From 634cbefc22a3572c784706f995ce974fcaf09b3a Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Sun, 24 May 2026 13:57:20 +0900 Subject: [PATCH] cgen: str chained-*struct field read -> 3-word -- Phase 2 C4.6 caseB (both stages) The chained N_DOT path (o.p.f, depth>=2, base AX) still loaded a str-typed field as 2 words, dropping cap -- the C4.6 sibling deferred to caseB. Fold the str case onto the adjacent 3-word slice-field arm (widen kind-gate: cstage type_isstr, ww typeisstr; never size==24). Emits len->BX+8, cap->CX+16, ptr->AX+0 LAST (AX is the base). cstage==wwstage byte-identical; the slice arm is unchanged for slices. test/wcc/934: table-driven runtime .cap-survives over the chained read; the row interposes a CX-clobbering call so a 2-word read cannot coincidentally pass on stale CX (per the 933 discriminator lesson). Verified fail-before/pass-after on both drivers. main.combined.ww regenerated via the canonical make path (md5-stable). --- Makefile | 7 + cmd/w6c/cgen.c | 19 +-- selfhost/cmd/w6c/main.combined.ww | 19 +-- selfhost/cmd/wcc/cgenexpr.ww | 19 +-- selfhost/cmd/wwdump/main.combined.ww | 19 +-- test/wcc/934_str_chained_field_cap_run.c | 168 +++++++++++++++++++++++ 6 files changed, 199 insertions(+), 52 deletions(-) create mode 100644 test/wcc/934_str_chained_field_cap_run.c diff --git a/Makefile b/Makefile index 6d30bf36..80b47043 100644 --- a/Makefile +++ b/Makefile @@ -256,6 +256,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_str_abi_run \ $(BIN)/test_str_elem_cap_run \ $(BIN)/test_str_field_cap_run \ + $(BIN)/test_str_chained_field_cap_run \ $(BIN)/test_composite_call_arg \ $(BIN)/test_composite_call_arg_run \ $(BIN)/test_letdecl_zeroinit \ @@ -634,6 +635,12 @@ $(BIN)/test_str_field_cap_run: test/wcc/933_str_field_cap_run.c \ $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +$(BIN)/test_str_chained_field_cap_run: test/wcc/934_str_chained_field_cap_run.c \ + $(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + $(BIN)/test_composite_call_arg: test/wcc/723_composite_call_arg.c \ $(BIN)/w6c $(BIN)/w6c_ww | $(BIN) $(CC) $(CFLAGS) -o $@ $< diff --git a/cmd/w6c/cgen.c b/cmd/w6c/cgen.c index 1c13976a..8c406c32 100644 --- a/cmd/w6c/cgen.c +++ b/cmd/w6c/cgen.c @@ -6061,20 +6061,13 @@ cgexpr(Cg *c, Node *n, Local *locals) Type *ft = f->type; Type *fu = (ft && ft->kind == TY_NAMED) ? ft->under : ft; - /* str field: load (ptr, len) into (AX, BX). */ - if (fu && fu->kind == TY_STR) { - ins2(c, A_MOVQ, - amem(D_AX, (int)f->offset + 8), - areg(D_BX)); - ins2(c, A_MOVQ, - amem(D_AX, (int)f->offset + 0), - areg(D_AX)); - goto dot_done; - } - /* slice field: load (ptr, len, cap) into + /* str IS []u8 — same 3-word {ptr,len,cap} as a + * slice field: load (ptr, len, cap) into * (AX, BX, CX). AX is the *struct base, so - * load .ptr (which targets AX) LAST. */ - if (fu && fu->kind == TY_SLICE) { + * load .ptr (which targets AX) LAST. str folds + * onto the slice arm (#1/Phase 3 collapse). */ + if ((fu && fu->kind == TY_SLICE) || + type_isstr(ft)) { ins2(c, A_MOVQ, amem(D_AX, (int)f->offset + 8), areg(D_BX)); diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index 3fc849b1..31f1f79f 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -15928,21 +15928,14 @@ fn cgdot(c: *cgen, n: *node) void = { if (streq(tf.name, fld)) { let ft: *tinfo = tf.type_; cgexpr(c, lhs); // AX = ptr to inner struct - // str field: load both halves. - if (typeisstr(ft)) { - emitline("\tMOVQ\t"); - emitdispreg((tf.offset + 8u64): i64, "AX"); - emitline(", BX\n"); - emitline("\tMOVQ\t"); - emitdispreg(tf.offset: i64, "AX"); - emitline(", AX\n"); - return; - }; - // slice field: load (ptr, len, cap) + // str IS []u8 — same 3-word {ptr,len,cap} + // as a slice field: load (ptr, len, cap) // into (AX, BX, CX). AX is the *struct // base, so load .ptr (which targets - // AX) LAST. - if (typeisslice(ft)) { + // AX) LAST. str folds onto the slice + // arm (#1/Phase 3 collapse; cite cstage + // cgen.c N_DOT chained *struct caseB). + if (typeisstr(ft) || typeisslice(ft)) { emitline("\tMOVQ\t"); emitdispreg((tf.offset + 8u64): i64, "AX"); emitline(", BX\n"); diff --git a/selfhost/cmd/wcc/cgenexpr.ww b/selfhost/cmd/wcc/cgenexpr.ww index 7b1efb80..de6abd12 100644 --- a/selfhost/cmd/wcc/cgenexpr.ww +++ b/selfhost/cmd/wcc/cgenexpr.ww @@ -2100,21 +2100,14 @@ fn cgdot(c: *cgen, n: *node) void = { if (streq(tf.name, fld)) { let ft: *tinfo = tf.type_; cgexpr(c, lhs); // AX = ptr to inner struct - // str field: load both halves. - if (typeisstr(ft)) { - emitline("\tMOVQ\t"); - emitdispreg((tf.offset + 8u64): i64, "AX"); - emitline(", BX\n"); - emitline("\tMOVQ\t"); - emitdispreg(tf.offset: i64, "AX"); - emitline(", AX\n"); - return; - }; - // slice field: load (ptr, len, cap) + // str IS []u8 — same 3-word {ptr,len,cap} + // as a slice field: load (ptr, len, cap) // into (AX, BX, CX). AX is the *struct // base, so load .ptr (which targets - // AX) LAST. - if (typeisslice(ft)) { + // AX) LAST. str folds onto the slice + // arm (#1/Phase 3 collapse; cite cstage + // cgen.c N_DOT chained *struct caseB). + if (typeisstr(ft) || typeisslice(ft)) { emitline("\tMOVQ\t"); emitdispreg((tf.offset + 8u64): i64, "AX"); emitline(", BX\n"); diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index a2749bcc..bb80071c 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -15928,21 +15928,14 @@ fn cgdot(c: *cgen, n: *node) void = { if (streq(tf.name, fld)) { let ft: *tinfo = tf.type_; cgexpr(c, lhs); // AX = ptr to inner struct - // str field: load both halves. - if (typeisstr(ft)) { - emitline("\tMOVQ\t"); - emitdispreg((tf.offset + 8u64): i64, "AX"); - emitline(", BX\n"); - emitline("\tMOVQ\t"); - emitdispreg(tf.offset: i64, "AX"); - emitline(", AX\n"); - return; - }; - // slice field: load (ptr, len, cap) + // str IS []u8 — same 3-word {ptr,len,cap} + // as a slice field: load (ptr, len, cap) // into (AX, BX, CX). AX is the *struct // base, so load .ptr (which targets - // AX) LAST. - if (typeisslice(ft)) { + // AX) LAST. str folds onto the slice + // arm (#1/Phase 3 collapse; cite cstage + // cgen.c N_DOT chained *struct caseB). + if (typeisstr(ft) || typeisslice(ft)) { emitline("\tMOVQ\t"); emitdispreg((tf.offset + 8u64): i64, "AX"); emitline(", BX\n"); diff --git a/test/wcc/934_str_chained_field_cap_run.c b/test/wcc/934_str_chained_field_cap_run.c new file mode 100644 index 00000000..c8bdcb12 --- /dev/null +++ b/test/wcc/934_str_chained_field_cap_run.c @@ -0,0 +1,168 @@ +/* + * 934_str_chained_field_cap_run — runtime coverage for the C4.6-caseB fold: + * a CHAINED str-field read `o.p.f` (depth >= 2, where p is a *struct field of + * o and f is a str field of *p) must load the full 24B {ptr,len,cap} header, + * not just {ptr,len}. str is 24B since Phase 2 (#1); pre-caseB the chained + * *struct N_DOT str arm loaded 2 words (ptr in AX, len in BX) and dropped cap. + * + * This is the chained sibling of 933 (which covered the direct / single-deref + * S1/S2 arms). The site is cgen.c's "Chained N_DOT through a *struct field" + * branch (n->lhs is itself an N_DOT typed *struct): the lhs cgexpr leaves AX = + * the inner *struct pointer, then the field is read off AX. caseB folds the + * str arm onto the adjacent 3-word slice arm — cap loads from +16(AX) and the + * base (AX = ptr) is read LAST so the earlier index loads still see the base. + * + * The byte-id gates (990-997) can't catch a symmetric 2-word miscompile: if + * both stages drop cap identically, byte-id passes silently. So this pins the + * *runtime* contract — build through both the cstage `ww` and wwstage `ww_ww` + * driver and confirm the assertion holds (exit 0). + * + * DISCRIMINATION (heed the 933 lesson): a 2-word read leaves CX untouched, so + * the row could coincidentally pass if CX happened to still carry the poison + * cap. spoil() interposes a call between the field store and the chained read; + * a call clobbers caller-saved CX (spoil's own str copy leaves cap=44 in CX), + * so a broken 2-word read observes cap=44, not 8, and the row fails (return 1). + * Verified fail-before (reverted fold: exit 1) / pass-after (exit 0), both + * drivers. + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { const char *label; const char *src; int want; }; + +static const struct row rows[] = { + /* caseB — `o.p.f` chained read: o a struct holding p: *inr, inr + * holding a str field f. Base AX = the inner *struct pointer; the + * str field is read 3-word off AX (cap at +16). Poison cap=8 + * (len=2). spoil() interposes a CX-clobbering call between the + * `ist.f = p` store and the chained `o.p.f` read so a broken + * 2-word read cannot coincidentally pass on a stale CX. */ + { "caseb_chained_field", + "type inr = struct { f: str };\n" + "type otr = struct { p: *inr };\n" + "fn spoil() i32 = {\n" + " let z: str = \"zzzz\";\n" + " z.cap = 44i32;\n" + " let w: str = z;\n" + " return w.cap: i32;\n" + "};\n" + "export fn main() i32 = {\n" + " let p: str = \"hi\";\n" + " p.cap = 8i32;\n" + " let ist: inr;\n" + " ist.f = p;\n" + " let o: otr;\n" + " o.p = &ist;\n" + " let junk: i32 = spoil();\n" + " let s: str = o.p.f;\n" + " if (s.cap: i32 != 8) { return 1; };\n" + " if (s.len: i32 != 2) { return 2; };\n" + " if (junk != 44) { return 3; };\n" + " return 0;\n" + "};\n", + 0 }, +}; + +static int +run_driver(const char *driver, const struct row *r, int i) +{ + char src[96], tmpdir[96], cmd[1024]; + snprintf(src, sizeof src, "/tmp/strchainfieldcap_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/strchainfieldcap_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -1; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s", + tmpdir, driver, src); + if (runwait(cmd) != 0) { + fprintf(stderr, "row[%s]: build via %s failed\n", + r->label, driver); + unlink(src); rmdir(tmpdir); + return -1; + } + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[160]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + int got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return got; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[512]; + if (bin[0] != '/') { + char cwd[256]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[640]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + char wdrv[640]; + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *path; int gated_on_existence; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated_on_existence + && access(drivers[d].path, X_OK) != 0) { + fprintf(stderr, + "str_chained_field_cap_run: skip %s (no %s)\n", + drivers[d].name, drivers[d].path); + continue; + } + for (int i = 0; i < n; i++) { + int got = run_driver(drivers[d].path, &rows[i], i); + total++; + if (got != rows[i].want) { + fprintf(stderr, + "str_chained_field_cap_run[%s][%s]: exit=%d want=%d\n", + drivers[d].name, rows[i].label, + got, rows[i].want); + fail++; + } + } + } + + if (fail) { + fprintf(stderr, "str_chained_field_cap_run: %d/%d fixtures failed\n", + fail, total); + return 1; + } + printf("str_chained_field_cap_run: %d/%d ok\n", total, total); + return 0; +}