diff --git a/Makefile b/Makefile index db5eb7fc..c54021ef 100644 --- a/Makefile +++ b/Makefile @@ -246,6 +246,8 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_signed_data_emit_run \ $(BIN)/test_tagged_call_arg \ $(BIN)/test_tagged_call_arg_run \ + $(BIN)/test_sret_struct_return \ + $(BIN)/test_sret_struct_return_run \ $(BIN)/test_param_shadow_mod \ $(BIN)/test_localoff_scope \ $(BIN)/test_cast_enum_movl \ @@ -531,6 +533,16 @@ $(BIN)/test_tagged_call_arg_run: test/wcc/924_tagged_call_arg_run.c \ $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +$(BIN)/test_sret_struct_return: test/wcc/721_sret_struct_return.c \ + $(BIN)/w6c $(BIN)/w6c_ww | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + +$(BIN)/test_sret_struct_return_run: test/wcc/925_sret_struct_return_run.c \ + $(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + $(BIN)/test_use_promote_alias: test/wcc/699_use_promote_alias.c \ $(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ $(LIB)/libwwrt.a | $(BIN) diff --git a/cmd/w6c/cgen.c b/cmd/w6c/cgen.c index 5c90010b..f45a5223 100644 --- a/cmd/w6c/cgen.c +++ b/cmd/w6c/cgen.c @@ -39,6 +39,26 @@ static int *cg_frame; * semantics for synthetic scratches). 0 means "not yet allocated"; * negative offsets returned by local_alloc are the live value. */ static int cg_retscr; +/* System V AMD64 sret discipline (task #23). Plain TY_STRUCT returns + * with size > 24B are passed via a hidden first-arg pointer (RDI) to + * a caller-prealloc dest; the callee writes through that pointer and + * returns it in RAX. Tagged returns (slot ≤ 32B in AX/DX/CX/R8) and + * tuples (16/24B in AX/DX/CX) keep their existing register-return ABI. + * + * cg_sret_arg_off — callee-side @sretarg slot (8B, holds saved RDI). + * Set in cgfn prologue when ret > 24B plain struct. + * cg_sret_dest_off — caller-side dest offset, propagated from a receive + * site (N_LET / N_ASSIGN ident) to the nested N_CALL + * so the call emits `LEAQ off(BP), RDI` instead of + * allocating a scratch. 0 means no receiver wired. + * cg_sretscr_off — per-fn @sretscr discard slot for sret CALLs whose + * result is dropped (no named receiver). Single-slot + * SSoT mirroring cg_retscr. Sized to the largest + * discarded sret return type in the fn. */ +static int cg_sret_arg_off; +static int cg_sret_dest_off; +static int cg_sretscr_off; +static int cg_sretscr_sz; /* Per-fn defer stack: pushed in registration order, popped (emitted) * in reverse at each return. */ @@ -71,6 +91,20 @@ cg_isfloat(Type *t) || t->kind == TY_UNTYPED_FLOAT; } +/* cg_sret_retsize — if `rt` is a plain TY_STRUCT > 24B, return its + * natural size (the sret threshold); else 0. Tagged unions, tuples, + * str, and slices route through their existing register-return ABIs + * regardless of size. Task #23. */ +static int +cg_sret_retsize(Type *rt) +{ + if (rt == NULL) return 0; + if (rt->kind == TY_NAMED) rt = rt->under; + if (rt == NULL || rt->kind != TY_STRUCT) return 0; + if ((int)rt->size <= 24) return 0; + return (int)rt->size; +} + static int node_isfloat(Node *n) { @@ -3629,6 +3663,21 @@ cgexpr(Cg *c, Node *n, Local *locals) } break; } + /* sret receive (#23): `s = f();` where s is a struct + * local >24B. s's slot IS the caller-prealloc dest; + * the callee writes through hidden RDI. Mirrors the + * cglet branch above. */ + if (lu && lu->kind == TY_STRUCT && (int)lu->size > 24 + && n->rhs && n->rhs->kind == N_CALL + && n->op == TK_ASSIGN) { + int off = localfind(locals, n->lhs->str); + if (off != 0) { + cg_sret_dest_off = off; + cgexpr(c, n->rhs, locals); + cg_sret_dest_off = 0; + break; + } + } /* Struct local reassignment: `s = expr;` where s is * a TY_STRUCT local of size <=24B. Two rhs shapes, * mirroring cglet's N_STRUCTLIT and the call-result @@ -4389,11 +4438,48 @@ cgexpr(Cg *c, Node *n, Local *locals) ins1(c, A_PUSHQ, areg(D_AX)); } } + /* sret discipline (#23): callee returns plain TY_STRUCT + * > 24B. Reserve RDI for the hidden dest-pointer arg by + * starting the int-arg cursor at 1 and emit the LEAQ AFTER + * the pop loop (so the pops don't clobber RDI). The dest + * slot is either the receiver's own slot (cg_sret_dest_off, + * propagated from N_LET / N_ASSIGN ident receive) or a + * per-fn @sretscr discard slot. Sized at the receive site + * or here for discards. + * + * Stack alignment is unaffected because pushargsrev/pops + * left RDI free — we never popped a user arg into it. */ + int sret_call_sz = 0; + int sret_call_off = 0; + { + Type *ret = (cu && cu->kind == TY_FN) + ? cu->ret : NULL; + sret_call_sz = cg_sret_retsize(ret); + } + if (sret_call_sz > 0) { + /* Always pre-allocate @sretscr at the first sret CALL + * regardless of whether cg_sret_dest_off is set — keeps + * cstage's frame in lockstep with wwstage's + * scanlocals-based reservation. Single-slot SSoT (cg_ + * sretscr_off) mirrors @retscr / @tagscr conventions. */ + if (cg_sretscr_off == 0) { + cg_sretscr_off = local_alloc(c, + &locals, "@sretscr", + sret_call_sz, cg_frame); + cg_sretscr_sz = sret_call_sz; + } + if (cg_sret_dest_off != 0) { + sret_call_off = cg_sret_dest_off; + cg_sret_dest_off = 0; + } else { + sret_call_off = cg_sretscr_off; + } + } /* pop forward into the right register class. Args that * don't fit in regs stay on the stack and are reached by * the callee via positive offsets from BP. The caller is * responsible for cleaning them up after CALL. */ - int ii = 0, fi = 0, stackslots = 0; + int ii = (sret_call_sz > 0) ? 1 : 0, fi = 0, stackslots = 0; for (int i = 0; i < argcount; i++) { if (widen[i]) { /* Pop widened tagged slot into arg-register @@ -4459,6 +4545,12 @@ cgexpr(Cg *c, Node *n, Local *locals) } } } + /* sret hidden first-arg (#23): load &dest into RDI AFTER + * all user-arg pops have finished — the pop loop started + * its int-arg cursor at 1, so RDI was never written. */ + if (sret_call_sz > 0) + ins2(c, A_LEAQ, amem(D_BP, sret_call_off), + areg(D_DI)); /* SysV: variadic callees require AL to hold the count of * XMM regs used in the variable portion. We don't pass * floats yet, so AL=0 covers every case we emit. */ @@ -6132,6 +6224,18 @@ cgstmt(Cg *c, Node *n, Local **locals, int *frame) cg_structlit_fill_bp(c, locals, lu, n->rhs, off); break; } + /* sret receive (#23): plain TY_STRUCT >24B. The let's own + * slot IS the caller-prealloc dest; the call writes + * through hidden RDI directly into our slot, no AX/DX/CX + * shuffle. Set cg_sret_dest_off so the nested cgexpr → + * N_CALL path emits `LEAQ off(BP), RDI` before CALL. */ + if (n->rhs && n->rhs->kind == N_CALL && lu + && lu->kind == TY_STRUCT && sz > 24) { + cg_sret_dest_off = off; + cgexpr(c, n->rhs, *locals); + cg_sret_dest_off = 0; + break; + } /* Whole-struct receive for sizes <=24B (call-result rhs). * Counterpart of #4's cgreturn ABI: cgexpr leaves * AX=bytes[0..7], DX=bytes[8..15], CX=bytes[16..23], zero- @@ -6435,10 +6539,91 @@ cgstmt(Cg *c, Node *n, Local **locals, int *frame) break; } } + /* sret return (#23): plain TY_STRUCT >24B. Callee writes + * the value through `*(@sretarg)` (the caller-prealloc + * dest passed in RDI at entry; saved to @sretarg in the + * prologue), then loads @sretarg into RAX and rets — the + * SysV sret discipline of "return the pointer". No + * AX/DX/CX shuffle, no scratch slot beyond @sretarg. */ + if (n->lhs && cg_ret_type && cg_sret_arg_off != 0) { + Type *rt = cg_ret_type; + if (rt->kind == TY_NAMED) rt = rt->under; + /* `return f();` from a sret callee falls through the + * arm below (rhs is N_CALL, not N_IDENT/N_STRUCTLIT) + * and would silent-miscompile: cgexpr places inner's + * result in @sretscr but outer never copies into + * *@sretarg and never sets RAX. Fail loud per + * CLAUDE.md rule 7; the workaround `let r = f(); + * return r;` is already wired and correct. */ + if (rt && rt->kind == TY_STRUCT + && (int)rt->size > 24 + && n->lhs->kind == N_CALL) + fatal("cgreturn: sret return-forwarding " + "for >24B struct not wired (task #23)"); + if (rt && rt->kind == TY_STRUCT + && (int)rt->size > 24 + && (n->lhs->kind == N_IDENT + || n->lhs->kind == N_STRUCTLIT)) { + int sz = (int)rt->size; + if (n->lhs->kind == N_STRUCTLIT) { + /* Delegate to the shared *-relative + * fill helper. Same store sequence the + * ≤24B path emits, but the base reg is + * reloaded from @sretarg(BP) before each + * field store. Mirrors DST_PTR_LOCAL + * usage at N_ASSIGN N_DOT via_ptr. */ + cg_structlit_fill(c, locals, rt, + n->lhs, DST_PTR_LOCAL, + cg_sret_arg_off, NULL, 0); + } else { + /* N_IDENT: word-copy from rhs slot to + * *(@sretarg). Whole 8B words via MOVQ; + * trailing partial words via MOVL/MOVB + * so the read stays inside the source + * slot's declared size. */ + int rhsoff = localfind(*locals, + n->lhs->str); + ins2(c, A_MOVQ, + amem(D_BP, cg_sret_arg_off), + areg(D_BX)); + int k = 0; + while (k + 8 <= sz) { + ins2(c, A_MOVQ, + amem(D_BP, rhsoff + k), + areg(D_AX)); + ins2(c, A_MOVQ, areg(D_AX), + amem(D_BX, k)); + k += 8; + } + while (k + 4 <= sz) { + ins2(c, A_MOVL, + amem(D_BP, rhsoff + k), + areg(D_AX)); + ins2(c, A_MOVL, areg(D_AX), + amem(D_BX, k)); + k += 4; + } + while (k < sz) { + ins2(c, A_MOVB, + amem(D_BP, rhsoff + k), + areg(D_AX)); + ins2(c, A_MOVB, areg(D_AX), + amem(D_BX, k)); + k += 1; + } + } + /* sret return: RAX = dest pointer. */ + ins2(c, A_MOVQ, + amem(D_BP, cg_sret_arg_off), areg(D_AX)); + ins2(c, A_MOVQ, areg(D_BP), areg(D_SP)); + ins1(c, A_POPQ, areg(D_BP)); + ins0(c, A_RET); + break; + } + } /* Whole-struct return for sizes ≤24B. ABI: AX=bytes[0..7], - * DX=bytes[8..15], CX=bytes[16..23]. Sizes >24B are not - * wired (sret deferred); they fall through to the scalar - * path below and return only AX. Materialise rhs into a + * DX=bytes[8..15], CX=bytes[16..23]. Sizes >24B route + * through the sret arm above. Materialise rhs into a * zero-padded 24B scratch slot, then emit AX/DX/CX loads * unconditionally so the instruction shape is constant * regardless of declared struct size. The receive side @@ -6872,6 +7057,10 @@ cgfn(Cg *c, FILE *out, Node *fn) nloops = 0; cg_ret_type = fn->type ? fn->type->ret : NULL; cg_retscr = 0; + cg_sret_arg_off = 0; + cg_sret_dest_off = 0; + cg_sretscr_off = 0; + cg_sretscr_sz = 0; int frame = 0; Local *locals = NULL; @@ -6893,10 +7082,23 @@ cgfn(Cg *c, FILE *out, Node *fn) subsp->to = areg(D_SP); emit(c, subsp); + /* sret discipline (#23): plain TY_STRUCT return > 24B consumes + * RDI as a hidden first-arg dest pointer. Spill it to @sretarg + * before the user-param loop so cgreturn can write through it, + * and start the user-arg register counter at 1 to shift every + * declared arg right by one (SI/DX/CX/R8/R9/+stack). */ + if (cg_sret_retsize(cg_ret_type) > 0) { + cg_sret_arg_off = local_alloc(c, &locals, "@sretarg", + 8, &frame); + ins2(c, A_MOVQ, areg(D_DI), + amem(D_BP, cg_sret_arg_off)); + } + /* spill incoming arg registers to local slots. Slice params * occupy 24 bytes; float params land in XMM0..7 (counted * separately from integer DI/SI/DX/CX/R8/R9). */ - int argi = 0, fargi = 0; + int argi = (cg_sret_arg_off != 0) ? 1 : 0; + int fargi = 0; Tparam *tp = fn->type ? fn->type->params : NULL; for (Node *p = fn->list; p; p = p->next) { if (p->str == NULL || strcmp(p->str, "...") == 0) { diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index a291841a..0a1012c8 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -7738,6 +7738,49 @@ fn structnaturalsize(si: *structinfo) i32 = { return n; }; +// sretretsize — if `t` ultimately denotes a plain TY_STRUCT > 24B, +// return its natural size; else 0. Tagged unions, tuples, str, +// slices, scalars route through their existing register-return ABIs +// (AX/DX/CX/[R8]) regardless of size. Task #23 mirrors cstage's +// cg_sret_retsize predicate. Resolves N_TNAME → struct via structlookup +// and unwraps one leading N_TBANG so `type box = !big;` still +// triggers sret on the underlying big. +export fn sretretsize(c: *cgen, t: *node) i32 = { + if (t == nil) { return 0; }; + let r: *node = t; + if (r.kind == nkind.N_TBANG) { + r = r.lhs; + if (r == nil) { return 0; }; + }; + if (r.kind != nkind.N_TNAME) { return 0; }; + // Primitives / aliased-to-primitives are never sret. + if (primsize(r.str) > 0) { return 0; }; + if (streq(r.str, "str")) { return 0; }; + let si: *structinfo = structlookup(c, r.str); + if (si == nil) { return 0; }; + let n: i32 = structnaturalsize(si); + if (n <= 24) { return 0; }; + return n; +}; + +// callsretsize — if N_CALL `n`'s callee returns a plain TY_STRUCT +// > 24B, return its natural size; else 0. Wraps sretretsize over the +// callee's resolved return type, used by cglet / cgassign receive +// sites and cgcall to detect sret at the receive / emit boundaries. +export fn callsretsize(c: *cgen, n: *node) i32 = { + if (n == nil) { return 0; }; + if (n.kind != nkind.N_CALL) { return 0; }; + let callee: *node = n.lhs; + if (callee == nil) { return 0; }; + let cn: str; + cn.ptr = nil; cn.len = 0; + if (callee.kind == nkind.N_IDENT) { cn = callee.str; }; + if (callee.kind == nkind.N_DOT) { cn = callee.str; }; + if (cn.len == 0) { return 0; }; + let rt: *node = fnretlookup(c, cn); + return sretretsize(c, rt); +}; + fn structlookup(c: *cgen, name: str) *structinfo = { // Exact match first: bare-from-source struct names and already- // leafed lookups hit here directly. @@ -12942,6 +12985,24 @@ fn cgcall(c: *cgen, n: *node) void = { }; }; let nargs: i32 = pushargsrev(c, n.list, calleeparams); + // sret call (#23): callee returns plain TY_STRUCT > 24B. The + // dest pointer lands in RDI; start intidx at 1 to skip RDI in + // the user-arg pop loop and emit `LEAQ off(BP), DI` AFTER all + // pops have finished (so they don't clobber RDI). The dest off + // is either the receive site's slot (c.sretdestoff, propagated + // from cglet / cgassign ident) or the per-fn @sretscr discard + // slot reserved by scanlocals. + let sretcs: i32 = callsretsize(c, n); + let sretcalloff: i32 = 0; + if (sretcs > 0) { + if (c.sretdestoff != 0) { + sretcalloff = c.sretdestoff; + c.sretdestoff = 0; + } else { + sretcalloff = localadd(c, "@sretscr", + c.sretscrsz, nil); + }; + }; // Pop forward. Float args were pushed as 8 bytes from X0 via // SUBQ+MOVSD; pop into the XMM stream (X0..X7). Everything else // pops into the int stream (DI..R9) per the SysV ABI. Walk the @@ -12950,6 +13011,7 @@ fn cgcall(c: *cgen, n: *node) void = { // the remaining slots stay on the stack and the callee reads them // via 16+8*k(BP). Caller-cleanup is emitted after the CALL. let intidx: i32 = 0; + if (sretcs > 0) { intidx = 1; }; let fpidx: i32 = 0; let a: *node = n.list; let popped: i32 = 0; @@ -13080,6 +13142,14 @@ fn cgcall(c: *cgen, n: *node) void = { }; }; }; + // sret hidden first-arg (#23): load &dest into RDI AFTER all + // user-arg pops have finished — intidx started at 1 so RDI was + // never written. The CALL emit follows immediately. + if (sretcs > 0) { + emitline("\tLEAQ\t"); + emitoff(sretcalloff: i64); + emitline("(BP), DI\n"); + }; if (isfnptrcall) { // Load fn-ptr field value into AX; CALL AX. We emit the // load AFTER the args have been popped (so AX/BX/etc @@ -15255,6 +15325,21 @@ fn cgassign(c: *cgen, n: *node) void = { }; if (n.rhs != nil && n.rhs.kind == nkind.N_CALL) { + // sret receive (#23): plain + // TY_STRUCT > 24B from a CALL. + // `s` is the prealloc dest; the + // callee writes through hidden RDI + // directly into off(BP). Mirror of + // cglet's sret branch. + if (lcnsz > 24) { + let rscs: i32 = callsretsize(c, n.rhs); + if (rscs > 0) { + c.sretdestoff = off; + cgexpr(c, n.rhs); + c.sretdestoff = 0; + return; + }; + }; let lcsz: i32 = lcnsz; if (lcsz <= 24) { let tlm: i32 = lcsz - (lcsz / 8) * 8; @@ -15744,15 +15829,106 @@ fn cgreturn(c: *cgen, n: *node) void = { c.lastwasreturn = 1; return; }; + // sret return (#23): plain TY_STRUCT > 24B. Callee writes + // through *(@sretarg) (the caller-prealloc dest saved at + // the prologue), then loads @sretarg into RAX and rets — + // the SysV "return the pointer" discipline. Two rhs shapes + // are wired: N_IDENT (word-copy from rhs slot to *(dest)) + // and N_STRUCTLIT (cgstructlitfill with mode=1 PTR_LOCAL). + if (c.sretargoff != 0) { + let scs: i32 = sretretsize(c, c.fnret); + if (scs > 0) { + // `return f();` from a sret callee would silent- + // miscompile: cgexpr writes inner's result to + // @sretscr but outer never copies into *@sretarg + // and never sets RAX. Fail loud per CLAUDE.md + // rule 7; the `let r = f(); return r;` workaround + // is already wired and byte-id with cstage. + if (rhs.kind == nkind.N_CALL) { + let m: str = "ww: cgreturn: sret return-forwarding for >24B struct not wired (task #23)\n"; + os.write(2, m.ptr, m.len: u64); + os.exit(1); + }; + let okrhs: bool = false; + if (rhs.kind == nkind.N_IDENT) { okrhs = true; }; + if (rhs.kind == nkind.N_STRUCTLIT) { okrhs = true; }; + if (okrhs) { + if (rhs.kind == nkind.N_STRUCTLIT) { + let trefn: *node = rhs.lhs; + let sname: str; + sname.ptr = nil; sname.len = 0; + if (trefn != nil) { + if (trefn.kind == nkind.N_IDENT) { sname = trefn.str; } + else { if (trefn.kind == nkind.N_TNAME) { sname = trefn.str; }; }; + }; + let sret_si: *structinfo = structlookup(c, sname); + if (sret_si != nil) { + let emptys: str; + emptys.ptr = nil; emptys.len = 0; + // mode=1 (PTR_LOCAL): base reg = BX, + // reloaded from @sretarg(BP) before + // each field store. disp = 0 because + // the dest pointer IS the struct base. + cgstructlitfill(c, sret_si, rhs, + 1, c.sretargoff, emptys, + 0, scs); + }; + } else { + let rl: *local = localfindnode(c, rhs.str); + if (rl != nil) { + emitline("\tMOVQ\t"); + emitoff(c.sretargoff: i64); + emitline("(BP), BX\n"); + let k: i32 = 0; + for (k + 8 <= scs) { + emitline("\tMOVQ\t"); + emitoff((rl.off + k): i64); + emitline("(BP), AX\n"); + emitline("\tMOVQ\tAX, "); + emitoff(k: i64); + emitline("(BX)\n"); + k += 8; + }; + for (k + 4 <= scs) { + emitline("\tMOVL\t"); + emitoff((rl.off + k): i64); + emitline("(BP), AX\n"); + emitline("\tMOVL\tAX, "); + emitoff(k: i64); + emitline("(BX)\n"); + k += 4; + }; + for (k < scs) { + emitline("\tMOVB\t"); + emitoff((rl.off + k): i64); + emitline("(BP), AX\n"); + emitline("\tMOVB\tAX, "); + emitoff(k: i64); + emitline("(BX)\n"); + k += 1; + }; + }; + }; + // sret return: RAX = dest pointer. + emitline("\tMOVQ\t"); + emitoff(c.sretargoff: i64); + emitline("(BP), AX\n"); + emitline("\tMOVQ\tBP, SP\n"); + emitline("\tPOPQ\tBP\n"); + emitline("\tRET\n"); + c.lastwasreturn = 1; + return; + }; + }; + }; // Whole-struct return for sizes <= 24B. ABI: AX=bytes[0..7], // DX=bytes[8..15], CX=bytes[16..23]. Mirrors cstage cgen.c // N_RETURN TY_STRUCT branch. Two rhs shapes are wired: // N_IDENT (word-copy from rhs local slot) and N_STRUCTLIT // (field-by-field store at scratch+foff, with tagged fields // delegated to cgwidentaggedstore). Call-result chain return - // is deferred to #5's receive side. Sizes > 24B fall through - // to the scalar path below (only AX gets the first qword), - // pending sret. + // is deferred to #5's receive side. Sizes > 24B route through + // the sret arm above. let rname: str; rname.ptr = nil; rname.len = 0; if (c.fnret != nil) { @@ -16076,6 +16252,22 @@ fn cglet(c: *cgen, n: *node) void = { return; }; }; + // sret receive (#23): plain TY_STRUCT > 24B from a call. + // The let's own slot IS the caller-prealloc dest; the + // nested cgexpr → cgcall path emits `LEAQ off(BP), DI` + // before the CALL and the callee writes through it. No + // AX/DX/CX shuffle; AX returns the dest pointer per SysV + // sret discipline (irrelevant here). + if (rhs.kind == nkind.N_CALL) { + let scs: i32 = callsretsize(c, rhs); + if (scs > 0) { + c.sretdestoff = off; + cgexpr(c, rhs); + c.sretdestoff = 0; + c.lastwasreturn = 0; + return; + }; + }; // Whole-struct receive for sizes <=24B (call-result rhs). // Counterpart of #4's cgreturn ABI: cgexpr leaves // AX=bytes[0..7], DX=bytes[8..15], CX=bytes[16..23], @@ -16804,6 +16996,20 @@ fn tagscrbump(c: *cgen, need: i32) i32 = { return delta; }; +// sretscrbump — sister of tagscrbump for the sret discard slot +// (#23). Tracks max sret return type used as a CALL discard / nested +// receiver. Returns frame-byte delta vs the previous high water mark +// (rounded up to 8B). +fn sretscrbump(c: *cgen, need: i32) i32 = { + let n: i32 = need; + if (n < 8) { n = 8; }; + if ((n & 7) != 0) { n = (n + 7) & ~7; }; + if (n <= c.sretscrsz) { return 0; }; + let delta: i32 = n - c.sretscrsz; + c.sretscrsz = n; + return delta; +}; + // // Recursively walks the body to count every local `let`. Each gets a // slot sized by slotsize(typ); 8-byte default. Match-bindings + for- @@ -17140,6 +17346,17 @@ fn scanlocals(c: *cgen, n: *node) i32 = { }; }; }; + // sret CALL (#23): callee returns plain TY_STRUCT > 24B. The + // receive site (cglet / cgassign ident) overrides at emit time + // with the dest local's own slot; discards / nested calls fall + // back to @sretscr. Single-slot per fn sized to the max sret + // return — sretscrbump tracks the high-water mark so a later + // larger call grows the frame without re-counting the prior + // reservation. Mirrors @tagscr's cumulative tagscrbump. + if (n.kind == nkind.N_CALL) { + let scs: i32 = callsretsize(c, n); + if (scs > 0) { total += sretscrbump(c, scs); }; + }; // Call-site struct-payload widening uses @tagscr — when the // arg is a struct literal/ident and the callee's param is // tagged, pushargsrev materialises in scratch and pushes. @@ -17254,7 +17471,11 @@ fn scanlocals(c: *cgen, n: *node) i32 = { fn cgfnparams(c: *cgen, params: *node) void = { let p: *node = params; + // sret (#23): RDI is consumed by the hidden dest pointer + // (already spilled to @sretarg by cgfn); the first user param + // lands in SI. let idx: i32 = 0; + if (c.sretargoff != 0) { idx = 1; }; let fidx: i32 = 0; // Cursor for args that overflow the SysV reg windows. Each // stack-passed arg lives at 16+8*k(BP) — no spill, the local @@ -17564,6 +17785,14 @@ fn cgfn(c: *cgen, fn_: *node) void = { c.curmod = fn_.module; c.fnret = fn_.lhs; + // sret callee (#23): return type is plain TY_STRUCT > 24B. + // Reserve 8B for @sretarg (holds the saved hidden RDI dest + // pointer); cgfnparams skips DI for user args, cgreturn writes + // through *(@sretarg) and returns @sretarg in RAX. Decision + // made here so the frame pre-scan and cgfnparams see the same + // view of the int-arg cursor. + let sret_callee: bool = sretretsize(c, c.fnret) > 0; + // Emit the TEXT label via emitfnname so the def site picks up the // same skip rule (FFI / `main` / empty-module) and the same module // hint (this fn's own module) that the call sites use. Drops the @@ -17586,6 +17815,12 @@ fn cgfn(c: *cgen, fn_: *node) void = { let frame: i32 = 0; let argi: i32 = 0; let fargi: i32 = 0; + // Reserve @sretarg (8B) BEFORE the param-induced frame, and + // start argi at 1 so the param walker sees RDI as consumed. + if (sret_callee) { + frame += 8; + argi = 1; + }; for (scanp != nil) { if (scanp.kind == nkind.N_PARAM) { let isvar: bool = scanp.op == tkind.TK_ELLIPSIS; @@ -17678,6 +17913,13 @@ fn cgfn(c: *cgen, fn_: *node) void = { emitint(frame: i64); emitline(", SP\n"); + if (sret_callee) { + let saoff: i32 = localadd(c, "@sretarg", 8, nil); + emitline("\tMOVQ\tDI, "); + emitoff(saoff: i64); + emitline("(BP)\n"); + }; + cgfnparams(c, fn_.list); c.lastwasreturn = 0; // Iterate the fn body's statements directly rather than dispatching @@ -18179,6 +18421,29 @@ type cgen = struct { // later emit reuses. Mirrors c.tagscrsz pattern (#38) but tracks // offset, not size (per-fn return type is fixed, so size is too). retscroff: i32, + // System V AMD64 sret discipline (#23). Plain TY_STRUCT returns + // with size > 24B are passed via a hidden first-arg pointer + // (RDI) to a caller-prealloc dest; the callee writes through + // that pointer and returns it in RAX. + // + // sretargoff — callee-side @sretarg slot (8B, holds saved RDI). + // Set in cgfn prologue when the fn's return type + // triggers sret. 0 means N/A. + // sretdestoff — caller-side dest BP offset, propagated from a + // receive site (cglet / cgassign ident) to the + // nested cgexpr → cgcall so the call emits + // `LEAQ off(BP), DI` instead of allocating a + // scratch. 0 means no receiver wired. + // sretscroff — per-fn @sretscr discard slot, used by sret CALLs + // whose result has no named receiver. Single-slot + // SSoT mirroring c.retscroff; the scanlocals walk + // sums c.sretscrsz to pre-reserve. + // sretscrsz — max sret discard size in this fn (sums during + // scanlocals, consumed by localadd("@sretscr", ...)). + sretargoff: i32, + sretdestoff: i32, + sretscroff: i32, + sretscrsz: i32, }; // Top-level mutable `let` registry. Mirrors cmd/w6c/cgen.c LetVar. @@ -18202,6 +18467,10 @@ fn cgeninit(c: *cgen, a: *arena) void = { c.varargseq = 0; c.tagscrsz = 0; c.retscroff = 0; + c.sretargoff = 0; + c.sretdestoff = 0; + c.sretscroff = 0; + c.sretscrsz = 0; // Note: strlit_seq, strlits, ffis are *not* reset here; they // persist across cgfn calls within one file. cgfile resets them // at the start of each compilation unit. @@ -18285,6 +18554,23 @@ fn localadd(c: *cgen, name: str, sz: i32, tnode: *node) i32 = { c.retscroff = off; return off; }; + // @sretarg / @sretscr (#23): same single-slot SSoT + // pattern as @retscr. @sretarg holds the saved hidden + // RDI for sret callees (8B, set once per fn at the + // prologue); @sretscr is the caller-side discard slot + // for sret CALLs whose result is dropped. + if (streq(name, "@sretarg")) { + if (c.sretargoff != 0) { return c.sretargoff; }; + let off: i32 = localalloc(c, name, sz, tnode); + c.sretargoff = off; + return off; + }; + if (streq(name, "@sretscr")) { + if (c.sretscroff != 0) { return c.sretscroff; }; + let off: i32 = localalloc(c, name, sz, tnode); + c.sretscroff = off; + return off; + }; let cur: *local = c.locals; for (cur != nil) { let cn: str = cur.name; diff --git a/selfhost/cmd/wcc/cgen.ww b/selfhost/cmd/wcc/cgen.ww index 08f3fd1b..85541b4a 100644 --- a/selfhost/cmd/wcc/cgen.ww +++ b/selfhost/cmd/wcc/cgen.ww @@ -431,6 +431,29 @@ type cgen = struct { // later emit reuses. Mirrors c.tagscrsz pattern (#38) but tracks // offset, not size (per-fn return type is fixed, so size is too). retscroff: i32, + // System V AMD64 sret discipline (#23). Plain TY_STRUCT returns + // with size > 24B are passed via a hidden first-arg pointer + // (RDI) to a caller-prealloc dest; the callee writes through + // that pointer and returns it in RAX. + // + // sretargoff — callee-side @sretarg slot (8B, holds saved RDI). + // Set in cgfn prologue when the fn's return type + // triggers sret. 0 means N/A. + // sretdestoff — caller-side dest BP offset, propagated from a + // receive site (cglet / cgassign ident) to the + // nested cgexpr → cgcall so the call emits + // `LEAQ off(BP), DI` instead of allocating a + // scratch. 0 means no receiver wired. + // sretscroff — per-fn @sretscr discard slot, used by sret CALLs + // whose result has no named receiver. Single-slot + // SSoT mirroring c.retscroff; the scanlocals walk + // sums c.sretscrsz to pre-reserve. + // sretscrsz — max sret discard size in this fn (sums during + // scanlocals, consumed by localadd("@sretscr", ...)). + sretargoff: i32, + sretdestoff: i32, + sretscroff: i32, + sretscrsz: i32, }; // Top-level mutable `let` registry. Mirrors cmd/w6c/cgen.c LetVar. @@ -454,6 +477,10 @@ fn cgeninit(c: *cgen, a: *arena) void = { c.varargseq = 0; c.tagscrsz = 0; c.retscroff = 0; + c.sretargoff = 0; + c.sretdestoff = 0; + c.sretscroff = 0; + c.sretscrsz = 0; // Note: strlit_seq, strlits, ffis are *not* reset here; they // persist across cgfn calls within one file. cgfile resets them // at the start of each compilation unit. @@ -537,6 +564,23 @@ fn localadd(c: *cgen, name: str, sz: i32, tnode: *node) i32 = { c.retscroff = off; return off; }; + // @sretarg / @sretscr (#23): same single-slot SSoT + // pattern as @retscr. @sretarg holds the saved hidden + // RDI for sret callees (8B, set once per fn at the + // prologue); @sretscr is the caller-side discard slot + // for sret CALLs whose result is dropped. + if (streq(name, "@sretarg")) { + if (c.sretargoff != 0) { return c.sretargoff; }; + let off: i32 = localalloc(c, name, sz, tnode); + c.sretargoff = off; + return off; + }; + if (streq(name, "@sretscr")) { + if (c.sretscroff != 0) { return c.sretscroff; }; + let off: i32 = localalloc(c, name, sz, tnode); + c.sretscroff = off; + return off; + }; let cur: *local = c.locals; for (cur != nil) { let cn: str = cur.name; diff --git a/selfhost/cmd/wcc/cgendecl.ww b/selfhost/cmd/wcc/cgendecl.ww index a98dd8b7..e97d4833 100644 --- a/selfhost/cmd/wcc/cgendecl.ww +++ b/selfhost/cmd/wcc/cgendecl.ww @@ -39,6 +39,20 @@ fn tagscrbump(c: *cgen, need: i32) i32 = { return delta; }; +// sretscrbump — sister of tagscrbump for the sret discard slot +// (#23). Tracks max sret return type used as a CALL discard / nested +// receiver. Returns frame-byte delta vs the previous high water mark +// (rounded up to 8B). +fn sretscrbump(c: *cgen, need: i32) i32 = { + let n: i32 = need; + if (n < 8) { n = 8; }; + if ((n & 7) != 0) { n = (n + 7) & ~7; }; + if (n <= c.sretscrsz) { return 0; }; + let delta: i32 = n - c.sretscrsz; + c.sretscrsz = n; + return delta; +}; + // // Recursively walks the body to count every local `let`. Each gets a // slot sized by slotsize(typ); 8-byte default. Match-bindings + for- @@ -375,6 +389,17 @@ fn scanlocals(c: *cgen, n: *node) i32 = { }; }; }; + // sret CALL (#23): callee returns plain TY_STRUCT > 24B. The + // receive site (cglet / cgassign ident) overrides at emit time + // with the dest local's own slot; discards / nested calls fall + // back to @sretscr. Single-slot per fn sized to the max sret + // return — sretscrbump tracks the high-water mark so a later + // larger call grows the frame without re-counting the prior + // reservation. Mirrors @tagscr's cumulative tagscrbump. + if (n.kind == nkind.N_CALL) { + let scs: i32 = callsretsize(c, n); + if (scs > 0) { total += sretscrbump(c, scs); }; + }; // Call-site struct-payload widening uses @tagscr — when the // arg is a struct literal/ident and the callee's param is // tagged, pushargsrev materialises in scratch and pushes. @@ -489,7 +514,11 @@ fn scanlocals(c: *cgen, n: *node) i32 = { fn cgfnparams(c: *cgen, params: *node) void = { let p: *node = params; + // sret (#23): RDI is consumed by the hidden dest pointer + // (already spilled to @sretarg by cgfn); the first user param + // lands in SI. let idx: i32 = 0; + if (c.sretargoff != 0) { idx = 1; }; let fidx: i32 = 0; // Cursor for args that overflow the SysV reg windows. Each // stack-passed arg lives at 16+8*k(BP) — no spill, the local @@ -799,6 +828,14 @@ fn cgfn(c: *cgen, fn_: *node) void = { c.curmod = fn_.module; c.fnret = fn_.lhs; + // sret callee (#23): return type is plain TY_STRUCT > 24B. + // Reserve 8B for @sretarg (holds the saved hidden RDI dest + // pointer); cgfnparams skips DI for user args, cgreturn writes + // through *(@sretarg) and returns @sretarg in RAX. Decision + // made here so the frame pre-scan and cgfnparams see the same + // view of the int-arg cursor. + let sret_callee: bool = sretretsize(c, c.fnret) > 0; + // Emit the TEXT label via emitfnname so the def site picks up the // same skip rule (FFI / `main` / empty-module) and the same module // hint (this fn's own module) that the call sites use. Drops the @@ -821,6 +858,12 @@ fn cgfn(c: *cgen, fn_: *node) void = { let frame: i32 = 0; let argi: i32 = 0; let fargi: i32 = 0; + // Reserve @sretarg (8B) BEFORE the param-induced frame, and + // start argi at 1 so the param walker sees RDI as consumed. + if (sret_callee) { + frame += 8; + argi = 1; + }; for (scanp != nil) { if (scanp.kind == nkind.N_PARAM) { let isvar: bool = scanp.op == tkind.TK_ELLIPSIS; @@ -913,6 +956,13 @@ fn cgfn(c: *cgen, fn_: *node) void = { emitint(frame: i64); emitline(", SP\n"); + if (sret_callee) { + let saoff: i32 = localadd(c, "@sretarg", 8, nil); + emitline("\tMOVQ\tDI, "); + emitoff(saoff: i64); + emitline("(BP)\n"); + }; + cgfnparams(c, fn_.list); c.lastwasreturn = 0; // Iterate the fn body's statements directly rather than dispatching diff --git a/selfhost/cmd/wcc/cgenexpr.ww b/selfhost/cmd/wcc/cgenexpr.ww index 756c1bff..e8458a81 100644 --- a/selfhost/cmd/wcc/cgenexpr.ww +++ b/selfhost/cmd/wcc/cgenexpr.ww @@ -2991,6 +2991,24 @@ fn cgcall(c: *cgen, n: *node) void = { }; }; let nargs: i32 = pushargsrev(c, n.list, calleeparams); + // sret call (#23): callee returns plain TY_STRUCT > 24B. The + // dest pointer lands in RDI; start intidx at 1 to skip RDI in + // the user-arg pop loop and emit `LEAQ off(BP), DI` AFTER all + // pops have finished (so they don't clobber RDI). The dest off + // is either the receive site's slot (c.sretdestoff, propagated + // from cglet / cgassign ident) or the per-fn @sretscr discard + // slot reserved by scanlocals. + let sretcs: i32 = callsretsize(c, n); + let sretcalloff: i32 = 0; + if (sretcs > 0) { + if (c.sretdestoff != 0) { + sretcalloff = c.sretdestoff; + c.sretdestoff = 0; + } else { + sretcalloff = localadd(c, "@sretscr", + c.sretscrsz, nil); + }; + }; // Pop forward. Float args were pushed as 8 bytes from X0 via // SUBQ+MOVSD; pop into the XMM stream (X0..X7). Everything else // pops into the int stream (DI..R9) per the SysV ABI. Walk the @@ -2999,6 +3017,7 @@ fn cgcall(c: *cgen, n: *node) void = { // the remaining slots stay on the stack and the callee reads them // via 16+8*k(BP). Caller-cleanup is emitted after the CALL. let intidx: i32 = 0; + if (sretcs > 0) { intidx = 1; }; let fpidx: i32 = 0; let a: *node = n.list; let popped: i32 = 0; @@ -3129,6 +3148,14 @@ fn cgcall(c: *cgen, n: *node) void = { }; }; }; + // sret hidden first-arg (#23): load &dest into RDI AFTER all + // user-arg pops have finished — intidx started at 1 so RDI was + // never written. The CALL emit follows immediately. + if (sretcs > 0) { + emitline("\tLEAQ\t"); + emitoff(sretcalloff: i64); + emitline("(BP), DI\n"); + }; if (isfnptrcall) { // Load fn-ptr field value into AX; CALL AX. We emit the // load AFTER the args have been popped (so AX/BX/etc @@ -5304,6 +5331,21 @@ fn cgassign(c: *cgen, n: *node) void = { }; if (n.rhs != nil && n.rhs.kind == nkind.N_CALL) { + // sret receive (#23): plain + // TY_STRUCT > 24B from a CALL. + // `s` is the prealloc dest; the + // callee writes through hidden RDI + // directly into off(BP). Mirror of + // cglet's sret branch. + if (lcnsz > 24) { + let rscs: i32 = callsretsize(c, n.rhs); + if (rscs > 0) { + c.sretdestoff = off; + cgexpr(c, n.rhs); + c.sretdestoff = 0; + return; + }; + }; let lcsz: i32 = lcnsz; if (lcsz <= 24) { let tlm: i32 = lcsz - (lcsz / 8) * 8; diff --git a/selfhost/cmd/wcc/cgenstmt.ww b/selfhost/cmd/wcc/cgenstmt.ww index 1592e72d..b2648219 100644 --- a/selfhost/cmd/wcc/cgenstmt.ww +++ b/selfhost/cmd/wcc/cgenstmt.ww @@ -291,15 +291,106 @@ fn cgreturn(c: *cgen, n: *node) void = { c.lastwasreturn = 1; return; }; + // sret return (#23): plain TY_STRUCT > 24B. Callee writes + // through *(@sretarg) (the caller-prealloc dest saved at + // the prologue), then loads @sretarg into RAX and rets — + // the SysV "return the pointer" discipline. Two rhs shapes + // are wired: N_IDENT (word-copy from rhs slot to *(dest)) + // and N_STRUCTLIT (cgstructlitfill with mode=1 PTR_LOCAL). + if (c.sretargoff != 0) { + let scs: i32 = sretretsize(c, c.fnret); + if (scs > 0) { + // `return f();` from a sret callee would silent- + // miscompile: cgexpr writes inner's result to + // @sretscr but outer never copies into *@sretarg + // and never sets RAX. Fail loud per CLAUDE.md + // rule 7; the `let r = f(); return r;` workaround + // is already wired and byte-id with cstage. + if (rhs.kind == nkind.N_CALL) { + let m: str = "ww: cgreturn: sret return-forwarding for >24B struct not wired (task #23)\n"; + os.write(2, m.ptr, m.len: u64); + os.exit(1); + }; + let okrhs: bool = false; + if (rhs.kind == nkind.N_IDENT) { okrhs = true; }; + if (rhs.kind == nkind.N_STRUCTLIT) { okrhs = true; }; + if (okrhs) { + if (rhs.kind == nkind.N_STRUCTLIT) { + let trefn: *node = rhs.lhs; + let sname: str; + sname.ptr = nil; sname.len = 0; + if (trefn != nil) { + if (trefn.kind == nkind.N_IDENT) { sname = trefn.str; } + else { if (trefn.kind == nkind.N_TNAME) { sname = trefn.str; }; }; + }; + let sret_si: *structinfo = structlookup(c, sname); + if (sret_si != nil) { + let emptys: str; + emptys.ptr = nil; emptys.len = 0; + // mode=1 (PTR_LOCAL): base reg = BX, + // reloaded from @sretarg(BP) before + // each field store. disp = 0 because + // the dest pointer IS the struct base. + cgstructlitfill(c, sret_si, rhs, + 1, c.sretargoff, emptys, + 0, scs); + }; + } else { + let rl: *local = localfindnode(c, rhs.str); + if (rl != nil) { + emitline("\tMOVQ\t"); + emitoff(c.sretargoff: i64); + emitline("(BP), BX\n"); + let k: i32 = 0; + for (k + 8 <= scs) { + emitline("\tMOVQ\t"); + emitoff((rl.off + k): i64); + emitline("(BP), AX\n"); + emitline("\tMOVQ\tAX, "); + emitoff(k: i64); + emitline("(BX)\n"); + k += 8; + }; + for (k + 4 <= scs) { + emitline("\tMOVL\t"); + emitoff((rl.off + k): i64); + emitline("(BP), AX\n"); + emitline("\tMOVL\tAX, "); + emitoff(k: i64); + emitline("(BX)\n"); + k += 4; + }; + for (k < scs) { + emitline("\tMOVB\t"); + emitoff((rl.off + k): i64); + emitline("(BP), AX\n"); + emitline("\tMOVB\tAX, "); + emitoff(k: i64); + emitline("(BX)\n"); + k += 1; + }; + }; + }; + // sret return: RAX = dest pointer. + emitline("\tMOVQ\t"); + emitoff(c.sretargoff: i64); + emitline("(BP), AX\n"); + emitline("\tMOVQ\tBP, SP\n"); + emitline("\tPOPQ\tBP\n"); + emitline("\tRET\n"); + c.lastwasreturn = 1; + return; + }; + }; + }; // Whole-struct return for sizes <= 24B. ABI: AX=bytes[0..7], // DX=bytes[8..15], CX=bytes[16..23]. Mirrors cstage cgen.c // N_RETURN TY_STRUCT branch. Two rhs shapes are wired: // N_IDENT (word-copy from rhs local slot) and N_STRUCTLIT // (field-by-field store at scratch+foff, with tagged fields // delegated to cgwidentaggedstore). Call-result chain return - // is deferred to #5's receive side. Sizes > 24B fall through - // to the scalar path below (only AX gets the first qword), - // pending sret. + // is deferred to #5's receive side. Sizes > 24B route through + // the sret arm above. let rname: str; rname.ptr = nil; rname.len = 0; if (c.fnret != nil) { @@ -623,6 +714,22 @@ fn cglet(c: *cgen, n: *node) void = { return; }; }; + // sret receive (#23): plain TY_STRUCT > 24B from a call. + // The let's own slot IS the caller-prealloc dest; the + // nested cgexpr → cgcall path emits `LEAQ off(BP), DI` + // before the CALL and the callee writes through it. No + // AX/DX/CX shuffle; AX returns the dest pointer per SysV + // sret discipline (irrelevant here). + if (rhs.kind == nkind.N_CALL) { + let scs: i32 = callsretsize(c, rhs); + if (scs > 0) { + c.sretdestoff = off; + cgexpr(c, rhs); + c.sretdestoff = 0; + c.lastwasreturn = 0; + return; + }; + }; // Whole-struct receive for sizes <=24B (call-result rhs). // Counterpart of #4's cgreturn ABI: cgexpr leaves // AX=bytes[0..7], DX=bytes[8..15], CX=bytes[16..23], diff --git a/selfhost/cmd/wcc/cgenutil.ww b/selfhost/cmd/wcc/cgenutil.ww index 63751bf5..4c09674d 100644 --- a/selfhost/cmd/wcc/cgenutil.ww +++ b/selfhost/cmd/wcc/cgenutil.ww @@ -1348,6 +1348,49 @@ fn structnaturalsize(si: *structinfo) i32 = { return n; }; +// sretretsize — if `t` ultimately denotes a plain TY_STRUCT > 24B, +// return its natural size; else 0. Tagged unions, tuples, str, +// slices, scalars route through their existing register-return ABIs +// (AX/DX/CX/[R8]) regardless of size. Task #23 mirrors cstage's +// cg_sret_retsize predicate. Resolves N_TNAME → struct via structlookup +// and unwraps one leading N_TBANG so `type box = !big;` still +// triggers sret on the underlying big. +export fn sretretsize(c: *cgen, t: *node) i32 = { + if (t == nil) { return 0; }; + let r: *node = t; + if (r.kind == nkind.N_TBANG) { + r = r.lhs; + if (r == nil) { return 0; }; + }; + if (r.kind != nkind.N_TNAME) { return 0; }; + // Primitives / aliased-to-primitives are never sret. + if (primsize(r.str) > 0) { return 0; }; + if (streq(r.str, "str")) { return 0; }; + let si: *structinfo = structlookup(c, r.str); + if (si == nil) { return 0; }; + let n: i32 = structnaturalsize(si); + if (n <= 24) { return 0; }; + return n; +}; + +// callsretsize — if N_CALL `n`'s callee returns a plain TY_STRUCT +// > 24B, return its natural size; else 0. Wraps sretretsize over the +// callee's resolved return type, used by cglet / cgassign receive +// sites and cgcall to detect sret at the receive / emit boundaries. +export fn callsretsize(c: *cgen, n: *node) i32 = { + if (n == nil) { return 0; }; + if (n.kind != nkind.N_CALL) { return 0; }; + let callee: *node = n.lhs; + if (callee == nil) { return 0; }; + let cn: str; + cn.ptr = nil; cn.len = 0; + if (callee.kind == nkind.N_IDENT) { cn = callee.str; }; + if (callee.kind == nkind.N_DOT) { cn = callee.str; }; + if (cn.len == 0) { return 0; }; + let rt: *node = fnretlookup(c, cn); + return sretretsize(c, rt); +}; + fn structlookup(c: *cgen, name: str) *structinfo = { // Exact match first: bare-from-source struct names and already- // leafed lookups hit here directly. diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index 1e2ffa46..3cf9e38f 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -7738,6 +7738,49 @@ fn structnaturalsize(si: *structinfo) i32 = { return n; }; +// sretretsize — if `t` ultimately denotes a plain TY_STRUCT > 24B, +// return its natural size; else 0. Tagged unions, tuples, str, +// slices, scalars route through their existing register-return ABIs +// (AX/DX/CX/[R8]) regardless of size. Task #23 mirrors cstage's +// cg_sret_retsize predicate. Resolves N_TNAME → struct via structlookup +// and unwraps one leading N_TBANG so `type box = !big;` still +// triggers sret on the underlying big. +export fn sretretsize(c: *cgen, t: *node) i32 = { + if (t == nil) { return 0; }; + let r: *node = t; + if (r.kind == nkind.N_TBANG) { + r = r.lhs; + if (r == nil) { return 0; }; + }; + if (r.kind != nkind.N_TNAME) { return 0; }; + // Primitives / aliased-to-primitives are never sret. + if (primsize(r.str) > 0) { return 0; }; + if (streq(r.str, "str")) { return 0; }; + let si: *structinfo = structlookup(c, r.str); + if (si == nil) { return 0; }; + let n: i32 = structnaturalsize(si); + if (n <= 24) { return 0; }; + return n; +}; + +// callsretsize — if N_CALL `n`'s callee returns a plain TY_STRUCT +// > 24B, return its natural size; else 0. Wraps sretretsize over the +// callee's resolved return type, used by cglet / cgassign receive +// sites and cgcall to detect sret at the receive / emit boundaries. +export fn callsretsize(c: *cgen, n: *node) i32 = { + if (n == nil) { return 0; }; + if (n.kind != nkind.N_CALL) { return 0; }; + let callee: *node = n.lhs; + if (callee == nil) { return 0; }; + let cn: str; + cn.ptr = nil; cn.len = 0; + if (callee.kind == nkind.N_IDENT) { cn = callee.str; }; + if (callee.kind == nkind.N_DOT) { cn = callee.str; }; + if (cn.len == 0) { return 0; }; + let rt: *node = fnretlookup(c, cn); + return sretretsize(c, rt); +}; + fn structlookup(c: *cgen, name: str) *structinfo = { // Exact match first: bare-from-source struct names and already- // leafed lookups hit here directly. @@ -12942,6 +12985,24 @@ fn cgcall(c: *cgen, n: *node) void = { }; }; let nargs: i32 = pushargsrev(c, n.list, calleeparams); + // sret call (#23): callee returns plain TY_STRUCT > 24B. The + // dest pointer lands in RDI; start intidx at 1 to skip RDI in + // the user-arg pop loop and emit `LEAQ off(BP), DI` AFTER all + // pops have finished (so they don't clobber RDI). The dest off + // is either the receive site's slot (c.sretdestoff, propagated + // from cglet / cgassign ident) or the per-fn @sretscr discard + // slot reserved by scanlocals. + let sretcs: i32 = callsretsize(c, n); + let sretcalloff: i32 = 0; + if (sretcs > 0) { + if (c.sretdestoff != 0) { + sretcalloff = c.sretdestoff; + c.sretdestoff = 0; + } else { + sretcalloff = localadd(c, "@sretscr", + c.sretscrsz, nil); + }; + }; // Pop forward. Float args were pushed as 8 bytes from X0 via // SUBQ+MOVSD; pop into the XMM stream (X0..X7). Everything else // pops into the int stream (DI..R9) per the SysV ABI. Walk the @@ -12950,6 +13011,7 @@ fn cgcall(c: *cgen, n: *node) void = { // the remaining slots stay on the stack and the callee reads them // via 16+8*k(BP). Caller-cleanup is emitted after the CALL. let intidx: i32 = 0; + if (sretcs > 0) { intidx = 1; }; let fpidx: i32 = 0; let a: *node = n.list; let popped: i32 = 0; @@ -13080,6 +13142,14 @@ fn cgcall(c: *cgen, n: *node) void = { }; }; }; + // sret hidden first-arg (#23): load &dest into RDI AFTER all + // user-arg pops have finished — intidx started at 1 so RDI was + // never written. The CALL emit follows immediately. + if (sretcs > 0) { + emitline("\tLEAQ\t"); + emitoff(sretcalloff: i64); + emitline("(BP), DI\n"); + }; if (isfnptrcall) { // Load fn-ptr field value into AX; CALL AX. We emit the // load AFTER the args have been popped (so AX/BX/etc @@ -15255,6 +15325,21 @@ fn cgassign(c: *cgen, n: *node) void = { }; if (n.rhs != nil && n.rhs.kind == nkind.N_CALL) { + // sret receive (#23): plain + // TY_STRUCT > 24B from a CALL. + // `s` is the prealloc dest; the + // callee writes through hidden RDI + // directly into off(BP). Mirror of + // cglet's sret branch. + if (lcnsz > 24) { + let rscs: i32 = callsretsize(c, n.rhs); + if (rscs > 0) { + c.sretdestoff = off; + cgexpr(c, n.rhs); + c.sretdestoff = 0; + return; + }; + }; let lcsz: i32 = lcnsz; if (lcsz <= 24) { let tlm: i32 = lcsz - (lcsz / 8) * 8; @@ -15744,15 +15829,106 @@ fn cgreturn(c: *cgen, n: *node) void = { c.lastwasreturn = 1; return; }; + // sret return (#23): plain TY_STRUCT > 24B. Callee writes + // through *(@sretarg) (the caller-prealloc dest saved at + // the prologue), then loads @sretarg into RAX and rets — + // the SysV "return the pointer" discipline. Two rhs shapes + // are wired: N_IDENT (word-copy from rhs slot to *(dest)) + // and N_STRUCTLIT (cgstructlitfill with mode=1 PTR_LOCAL). + if (c.sretargoff != 0) { + let scs: i32 = sretretsize(c, c.fnret); + if (scs > 0) { + // `return f();` from a sret callee would silent- + // miscompile: cgexpr writes inner's result to + // @sretscr but outer never copies into *@sretarg + // and never sets RAX. Fail loud per CLAUDE.md + // rule 7; the `let r = f(); return r;` workaround + // is already wired and byte-id with cstage. + if (rhs.kind == nkind.N_CALL) { + let m: str = "ww: cgreturn: sret return-forwarding for >24B struct not wired (task #23)\n"; + os.write(2, m.ptr, m.len: u64); + os.exit(1); + }; + let okrhs: bool = false; + if (rhs.kind == nkind.N_IDENT) { okrhs = true; }; + if (rhs.kind == nkind.N_STRUCTLIT) { okrhs = true; }; + if (okrhs) { + if (rhs.kind == nkind.N_STRUCTLIT) { + let trefn: *node = rhs.lhs; + let sname: str; + sname.ptr = nil; sname.len = 0; + if (trefn != nil) { + if (trefn.kind == nkind.N_IDENT) { sname = trefn.str; } + else { if (trefn.kind == nkind.N_TNAME) { sname = trefn.str; }; }; + }; + let sret_si: *structinfo = structlookup(c, sname); + if (sret_si != nil) { + let emptys: str; + emptys.ptr = nil; emptys.len = 0; + // mode=1 (PTR_LOCAL): base reg = BX, + // reloaded from @sretarg(BP) before + // each field store. disp = 0 because + // the dest pointer IS the struct base. + cgstructlitfill(c, sret_si, rhs, + 1, c.sretargoff, emptys, + 0, scs); + }; + } else { + let rl: *local = localfindnode(c, rhs.str); + if (rl != nil) { + emitline("\tMOVQ\t"); + emitoff(c.sretargoff: i64); + emitline("(BP), BX\n"); + let k: i32 = 0; + for (k + 8 <= scs) { + emitline("\tMOVQ\t"); + emitoff((rl.off + k): i64); + emitline("(BP), AX\n"); + emitline("\tMOVQ\tAX, "); + emitoff(k: i64); + emitline("(BX)\n"); + k += 8; + }; + for (k + 4 <= scs) { + emitline("\tMOVL\t"); + emitoff((rl.off + k): i64); + emitline("(BP), AX\n"); + emitline("\tMOVL\tAX, "); + emitoff(k: i64); + emitline("(BX)\n"); + k += 4; + }; + for (k < scs) { + emitline("\tMOVB\t"); + emitoff((rl.off + k): i64); + emitline("(BP), AX\n"); + emitline("\tMOVB\tAX, "); + emitoff(k: i64); + emitline("(BX)\n"); + k += 1; + }; + }; + }; + // sret return: RAX = dest pointer. + emitline("\tMOVQ\t"); + emitoff(c.sretargoff: i64); + emitline("(BP), AX\n"); + emitline("\tMOVQ\tBP, SP\n"); + emitline("\tPOPQ\tBP\n"); + emitline("\tRET\n"); + c.lastwasreturn = 1; + return; + }; + }; + }; // Whole-struct return for sizes <= 24B. ABI: AX=bytes[0..7], // DX=bytes[8..15], CX=bytes[16..23]. Mirrors cstage cgen.c // N_RETURN TY_STRUCT branch. Two rhs shapes are wired: // N_IDENT (word-copy from rhs local slot) and N_STRUCTLIT // (field-by-field store at scratch+foff, with tagged fields // delegated to cgwidentaggedstore). Call-result chain return - // is deferred to #5's receive side. Sizes > 24B fall through - // to the scalar path below (only AX gets the first qword), - // pending sret. + // is deferred to #5's receive side. Sizes > 24B route through + // the sret arm above. let rname: str; rname.ptr = nil; rname.len = 0; if (c.fnret != nil) { @@ -16076,6 +16252,22 @@ fn cglet(c: *cgen, n: *node) void = { return; }; }; + // sret receive (#23): plain TY_STRUCT > 24B from a call. + // The let's own slot IS the caller-prealloc dest; the + // nested cgexpr → cgcall path emits `LEAQ off(BP), DI` + // before the CALL and the callee writes through it. No + // AX/DX/CX shuffle; AX returns the dest pointer per SysV + // sret discipline (irrelevant here). + if (rhs.kind == nkind.N_CALL) { + let scs: i32 = callsretsize(c, rhs); + if (scs > 0) { + c.sretdestoff = off; + cgexpr(c, rhs); + c.sretdestoff = 0; + c.lastwasreturn = 0; + return; + }; + }; // Whole-struct receive for sizes <=24B (call-result rhs). // Counterpart of #4's cgreturn ABI: cgexpr leaves // AX=bytes[0..7], DX=bytes[8..15], CX=bytes[16..23], @@ -16804,6 +16996,20 @@ fn tagscrbump(c: *cgen, need: i32) i32 = { return delta; }; +// sretscrbump — sister of tagscrbump for the sret discard slot +// (#23). Tracks max sret return type used as a CALL discard / nested +// receiver. Returns frame-byte delta vs the previous high water mark +// (rounded up to 8B). +fn sretscrbump(c: *cgen, need: i32) i32 = { + let n: i32 = need; + if (n < 8) { n = 8; }; + if ((n & 7) != 0) { n = (n + 7) & ~7; }; + if (n <= c.sretscrsz) { return 0; }; + let delta: i32 = n - c.sretscrsz; + c.sretscrsz = n; + return delta; +}; + // // Recursively walks the body to count every local `let`. Each gets a // slot sized by slotsize(typ); 8-byte default. Match-bindings + for- @@ -17140,6 +17346,17 @@ fn scanlocals(c: *cgen, n: *node) i32 = { }; }; }; + // sret CALL (#23): callee returns plain TY_STRUCT > 24B. The + // receive site (cglet / cgassign ident) overrides at emit time + // with the dest local's own slot; discards / nested calls fall + // back to @sretscr. Single-slot per fn sized to the max sret + // return — sretscrbump tracks the high-water mark so a later + // larger call grows the frame without re-counting the prior + // reservation. Mirrors @tagscr's cumulative tagscrbump. + if (n.kind == nkind.N_CALL) { + let scs: i32 = callsretsize(c, n); + if (scs > 0) { total += sretscrbump(c, scs); }; + }; // Call-site struct-payload widening uses @tagscr — when the // arg is a struct literal/ident and the callee's param is // tagged, pushargsrev materialises in scratch and pushes. @@ -17254,7 +17471,11 @@ fn scanlocals(c: *cgen, n: *node) i32 = { fn cgfnparams(c: *cgen, params: *node) void = { let p: *node = params; + // sret (#23): RDI is consumed by the hidden dest pointer + // (already spilled to @sretarg by cgfn); the first user param + // lands in SI. let idx: i32 = 0; + if (c.sretargoff != 0) { idx = 1; }; let fidx: i32 = 0; // Cursor for args that overflow the SysV reg windows. Each // stack-passed arg lives at 16+8*k(BP) — no spill, the local @@ -17564,6 +17785,14 @@ fn cgfn(c: *cgen, fn_: *node) void = { c.curmod = fn_.module; c.fnret = fn_.lhs; + // sret callee (#23): return type is plain TY_STRUCT > 24B. + // Reserve 8B for @sretarg (holds the saved hidden RDI dest + // pointer); cgfnparams skips DI for user args, cgreturn writes + // through *(@sretarg) and returns @sretarg in RAX. Decision + // made here so the frame pre-scan and cgfnparams see the same + // view of the int-arg cursor. + let sret_callee: bool = sretretsize(c, c.fnret) > 0; + // Emit the TEXT label via emitfnname so the def site picks up the // same skip rule (FFI / `main` / empty-module) and the same module // hint (this fn's own module) that the call sites use. Drops the @@ -17586,6 +17815,12 @@ fn cgfn(c: *cgen, fn_: *node) void = { let frame: i32 = 0; let argi: i32 = 0; let fargi: i32 = 0; + // Reserve @sretarg (8B) BEFORE the param-induced frame, and + // start argi at 1 so the param walker sees RDI as consumed. + if (sret_callee) { + frame += 8; + argi = 1; + }; for (scanp != nil) { if (scanp.kind == nkind.N_PARAM) { let isvar: bool = scanp.op == tkind.TK_ELLIPSIS; @@ -17678,6 +17913,13 @@ fn cgfn(c: *cgen, fn_: *node) void = { emitint(frame: i64); emitline(", SP\n"); + if (sret_callee) { + let saoff: i32 = localadd(c, "@sretarg", 8, nil); + emitline("\tMOVQ\tDI, "); + emitoff(saoff: i64); + emitline("(BP)\n"); + }; + cgfnparams(c, fn_.list); c.lastwasreturn = 0; // Iterate the fn body's statements directly rather than dispatching @@ -18179,6 +18421,29 @@ type cgen = struct { // later emit reuses. Mirrors c.tagscrsz pattern (#38) but tracks // offset, not size (per-fn return type is fixed, so size is too). retscroff: i32, + // System V AMD64 sret discipline (#23). Plain TY_STRUCT returns + // with size > 24B are passed via a hidden first-arg pointer + // (RDI) to a caller-prealloc dest; the callee writes through + // that pointer and returns it in RAX. + // + // sretargoff — callee-side @sretarg slot (8B, holds saved RDI). + // Set in cgfn prologue when the fn's return type + // triggers sret. 0 means N/A. + // sretdestoff — caller-side dest BP offset, propagated from a + // receive site (cglet / cgassign ident) to the + // nested cgexpr → cgcall so the call emits + // `LEAQ off(BP), DI` instead of allocating a + // scratch. 0 means no receiver wired. + // sretscroff — per-fn @sretscr discard slot, used by sret CALLs + // whose result has no named receiver. Single-slot + // SSoT mirroring c.retscroff; the scanlocals walk + // sums c.sretscrsz to pre-reserve. + // sretscrsz — max sret discard size in this fn (sums during + // scanlocals, consumed by localadd("@sretscr", ...)). + sretargoff: i32, + sretdestoff: i32, + sretscroff: i32, + sretscrsz: i32, }; // Top-level mutable `let` registry. Mirrors cmd/w6c/cgen.c LetVar. @@ -18202,6 +18467,10 @@ fn cgeninit(c: *cgen, a: *arena) void = { c.varargseq = 0; c.tagscrsz = 0; c.retscroff = 0; + c.sretargoff = 0; + c.sretdestoff = 0; + c.sretscroff = 0; + c.sretscrsz = 0; // Note: strlit_seq, strlits, ffis are *not* reset here; they // persist across cgfn calls within one file. cgfile resets them // at the start of each compilation unit. @@ -18285,6 +18554,23 @@ fn localadd(c: *cgen, name: str, sz: i32, tnode: *node) i32 = { c.retscroff = off; return off; }; + // @sretarg / @sretscr (#23): same single-slot SSoT + // pattern as @retscr. @sretarg holds the saved hidden + // RDI for sret callees (8B, set once per fn at the + // prologue); @sretscr is the caller-side discard slot + // for sret CALLs whose result is dropped. + if (streq(name, "@sretarg")) { + if (c.sretargoff != 0) { return c.sretargoff; }; + let off: i32 = localalloc(c, name, sz, tnode); + c.sretargoff = off; + return off; + }; + if (streq(name, "@sretscr")) { + if (c.sretscroff != 0) { return c.sretscroff; }; + let off: i32 = localalloc(c, name, sz, tnode); + c.sretscroff = off; + return off; + }; let cur: *local = c.locals; for (cur != nil) { let cn: str = cur.name; diff --git a/test/wcc/698_cgreturn_struct.c b/test/wcc/698_cgreturn_struct.c index b7a66ba2..c274d2ba 100644 --- a/test/wcc/698_cgreturn_struct.c +++ b/test/wcc/698_cgreturn_struct.c @@ -1,41 +1,39 @@ /* - * 698_cgreturn_struct — whole-struct return ABI for sizes <= 24B. + * 698_cgreturn_struct — whole-struct return ABI across both 3-reg + * register-return (≤24B) and SysV sret (>24B, task #23) paths. * * Pre-#7: `return s;` from a struct-returning fn fell through to the * scalar path: only the first 8 bytes of the struct made it to AX, - * the rest was silently dropped. Compounded with the receive side - * (#5 N_ASSIGN whole-STRUCT rhs) being unwired, struct returns were - * a no-op end-to-end. - * - * #7 wires the producer side: cgreturn now materialises the struct - * into a zero-padded 24B scratch slot (`@retscr`), then loads - * AX/DX/CX from the slot unconditionally — three MOVQs regardless of - * declared size — so receiver code (landing in #5) can read all - * three words and mask by the declared struct size. R8 stays - * reserved for the tagged-return 4th word; sret for sizes > 24B is - * a separate future task. + * the rest was silently dropped. #7 wired the ≤24B producer side + * (materialise into @retscr, load AX/DX/CX). The >24B case stayed + * OUT OF SCOPE — fell through to the same scalar path — until task + * #23 landed standard SysV sret discipline (caller pre-allocates + * dest, passes &dest in RDI, callee writes through *RDI and returns + * RDI in RAX). Surfaced by lib/encoding/utf8 pre-flight when the + * Hoehrmann decoder (`struct { offs: size, src: []u8 }`, 32B) hit + * the OUT-OF-SCOPE path; the marker pattern bit precisely when its + * scope hit, which is the right escalation signal. * * What this test pins: - * - cstage and wwstage emit byte-identical asm for every fixture - * (the bootstrap byte-identity invariant — if either stage's - * scanlocals / cgreturn drifts, the diff catches it). + * - cstage and wwstage emit byte-identical asm for every fixture, + * including the new 25B+ sret rows (the bootstrap byte-identity + * invariant — if either stage's scanlocals / cgreturn / cgcall + * drifts, the diff catches it). * - Each fixture compiles+links+runs without crashing under both * drivers (proves the prologue SUBQ reserves enough frame for - * the @retscr scratch; an under-booked frame would smash the - * saved BP / return address on the load-back). + * @retscr / @sretarg / @sretscr; an under-booked frame would + * smash the saved BP / return address). * - End-to-end value verification (caller reads AX/DX/CX into a - * dst slot) is deferred to #5's test surface, since that's the - * receive side. Until then the call's result is discarded and - * main returns a literal exit code; we're checking the cgreturn - * side doesn't crash or produce invalid asm. + * dst slot, or sret writes through *RDI) is deferred to #5's + * test surface and the new 9xx semantic test for #23. Here we + * check the cgreturn side doesn't crash or produce invalid asm. * - * Coverage: five struct shapes — 8B one-field, 16B two-i64, 24B - * three-i64 (the headline ABI shape), mixed-alignment i32+i32+i64+i64 - * (totsize 24 with the i32-pair packed), and N_IDENT rhs (let-init - * then `return p;`) vs N_STRUCTLIT rhs (`return T{...};`). The - * 25B+ sret case is explicitly OUT OF SCOPE — falls through to the - * existing scalar path (only AX gets the first qword); not pinned - * here. + * Coverage: ≤24B shapes — 8B one-field, 16B two-i64, 24B three-i64, + * mixed-alignment i32+i32+i64+i64 (totsize 24 with the i32-pair + * packed), and N_IDENT rhs (let-init then `return p;`). Plus the + * new 25B+ rows added with #23: 32B i64×4, the utf8 decoder shape + * (i64 + []u8 = 32B aligned, the canonical surfacing case), and + * 40B i64×5. */ #include #include @@ -99,6 +97,42 @@ static const struct row rows[] = { "};\n" "fn main() i32 = { mk(); return 0; };\n", 0 }, + /* 32B four-i64 — first row past the 24B → sret threshold. + * Hits the sret prologue (@sretarg ← DI), the structlit-fill + * through *(@sretarg), and `MOVQ @sretarg(BP), AX; RET`. */ + { "quad_i64_lit_sret", + "type quad = struct { a: i64, b: i64, c: i64, d: i64 };\n" + "fn mk() quad = { return quad { a = 1i64, b = 2i64, c = 3i64, d = 4i64 }; };\n" + "fn main() i32 = { let q: quad = mk(); return 0; };\n", + 0 }, + /* utf8 decoder shape (the surfacing case for #23): + * `struct { offs: i64, src: []u8 }` — i64 at +0, slice at +8 + * (16B+8B alignment, totsize 32). N_IDENT rhs exercises the + * sret word-copy-from-rhs-slot branch. */ + { "decoder_ident_sret", + "type decoder = struct { offs: i64, src: []u8 };\n" + "fn mk(s: []u8) decoder = {\n" + " let r: decoder;\n" + " r.offs = 0i64;\n" + " r.src = s;\n" + " return r;\n" + "};\n" + "fn main() i32 = {\n" + " let b: [1]u8;\n" + " let d: decoder = mk(b[0:1]);\n" + " return 0;\n" + "};\n", + 0 }, + /* 40B five-i64 — second sret row, sized past 32B to exercise + * the sretscr / @sretarg sizing for a larger struct in the + * same fn family. */ + { "five_i64_lit_sret", + "type five = struct { a: i64, b: i64, c: i64, d: i64, e: i64 };\n" + "fn mk() five = {\n" + " return five { a = 1i64, b = 2i64, c = 3i64, d = 4i64, e = 5i64 };\n" + "};\n" + "fn main() i32 = { let f: five = mk(); return 0; };\n", + 0 }, }; static int diff --git a/test/wcc/721_sret_struct_return.c b/test/wcc/721_sret_struct_return.c new file mode 100644 index 00000000..d8b66ee5 --- /dev/null +++ b/test/wcc/721_sret_struct_return.c @@ -0,0 +1,304 @@ +/* + * 721_sret_struct_return — Class A asm-presence sentinels for the + * System V AMD64 sret ABI lowering (task #23). + * + * #23 wires both stages to lower a plain TY_STRUCT return > 24B + * through the standard SysV sret discipline: caller pre-allocates + * dest, passes &dest in RDI as a hidden first arg (shifting all + * declared args right by one — SI/DX/CX/R8/R9/+stack), callee saves + * RDI to @sretarg in the prologue, writes the return value through + * the saved pointer, then `MOVQ @sretarg(BP), AX; RET` (the SysV + * "return the pointer" discipline). 4 lowering sites: caller arg- + * shift+receive, callee prologue, callee return — receive collapses + * into the caller-prealloc because the named LHS slot IS the + * prealloc dest. + * + * Pre-#23: cstage skipped the CALL emit entirely at the receive + * site (frame layout collapsed; exit 11). wwstage emitted the CALL + * but truncated the 32B return to RAX only (slice payload garbage; + * segfault). Surfaced by lib/encoding/utf8 pre-flight when the + * Hoehrmann decoder `struct { offs: size, src: []u8 }` (32B) hit + * the documented OUT-OF-SCOPE marker at 698. + * + * Three sentinels per row pinned here (rob-pike's triangle): + * (a) caller emits `LEAQ (BP), DI` immediately before `CALL` — + * the hidden RDI dest pointer (asm-presence positive). + * (b) callee emits `MOVQ (BP), AX` BEFORE the final `RET` — + * the sret return-the-pointer load (asm-presence positive). + * The K is the @sretarg offset; we don't pin it, but we pin + * that an `(BP), AX` load lives in the last three lines + * before RET in any fn whose return type is > 24B struct. + * (c) caller emits NO `MOVQ AX, (BP)` capture of the call + * result for a return type > 24B (asm-presence negative). + * Pre-#23 wwstage emitted such a capture and truncated. + * + * Plus byte-id between stages per row (a future Class A divergence + * via either site catches here). + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { const char *label; const char *src; }; + +/* Each row's mk fn returns a >24B struct; main does a `let r: T = mk(...)` + * so the receive site is wired and the sret discipline fires. */ +static const struct row rows[] = { + /* 32B four-i64: the smallest-padded sret return shape. */ + { "quad_i64", + "type quad = struct { a: i64, b: i64, c: i64, d: i64 };\n" + "fn mk() quad = {\n" + " return quad { a = 1i64, b = 2i64, c = 3i64, d = 4i64 };\n" + "};\n" + "fn main() i32 = { let q: quad = mk(); return 0; };\n" }, + /* utf8 decoder shape (surfacing case for #23): i64 + []u8. The + * []u8 field's slice layout (ptr/len/cap) crosses the AX/DX/CX + * boundary — the wwstage truncation bug dropped the slice tail. */ + { "decoder", + "type decoder = struct { offs: i64, src: []u8 };\n" + "fn mk(s: []u8) decoder = {\n" + " let r: decoder;\n" + " r.offs = 0i64;\n" + " r.src = s;\n" + " return r;\n" + "};\n" + "fn main() i32 = {\n" + " let b: [1]u8;\n" + " let d: decoder = mk(b[0:1]);\n" + " return 0;\n" + "};\n" }, + /* 40B five-i64: second size past 24B, exercises @sretscr sizing. */ + { "five_i64", + "type five = struct { a: i64, b: i64, c: i64, d: i64, e: i64 };\n" + "fn mk() five = {\n" + " return five { a = 1i64, b = 2i64, c = 3i64, d = 4i64, e = 5i64 };\n" + "};\n" + "fn main() i32 = { let f: five = mk(); return 0; };\n" }, +}; + +static int +slurp(const char *path, char *buf, size_t cap) +{ + FILE *f = fopen(path, "rb"); + if (!f) return -1; + size_t n = fread(buf, 1, cap - 1, f); + fclose(f); + buf[n] = '\0'; + return (int)n; +} + +static int +emit_s(const char *w6c, const struct row *r, int i, char *out_s, size_t cap) +{ + char src[96], cmd[1024]; + snprintf(src, sizeof src, "/tmp/sret_asm_%d_%d.ww", getpid(), i); + snprintf(out_s, cap, "/tmp/sret_asm_%d_%d_%s.s", + getpid(), i, w6c[strlen(w6c) - 1] == 'w' ? "ww" : "c"); + + FILE *f = fopen(src, "wb"); + if (!f) return -1; + fputs(r->src, f); + fclose(f); + + snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null", w6c, out_s, src); + int rc = runwait(cmd); + unlink(src); + return rc; +} + +/* (a) caller-side prealloc sentinel: `LEAQ -K(BP), DI` must appear + * on the line immediately preceding `CALL mk(SB)`. */ +static int +check_leaq_di_before_call(const char *path, const struct row *r) +{ + FILE *f = fopen(path, "rb"); + if (!f) return -1; + char prev[256] = {0}; + char line[1024]; + int ok = -1; + while (fgets(line, sizeof line, f)) { + if (strstr(line, "CALL\tmk(SB)") + || strstr(line, "CALL mk(SB)")) { + if (strstr(prev, "LEAQ\t") + && strstr(prev, "(BP), DI")) { + ok = 0; + } + break; + } + strncpy(prev, line, sizeof prev - 1); + prev[sizeof prev - 1] = '\0'; + } + fclose(f); + if (ok != 0) + fprintf(stderr, + "row[%s]: LEAQ -K(BP), DI before CALL mk(SB) missing\n", + r->label); + return ok; +} + +/* (b) callee-side return-the-pointer sentinel: in the mk fn body + * (between `TEXT mk,` and the FIRST `RET` after it), assert a + * `MOVQ -K(BP), AX` appears within the last few lines before that + * RET — the @sretarg reload. */ +static int +check_movq_bp_ax_before_ret(const char *path, const struct row *r) +{ + FILE *f = fopen(path, "rb"); + if (!f) return -1; + char line[1024]; + int in_mk = 0; + char window[8][256] = {{0}}; + int wi = 0; + int ok = -1; + while (fgets(line, sizeof line, f)) { + if (!in_mk) { + if (strstr(line, "TEXT mk,") || strstr(line, "TEXT\tmk,")) + in_mk = 1; + continue; + } + if (strstr(line, "\tRET\n")) { + for (int k = 0; k < 8; k++) { + if (strstr(window[k], "MOVQ\t") + && strstr(window[k], "(BP), AX")) { + ok = 0; + break; + } + } + break; + } + strncpy(window[wi % 8], line, sizeof window[0] - 1); + window[wi % 8][sizeof window[0] - 1] = '\0'; + wi++; + } + fclose(f); + if (ok != 0) + fprintf(stderr, + "row[%s]: MOVQ -K(BP), AX before RET in mk missing\n", + r->label); + return ok; +} + +/* (c) caller-side negative-assert: between `CALL mk(SB)` and the + * NEXT instruction line, there must be NO `MOVQ AX, -K(BP)` (the + * pre-#23 wwstage truncation pattern). The natural sret receive + * leaves the value in the slot already; AX holds the dest ptr but + * we don't store it back. */ +static int +check_no_movq_ax_bp_after_call(const char *path, const struct row *r) +{ + FILE *f = fopen(path, "rb"); + if (!f) return -1; + char line[1024]; + int seen_call = 0; + int peek = 0; + int ok = 0; + while (fgets(line, sizeof line, f)) { + if (!seen_call) { + if (strstr(line, "CALL\tmk(SB)") + || strstr(line, "CALL mk(SB)")) { + seen_call = 1; + } + continue; + } + /* Inspect the next few instruction lines. A `MOVQ AX, -N(BP)` + * within ~3 lines after CALL would be the truncation + * pattern. */ + if (peek++ >= 3) break; + if (strstr(line, "MOVQ\tAX,") && strstr(line, "(BP)")) { + ok = -1; + break; + } + } + fclose(f); + if (ok != 0) + fprintf(stderr, + "row[%s]: unexpected MOVQ AX, -K(BP) after CALL mk(SB)" + " (pre-#23 truncation pattern)\n", r->label); + return ok; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[512]; + if (bin[0] != '/') { + char cwd[256]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char w6c[640], w6c_ww[640]; + snprintf(w6c, sizeof w6c, "%s/w6c", bin); + snprintf(w6c_ww, sizeof w6c_ww, "%s/w6c_ww", bin); + + int have_ww = (access(w6c_ww, X_OK) == 0); + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + + for (int i = 0; i < n; i++) { + char cs_path[128], ws_path[128]; + + /* cstage asm + three sentinels. */ + if (emit_s(w6c, &rows[i], i, cs_path, sizeof cs_path) != 0) { + fprintf(stderr, "row[%s]: w6c failed\n", rows[i].label); + fail++; total++; continue; + } + total += 3; + if (check_leaq_di_before_call(cs_path, &rows[i]) != 0) fail++; + if (check_movq_bp_ax_before_ret(cs_path, &rows[i]) != 0) fail++; + if (check_no_movq_ax_bp_after_call(cs_path, &rows[i]) != 0) fail++; + + if (!have_ww) { unlink(cs_path); continue; } + + /* wwstage asm + three sentinels. */ + if (emit_s(w6c_ww, &rows[i], i, ws_path, sizeof ws_path) != 0) { + fprintf(stderr, + "row[%s]: w6c_ww failed\n", rows[i].label); + fail++; total++; + unlink(cs_path); + continue; + } + total += 3; + if (check_leaq_di_before_call(ws_path, &rows[i]) != 0) fail++; + if (check_movq_bp_ax_before_ret(ws_path, &rows[i]) != 0) fail++; + if (check_no_movq_ax_bp_after_call(ws_path, &rows[i]) != 0) fail++; + + /* Byte-id diff between stages. */ + total++; + char cmd[512]; + snprintf(cmd, sizeof cmd, "cmp -s %s %s", cs_path, ws_path); + if (runwait(cmd) != 0) { + fprintf(stderr, + "row[%s]: cstage vs wwstage asm differs\n", + rows[i].label); + fail++; + } + + unlink(cs_path); unlink(ws_path); + } + + if (fail) { + fprintf(stderr, + "sret_struct_return: %d/%d fixtures failed\n", + fail, total); + return 1; + } + printf("sret_struct_return: %d/%d ok\n", total, total); + return 0; +} diff --git a/test/wcc/925_sret_struct_return_run.c b/test/wcc/925_sret_struct_return_run.c new file mode 100644 index 00000000..4e819196 --- /dev/null +++ b/test/wcc/925_sret_struct_return_run.c @@ -0,0 +1,271 @@ +/* + * 925_sret_struct_return_run — Class B semantic test for the System V + * AMD64 sret ABI lowering (task #23). End-to-end round-trip pinning + * that values cross the >24B struct-return boundary intact under + * both cstage and wwstage. + * + * Class A asm-presence is pinned at 721; Class B (this file) catches + * shared miscompiles that asm byte-id can't see. Pre-#23 both stages + * were broken in different ways — cstage skipped the CALL emit + * (exit 11), wwstage truncated to AX only (segfault). Post-#23 both + * round-trip cleanly across 32B / 40B / nested / slice-payload + * shapes. + * + * Critical row: a 25B+ struct that is BOTH returned AND passed by- + * value as an arg (collision with #11's struct-by-value param + * decompose). Catches arg-shift bugs where the hidden RDI displaces + * a declared struct-by-value arg into the wrong reg. + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { const char *label; const char *src; int want; }; + +static const struct row rows[] = { + /* 32B four-i64: smallest sret shape. All four words must + * round-trip; pre-#23 wwstage dropped DX/CX/R8 silently. */ + { "quad_i64_roundtrip", + "type quad = struct { a: i64, b: i64, c: i64, d: i64 };\n" + "fn mk(x: i64) quad = {\n" + " return quad { a = x, b = x + 1i64, c = x + 2i64, d = x + 3i64 };\n" + "};\n" + "export fn main() i32 = {\n" + " let q: quad = mk(10i64);\n" + " if (q.a != 10i64) { return 1; };\n" + " if (q.b != 11i64) { return 2; };\n" + " if (q.c != 12i64) { return 3; };\n" + " if (q.d != 13i64) { return 4; };\n" + " return 0;\n" + "};\n", + 0 }, + /* utf8 decoder shape — the surfacing case for #23. i64 + []u8 + * (slice ptr/len/cap). Slice-tail words pre-#23 leaked into + * the wrong slot or stayed garbage. */ + { "decoder_slice_payload", + "type decoder = struct { offs: i64, src: []u8 };\n" + "fn mk(s: []u8) decoder = {\n" + " let r: decoder;\n" + " r.offs = 42i64;\n" + " r.src = s;\n" + " return r;\n" + "};\n" + "export fn main() i32 = {\n" + " let buf: [3]u8;\n" + " buf[0] = 0xa1u8;\n" + " buf[1] = 0xb2u8;\n" + " buf[2] = 0xc3u8;\n" + " let d: decoder = mk(buf[0:3]);\n" + " if (d.offs != 42i64) { return 1; };\n" + " if (d.src.len != 3) { return 2; };\n" + " if (d.src[0] != 0xa1u8) { return 3; };\n" + " if (d.src[1] != 0xb2u8) { return 4; };\n" + " if (d.src[2] != 0xc3u8) { return 5; };\n" + " return 0;\n" + "};\n", + 0 }, + /* 40B five-i64: second past-24B size. Exercises @sretscr / + * @sretarg sizing for a larger struct in the same fn family. */ + { "five_i64_roundtrip", + "type five = struct { a: i64, b: i64, c: i64, d: i64, e: i64 };\n" + "fn mk() five = {\n" + " return five { a = 1i64, b = 2i64, c = 3i64, d = 4i64, e = 5i64 };\n" + "};\n" + "export fn main() i32 = {\n" + " let f: five = mk();\n" + " if (f.a != 1i64) { return 1; };\n" + " if (f.b != 2i64) { return 2; };\n" + " if (f.c != 3i64) { return 3; };\n" + " if (f.d != 4i64) { return 4; };\n" + " if (f.e != 5i64) { return 5; };\n" + " return 0;\n" + "};\n", + 0 }, + /* Nested struct payload: outer 32B struct contains a 16B inner. + * Pin that the inner's field offsets land correctly via the + * `cg_structlit_fill` recursion through *(@sretarg). */ + { "nested_struct_payload", + "type inner = struct { p: i64, q: i64 };\n" + "type outer = struct { i: inner, s: i64, t: i64 };\n" + "fn mk() outer = {\n" + " return outer {\n" + " i = inner { p = 100i64, q = 200i64 },\n" + " s = 300i64, t = 400i64\n" + " };\n" + "};\n" + "export fn main() i32 = {\n" + " let o: outer = mk();\n" + " if (o.i.p != 100i64) { return 1; };\n" + " if (o.i.q != 200i64) { return 2; };\n" + " if (o.s != 300i64) { return 3; };\n" + " if (o.t != 400i64) { return 4; };\n" + " return 0;\n" + "};\n", + 0 }, + /* Reassignment receive: `let x: T;` followed by `x = mk();` + * routes through cgassign's sret branch (vs cglet's). */ + { "reassign_receive", + "type quad = struct { a: i64, b: i64, c: i64, d: i64 };\n" + "fn mk(s: i64) quad = {\n" + " return quad { a = s, b = s, c = s, d = s };\n" + "};\n" + "export fn main() i32 = {\n" + " let q: quad;\n" + " q = mk(7i64);\n" + " if (q.a != 7i64) { return 1; };\n" + " if (q.b != 7i64) { return 2; };\n" + " if (q.c != 7i64) { return 3; };\n" + " if (q.d != 7i64) { return 4; };\n" + " return 0;\n" + "};\n", + 0 }, + /* Collision row: a 16B struct passed by-value as an arg into a + * fn that ALSO returns a >24B struct. Pre-fix the hidden RDI + * would displace SI/DX (the struct-by-value pair) — caller would + * pop the i64 struct-words into DX/CX and emit LEAQ into DI, + * leaving SI uninitialised and the callee reading garbage. The + * arg-shift fix routes the int-arg cursor starting at 1, so the + * 16B struct lands cleanly in SI/DX. (Sister site of #11.) */ + { "sret_with_struct16_arg", + "type pair = struct { x: i64, y: i64 };\n" + "type quad = struct { a: i64, b: i64, c: i64, d: i64 };\n" + "fn mk(p: pair, k: i64) quad = {\n" + " return quad { a = p.x, b = p.y, c = k, d = p.x + p.y + k };\n" + "};\n" + "export fn main() i32 = {\n" + " let p: pair = pair { x = 3i64, y = 5i64 };\n" + " let q: quad = mk(p, 11i64);\n" + " if (q.a != 3i64) { return 1; };\n" + " if (q.b != 5i64) { return 2; };\n" + " if (q.c != 11i64) { return 3; };\n" + " if (q.d != 19i64) { return 4; };\n" + " return 0;\n" + "};\n", + 0 }, + /* N_IDENT return rhs: callee builds the struct in a local + * `let r: T;` then `return r;` — exercises the word-copy-from- + * rhs-slot arm of cgreturn (vs the structlit fill arm). */ + { "ident_return_rhs", + "type pos = struct { x: i64, y: i64, z: i64, w: i64 };\n" + "fn mk() pos = {\n" + " let r: pos;\n" + " r.x = 11i64;\n" + " r.y = 22i64;\n" + " r.z = 33i64;\n" + " r.w = 44i64;\n" + " return r;\n" + "};\n" + "export fn main() i32 = {\n" + " let p: pos = mk();\n" + " if (p.x != 11i64) { return 1; };\n" + " if (p.y != 22i64) { return 2; };\n" + " if (p.z != 33i64) { return 3; };\n" + " if (p.w != 44i64) { return 4; };\n" + " return 0;\n" + "};\n", + 0 }, +}; + +static int +run_driver(const char *driver, const struct row *r, int i) +{ + char src[96], tmpdir[96], cmd[1024]; + snprintf(src, sizeof src, "/tmp/sret_run_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/sret_run_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -1; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s", + tmpdir, driver, src); + if (runwait(cmd) != 0) { + fprintf(stderr, "row[%s]: build via %s failed\n", + r->label, driver); + unlink(src); rmdir(tmpdir); + return -1; + } + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[160]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + int got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return got; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[512]; + if (bin[0] != '/') { + char cwd[256]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[640]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + char wdrv[640]; + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *path; int gated_on_existence; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated_on_existence + && access(drivers[d].path, X_OK) != 0) { + fprintf(stderr, + "sret_struct_return_run: skip %s (no %s)\n", + drivers[d].name, drivers[d].path); + continue; + } + for (int i = 0; i < n; i++) { + int got = run_driver(drivers[d].path, &rows[i], i); + total++; + if (got != rows[i].want) { + fprintf(stderr, + "sret_struct_return_run[%s][%s]: exit=%d want=%d\n", + drivers[d].name, rows[i].label, + got, rows[i].want); + fail++; + } + } + } + + if (fail) { + fprintf(stderr, + "sret_struct_return_run: %d/%d fixtures failed\n", + fail, total); + return 1; + } + printf("sret_struct_return_run: %d/%d ok\n", total, total); + return 0; +}