From 3ba19227ba0ec86d45bd01fec5c52ed8a3b35cae Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Mon, 18 May 2026 19:55:30 +0900 Subject: [PATCH] selfhost+test: route chained N_INDEX outer element size through indexvaluetnode on write path (#27) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Wwstage cgassign's N_INDEX-lhs base-inspection (cgenexpr.ww) only computed esz/elemtn when base.kind == N_IDENT or N_DOT. For a chained `names[i][k] = v` (names: **u8) the outer N_INDEX has base.kind == N_INDEX; esz fell through to the default 8 so the outer store emitted `MOVQ AX, (BX)` into a 1-byte u8 slot (8 bytes written — adjacent memory corrupted) plus a stray `MOVQ $8, CX; IMULQ CX, AX` scaling on the outer index that cstage doesn't emit. Wrong-width-store: the byte slot was written as 8 bytes and the outer offset multiplied by sizeof *u8 instead of sizeof u8. Cstage walks `n->lhs->type` directly via the typed AST at the N_ASSIGN N_INDEX-lhs branch (cmd/w6c/cgen.c eff->sub->size = 1). Wwstage now mirrors via indexvaluetnode (already graduated for cgindex in #24, commit aa8ca47) — the cgassign N_INDEX-lhs branch gains the parallel base-N_INDEX arm: call indexvaluetnode, then elemsizeofc for esz and one-layer-strip for elemtn (so the tagged- element gate keys honestly on the element type, matching the N_IDENT branch's pattern). Class A wwstage cgen UNDER. Sister latent of #24's surfaced read- path bug; filed during the #24 graduation with selfhost + lib grep empty for chained-write. No in-tree consumer surfaced this before the fix, so test 740_chained_write is the sole exerciser — pins cstage-byte-identical asm for **u8 (MOVB store, 1 inner-stride-8 IMULQ pair, no outer scale) + **i32 (MOVL store, inner $8 + outer $4 IMULQ pairs). Anti-check on the u8 row guards against the pre- fix stray `MOVQ AX, (BX)` regression. Sister latents filed (no in-tree consumer): cgassign N_DOT-base elemtn drop (sister of cgindex N_DOT-base in #24 review): tagged-element store via obj.arr[i] over a struct-field array falls through to scalar store. 114/114 ok. ww2 == ww3 == ww4 byte-id. --- Makefile | 5 + selfhost/cmd/w6c/main.combined.ww | 17 +- selfhost/cmd/wcc/cgenexpr.ww | 17 +- selfhost/cmd/wwdump/main.combined.ww | 17 +- test/wcc/740_chained_write.c | 286 +++++++++++++++++++++++++++ 5 files changed, 339 insertions(+), 3 deletions(-) create mode 100644 test/wcc/740_chained_write.c diff --git a/Makefile b/Makefile index 80532828..5bdb971e 100644 --- a/Makefile +++ b/Makefile @@ -267,6 +267,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_direnum \ $(BIN)/test_module_decl \ $(BIN)/test_chained_index \ + $(BIN)/test_chained_write \ $(BIN)/test_fnparams_bare_leaf_shadow \ $(BIN)/test_fnret_bare_leaf_shadow \ $(BIN)/test_param_shadow_mod \ @@ -644,6 +645,10 @@ $(BIN)/test_chained_index: test/wcc/739_chained_index.c \ $(BIN)/w6c $(BIN)/w6c_ww | $(BIN) $(CC) $(CFLAGS) -o $@ $< +$(BIN)/test_chained_write: test/wcc/740_chained_write.c \ + $(BIN)/w6c $(BIN)/w6c_ww | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + $(BIN)/test_fnparams_bare_leaf_shadow: test/wcc/732_fnparams_bare_leaf_shadow.c \ $(BIN)/w6c $(BIN)/w6c_ww | $(BIN) $(CC) $(CFLAGS) -o $@ $< diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index 99d700af..d9845189 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -14242,7 +14242,22 @@ fn cgassign(c: *cgen, n: *node) void = { }; } else { if (base.kind == nkind.N_DOT) { esz = indexbaseesz(c, base); - };}; + } else { if (base.kind == nkind.N_INDEX) { + // Chained-write write-side parallel of the + // cgindex N_INDEX-base arm graduated in #24: + // `names[i][k] = v` (names: **u8) — outer + // base is the inner N_INDEX whose value-type + // is *u8, so the outer element is u8 and + // the store is MOVB, not MOVQ. + let bt: *node = indexvaluetnode(c, base); + if (bt != nil) { + esz = elemsizeofc(c, bt); + let bk2: nkind = bt.kind; + if (bk2 == nkind.N_TPTR) { elemtn = bt.lhs; }; + if (bk2 == nkind.N_TSLICE) { elemtn = bt.lhs; }; + if (bk2 == nkind.N_TARRAY) { elemtn = bt.lhs; }; + }; + };};}; }; // Tagged-union element: materialize source in a shared // scratch slot via cgwidentaggedstore (handles struct / diff --git a/selfhost/cmd/wcc/cgenexpr.ww b/selfhost/cmd/wcc/cgenexpr.ww index 42925d12..72a240ba 100644 --- a/selfhost/cmd/wcc/cgenexpr.ww +++ b/selfhost/cmd/wcc/cgenexpr.ww @@ -3518,7 +3518,22 @@ fn cgassign(c: *cgen, n: *node) void = { }; } else { if (base.kind == nkind.N_DOT) { esz = indexbaseesz(c, base); - };}; + } else { if (base.kind == nkind.N_INDEX) { + // Chained-write write-side parallel of the + // cgindex N_INDEX-base arm graduated in #24: + // `names[i][k] = v` (names: **u8) — outer + // base is the inner N_INDEX whose value-type + // is *u8, so the outer element is u8 and + // the store is MOVB, not MOVQ. + let bt: *node = indexvaluetnode(c, base); + if (bt != nil) { + esz = elemsizeofc(c, bt); + let bk2: nkind = bt.kind; + if (bk2 == nkind.N_TPTR) { elemtn = bt.lhs; }; + if (bk2 == nkind.N_TSLICE) { elemtn = bt.lhs; }; + if (bk2 == nkind.N_TARRAY) { elemtn = bt.lhs; }; + }; + };};}; }; // Tagged-union element: materialize source in a shared // scratch slot via cgwidentaggedstore (handles struct / diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index da434c6d..a25abee0 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -14242,7 +14242,22 @@ fn cgassign(c: *cgen, n: *node) void = { }; } else { if (base.kind == nkind.N_DOT) { esz = indexbaseesz(c, base); - };}; + } else { if (base.kind == nkind.N_INDEX) { + // Chained-write write-side parallel of the + // cgindex N_INDEX-base arm graduated in #24: + // `names[i][k] = v` (names: **u8) — outer + // base is the inner N_INDEX whose value-type + // is *u8, so the outer element is u8 and + // the store is MOVB, not MOVQ. + let bt: *node = indexvaluetnode(c, base); + if (bt != nil) { + esz = elemsizeofc(c, bt); + let bk2: nkind = bt.kind; + if (bk2 == nkind.N_TPTR) { elemtn = bt.lhs; }; + if (bk2 == nkind.N_TSLICE) { elemtn = bt.lhs; }; + if (bk2 == nkind.N_TARRAY) { elemtn = bt.lhs; }; + }; + };};}; }; // Tagged-union element: materialize source in a shared // scratch slot via cgwidentaggedstore (handles struct / diff --git a/test/wcc/740_chained_write.c b/test/wcc/740_chained_write.c new file mode 100644 index 00000000..e7177454 --- /dev/null +++ b/test/wcc/740_chained_write.c @@ -0,0 +1,286 @@ +/* + * 740_chained_write — sentinel for #27. Pins wwstage's cgassign to + * compute the element size of the outer N_INDEX in `arr[i][k] = v` + * from the value-type of the inner N_INDEX, instead of defaulting + * to 8. Sister of 739_chained_index (#24, read path); same dispatch + * gap on the write side. + * + * Pre-fix wwstage cgassign (selfhost/cmd/wcc/cgenexpr.ww) only + * walked `base.kind == N_IDENT` and `base.kind == N_DOT` for the + * esz/elemtn dispatch on the N_INDEX-lhs branch. When base was the + * inner N_INDEX of a chained `names[i][k]` shape (names: **u8), esz + * stayed at the default 8 and the store fell through to MOVQ — an + * 8-byte write over a 1-byte u8 slot (corrupting adjacent memory), + * plus a stray `MOVQ $8, CX; IMULQ CX, AX` on the outer index that + * cstage doesn't emit. + * + * Cstage walks `n->lhs->type` directly (cmd/w6c/cgen.c N_ASSIGN + + * N_INDEX lhs) — the typed AST already says the post-inner-index + * value is *u8, so eff->sub->size = 1 lands naturally. Wwstage now + * mirrors via indexvaluetnode (already graduated for cgindex in #24). + * + * Class A wwstage cgen UNDER. No in-tree consumer surfaced before + * the fix (selfhost + lib grep is empty for chained-write); the + * filed-latent sister of #24's surfaced bug. This sentinel is the + * sole exerciser of the shape. + * + * Sentinel per row: in the `probe` body, assert the final element + * store uses the expected narrow MOV mnemonic, the outer-index + * scale is absent (esz=1) or matches `MOVQ $, CX`, and the + * cstage vs wwstage asm is byte-identical. + */ +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +/* `storemov` = expected mnemonic for the trailing ` AX, (BX)` + * store at the outer index. `outerscale` = expected esz for the + * outer index (1 → no IMULQ; 4 → `MOVQ $4, CX; IMULQ`). */ +struct row { + const char *label; + const char *src; + const char *storemov; + int outerscale; +}; + +static const struct row rows[] = { + /* The load-bearing case: **u8 chained-write. Sister of 739's + * **u8 read. esz must drop to 1; MOVB store; no outer scale. */ + { "chained_u8", + "fn probe(names: **u8) void = {\n" + " let i: i32 = 0;\n" + " let k: u64 = 0u64;\n" + " names[i][k] = 65u8;\n" + "};\n" + "export fn main() i32 = { return 0; };\n", + "MOVB", 1 }, + /* **i32 — 4-byte store, IMULQ $4 outer scaling, IMULQ $8 inner + * *i32 stride. */ + { "chained_i32", + "fn probe(mat: **i32) void = {\n" + " let i: i32 = 0;\n" + " let k: u64 = 0u64;\n" + " mat[i][k] = 42i32;\n" + "};\n" + "export fn main() i32 = { return 0; };\n", + "MOVL", 4 }, +}; + +static int +slurp(const char *path, char *buf, size_t cap) +{ + FILE *f = fopen(path, "rb"); + if (!f) return -1; + size_t n = fread(buf, 1, cap - 1, f); + fclose(f); + buf[n] = '\0'; + return (int)n; +} + +static int +emit_s(const char *w6c, const struct row *r, int i, char *out_s, size_t cap) +{ + char src[96], cmd[1024]; + snprintf(src, sizeof src, "/tmp/chwr_%d_%d.ww", getpid(), i); + snprintf(out_s, cap, "/tmp/chwr_%d_%d_%s.s", + getpid(), i, w6c[strlen(w6c) - 1] == 'w' ? "ww" : "c"); + + FILE *f = fopen(src, "wb"); + if (!f) return -1; + fputs(r->src, f); + fclose(f); + + snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null", w6c, out_s, src); + int rc = runwait(cmd); + unlink(src); + return rc; +} + +/* Inside `TEXT probe`, the final element store must use the + * expected narrow MOV mnemonic on `AX, (BX)`. Pre-fix wwstage + * emitted plain `MOVQ AX, (BX)`. */ +static int +check_storemov(const char *spath, const struct row *r, const char *stage) +{ + char buf[1 << 14]; + if (slurp(spath, buf, sizeof buf) < 0) { + fprintf(stderr, "row[%s][%s]: cannot read %s\n", + r->label, stage, spath); + return -1; + } + const char *fn = strstr(buf, "TEXT probe"); + if (!fn) { + fprintf(stderr, + "row[%s][%s]: no TEXT probe in %s\n", + r->label, stage, spath); + return -1; + } + const char *ret = strstr(fn, "\tRET\n"); + char needle[64]; + snprintf(needle, sizeof needle, "\t%s\tAX, (BX)\n", r->storemov); + const char *m = strstr(fn, needle); + if (!m || (ret && m > ret)) { + fprintf(stderr, + "row[%s][%s]: expected `%s AX, (BX)` in probe body\n", + r->label, stage, r->storemov); + return -1; + } + /* Pre-fix wwstage **u8 write emitted plain `MOVQ AX, (BX)`. For + * the u8 row that's a wrong-width store — anti-check it is + * absent. */ + if (r->outerscale == 1) { + const char *bad = strstr(fn, "\tMOVQ\tAX, (BX)\n"); + if (bad && (!ret || bad < ret)) { + fprintf(stderr, + "row[%s][%s]: stray 8-byte `MOVQ AX, (BX)` in " + "probe body — pre-#27 wrong-width-store regression\n", + r->label, stage); + return -1; + } + } + return 0; +} + +/* Negative: pre-fix wwstage emitted a stray `MOVQ $8, CX; IMULQ CX, + * AX` for the OUTER index of a **u8 chain (because esz defaulted to + * 8). For a u8 outer the correct emit is no scaling at all. Assert + * the count of `MOVQ $8, CX` followed by `IMULQ CX, AX` pairs in the + * probe body matches the expected inner-only count (= 1 for **T; + * the inner index of *T elements always scales by 8). */ +static int +check_inner_scale_only(const char *spath, const struct row *r, + const char *stage) +{ + char buf[1 << 14]; + if (slurp(spath, buf, sizeof buf) < 0) return -1; + const char *fn = strstr(buf, "TEXT probe"); + if (!fn) return -1; + const char *ret = strstr(fn, "\tRET\n"); + if (!ret) ret = fn + strlen(fn); + + int n_inner = 0, n_outer = 0; + const char *p = fn; + while (p < ret) { + const char *inner = strstr(p, "\tMOVQ\t$8, CX\n"); + if (!inner || inner >= ret) break; + const char *next = strstr(inner, "\tIMULQ\tCX, AX\n"); + if (!next || next >= ret) { p = inner + 1; continue; } + n_inner++; + p = next + 1; + } + if (r->outerscale == 1) { + /* Pre-fix wwstage had two `MOVQ $8, CX; IMULQ` pairs (one + * for the outer index that shouldn't scale at all). Cstage + * has one — for the inner *u8 stride only. */ + if (n_inner != 1) { + fprintf(stderr, + "row[%s][%s]: expected exactly 1 inner `MOVQ $8, " + "CX; IMULQ CX, AX` pair (no outer scaling for u8), " + "got %d\n", r->label, stage, n_inner); + return -1; + } + } else { + /* For **i32: inner stride is 8 (sizeof *i32), outer scale is + * 4 (sizeof i32). Assert one `MOVQ $8, CX` for inner and one + * `MOVQ $4, CX` for outer. */ + p = fn; + while (p < ret) { + const char *outer = strstr(p, "\tMOVQ\t$4, CX\n"); + if (!outer || outer >= ret) break; + const char *next = strstr(outer, "\tIMULQ\tCX, AX\n"); + if (!next || next >= ret) { p = outer + 1; continue; } + n_outer++; + p = next + 1; + } + if (n_inner != 1 || n_outer != 1) { + fprintf(stderr, + "row[%s][%s]: expected 1 inner `MOVQ $8` + 1 outer " + "`MOVQ $4` IMULQ pair, got inner=%d outer=%d\n", + r->label, stage, n_inner, n_outer); + return -1; + } + } + return 0; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[512]; + if (bin[0] != '/') { + char cwd[256]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char w6c[640], w6c_ww[640]; + snprintf(w6c, sizeof w6c, "%s/w6c", bin); + snprintf(w6c_ww, sizeof w6c_ww, "%s/w6c_ww", bin); + + int have_ww = (access(w6c_ww, X_OK) == 0); + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + + for (int i = 0; i < n; i++) { + char cs_path[128], ws_path[128]; + + if (emit_s(w6c, &rows[i], i, cs_path, sizeof cs_path) != 0) { + fprintf(stderr, + "chained_write[cstage][%s]: w6c failed\n", + rows[i].label); + fail++; total++; continue; + } + total += 2; + if (check_storemov(cs_path, &rows[i], "cstage") != 0) fail++; + if (check_inner_scale_only(cs_path, &rows[i], "cstage") != 0) + fail++; + + if (!have_ww) { unlink(cs_path); continue; } + + if (emit_s(w6c_ww, &rows[i], i, ws_path, sizeof ws_path) != 0) { + fprintf(stderr, + "chained_write[wwstage][%s]: w6c_ww failed\n", + rows[i].label); + fail++; total++; + unlink(cs_path); continue; + } + total += 2; + if (check_storemov(ws_path, &rows[i], "wwstage") != 0) fail++; + if (check_inner_scale_only(ws_path, &rows[i], "wwstage") != 0) + fail++; + + total++; + char cmd[512]; + snprintf(cmd, sizeof cmd, "cmp -s %s %s", cs_path, ws_path); + if (runwait(cmd) != 0) { + fprintf(stderr, + "chained_write[%s]: cstage vs wwstage asm differs\n", + rows[i].label); + fail++; + } + + unlink(cs_path); unlink(ws_path); + } + + if (fail) { + fprintf(stderr, + "chained_write: %d/%d fixtures failed\n", fail, total); + return 1; + } + printf("chained_write: %d/%d ok\n", total, total); + return 0; +}