w6c+wwstage: chained-base array-field address via dotbaseaddr — close the family (#253)

cg_dotbase_addr / dotbaseaddr rejected a non-ident inner, so a chained
base (`o.p.m[i]` / `o.i.m[i]` / `o.a.b.m[i]`) fell to cgexpr(base) which
auto-derefs the array field's first 8 bytes AS a pointer -> garbage base
-> segfault (base64 fillobuf `s.enc.encmap[...]` blocker). Extend the one
helper per stage to accept a chained inner: a new cg_dotchain_addr /
dotchainaddr recovers the container base via the dot-chain spine (recurse
to &x, deref when x is a *struct, sum field offsets), keeping the same
no-AX/no-stack spill contract. dotbaseaddr then takes the pointer VALUE of
inner when viaptr, else its ADDRESS, and adds the field offset. One fix
closes every op (index r/w, addr-of, slice, compound) since all route
through the helper. Symmetric cs==ww byte-id.

test/949: +22 rows. Chained-PTR (rd/wr/addr/slice x2/compound), deeper
(value+ptr leaf links, triple-pointer exercising the internal deref),
non-u8 esz stride (i32 addr+slice), and single-level controls — all
byte-id. The chained VALUE-container arm (`o.i.m`) is run-only (byteid=0):
it needs a value nested-struct instance, which trips THREE orthogonal
pre-existing cs!=ww emission divergences (bare-let zero-init policy,
global DATAW byte count, i32 element-load opcode in the index fallback)
unrelated to #253. Run correctness proves the segfault is gone for that
cell; byte-id there awaits the separate wwstage value-nested-struct fix.

cmd/w6c/cgen.c

@@ -1685,9 +1685,63 @@ static void cg_widen_tagged_push(Cg*, Local**, Type*, Node*, int);
 static void cg_widen_tagged_store(Cg*, Local**, Type*, Node*, int, int, int);
 static void cg_widen_tag_remap(Cg*, Type*, Type*, int);
 
-/* cg_dotbase_addr — compute &(inner.field) into `dst_reg` for a bare
+/* cg_dotchain_addr — compute the ADDRESS of a dot/ident lvalue chain
+ * into `dst_reg`, dereferencing pointer links mid-chain. Returns 1 on
+ * success, 0 if a link isn't a struct / ptr-to-struct it can resolve.
+ * Recursion mirrors the read spine (cgen.c:3722 value-struct field /
+ * :4033 ptr-field): for `x.f`, recurse to &x, deref if x is a *struct
+ * (so dst holds the pointee base), then add f's offset. Touches ONLY
+ * dst_reg — no AX, no stack — so it honours cg_dotbase_addr's caller-
+ * spill contract. The chained-base arm of cg_dotbase_addr (#253) is its
+ * sole caller. */
+static int
+cg_dotchain_addr(Cg *c, Node *node, int dst_reg, Local *locals)
+{
+	if (node == NULL) return 0;
+	if (node->kind == N_IDENT) {
+		int off = localfind(locals, node->str);
+		if (off != 0) {
+			ins2(c, A_LEAQ, amem(D_BP, off), areg(dst_reg));
+			return 1;
+		}
+		if (let_islet(node->str) || def_isstructdef(node->str)) {
+			ins2(c, A_LEAQ, masym(c, node->str), areg(dst_reg));
+			return 1;
+		}
+		return 0;
+	}
+	if (node->kind != N_DOT) return 0;
+	Node *x = node->lhs;
+	if (x == NULL) return 0;
+	Type *xt = x->type;
+	if (xt == NULL || xt == ty_err) return 0;
+	Type *xu = type_chase_named(xt);
+	if (xu == NULL) return 0;
+	int xviaptr = 0;
+	Type *st = NULL;
+	if (xu->kind == TY_PTR) {
+		Type *p = type_chase_named(xu->sub);
+		if (p && p->kind == TY_STRUCT) { st = p; xviaptr = 1; }
+	} else if (xu->kind == TY_STRUCT) {
+		st = xu;
+	}
+	if (st == NULL) return 0;
+	Tfield *f = NULL;
+	for (Tfield *fl = st->fields; fl; fl = fl->next)
+		if (strcmp(fl->name, node->str) == 0) { f = fl; break; }
+	if (f == NULL) return 0;
+	if (!cg_dotchain_addr(c, x, dst_reg, locals)) return 0;
+	if (xviaptr)
+		ins2(c, A_MOVQ, amem(dst_reg, 0), areg(dst_reg));
+	if ((int)f->offset != 0)
+		ins2(c, A_ADDQ, aimm((int)f->offset), areg(dst_reg));
+	return 1;
+}
+
+/* cg_dotbase_addr — compute &(inner.field) into `dst_reg` for an
  * N_DOT base where `inner` is an N_IDENT local (struct value OR *struct
- * pointer). Returns 1 if emitted, 0 if base shape isn't supported (the
+ * pointer) OR a chained N_DOT (#253: `o.p.m` / `o.i.m` / `o.a.b.m`).
+ * Returns 1 if emitted, 0 if base shape isn't supported (the
  * caller falls back to its prior `cgexpr(base); MOVQ AX, dst_reg`).
  *
  * #135: cgexpr on an N_DOT whose .field is a `[N]T`-typed field auto-
@@ -1696,18 +1750,26 @@ static void cg_widen_tag_remap(Cg*, Type*, Type*, int);
  * `d.fld[i] OP= v`), the caller wants the field's ADDRESS — this helper
  * supplies it inline, avoiding the value-load. Mirror primitive of the
  * inverse template at cgen.c arr[i].field (the cgdot N_INDEX-lhs
- * branch). Chained N_DOT (`a.b.c.field[i]`) deferred — not in #135
- * scope.
+ * branch).
  *
- * Caller-spill contract: the helper emits at most one MOVQ + one ADDQ
- * (or one LEAQ); it does NOT touch AX unless dst_reg == D_AX. Safe to
- * call where AX holds an unrelated live value (BX dst). */
+ * #253: a chained inner (`inner` is itself an N_DOT) routes through
+ * cg_dotchain_addr to recover the container's base — the pointer VALUE
+ * of inner when inner is a *struct (viaptr), else the ADDRESS of inner
+ * — then adds the array field's offset. Closes the whole array-field-
+ * base-address family across every op (index r/w, addr-of, slice,
+ * compound) since all of them route through this helper.
+ *
+ * Caller-spill contract: the helper does NOT touch AX unless
+ * dst_reg == D_AX. Safe to call where AX holds an unrelated live value
+ * (BX dst); cg_dotchain_addr keeps the same contract. */
 static int
 cg_dotbase_addr(Cg *c, Node *base, int dst_reg, Local *locals)
 {
 	if (base == NULL || base->kind != N_DOT) return 0;
 	Node *inner = base->lhs;
-	if (inner == NULL || inner->kind != N_IDENT) return 0;
+	if (inner == NULL) return 0;
+	int chained = (inner->kind == N_DOT);
+	if (inner->kind != N_IDENT && !chained) return 0;
 	Type *bt = inner->type;
 	/* #128b: module-qualified `mod.arr` where arr is an imported
 	 * top-level `let X: [N]T`. The checker leaves SK_USE module-idents
@@ -1752,8 +1814,19 @@ cg_dotbase_addr(Cg *c, Node *base, int dst_reg, Local *locals)
 	 * pointer/slice/str field as an inline array. */
 	Type *ft = type_chase_named(f->type);
 	if (ft == NULL || ft->kind != TY_ARRAY) return 0;
-	int inner_off = localfind(locals, inner->str);
 	int foff = (int)f->offset;
+	/* #253: chained inner — compute the container base via the dot-chain
+	 * spine (pointer VALUE of inner when viaptr, else its ADDRESS), then
+	 * add the field offset. cg_dotchain_addr keeps the spill contract. */
+	if (chained) {
+		if (!cg_dotchain_addr(c, inner, dst_reg, locals)) return 0;
+		if (viaptr)
+			ins2(c, A_MOVQ, amem(dst_reg, 0), areg(dst_reg));
+		if (foff != 0)
+			ins2(c, A_ADDQ, aimm(foff), areg(dst_reg));
+		return 1;
+	}
+	int inner_off = localfind(locals, inner->str);
 	/* #249 (sibling of #135): a module-GLOBAL struct value base. localfind
 	 * returns 0 for a global, so the BP-rel form below would emit `LEAQ
 	 * (BP)` (read the stack frame, not the global). Resolve the same way