selfhost+test: route N_DOT base through indexvaluetnode + scanlocals for N_INDEX-lhs cgassign chain (#28+#30)

Wwstage's N_INDEX-lhs cgassign dispatch chain had a triple-site
N_DOT base gap (sister latents filed during #24 / #27 review):

  Read (#28): `obj.mat[i][k]` over a struct field mat: **u8.
  cgindex routes the outer N_INDEX's N_INDEX base through
  indexvaluetnode; the recursion bottomed out at the inner
  N_INDEX's N_DOT base with bt=nil. esz fell through to 8 +
  signed_elem to false — wwstage emitted a stray outer
  `MOVQ $8, CX; IMULQ CX, AX` plus `MOVQ (AX), AX` (8-byte
  read over a 1-byte u8) instead of cstage's bare
  `MOVZBQ (AX), AX`.

  Write (#30): `obj.arr[i] = v` over a struct field arr:
  [N]Tagged (e.g. (i64|str)). cgassign's N_DOT-base arm
  computed esz via indexbaseesz but never set elemtn, so the
  tagged-element store gate missed and the 24-byte tagged slot
  was overwritten by a single scalar MOVQ — wrong-width store
  + tag/payload junk in the upper 16 bytes.

Cstage walks `n->lhs->type` directly via the typed AST
(cmd/w6c/cgen.c idx_eff + the N_INDEX-lhs N_ASSIGN branch).
Wwstage now mirrors via indexvaluetnode, which #24 (aa8ca47)
introduced for the N_INDEX-base case; #28/#30 graduate it for
N_DOT base via the existing dotfieldtnode helper.

Bundle graduates N_DOT base for the entire N_INDEX-lhs cgassign
chain: (a) indexvaluetnode in cgenutil.ww handles N_DOT base via
dotfieldtnode; (b) cgassign N_DOT-base arm in cgenexpr.ww calls
indexvaluetnode for elemtn; (c) scanlocals N_DOT-base arm in
cgendecl.ww parallels the existing N_IDENT arm for tagscr-bump.
Splits are bisect-incoherent: (b)-alone clobbers locals via
under-sized frame, (a)-alone leaves the write path with wrong
elemtn, (c)-alone has no consumer. Only the triple delivers a
complete N_DOT-base graduation matching #24's N_INDEX-base
pattern.

Cstage's first-use+fail-loud strategy for @tagscr (#26 commit
069548d) handles the N_DOT-base shape naturally; the scanlocals
N_DOT arm is wwstage-specific. Long-term rule-10 convergence
(wwstage DOWN from scanlocals to first-use+fail-loud on BOTH
stages) is filed as task #15.

Class A wwstage cgen UNDER. No in-tree consumer; sister latents
filed during #24 + #27 reviews. Test 741_dotbase_chained pins
the dispatch + cstage-byte-identical asm for both rows.

Sister latent (filed): indexbaseesz has no N_TARRAY arm for
scalar struct-field array writes — `s.arr: [N]i32` scalar write
falls through to esz=8 on wwstage. No in-tree exerciser; tight
scope kept here.

115/115 ok. ww2 == ww3 == ww4 byte-id.
This commit is contained in:
2026-05-18 20:25:59 +09:00
parent 3ba19227ba
commit 4f1d7a462d
7 changed files with 349 additions and 0 deletions

View File

@@ -0,0 +1,239 @@
/*
* 741_dotbase_chained — sentinel for #28 + #30. Pins wwstage's
* `indexvaluetnode` to handle N_DOT base (graduates the helper #24
* introduced for chained N_INDEX so the N_DOT base shape rides the
* same path).
*
* Two sister latents, one helper graduation:
*
* Read (#28): `obj.mat[i][k]` where obj is a struct with field
* `mat: **u8`. The outer N_INDEX's base is the inner N_INDEX,
* whose base is N_DOT. cgindex routes through `indexvaluetnode`
* for the inner base type; pre-fix `indexvaluetnode` only handled
* N_IDENT + N_INDEX bases, so the recursion bottomed out at the
* N_DOT base with bt=nil. esz fell through to 8 and signed_elem
* to false — wwstage emitted a stray outer `MOVQ $8, CX; IMULQ
* CX, AX` plus `MOVQ (AX), AX` (8-byte read over a 1-byte u8)
* instead of cstage's bare `MOVZBQ (AX), AX`.
*
* Write (#30): `obj.arr[i] = v` where obj is a struct with field
* `arr: [N]Tagged` (e.g. (i64|str)). cgassign's N_DOT-base arm
* computed esz via `indexbaseesz` but never set `elemtn`, so the
* tagged-element store gate (keyed on elemtn) missed and the
* 24-byte tagged slot was overwritten by a single MOVQ scalar
* store — wrong-width store + tag/payload junk in the upper
* 16 bytes. The matching scanlocals pre-pass arm (cgendecl.ww)
* was also missing N_DOT base, so post-elemtn-fix the @tagscr
* slot allocated past the frame boundary and clobbered live
* locals (s, i).
*
* Cstage walks `n->lhs->type` directly via the typed AST (cmd/w6c/
* cgen.c idx_eff + the N_INDEX-lhs N_ASSIGN branch). Wwstage
* mirrors via `indexvaluetnode`, which #24 introduced for the
* N_INDEX-base case and #28/#30 now graduate for N_DOT base via
* `dotfieldtnode` lookup.
*
* Class A wwstage cgen UNDER. No in-tree consumer; sister latents
* filed during #24 + #27 reviews (commits aa8ca47, 3ba1922). This
* sentinel is the sole exerciser of the shape.
*
* Per row: in the `probe` body, assert the dispatch-defining MOV
* mnemonic + scaling is present, plus cstage vs wwstage asm is
* byte-identical.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
/* `needle` = a substring that must appear in the probe body and
* uniquely identifies the post-fix dispatch (narrow MOV mnemonic
* for read, 24B element scale for tagged write).
* `antineedle` = a substring that MUST NOT appear — pre-fix wwstage
* regression marker. Empty string skips the anti-check (write row
* relies on cmp -s byte-id to catch divergence, since the tagged-
* store byte-copy legitimately contains MOVQ-store fragments). */
struct row {
const char *label;
const char *src;
const char *needle;
const char *antineedle;
};
static const struct row rows[] = {
/* Read: chained `obj.mat[i][k]` where mat: **u8. Post-fix wwstage
* routes the inner N_INDEX's N_DOT base through indexvaluetnode →
* dotfieldtnode, esz collapses to 1, outer load becomes MOVZBQ.
* Pre-fix had stray `MOVQ (AX), AX` (8-byte read over u8). */
{ "dotbase_chained_read",
"type S = struct{ pad: i64, mat: **u8 };\n"
"fn probe(s: *S) u8 = {\n"
" let i: i32 = 0;\n"
" let k: u64 = 0u64;\n"
" return s.mat[i][k];\n"
"};\n"
"export fn main() i32 = { return 0; };\n",
"\tMOVZBQ\t(AX), AX\n",
"" },
/* Write: `obj.arr[i] = v` where arr: [N](i64|str) — 24B tagged.
* Post-fix wwstage: cgassign N_DOT arm sets elemtn → tagged-store
* path → IMULQ $24 + byte-copy from scratch. Scanlocals N_DOT arm
* pre-reserves @tagscr in the frame. Pre-fix: scalar `MOVQ AX,
* (BX)` over the 24B slot. */
{ "dotbase_array_tagged_write",
"type T = (i64 | str);\n"
"type S = struct{ pad: i64, arr: [4]T };\n"
"fn probe(s: *S) void = {\n"
" let i: i32 = 0;\n"
" s.arr[i] = 42i64;\n"
"};\n"
"export fn main() i32 = { return 0; };\n",
"\tMOVQ\t$24, CX\n",
"" },
};
static int
slurp(const char *path, char *buf, size_t cap)
{
FILE *f = fopen(path, "rb");
if (!f) return -1;
size_t n = fread(buf, 1, cap - 1, f);
fclose(f);
buf[n] = '\0';
return (int)n;
}
static int
emit_s(const char *w6c, const struct row *r, int i, char *out_s, size_t cap)
{
char src[96], cmd[1024];
snprintf(src, sizeof src, "/tmp/dotbase_%d_%d.ww", getpid(), i);
snprintf(out_s, cap, "/tmp/dotbase_%d_%d_%s.s",
getpid(), i, w6c[strlen(w6c) - 1] == 'w' ? "ww" : "c");
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null", w6c, out_s, src);
int rc = runwait(cmd);
unlink(src);
return rc;
}
/* Inside `TEXT probe`, the needle must appear and the antineedle
* must NOT appear (anti-regression on pre-fix wwstage emit). */
static int
check_probe(const char *spath, const struct row *r, const char *stage)
{
char buf[1 << 14];
if (slurp(spath, buf, sizeof buf) < 0) {
fprintf(stderr, "row[%s][%s]: cannot read %s\n",
r->label, stage, spath);
return -1;
}
const char *fn = strstr(buf, "TEXT probe");
if (!fn) {
fprintf(stderr,
"row[%s][%s]: no TEXT probe in %s\n",
r->label, stage, spath);
return -1;
}
const char *ret = strstr(fn, "\tRET\n");
const char *m = strstr(fn, r->needle);
if (!m || (ret && m > ret)) {
fprintf(stderr,
"row[%s][%s]: expected `%s` in probe body\n",
r->label, stage, r->needle);
return -1;
}
if (r->antineedle[0] != '\0') {
const char *bad = strstr(fn, r->antineedle);
if (bad && (!ret || bad < ret)) {
fprintf(stderr,
"row[%s][%s]: stray `%s` in probe body — "
"pre-fix wwstage regression\n",
r->label, stage, r->antineedle);
return -1;
};
}
return 0;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[512];
if (bin[0] != '/') {
char cwd[256];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char w6c[640], w6c_ww[640];
snprintf(w6c, sizeof w6c, "%s/w6c", bin);
snprintf(w6c_ww, sizeof w6c_ww, "%s/w6c_ww", bin);
int have_ww = (access(w6c_ww, X_OK) == 0);
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int i = 0; i < n; i++) {
char cs_path[128], ws_path[128];
if (emit_s(w6c, &rows[i], i, cs_path, sizeof cs_path) != 0) {
fprintf(stderr,
"dotbase_chained[cstage][%s]: w6c failed\n",
rows[i].label);
fail++; total++; continue;
}
total++;
if (check_probe(cs_path, &rows[i], "cstage") != 0) fail++;
if (!have_ww) { unlink(cs_path); continue; }
if (emit_s(w6c_ww, &rows[i], i, ws_path, sizeof ws_path) != 0) {
fprintf(stderr,
"dotbase_chained[wwstage][%s]: w6c_ww failed\n",
rows[i].label);
fail++; total++;
unlink(cs_path); continue;
}
total++;
if (check_probe(ws_path, &rows[i], "wwstage") != 0) fail++;
total++;
char cmd[512];
snprintf(cmd, sizeof cmd, "cmp -s %s %s", cs_path, ws_path);
if (runwait(cmd) != 0) {
fprintf(stderr,
"dotbase_chained[%s]: cstage vs wwstage asm differs\n",
rows[i].label);
fail++;
}
unlink(cs_path); unlink(ws_path);
}
if (fail) {
fprintf(stderr,
"dotbase_chained: %d/%d fixtures failed\n", fail, total);
return 1;
}
printf("dotbase_chained: %d/%d ok\n", total, total);
return 0;
}