diff --git a/Makefile b/Makefile index 80dd0789..62ef7685 100644 --- a/Makefile +++ b/Makefile @@ -252,6 +252,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_chainidx_run \ $(BIN)/test_tupfieldsize_run \ $(BIN)/test_gunsigned_run \ + $(BIN)/test_taggedidx_run \ $(BIN)/test_arr_ptr_global \ $(BIN)/test_def_arr_infer_len \ $(BIN)/test_def_arr_len \ @@ -678,6 +679,16 @@ $(BIN)/test_gunsigned_run: test/wcc/989_gunsigned_run.c \ $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +# 989_taggedidx_run (F7-c6, #23): a tagged-union element indexed off a call +# or slice base must load the full tag+payload cursor. Builds+runs on BOTH +# driver twins (rule-10). +$(BIN)/test_taggedidx_run: test/wcc/989_taggedidx_run.c \ + $(BIN)/ww $(BIN)/ww_ww \ + $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + $(BIN)/test_let_global: test/wcc/630_let_global.c $(BIN)/ww $(BIN)/w6c \ $(BIN)/w6a $(BIN)/w6l $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index 5143a178..c8b6764f 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -24669,18 +24669,22 @@ fn cgindex(c: *cgen, n: *node) void = { elemisstr = isstrtype(c, etn); elemisslice = isslicetype(c, etn); }; - // N_DOT / N_INDEX base (`x.o[i]`, chained `m[i][j]`): the - // element tinfo is n.type_ (the checker-stamped indexresult), - // same source the esz/str/slice/float flags read above. Mirror - // cstage cgen.c:8101 `esubu->kind == TY_TAGGED` — classified for - // ANY base, NOT gated on N_IDENT, and NOT excluding the nullable - // fold (slot_sz=8 degrades the copy arm to one MOVQ, matching - // cstage's fallback `MOVQ AX,BX; MOVQ (BX),AX`). #261: without - // this an N_DOT-base tagged element fell to the scalar - // loadopsz path and silently dropped the tag/payload-high word. - // N_UN deref base joins for the same reason (#61 C). - if (base.kind == nkind.N_DOT || base.kind == nkind.N_INDEX - || (base.kind == nkind.N_UN && base.op == tkind.TK_STAR)) { + // Any NON-ident base (`x.o[i]`, chained `m[i][j]`, `(*p)[i]`, + // call `f()[i]`, slice `s[a:b][i]`, typeassert …): the element + // tinfo is n.type_ (the checker-stamped indexresult), same source + // the esz/str/slice/float flags read above. Mirror cstage + // cgen.c:8101 `esubu->kind == TY_TAGGED` — classified for ANY + // base, NOT gated on a base-kind whitelist, and NOT excluding the + // nullable fold (slot_sz=8 degrades the copy arm to one MOVQ, + // matching cstage's fallback `MOVQ AX,BX; MOVQ (BX),AX`). + // #261: without the classify an N_DOT-base tagged element fell to + // the scalar loadopsz path and dropped the tag/payload-high word; + // #23 (F7-c6): the prior N_DOT/N_INDEX/N_UN whitelist still missed + // an N_CALL / N_SLICE base (`f()[i]` / `s[a:b][i]`) → lone + // `MOVQ (AX),AX` (tag only) vs cstage's full 4-word cursor + // (cs rc=50 / ww rc=40). Dropping the whitelist for the stamp read + // closes the base-kind class by construction. + if (base.kind != nkind.N_IDENT) { let dt: *tinfo = n.type_: *tinfo; if (dt != nil) { if (typeistagged(dt)) { diff --git a/selfhost/cmd/wcc/cgenexpr.ww b/selfhost/cmd/wcc/cgenexpr.ww index 6eaf7d2e..7f003f5a 100644 --- a/selfhost/cmd/wcc/cgenexpr.ww +++ b/selfhost/cmd/wcc/cgenexpr.ww @@ -1966,18 +1966,22 @@ fn cgindex(c: *cgen, n: *node) void = { elemisstr = isstrtype(c, etn); elemisslice = isslicetype(c, etn); }; - // N_DOT / N_INDEX base (`x.o[i]`, chained `m[i][j]`): the - // element tinfo is n.type_ (the checker-stamped indexresult), - // same source the esz/str/slice/float flags read above. Mirror - // cstage cgen.c:8101 `esubu->kind == TY_TAGGED` — classified for - // ANY base, NOT gated on N_IDENT, and NOT excluding the nullable - // fold (slot_sz=8 degrades the copy arm to one MOVQ, matching - // cstage's fallback `MOVQ AX,BX; MOVQ (BX),AX`). #261: without - // this an N_DOT-base tagged element fell to the scalar - // loadopsz path and silently dropped the tag/payload-high word. - // N_UN deref base joins for the same reason (#61 C). - if (base.kind == nkind.N_DOT || base.kind == nkind.N_INDEX - || (base.kind == nkind.N_UN && base.op == tkind.TK_STAR)) { + // Any NON-ident base (`x.o[i]`, chained `m[i][j]`, `(*p)[i]`, + // call `f()[i]`, slice `s[a:b][i]`, typeassert …): the element + // tinfo is n.type_ (the checker-stamped indexresult), same source + // the esz/str/slice/float flags read above. Mirror cstage + // cgen.c:8101 `esubu->kind == TY_TAGGED` — classified for ANY + // base, NOT gated on a base-kind whitelist, and NOT excluding the + // nullable fold (slot_sz=8 degrades the copy arm to one MOVQ, + // matching cstage's fallback `MOVQ AX,BX; MOVQ (BX),AX`). + // #261: without the classify an N_DOT-base tagged element fell to + // the scalar loadopsz path and dropped the tag/payload-high word; + // #23 (F7-c6): the prior N_DOT/N_INDEX/N_UN whitelist still missed + // an N_CALL / N_SLICE base (`f()[i]` / `s[a:b][i]`) → lone + // `MOVQ (AX),AX` (tag only) vs cstage's full 4-word cursor + // (cs rc=50 / ww rc=40). Dropping the whitelist for the stamp read + // closes the base-kind class by construction. + if (base.kind != nkind.N_IDENT) { let dt: *tinfo = n.type_: *tinfo; if (dt != nil) { if (typeistagged(dt)) { diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index 58c4088a..ea84cff5 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -24669,18 +24669,22 @@ fn cgindex(c: *cgen, n: *node) void = { elemisstr = isstrtype(c, etn); elemisslice = isslicetype(c, etn); }; - // N_DOT / N_INDEX base (`x.o[i]`, chained `m[i][j]`): the - // element tinfo is n.type_ (the checker-stamped indexresult), - // same source the esz/str/slice/float flags read above. Mirror - // cstage cgen.c:8101 `esubu->kind == TY_TAGGED` — classified for - // ANY base, NOT gated on N_IDENT, and NOT excluding the nullable - // fold (slot_sz=8 degrades the copy arm to one MOVQ, matching - // cstage's fallback `MOVQ AX,BX; MOVQ (BX),AX`). #261: without - // this an N_DOT-base tagged element fell to the scalar - // loadopsz path and silently dropped the tag/payload-high word. - // N_UN deref base joins for the same reason (#61 C). - if (base.kind == nkind.N_DOT || base.kind == nkind.N_INDEX - || (base.kind == nkind.N_UN && base.op == tkind.TK_STAR)) { + // Any NON-ident base (`x.o[i]`, chained `m[i][j]`, `(*p)[i]`, + // call `f()[i]`, slice `s[a:b][i]`, typeassert …): the element + // tinfo is n.type_ (the checker-stamped indexresult), same source + // the esz/str/slice/float flags read above. Mirror cstage + // cgen.c:8101 `esubu->kind == TY_TAGGED` — classified for ANY + // base, NOT gated on a base-kind whitelist, and NOT excluding the + // nullable fold (slot_sz=8 degrades the copy arm to one MOVQ, + // matching cstage's fallback `MOVQ AX,BX; MOVQ (BX),AX`). + // #261: without the classify an N_DOT-base tagged element fell to + // the scalar loadopsz path and dropped the tag/payload-high word; + // #23 (F7-c6): the prior N_DOT/N_INDEX/N_UN whitelist still missed + // an N_CALL / N_SLICE base (`f()[i]` / `s[a:b][i]`) → lone + // `MOVQ (AX),AX` (tag only) vs cstage's full 4-word cursor + // (cs rc=50 / ww rc=40). Dropping the whitelist for the stamp read + // closes the base-kind class by construction. + if (base.kind != nkind.N_IDENT) { let dt: *tinfo = n.type_: *tinfo; if (dt != nil) { if (typeistagged(dt)) { diff --git a/test/wcc/989_taggedidx_run.c b/test/wcc/989_taggedidx_run.c new file mode 100644 index 00000000..200a3ebd --- /dev/null +++ b/test/wcc/989_taggedidx_run.c @@ -0,0 +1,197 @@ +/* + * 989_taggedidx_run — F7-c6 (#23): a tagged-union element indexed off a + * CALL or SLICE base must load the full tag+payload cursor, both stages. + * + * THE BUG (cat-A silent miscompile, gate-blind): cgindex + * (selfhost/cmd/wcc/cgenexpr.ww) classifies an indexed element as tagged + * so it loads the (tag, val0, val1) slot. The non-ident-base arm gated + * that classify on a base-kind WHITELIST (N_DOT / N_INDEX / N_UN-deref), + * so a tagged element indexed off an N_CALL base (`f()[i]`) or N_SLICE + * base (`s[a:b][i]`) fell through to the scalar load — a lone + * `MOVQ (AX),AX` (tag word only), dropping the payload. cstage classifies + * for ANY base off the stamped element tinfo (`esubu->kind == TY_TAGGED`, + * cmd/w6c/cgen.c:8101), so it loaded the full cursor and ran correct + * (cs rc=50 / ww rc=40 in the review repro — the cat-A divergence). + * 990-997 stay green because the corpus never indexes a tagged element + * off a call/slice base; only a runtime row catches it. THE FIX: drop the + * base-kind whitelist — classify the tagged element off n.type_ for any + * non-N_IDENT base, aligning wwstage UP. + * + * Arrays of tagged are built by per-element store; box = (i64|bool). + * + * Rows (cstage `ww` + gated wwstage `ww_ww`; rule-10 + absolute value): + * row | shape | want + * -----------------+--------------------------------+------ + * slice_tagged_idx | arr[1:][0] (N_SLICE base) | 40 [#23 bug] + * call_tagged_idx | getrows()[1] (N_CALL base) | 50 [#23 bug] + * ident_tagged_idx | arr[1] (N_IDENT base) | 40 (control: the + * | first arm already handled it — no regression) + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { + const char *label; + const char *src; + int want_exit; +}; + +static const struct row rows[] = { + /* (1) #23 — tagged element off a SLICE base `arr[1:][0]`. arr[1] is the + * i64 variant 40; the bug loaded only the tag word → garbage match. */ + { "slice_tagged_idx", + "package main;\n" + "type box = (i64 | bool);\n" + "export fn main() int = {\n" + " let arr: [3]box;\n" + " arr[0] = 10; arr[1] = 40; arr[2] = 70;\n" + " let v: box = arr[1:][0];\n" + " let r: i64 = 0;\n" + " match (v) {\n" + " case let x: i64 => { r = x; };\n" + " case let b: bool => { r = 99; };\n" + " };\n" + " return r: int;\n" + "};\n", + 40 }, + + /* (2) #23 — tagged element off a CALL base `getrows()[1]`. The fn + * returns []box; element 1 is the i64 variant 50. */ + { "call_tagged_idx", + "package main;\n" + "type box = (i64 | bool);\n" + "fn getrows() []box = {\n" + " let arr: [3]box;\n" + " arr[0] = 10; arr[1] = 50; arr[2] = 70;\n" + " return arr[0:];\n" + "};\n" + "export fn main() int = {\n" + " let v: box = getrows()[1];\n" + " let r: i64 = 0;\n" + " match (v) {\n" + " case let x: i64 => { r = x; };\n" + " case let b: bool => { r = 99; };\n" + " };\n" + " return r: int;\n" + "};\n", + 50 }, + + /* (3) control — tagged element off an N_IDENT base `arr[1]` (the first + * cgindex arm already handled it via istaggedtype on the base tnode): + * c6 must not regress it. arr[1] == 40. */ + { "ident_tagged_idx", + "package main;\n" + "type box = (i64 | bool);\n" + "export fn main() int = {\n" + " let arr: [3]box;\n" + " arr[0] = 10; arr[1] = 40; arr[2] = 70;\n" + " let v: box = arr[1];\n" + " let r: i64 = 0;\n" + " match (v) {\n" + " case let x: i64 => { r = x; };\n" + " case let b: bool => { r = 99; };\n" + " };\n" + " return r: int;\n" + "};\n", + 40 }, +}; + +/* run_build — build+run `src` via `driver`; returns the binary's exit + * code, or -1 on a build failure. */ +static int +run_build(const char *driver, const struct row *r, int i) +{ + char src[64], tmpdir[64], cmd[1024]; + snprintf(src, sizeof src, "/tmp/tagidx_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/tagidx_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -2; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null", + tmpdir, driver, src); + int brc = runwait(cmd); + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[128]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + + int got = -1; + if (brc == 0) got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return brc == 0 ? got : -1; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[1024]; + if (bin[0] != '/') { + char cwd[1024]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[1024], wdrv[1024]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *drv; int gated; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated && access(drivers[d].drv, X_OK) != 0) { + fprintf(stderr, "taggedidx_run: skip %s (no %s)\n", + drivers[d].name, drivers[d].drv); + continue; + } + for (int i = 0; i < n; i++) { + total++; + int got = run_build(drivers[d].drv, &rows[i], i); + if (got != rows[i].want_exit) { + fprintf(stderr, "taggedidx_run[%s][%s]: exit=%d " + "want=%d\n", drivers[d].name, rows[i].label, + got, rows[i].want_exit); + fail++; + } + } + } + + if (fail) { + fprintf(stderr, "taggedidx_run: %d/%d fixtures failed\n", + fail, total); + return 1; + } + printf("taggedidx_run: %d/%d ok\n", total, total); + return 0; +}