From 4961a91d14ea9962d9734c3d1a0e16047c78d2a8 Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Fri, 12 Jun 2026 09:03:40 +0900 Subject: [PATCH] wcc/ww: is/as on a module-global tagged ident loads from g(SB) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The global tagged ident operand read saved BP instead of the global: 'is' compared garbage as the tag; 'as' never had a payload. Route the load through the g(SB) base — tag at +0, payload at +8, cap at +16 for str (one mechanism, both consumers). The 'is' half aligns ww UP (cs==ww pinned); the 'as' half is a both-wrong pair — cstage spills an uninitialized payload register (its N_TYPEASSERT assumes cgexpr filled AX/DX/CX; filed as task #46), so its rows assert ww-runtime-correct with the cs divergence documented until #46 lands. Review item #18. --- Makefile | 12 ++ selfhost/cmd/w6c/main.combined.ww | 43 ++++++- selfhost/cmd/wcc/cgenexpr.ww | 43 ++++++- selfhost/cmd/wwdump/main.combined.ww | 43 ++++++- test/wcc/989_globtagisas_run.c | 179 +++++++++++++++++++++++++++ 5 files changed, 311 insertions(+), 9 deletions(-) create mode 100644 test/wcc/989_globtagisas_run.c diff --git a/Makefile b/Makefile index d342d562..cef59940 100644 --- a/Makefile +++ b/Makefile @@ -257,6 +257,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_tagnorm_run \ $(BIN)/test_globslicefield_run \ $(BIN)/test_globstrslice_run \ + $(BIN)/test_globtagisas_run \ $(BIN)/test_arr_ptr_global \ $(BIN)/test_def_arr_infer_len \ $(BIN)/test_def_arr_len \ @@ -735,6 +736,17 @@ $(BIN)/test_globstrslice_run: test/wcc/989_globstrslice_run.c \ $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +# 989_globtagisas_run (F8-c3, #18): `is`/`as` on a module-global tagged +# ident must read tag/payload from g(SB), not saved-BP. MIXED per-half: +# `is` align-UP (cs==ww); `as` #263 ww-runtime-correct (cs!=ww residual, +# cstage half = task #46). Per-driver expected rows. See the test header. +$(BIN)/test_globtagisas_run: test/wcc/989_globtagisas_run.c \ + $(BIN)/ww $(BIN)/ww_ww \ + $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + $(BIN)/test_let_global: test/wcc/630_let_global.c $(BIN)/ww $(BIN)/w6c \ $(BIN)/w6a $(BIN)/w6l $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index 96231ec2..f791d753 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -23353,12 +23353,20 @@ fn cgtypetest(c: *cgen, n: *node) void = { let scrutoff: i32 = 0; let scrutt: *node = nil; let nonident: bool = false; + let globalident: bool = false; if (lhs != nil) { if (lhs.kind == nkind.N_IDENT) { let lc: *local = localfindnode(c, lhs.str); if (lc != nil) { scrutoff = lc.off; scrutt = resolvetagged(c, lc.tnode); + } else { + // #18 is-half (align-UP): global tagged ident — tag word at + // g(SB)+0, no BP slot. cstage N_TYPETEST is uniformly cgexpr + // (MOVQ g(SB),AX); pre-fix the !nonident emit read 0(BP)=saved BP. + let gt: *node = letvartnode(c, lhs.str); + scrutt = resolvetagged(c, gt); + globalident = true; }; } else { // #45: non-ident scrutinee (xs[i], p.field, call). @@ -23414,9 +23422,15 @@ fn cgtypetest(c: *cgen, n: *node) void = { want = cgtagvariantidx(c, scrutt, n.rhs); }; if (!nonident) { - emitline("\tMOVQ\t"); - emitoff(scrutoff: i64); - emitline("(BP), AX\n"); + if (globalident) { + emitline("\tMOVQ\t"); + emitsymname(c, lhs.str); + emitline("(SB), AX\n"); + } else { + emitline("\tMOVQ\t"); + emitoff(scrutoff: i64); + emitline("(BP), AX\n"); + }; }; let nel: str = mklabel(c, "is_ne"); let dnl: str = mklabel(c, "is_done"); @@ -23496,6 +23510,29 @@ fn cgtypeassert(c: *cgen, n: *node) void = { if (lc != nil) { scrutoff = lc.off; scrutt = resolvetagged(c, lc.tnode); + } else { + // #18 as-half (#263 ww-runtime-correct; cstage N_TYPEASSERT on a + // global tagged ident spills uninitialized DX as the payload — + // task #46). No BP slot: copy the box words from g(SB) into a + // fresh @asrt_spill so the tag-check + payload load below index + // off memory like a local. cs!=ww residual until #46 lands. + let gt: *node = letvartnode(c, lhs.str); + scrutt = resolvetagged(c, gt); + let gsz: i32 = matchspillsz(c, scrutt); + scrutoff = localalloc(c, "@asrt_spill", gsz, nil); + emitline("\tLEAQ\t"); + emitsymname(c, lhs.str); + emitline("(SB), AX\n"); + let gk: i32 = 0; + for (gk < gsz) { + emitline("\tMOVQ\t"); + emitdispreg(gk: i64, "AX"); + emitline(", DX\n"); + emitline("\tMOVQ\tDX, "); + emitoff((scrutoff + gk): i64); + emitline("(BP)\n"); + gk += 8; + }; }; } else { // Non-ident scrutinee (call result, arr[i], p.field, ?, diff --git a/selfhost/cmd/wcc/cgenexpr.ww b/selfhost/cmd/wcc/cgenexpr.ww index b680dd82..d9cd6f3e 100644 --- a/selfhost/cmd/wcc/cgenexpr.ww +++ b/selfhost/cmd/wcc/cgenexpr.ww @@ -582,12 +582,20 @@ fn cgtypetest(c: *cgen, n: *node) void = { let scrutoff: i32 = 0; let scrutt: *node = nil; let nonident: bool = false; + let globalident: bool = false; if (lhs != nil) { if (lhs.kind == nkind.N_IDENT) { let lc: *local = localfindnode(c, lhs.str); if (lc != nil) { scrutoff = lc.off; scrutt = resolvetagged(c, lc.tnode); + } else { + // #18 is-half (align-UP): global tagged ident — tag word at + // g(SB)+0, no BP slot. cstage N_TYPETEST is uniformly cgexpr + // (MOVQ g(SB),AX); pre-fix the !nonident emit read 0(BP)=saved BP. + let gt: *node = letvartnode(c, lhs.str); + scrutt = resolvetagged(c, gt); + globalident = true; }; } else { // #45: non-ident scrutinee (xs[i], p.field, call). @@ -643,9 +651,15 @@ fn cgtypetest(c: *cgen, n: *node) void = { want = cgtagvariantidx(c, scrutt, n.rhs); }; if (!nonident) { - emitline("\tMOVQ\t"); - emitoff(scrutoff: i64); - emitline("(BP), AX\n"); + if (globalident) { + emitline("\tMOVQ\t"); + emitsymname(c, lhs.str); + emitline("(SB), AX\n"); + } else { + emitline("\tMOVQ\t"); + emitoff(scrutoff: i64); + emitline("(BP), AX\n"); + }; }; let nel: str = mklabel(c, "is_ne"); let dnl: str = mklabel(c, "is_done"); @@ -725,6 +739,29 @@ fn cgtypeassert(c: *cgen, n: *node) void = { if (lc != nil) { scrutoff = lc.off; scrutt = resolvetagged(c, lc.tnode); + } else { + // #18 as-half (#263 ww-runtime-correct; cstage N_TYPEASSERT on a + // global tagged ident spills uninitialized DX as the payload — + // task #46). No BP slot: copy the box words from g(SB) into a + // fresh @asrt_spill so the tag-check + payload load below index + // off memory like a local. cs!=ww residual until #46 lands. + let gt: *node = letvartnode(c, lhs.str); + scrutt = resolvetagged(c, gt); + let gsz: i32 = matchspillsz(c, scrutt); + scrutoff = localalloc(c, "@asrt_spill", gsz, nil); + emitline("\tLEAQ\t"); + emitsymname(c, lhs.str); + emitline("(SB), AX\n"); + let gk: i32 = 0; + for (gk < gsz) { + emitline("\tMOVQ\t"); + emitdispreg(gk: i64, "AX"); + emitline(", DX\n"); + emitline("\tMOVQ\tDX, "); + emitoff((scrutoff + gk): i64); + emitline("(BP)\n"); + gk += 8; + }; }; } else { // Non-ident scrutinee (call result, arr[i], p.field, ?, diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index f4718ef7..2a70ee38 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -23353,12 +23353,20 @@ fn cgtypetest(c: *cgen, n: *node) void = { let scrutoff: i32 = 0; let scrutt: *node = nil; let nonident: bool = false; + let globalident: bool = false; if (lhs != nil) { if (lhs.kind == nkind.N_IDENT) { let lc: *local = localfindnode(c, lhs.str); if (lc != nil) { scrutoff = lc.off; scrutt = resolvetagged(c, lc.tnode); + } else { + // #18 is-half (align-UP): global tagged ident — tag word at + // g(SB)+0, no BP slot. cstage N_TYPETEST is uniformly cgexpr + // (MOVQ g(SB),AX); pre-fix the !nonident emit read 0(BP)=saved BP. + let gt: *node = letvartnode(c, lhs.str); + scrutt = resolvetagged(c, gt); + globalident = true; }; } else { // #45: non-ident scrutinee (xs[i], p.field, call). @@ -23414,9 +23422,15 @@ fn cgtypetest(c: *cgen, n: *node) void = { want = cgtagvariantidx(c, scrutt, n.rhs); }; if (!nonident) { - emitline("\tMOVQ\t"); - emitoff(scrutoff: i64); - emitline("(BP), AX\n"); + if (globalident) { + emitline("\tMOVQ\t"); + emitsymname(c, lhs.str); + emitline("(SB), AX\n"); + } else { + emitline("\tMOVQ\t"); + emitoff(scrutoff: i64); + emitline("(BP), AX\n"); + }; }; let nel: str = mklabel(c, "is_ne"); let dnl: str = mklabel(c, "is_done"); @@ -23496,6 +23510,29 @@ fn cgtypeassert(c: *cgen, n: *node) void = { if (lc != nil) { scrutoff = lc.off; scrutt = resolvetagged(c, lc.tnode); + } else { + // #18 as-half (#263 ww-runtime-correct; cstage N_TYPEASSERT on a + // global tagged ident spills uninitialized DX as the payload — + // task #46). No BP slot: copy the box words from g(SB) into a + // fresh @asrt_spill so the tag-check + payload load below index + // off memory like a local. cs!=ww residual until #46 lands. + let gt: *node = letvartnode(c, lhs.str); + scrutt = resolvetagged(c, gt); + let gsz: i32 = matchspillsz(c, scrutt); + scrutoff = localalloc(c, "@asrt_spill", gsz, nil); + emitline("\tLEAQ\t"); + emitsymname(c, lhs.str); + emitline("(SB), AX\n"); + let gk: i32 = 0; + for (gk < gsz) { + emitline("\tMOVQ\t"); + emitdispreg(gk: i64, "AX"); + emitline(", DX\n"); + emitline("\tMOVQ\tDX, "); + emitoff((scrutoff + gk): i64); + emitline("(BP)\n"); + gk += 8; + }; }; } else { // Non-ident scrutinee (call result, arr[i], p.field, ?, diff --git a/test/wcc/989_globtagisas_run.c b/test/wcc/989_globtagisas_run.c new file mode 100644 index 00000000..7ff5f886 --- /dev/null +++ b/test/wcc/989_globtagisas_run.c @@ -0,0 +1,179 @@ +/* + * 989_globtagisas_run — F8-c3 (report-item #18): `is`/`as` on a module- + * GLOBAL tagged-union ident must read the tag/payload from g(SB), not the + * saved-BP word. + * + * THE BUG (cat-A silent miscompile): in cgenexpr.ww cgtypetest (`is`) and + * cgtypeassert (`as`) resolve an N_IDENT scrutinee's slot via localfindnode. + * A module-global ident returns nil (no BP slot), so scrutoff stayed 0 and + * the tag read fell on 0(BP) = the saved-BP word (and the payload on 8(BP) = + * the return address). cstage N_TYPETEST is uniformly cgexpr (MOVQ g(SB),AX), + * so the bootstrap corpus never trips it on 990-997 — a runtime row is the net. + * + * MIXED CATEGORY (per-half, asm-verified — spec §3 principle): + * • `is` half = ALIGN-UP. cstage reads the tag correctly (MOVQ g(SB),AX); + * wwstage read 0(BP). FIX routes the global ident to MOVQ g(SB),AX → + * cs==ww + runtime-correct (the is_* rows assert want on BOTH drivers). + * • `as` half = #263 BOTH-WRONG. cstage N_TYPEASSERT on a global ident also + * fails: it spills cgexpr's AX (tag only) plus UNINITIALIZED DX as the + * payload (never loads g(SB)+8) → returns garbage (0). The wwstage FIX + * copies the global box words from g(SB)+0/+8[/+16] into a fresh + * @asrt_spill so the tag-check + payload load index off memory like a + * local → ww runtime-correct, while cstage stays wrong: cs≠ww residual + * BY DESIGN until the cstage half lands (ww-core TASK #46). The as_* rows + * assert ww-correct AND pin cstage's documented-wrong value so the residual + * is never misread as a regression. + * + * Rows (built+run on cstage `ww` and wwstage `ww_ww`; each driver checked + * against ITS expected — want_cs / want_ww — to encode the #263 residual): + * row | shape | cs | ww | cat + * ----------+----------------------------------------+----+----+-------- + * is_match | g:(i64|bool)=5; if g is i64 →0 else 12 | 0 | 0 | align-UP + * is_nomatch| g:(i64|bool)=5; if g is bool →13 else 0 | 0 | 0 | align-UP + * as_i64 | g:(i64|bool)=42; (g as i64):int | 0 | 42 | #263 (#46) + * as_str | g:(str|i64)="hello"; len(g as str) | 0 | 5 | #263 (#46) + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { + const char *label; + const char *src; + int want_cs; + int want_ww; +}; + +static const struct row rows[] = { + { "is_match", + "package main;\n" + "let g: (i64 | bool) = 5;\n" + "fn check() int = { if (g is i64) { return 0; }; return 12; };\n" + "export fn main() int = { return check(); };\n", + 0, 0 }, + + { "is_nomatch", + "package main;\n" + "let g: (i64 | bool) = 5;\n" + "fn check() int = { if (g is bool) { return 13; }; return 0; };\n" + "export fn main() int = { return check(); };\n", + 0, 0 }, + + /* #263: cstage spills uninitialized DX as the payload (task #46) → + * returns 0; wwstage copies the box from g(SB) → 42. */ + { "as_i64", + "package main;\n" + "let g: (i64 | bool) = 42;\n" + "fn check() int = { let x: i64 = g as i64; return x: int; };\n" + "export fn main() int = { return check(); };\n", + 0, 42 }, + + /* #263: str variant — wwstage copies the +16 cap word too (task #46). */ + { "as_str", + "package main;\n" + "let g: (str | i64) = \"hello\";\n" + "fn check() int = { let s: str = g as str; return len(s): int; };\n" + "export fn main() int = { return check(); };\n", + 0, 5 }, +}; + +/* run_build — build+run `src` via `driver`; returns the binary's exit + * code, or -1 on a build failure. */ +static int +run_build(const char *driver, const struct row *r, int i) +{ + char src[64], tmpdir[64], cmd[1024]; + snprintf(src, sizeof src, "/tmp/gtia_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/gtia_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -2; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null", + tmpdir, driver, src); + int brc = runwait(cmd); + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[128]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + + int got = -1; + if (brc == 0) got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return brc == 0 ? got : -1; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[1024]; + if (bin[0] != '/') { + char cwd[1024]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[1024], wdrv[1024]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *drv; int gated; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated && access(drivers[d].drv, X_OK) != 0) { + fprintf(stderr, "globtagisas_run: skip %s (no %s)\n", + drivers[d].name, drivers[d].drv); + continue; + } + int is_ww = (d == 1); + for (int i = 0; i < n; i++) { + total++; + int want = is_ww ? rows[i].want_ww : rows[i].want_cs; + int got = run_build(drivers[d].drv, &rows[i], i); + if (got != want) { + fprintf(stderr, "globtagisas_run[%s][%s]: exit=%d " + "want=%d\n", drivers[d].name, rows[i].label, + got, want); + fail++; + } + } + } + + if (fail) { + fprintf(stderr, "globtagisas_run: %d/%d fixtures failed\n", + fail, total); + return 1; + } + printf("globtagisas_run: %d/%d ok\n", total, total); + return 0; +}