Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

w6c+wwstage: construct + bind tuple-in-union payload (#242)

Browse Source 
A mixed-scalar tuple WRAPPED IN A TAGGED UNION (the (neg, n) shape Hare's
strconv parseint returns, ((bool,u64)|invalid|overflow)) miscompiled three
ways, all gate-blind (no bootstrap tuple-in-union):

(a) cstage CONSTRUCTION: a tuple variant fell through the N_RETURN scalar
    shuffle, which ZEROED tag + payload — the operands were never packed.
    Route the tuple variant through the scratch-slot widen path; add a
    TY_TUPLE arm to cg_widen_tagged_store that packs each element into the
    union payload at the register-ABI 8B stride + sets the variant tag.

(b) wwstage CHECKER: `let (a,b)=t` over a plain tuple ident (the match-
    bound union payload) left the un-annotated binders UNTYPED, so the bin
    node reading them was untyped -> asserttyped abort. The element-type
    distribution only fired for an N_CALL rhs. Consume the rhs tuple type
    for ANY rhs (mirror cstage check.c:2017).

(c) BOTH stages DESTRUCTURE: the register-cursor receive assumes the rhs
    left every element in AX/DX/CX (a call's tuple-return ABI). For a tuple
    IDENT cgexpr loads only word0->AX, so the 2nd binder read a STALE DX.
    Copy each element from the ident's slot at the 8B stride.

Construction is correct at ANY variant position (the resolved tag, not a
default 0); wwstage resolves it via the typeeq core (flatvariantidxt), not
taggedvariantindext whose str/slice shape-fallback would mask a mismatch.

Two rule-7 loud-stops cover shapes this slotted packing can't yet handle,
on BOTH stages, so neither silently miscompiles:

  - a tuple with a SysV-eightbyte-sharing narrow pair (e.g. (i32,i32,u64)),
    caught by the 8+payload > slot-size guard (the eightbyte tuple
    classification is #243);

  - a tuple built from a BARE LITERAL element (`true`/`false`, suffix-less
    `7`). cstage's cg_tag_for_variant can't type the literal (#241), returns
    -1, and loud-stops. wwstage types `true` as bool and `7` as untyped_int,
    so flatvariantidxt WOULD resolve the variant — a program cstage rejects
    but wwstage accepts is the cs!=ww divergence rule 10 forbids. wwstage
    mirrors cstage's CONDITION (a bare-literal element), not its -1
    mechanism, with an explicit guard that aligns the richer side DOWN. Lift
    BOTH guards together when #241 lands cstage literal typing -> symmetric
    accept.

Test 940_tuple_in_union: 4 K_RUN rows (variant 0, void arm, tuple at
variant 1 two ways) x cstage-run + wwstage-run + cs==ww byte-id, plus 2
K_BUILDERR rows (eightbyte-share, bare-literal) asserting a loud stop with
the #242 diagnostic on BOTH drivers = 16 ok.
This commit is contained in:
Hojun-Cho
2026-06-01 19:56:52 +09:00
parent b79f005489
commit 6fc85f9aaf
8 changed files with 1114 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

128
selfhost/cmd/wcc/cgenutil.ww
View File

@@ -2895,6 +2895,134 @@ fn cgwidentaggedstorebp(c: *cgen, dst: *tinfo, src: *node, slot_off: i32, slot_s
};
return;
};
// #242: tuple payload. Each element rides ONE register-ABI
// eightbyte — scalar/float a single 8B word, a slice/str its 3-word
// {ptr,len,cap} header (24B) — matching the tagged-return load
// (AX=tag, DX=word0, CX=word1, R8=word2) and the cgmlet receive
// cursor. NOT the packed-by-size t.N field layout (#238). Mirror of
// cstage cg_widen_tagged_store's TY_TUPLE arm.
if (src != nil) { if (src.kind == nkind.N_TUPLE) {
let stu: *tinfo = src.type_: *tinfo;
for (stu != nil && stu.kind == tykind.TY_NAMED) { stu = stu.under; };
if (stu != nil) { if (stu.kind == tykind.TY_TUPLE) {
// #242/#241: mirror cstage's loud-stop CONDITION, not its
// -1 mechanism (rule 10, align the RICHER side DOWN).
// wwstage types `true`/`false` as bool and a suffix-less `7`
// as untyped_int, so flatvariantidxt below DOES resolve the
// variant — but cstage's cg_tag_for_variant can't type a bare
// literal element (#241), returns -1, and loud-stops. A
// program cstage rejects, wwstage must also reject. The shape
// cstage can't type: a bool literal (N_TRUE/N_FALSE) or a
// suffix-less numeric literal (untyped_int/untyped_float).
// LIFT BOTH stage guards together when #241 fixes cstage
// literal typing -> symmetric accept.
let bl: *node = src.list;
for (bl != nil) {
let bare: bool = false;
if (bl.kind == nkind.N_TRUE) { bare = true; };
if (bl.kind == nkind.N_FALSE) { bare = true; };
if (bl.kind == nkind.N_INTLIT && bl.tsuffix.len == 0) {
bare = true;
};
if (bl.kind == nkind.N_FLOATLIT && bl.tsuffix.len == 0) {
bare = true;
};
if (bare) {
let ml: str = "cgwidentaggedstore: tuple-in-union variant tag unresolved (untyped/literal tuple element; see #242 / #241)\n";
os.write(2, ml.ptr, ml.len: u64);
os.exit(1);
};
bl = bl.next;
};
// #242: resolve the variant tag via the typeeq core
// (flatvariantidxt) — NOT taggedvariantindext, whose
// str/slice shape fallback would silently pick tag 0 for an
// unmatched tuple, diverging from cstage cg_tag_for_variant
// (which returns -1) and masking the loud-stop below.
let ttag: i32 = flatvariantidxt(dt, src.type_: *tinfo);
// #242: an untyped/literal tuple element (`(true,7)`) leaves
// the src tuple un-matchable, so the variant tag can't
// resolve — the supported shape is a tuple of TYPED exprs
// (strconv parseint `(neg, n)`). Loud-stop rather than
// silently mis-tag (rule 7); #241 literal-init family.
if (ttag < 0) {
let m1: str = "cgwidentaggedstore: tuple-in-union variant tag unresolved (untyped/literal tuple element; see #242 / #241)\n";
os.write(2, m1.ptr, m1.len: u64);
os.exit(1);
};
// #242: this 8B-per-eightbyte packing is correct only when
// no two scalar elements share a SysV eightbyte — e.g.
// (bool,u64). A (i32,i32,u64) would overflow the union
// payload the slotted write assumes. Loud-stop (rule 7);
// SysV eightbyte tuple classification is a deferred
// follow-up. Symmetric with cstage cg_widen_tagged_store.
let ttotal: i32 = 0;
let ce: *node = src.list;
for (ce != nil) {
if (nodeisstr(c, ce) || nodeisslice(c, ce)) {
ttotal += 24;
} else { ttotal += 8; };
ce = ce.next;
};
if (8 + ttotal > slot_sz) {
let m2: str = "cgwidentaggedstore: tuple-in-union payload needs SysV eightbyte packing (narrow elements share an eightbyte; see #242 follow-up)\n";
os.write(2, m2.ptr, m2.len: u64);
os.exit(1);
};
emitline("\tXORQ\tAX, AX\n");
let tzk: i32 = 0;
for (tzk < slot_sz) {
emitline("\tMOVQ\tAX, ");
emitoff((slot_off + tzk): i64);
emitline("(BP)\n");
tzk += 8;
};
let tfoff: i32 = 0;
let te: *node = src.list;
for (te != nil) {
let isflt: bool = isfloattype(c, te);
let wide: bool = nodeisstr(c, te) || nodeisslice(c, te);
let esz: i32 = 8;
let eti: *tinfo = te.type_: *tinfo;
if (eti != nil) { esz = eti.size: i32; };
cgexpr(c, te);
if (isflt) {
let mov: str = "MOVSD";
if (isf32type(c, te)) { mov = "MOVSS"; };
emitline("\t");
emitline(mov);
emitline("\tX0, ");
emitoff((slot_off + 8 + tfoff): i64);
emitline("(BP)\n");
} else { if (wide) {
emitline("\tMOVQ\tAX, ");
emitoff((slot_off + 8 + tfoff): i64);
emitline("(BP)\n");
emitline("\tMOVQ\tBX, ");
emitoff((slot_off + 8 + tfoff + 8): i64);
emitline("(BP)\n");
emitline("\tMOVQ\tCX, ");
emitoff((slot_off + 8 + tfoff + 16): i64);
emitline("(BP)\n");
} else {
let sop: str = tnodestoreop(c, te, esz);
emitline("\t");
emitline(sop);
emitline("\tAX, ");
emitoff((slot_off + 8 + tfoff): i64);
emitline("(BP)\n");
}; };
if (wide) { tfoff += 24; } else { tfoff += 8; };
te = te.next;
};
emitline("\tMOVQ\t$");
emitint(ttag: i64);
emitline(", ");
emitoff(slot_off: i64);
emitline("(BP)\n");
return;
}; };
}; };
// Struct payload (literal or ident).
let sname: str = rhsstructpayload(c, src);
if (sname.len > 0) {