
emitline("\n");
return;
};
// #58: a TAGGED field of an indexed
// array element (`xs[i].f = v`). The
// scalar store below would write the
// raw unboxed rhs into the TAG slot —
// never boxing, never writing the
// payload (box-corruption, the #38a
// write-twin). BOX (mirror the #24
// tagged-field-assign tag lookup,
// taggedvariantindext) + STORE spine
// (mirror the co-located str/slice
// 3-word arm above): cgexpr the
// payload, spill across the index/
// address computation, compute
// &xs[i]->BX, store the variant tag
// (constant) at foff+0 and the scalar
// payload at foff+8. Only a SCALAR-
// payload variant (box <=16B) store
// is wired here. A >16B / multi-word /
// float-payload union field IS
// constructible (a wide box, built via
// a NARROW variant — not unbuildable as
// earlier triage assumed; #54/#23 fires
// only on STRUCT-LITERAL payloads), but
// its box+memcpy store arm is not yet
// wired, so it LOUD-STOPS rather than
// silently corrupting the box (rule 7,
// the #41 untested-arm trap), byte-id-
// neutral. Reachable + pinned expect-
// loud (test/wcc/944 cfail rows). When
// #114 wires them, that commit replaces
// these stops with the real box+memcpy
// emission + value pin rows. Mirrors
// cstage cgen.c.
if (istaggedtype(c, fi.tnode)) {
let bsz: i32 = slotsize(c, fi.tnode);
if (bsz > TUPLE_GPCAP * 8) {
let m58s: str = "#58: >32B tagged-field indexed store unreachable until #114\n";
os.write(2, m58s.ptr, m58s.len: u64);
os.exit(1);
};
if (bsz > 16) {
let m58m: str = "#58: multi-word tagged-field indexed store unreachable until #114\n";
os.write(2, m58m.ptr, m58m.len: u64);
os.exit(1);
};
if (typeisfloat(n.rhs.type_: *tinfo)) {
let m58f: str = "#58: float-payload tagged-field indexed store unreachable until #114\n";
os.write(2, m58f.ptr, m58f.len: u64);
os.exit(1);
};
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tAX\n");
cgexpr(c, idx);
if (esz > 1) {
emitline("\tMOVQ\t$");
emitint(esz: i64);
emitline(", CX\n");
emitline("\tIMULQ\tCX, AX\n");
};
if (baseisarray) {
emitline("\tLEAQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
} else {
emitline("\tMOVQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
};
emitline("\tADDQ\tAX, BX\n");
if (viaptr) { emitline("\tMOVQ\t(BX), BX\n"); };
emitline("\tPOPQ\tAX\n");
let v58tag: i32 = taggedvariantindext(c, fi.tnode.type_: *tinfo, n.rhs);
if (v58tag < 0) { v58tag = 0; };
emitline("\tMOVQ\t$");
emitint(v58tag: i64);
emitline(", ");
emitdispreg(fi.foff: i64, "BX");
emitline("\n");
emitline("\tMOVQ\tAX, ");
emitdispreg((fi.foff + 8): i64, "BX");
emitline("\n");
return;
};
// scalar plain `=`
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tAX\n");

132
selfhost/cmd/wwdump/main.combined.ww
View File

@@ -24894,6 +24894,55 @@ fn cgdot(c: *cgen, n: *node) void = {
emitline(", X0\n");
return;
};
// #58: a TAGGED field of an indexed array
// element (`xs[i].f`). AX holds &xs[i]; load
// the box cursor (AX=tag, DX/CX/R8=payload)
// mirroring taggedmemread's <=32B convention,
// tag LAST (it clobbers the base AX). Without
// this arm the field fell to the scalar load
// below, reading only the tag word and leaving
// the payload cursor (DX) stale (`xs[i].f as
// T` read garbage; #38a INDEX-spine residual).
// >32B box: a wide-box union (largest variant
// >32B) IS constructible via a NARROW variant
// (not unbuildable as earlier triage assumed;
// #54/#23 fires only on STRUCT-LITERAL
// payloads), but the mem-based read (LEAQ
// foff(AX),AX) is not yet wired here — so this
// arm LOUD-STOPS rather than silently reading a
// truncated box (rule 7, the #41 untested-arm
// trap), byte-id-neutral. Reachable + pinned
// expect-loud (test/wcc/944 cfail rows). When
// #114 wires it, that commit replaces this with
// the LEAQ box-address emission + a >32B value
// pin row. Mirrors cstage cgen.c.
if (fu != nil && fu.kind == tykind.TY_TAGGED) {
let bsz: i32 = fu.size: i32;
if (bsz > TUPLE_GPCAP * 8) {
let m58r: str = "#58: >32B tagged-field indexed read unreachable until #114\n";
os.write(2, m58r.ptr, m58r.len: u64);
os.exit(1);
};
if (bsz > 24) {
emitline("\tMOVQ\t");
emitdispreg(foff + 24, "AX");
emitline(", R8\n");
};
if (bsz > 16) {
emitline("\tMOVQ\t");
emitdispreg(foff + 16, "AX");
emitline(", CX\n");
};
if (bsz > 8) {
emitline("\tMOVQ\t");
emitdispreg(foff + 8, "AX");
emitline(", DX\n");
};
emitline("\tMOVQ\t");
emitdispreg(foff, "AX");
emitline(", AX\n");
return;
};
let fsz: i32 = 8;
if (ft != nil) { fsz = ft.size: i32; };
let lop: str = loadopsz(typeissigned(ft), fsz);
@@ -29950,6 +29999,89 @@ fn cgassign(c: *cgen, n: *node) void = {
emitline("\n");
return;
};
// #58: a TAGGED field of an indexed
// array element (`xs[i].f = v`). The
// scalar store below would write the
// raw unboxed rhs into the TAG slot —
// never boxing, never writing the
// payload (box-corruption, the #38a
// write-twin). BOX (mirror the #24
// tagged-field-assign tag lookup,
// taggedvariantindext) + STORE spine
// (mirror the co-located str/slice
// 3-word arm above): cgexpr the
// payload, spill across the index/
// address computation, compute
// &xs[i]->BX, store the variant tag
// (constant) at foff+0 and the scalar
// payload at foff+8. Only a SCALAR-
// payload variant (box <=16B) store
// is wired here. A >16B / multi-word /
// float-payload union field IS
// constructible (a wide box, built via
// a NARROW variant — not unbuildable as
// earlier triage assumed; #54/#23 fires
// only on STRUCT-LITERAL payloads), but
// its box+memcpy store arm is not yet
// wired, so it LOUD-STOPS rather than
// silently corrupting the box (rule 7,
// the #41 untested-arm trap), byte-id-
// neutral. Reachable + pinned expect-
// loud (test/wcc/944 cfail rows). When
// #114 wires them, that commit replaces
// these stops with the real box+memcpy
// emission + value pin rows. Mirrors
// cstage cgen.c.
if (istaggedtype(c, fi.tnode)) {
let bsz: i32 = slotsize(c, fi.tnode);
if (bsz > TUPLE_GPCAP * 8) {
let m58s: str = "#58: >32B tagged-field indexed store unreachable until #114\n";
os.write(2, m58s.ptr, m58s.len: u64);
os.exit(1);
};
if (bsz > 16) {
let m58m: str = "#58: multi-word tagged-field indexed store unreachable until #114\n";
os.write(2, m58m.ptr, m58m.len: u64);
os.exit(1);
};
if (typeisfloat(n.rhs.type_: *tinfo)) {
let m58f: str = "#58: float-payload tagged-field indexed store unreachable until #114\n";
os.write(2, m58f.ptr, m58f.len: u64);
os.exit(1);
};
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tAX\n");
cgexpr(c, idx);
if (esz > 1) {
emitline("\tMOVQ\t$");
emitint(esz: i64);
emitline(", CX\n");
emitline("\tIMULQ\tCX, AX\n");
};
if (baseisarray) {
emitline("\tLEAQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
} else {
emitline("\tMOVQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
};
emitline("\tADDQ\tAX, BX\n");
if (viaptr) { emitline("\tMOVQ\t(BX), BX\n"); };
emitline("\tPOPQ\tAX\n");
let v58tag: i32 = taggedvariantindext(c, fi.tnode.type_: *tinfo, n.rhs);
if (v58tag < 0) { v58tag = 0; };
emitline("\tMOVQ\t$");
emitint(v58tag: i64);
emitline(", ");
emitdispreg(fi.foff: i64, "BX");
emitline("\n");
emitline("\tMOVQ\tAX, ");
emitdispreg((fi.foff + 8): i64, "BX");
emitline("\n");
return;
};
// scalar plain `=`
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tAX\n");