Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cgen: fix global-ptr field READ, load ptr value via SB before offset (#15)

Browse Source 
Reading gp.f through a module-global pointer miscompiled in BOTH stages,
differently: cstage classified gp as a local at boff 0 and derefed BP
(MOVQ (BP),BX), wwstage collapsed gp.f to an undefined global symbol f
(MOVQ f(SB)). Both now load the pointer value from the global's data slot
before the field offset, converging on MOVQ gp(SB),BX; MOVQ off(BX),AX.
cstage mirrors the #6 store decline; wwstage gains a global-ptr arm and
shares a cgptrfieldload helper with the local arm.

Fused, not split: the two stages must emit byte-identical asm, so a
one-stage commit would fail the byte-id gate. Sibling byte-divergences
filed: #16 (chained-spine gp.x.y), #17 (>32B tagged word-order).

Test: table-driven 689_globptr_field_read_run (24 rows, runtime + byte-id).
This commit is contained in:
Hojun-Cho
2026-06-23 06:42:38 +09:00
parent 02967e04ce
commit 475c003b0d
4 changed files with 399 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

192
selfhost/cmd/wcc/cgenexpr.ww
View File

@@ -3248,6 +3248,51 @@ fn cgmatch(c: *cgen, n: *syntax.node) void = {
return;
};
fn cgptrfieldload(c: *cgen, fi: *fieldinfo) void = {
// #15 — load struct field `fi` from a *struct base already in BX
// (a local ptr's MOVQ off(BP) value, or a module-global ptr's
// MOVQ name(SB) value). Shared by the local and global *struct
// field-read arms in cgdot; mirrors cstage cgen.c N_DOT *struct
// field tail. BX is never a load target, so order is harmless.
if (istaggedtype(c, fi.tnode)) {
let tsz: i32 = slotsize(c, fi.tnode);
cgloadtaggedfield(c, "BX", fi.foff, tsz);
return;
};
// str IS []u8 — same 3-word {ptr,len,cap} as a slice field: load
// (ptr, len, cap) into (AX, BX, CX); .len LAST so the earlier reads
// still index off BX (#1/Phase 3 collapse).
if (isstrtype(c, fi.tnode) || isslicetype(c, fi.tnode)) {
emitline("\tMOVQ\t");
emitdispreg(fi.foff: i64, "BX");
emitline(", AX\n");
emitline("\tMOVQ\t");
emitdispreg((fi.foff + 16): i64, "BX");
emitline(", CX\n");
emitline("\tMOVQ\t");
emitdispreg((fi.foff + 8): i64, "BX");
emitline(", BX\n");
return;
};
if (isfloattype(c, fi.tnode)) {
// f64/f32 via *struct: route through X0.
let mov: str = "MOVSD";
if (isf32type(c, fi.tnode)) { mov = "MOVSS"; };
emitline("\t");
emitline(mov);
emitline("\t");
emitdispreg(fi.foff: i64, "BX");
emitline(", X0\n");
return;
};
let op: str = fieldloadop(c, fi);
emitline("\t");
emitline(op);
emitline("\t");
emitdispreg(fi.foff: i64, "BX");
emitline(", AX\n");
};
fn cgdot(c: *cgen, n: *syntax.node) void = {
let lhs: *syntax.node = n.lhs;
let fld: str = n.str;
@@ -3370,66 +3415,16 @@ fn cgdot(c: *cgen, n: *syntax.node) void = {
for (fi != nil) {
let fn_: str = fi.fname;
if (syntax.streq(fn_, fld)) {
// tagged-union field via *struct: stage
// the *struct in BX, then load the four
// payload regs via cgloadtaggedfield.
// BX isn't a target (AX/DX/CX/R8), so
// load order doesn't matter. Mirrors
// the direct-local branch above so the
// match / let-init / call-arg consumer
// shape is identical regardless of
// pointer rooting.
if (istaggedtype(c, fi.tnode)) {
let tsz: i32 = slotsize(c, fi.tnode);
emitline("\tMOVQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
cgloadtaggedfield(c, "BX",
fi.foff, tsz);
return;
};
// str IS []u8 — same 3-word {ptr,len,cap}
// as a slice field via *struct: load
// (ptr, len, cap) into (AX, BX, CX). BX
// holds the *struct pointer, so load .len
// LAST so the earlier reads still index
// off the base. str folds onto the slice
// arm (#1/Phase 3 collapse; cite cstage
// cgen.c N_DOT *struct S2).
// Stage the *struct base in BX, then field
// load via cgptrfieldload (shared with the
// #15 global-ptr arm below). BX isn't a load
// target (AX/DX/CX/R8/X0), so order is
// harmless. Mirrors cstage cgen.c N_DOT
// *struct field arm.
emitline("\tMOVQ\t");
emitoff(lc.off: i64);
emitline("(BP), BX\n");
if (isstrtype(c, fi.tnode) || isslicetype(c, fi.tnode)) {
emitline("\tMOVQ\t");
emitdispreg(fi.foff: i64, "BX");
emitline(", AX\n");
emitline("\tMOVQ\t");
emitdispreg((fi.foff + 16): i64, "BX");
emitline(", CX\n");
emitline("\tMOVQ\t");
emitdispreg((fi.foff + 8): i64, "BX");
emitline(", BX\n");
} else { if (isfloattype(c, fi.tnode)) {
// f64/f32 via *struct: route through X0.
// MOVQ into AX leaves the SSE reg stale
// and any downstream consumer (arg
// pass, return, arithmetic) reads
// garbage.
let mov: str = "MOVSD";
if (isf32type(c, fi.tnode)) { mov = "MOVSS"; };
emitline("\t");
emitline(mov);
emitline("\t");
emitdispreg(fi.foff: i64, "BX");
emitline(", X0\n");
} else {
let op: str = fieldloadop(c, fi);
emitline("\t");
emitline(op);
emitline("\t");
emitdispreg(fi.foff: i64, "BX");
emitline(", AX\n");
}; };
cgptrfieldload(c, fi);
return;
};
fi = fi.finext;
@@ -3684,6 +3679,89 @@ fn cgdot(c: *cgen, n: *syntax.node) void = {
};
};
};
// #15 — module-GLOBAL ptr receiver `gp.f` (no local slot, so the
// local arm above is skipped): load the pointer VALUE from name(SB)
// into BX, then field load. Read twin of the #6 store fix; mirrors
// cstage cgen.c N_DOT pointer-to-{struct,slice/str} SB base load. A
// global VALUE struct/slice/array is served by the dedicated global
// arms below, so only a *T receiver lands here.
if (dotlhs != nil) {
if (dotlhs.kind == syntax.nkind.N_IDENT) {
// localfindnode==nil mirrors cstage's off==0 guard: a
// LOCAL ptr (incl. one shadowing a global let) stays on
// the BP-relative local arm above; only a true module
// global lands here.
if (localfindnode(c, dotlhs.str) == nil
&& isletvar(c, dotlhs.str)) {
let gnm: str = dotlhs.str;
let gtn: *syntax.node = letvartnode(c, gnm);
// Peel a NAMED alias chain to expose N_TPTR, the
// same module-aware peel as the local arm (#191/#223).
for (gtn != nil && gtn.kind == syntax.nkind.N_TNAME) {
if (structsamemod(c, gtn.str) != nil) { break; };
let nx: *syntax.node = aliassamemod(c, gtn.str);
if (nx == nil) {
if (structlookup(c, gtn.str) != nil) { break; };
nx = aliaslookup(c, gtn.str);
if (nx == nil) { break; };
};
gtn = nx;
};
if (gtn != nil) {
if (gtn.kind == syntax.nkind.N_TPTR) {
let inner: *syntax.node = gtn.lhs;
let sname: str;
sname.ptr = nil; sname.len = 0;
if (inner != nil) {
if (inner.kind == syntax.nkind.N_TNAME) {
sname = inner.str;
};
};
if (sname.len > 0) {
let si: *structinfo = structlookupchain(c, inner);
if (si != nil) {
let fi: *fieldinfo = si.fields;
for (fi != nil) {
if (syntax.streq(fi.fname, fld)) {
emitline("\tMOVQ\t");
emitsymname(c, gnm);
emitline("(SB), BX\n");
cgptrfieldload(c, fi);
return;
};
fi = fi.finext;
};
};
};
// Pointer to str/slice (`*[]u8`, `*str`): deref
// name(SB), then load at delta within the header.
let delta: i32 = -1;
if (syntax.streq(fld, "ptr")) { delta = 0; };
if (syntax.streq(fld, "len")) { delta = 8; };
if (syntax.streq(fld, "cap")) { delta = 16; };
if (delta >= 0) {
let innerkind: syntax.nkind = syntax.nkind.N_NONE;
if (inner != nil) { innerkind = inner.kind; };
let innerstr: bool = false;
if (innerkind == syntax.nkind.N_TNAME) {
if (syntax.streq(inner.str, "str")) { innerstr = true; };
};
if (innerkind == syntax.nkind.N_TSLICE) { innerstr = true; };
if (innerstr) {
emitline("\tMOVQ\t");
emitsymname(c, gnm);
emitline("(SB), BX\n");
emitline("\tMOVQ\t");
emitdispreg(delta: i64, "BX");
emitline(", AX\n");
return;
};
};
};
};
};
};
};
// `def NAME: str = "..."` field access — inline the literal.
// Sdef-backed strs aren't laid out in memory, so falling
// through to the SB-load fallback below would mis-emit