Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cstage+selfhost+test: System V AMD64 sret discipline for >24B struct return (#23)

Browse Source 
Class B shared miscompile pre-fix: cstage skipped the CALL emit at the
receive site (frame collapsed, exit 11); wwstage emitted CALL but
truncated 32B return to AX only (slice payload garbage, segfault on
g.b[0]). Both stages now lower plain TY_STRUCT > 24B through the SysV
sret discipline: caller pre-allocates dest, passes &dest in RDI as a
hidden first-arg (user args shift to SI/DX/CX/R8/R9/+stack), callee
saves RDI to @sretarg at the prologue and writes through it, returns
RDI in RAX. Surfaced by lib/encoding/utf8 pre-flight when the
Hoehrmann decoder (32B) hit 698_cgreturn_struct.c's OUT-OF-SCOPE
marker.

Scope: plain TY_STRUCT > 24B only — tagged unions, tuples, str, slice
keep their existing register-return ABIs. `return f()` forwarding
from a sret callee is fail-loud-not-wired (compile-time error in
both stages, follow-up filed); the workaround `let r = f(); return
r;` is wired and byte-identical. Discard-context calls (`f();` of an
sret-returning function) share a per-fn single-slot @sretscr;
consecutive discards reuse the same slot.

698_cgreturn_struct.c's OUT-OF-SCOPE marker retired in the same
commit; three positive rows (32B quad, 32B decoder, 40B five) now
assert the sret discipline across both stages via byte-id diff.

Tests:
  - 721_sret_struct_return pins three asm-presence sentinels per
    row: (a) LEAQ -K(BP), DI immediately before CALL at the receive
    site, (b) MOVQ -K(BP), AX before RET in the callee (sret return-
    the-pointer), (c) negative-assert no MOVQ AX, -K(BP) capture for
    return type >8B. Three rows × both stages × cmp -s byte-id.
  - 925_sret_struct_return_run runtime-pins 7 rows × 2 stages
    including the collision row (25B+ struct BOTH returned AND passed
    by-value as arg — catches arg-shift, sister site to #11), nested
    struct payload, slice payload, reassign-receive, N_IDENT return
    rhs.

89/89 ok. 995_self_rebuild stays green (ww2==ww3==ww4 byte-id).
This commit is contained in:
Hojun-Cho
2026-05-17 23:17:03 +09:00
parent 6ab865d933
commit 7e0c280691
12 changed files with 1723 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
Makefile
View File

@@ -246,6 +246,8 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
$(BIN)/test_signed_data_emit_run \
$(BIN)/test_tagged_call_arg \
$(BIN)/test_tagged_call_arg_run \
$(BIN)/test_sret_struct_return \
$(BIN)/test_sret_struct_return_run \
$(BIN)/test_param_shadow_mod \
$(BIN)/test_localoff_scope \
$(BIN)/test_cast_enum_movl \
@@ -531,6 +533,16 @@ $(BIN)/test_tagged_call_arg_run: test/wcc/924_tagged_call_arg_run.c \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
$(BIN)/test_sret_struct_return: test/wcc/721_sret_struct_return.c \
$(BIN)/w6c $(BIN)/w6c_ww | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
$(BIN)/test_sret_struct_return_run: test/wcc/925_sret_struct_return_run.c \
$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
$(BIN)/test_use_promote_alias: test/wcc/699_use_promote_alias.c \
$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
$(LIB)/libwwrt.a | $(BIN)

212
cmd/w6c/cgen.c
View File

@@ -39,6 +39,26 @@ static int *cg_frame;
* semantics for synthetic scratches). 0 means "not yet allocated";
* negative offsets returned by local_alloc are the live value. */
static int cg_retscr;
/* System V AMD64 sret discipline (task #23). Plain TY_STRUCT returns
* with size > 24B are passed via a hidden first-arg pointer (RDI) to
* a caller-prealloc dest; the callee writes through that pointer and
* returns it in RAX. Tagged returns (slot ≤ 32B in AX/DX/CX/R8) and
* tuples (16/24B in AX/DX/CX) keep their existing register-return ABI.
*
* cg_sret_arg_off — callee-side @sretarg slot (8B, holds saved RDI).
* Set in cgfn prologue when ret > 24B plain struct.
* cg_sret_dest_off — caller-side dest offset, propagated from a receive
* site (N_LET / N_ASSIGN ident) to the nested N_CALL
* so the call emits `LEAQ off(BP), RDI` instead of
* allocating a scratch. 0 means no receiver wired.
* cg_sretscr_off — per-fn @sretscr discard slot for sret CALLs whose
* result is dropped (no named receiver). Single-slot
* SSoT mirroring cg_retscr. Sized to the largest
* discarded sret return type in the fn. */
static int cg_sret_arg_off;
static int cg_sret_dest_off;
static int cg_sretscr_off;
static int cg_sretscr_sz;
/* Per-fn defer stack: pushed in registration order, popped (emitted)
* in reverse at each return. */
@@ -71,6 +91,20 @@ cg_isfloat(Type *t)
|| t->kind == TY_UNTYPED_FLOAT;
}
/* cg_sret_retsize — if `rt` is a plain TY_STRUCT > 24B, return its
* natural size (the sret threshold); else 0. Tagged unions, tuples,
* str, and slices route through their existing register-return ABIs
* regardless of size. Task #23. */
static int
cg_sret_retsize(Type *rt)
{
if (rt == NULL) return 0;
if (rt->kind == TY_NAMED) rt = rt->under;
if (rt == NULL || rt->kind != TY_STRUCT) return 0;
if ((int)rt->size <= 24) return 0;
return (int)rt->size;
}
static int
node_isfloat(Node *n)
{
@@ -3629,6 +3663,21 @@ cgexpr(Cg *c, Node *n, Local *locals)
}
break;
}
/* sret receive (#23): `s = f();` where s is a struct
* local >24B. s's slot IS the caller-prealloc dest;
* the callee writes through hidden RDI. Mirrors the
* cglet branch above. */
if (lu && lu->kind == TY_STRUCT && (int)lu->size > 24
&& n->rhs && n->rhs->kind == N_CALL
&& n->op == TK_ASSIGN) {
int off = localfind(locals, n->lhs->str);
if (off != 0) {
cg_sret_dest_off = off;
cgexpr(c, n->rhs, locals);
cg_sret_dest_off = 0;
break;
}
}
/* Struct local reassignment: `s = expr;` where s is
* a TY_STRUCT local of size <=24B. Two rhs shapes,
* mirroring cglet's N_STRUCTLIT and the call-result
@@ -4389,11 +4438,48 @@ cgexpr(Cg *c, Node *n, Local *locals)
ins1(c, A_PUSHQ, areg(D_AX));
}
}
/* sret discipline (#23): callee returns plain TY_STRUCT
* > 24B. Reserve RDI for the hidden dest-pointer arg by
* starting the int-arg cursor at 1 and emit the LEAQ AFTER
* the pop loop (so the pops don't clobber RDI). The dest
* slot is either the receiver's own slot (cg_sret_dest_off,
* propagated from N_LET / N_ASSIGN ident receive) or a
* per-fn @sretscr discard slot. Sized at the receive site
* or here for discards.
*
* Stack alignment is unaffected because pushargsrev/pops
* left RDI free — we never popped a user arg into it. */
int sret_call_sz = 0;
int sret_call_off = 0;
{
Type *ret = (cu && cu->kind == TY_FN)
? cu->ret : NULL;
sret_call_sz = cg_sret_retsize(ret);
}
if (sret_call_sz > 0) {
/* Always pre-allocate @sretscr at the first sret CALL
* regardless of whether cg_sret_dest_off is set — keeps
* cstage's frame in lockstep with wwstage's
* scanlocals-based reservation. Single-slot SSoT (cg_
* sretscr_off) mirrors @retscr / @tagscr conventions. */
if (cg_sretscr_off == 0) {
cg_sretscr_off = local_alloc(c,
&locals, "@sretscr",
sret_call_sz, cg_frame);
cg_sretscr_sz = sret_call_sz;
}
if (cg_sret_dest_off != 0) {
sret_call_off = cg_sret_dest_off;
cg_sret_dest_off = 0;
} else {
sret_call_off = cg_sretscr_off;
}
}
/* pop forward into the right register class. Args that
* don't fit in regs stay on the stack and are reached by
* the callee via positive offsets from BP. The caller is
* responsible for cleaning them up after CALL. */
int ii = 0, fi = 0, stackslots = 0;
int ii = (sret_call_sz > 0) ? 1 : 0, fi = 0, stackslots = 0;
for (int i = 0; i < argcount; i++) {
if (widen[i]) {
/* Pop widened tagged slot into arg-register
@@ -4459,6 +4545,12 @@ cgexpr(Cg *c, Node *n, Local *locals)
}
}
}
/* sret hidden first-arg (#23): load &dest into RDI AFTER
* all user-arg pops have finished — the pop loop started
* its int-arg cursor at 1, so RDI was never written. */
if (sret_call_sz > 0)
ins2(c, A_LEAQ, amem(D_BP, sret_call_off),
areg(D_DI));
/* SysV: variadic callees require AL to hold the count of
* XMM regs used in the variable portion. We don't pass
* floats yet, so AL=0 covers every case we emit. */
@@ -6132,6 +6224,18 @@ cgstmt(Cg *c, Node *n, Local **locals, int *frame)
cg_structlit_fill_bp(c, locals, lu, n->rhs, off);
break;
}
/* sret receive (#23): plain TY_STRUCT >24B. The let's own
* slot IS the caller-prealloc dest; the call writes
* through hidden RDI directly into our slot, no AX/DX/CX
* shuffle. Set cg_sret_dest_off so the nested cgexpr →
* N_CALL path emits `LEAQ off(BP), RDI` before CALL. */
if (n->rhs && n->rhs->kind == N_CALL && lu
&& lu->kind == TY_STRUCT && sz > 24) {
cg_sret_dest_off = off;
cgexpr(c, n->rhs, *locals);
cg_sret_dest_off = 0;
break;
}
/* Whole-struct receive for sizes <=24B (call-result rhs).
* Counterpart of #4's cgreturn ABI: cgexpr leaves
* AX=bytes[0..7], DX=bytes[8..15], CX=bytes[16..23], zero-
@@ -6435,10 +6539,91 @@ cgstmt(Cg *c, Node *n, Local **locals, int *frame)
break;
}
}
/* sret return (#23): plain TY_STRUCT >24B. Callee writes
* the value through `*(@sretarg)` (the caller-prealloc
* dest passed in RDI at entry; saved to @sretarg in the
* prologue), then loads @sretarg into RAX and rets — the
* SysV sret discipline of "return the pointer". No
* AX/DX/CX shuffle, no scratch slot beyond @sretarg. */
if (n->lhs && cg_ret_type && cg_sret_arg_off != 0) {
Type *rt = cg_ret_type;
if (rt->kind == TY_NAMED) rt = rt->under;
/* `return f();` from a sret callee falls through the
* arm below (rhs is N_CALL, not N_IDENT/N_STRUCTLIT)
* and would silent-miscompile: cgexpr places inner's
* result in @sretscr but outer never copies into
* *@sretarg and never sets RAX. Fail loud per
* CLAUDE.md rule 7; the workaround `let r = f();
* return r;` is already wired and correct. */
if (rt && rt->kind == TY_STRUCT
&& (int)rt->size > 24
&& n->lhs->kind == N_CALL)
fatal("cgreturn: sret return-forwarding "
"for >24B struct not wired (task #23)");
if (rt && rt->kind == TY_STRUCT
&& (int)rt->size > 24
&& (n->lhs->kind == N_IDENT
|| n->lhs->kind == N_STRUCTLIT)) {
int sz = (int)rt->size;
if (n->lhs->kind == N_STRUCTLIT) {
/* Delegate to the shared *-relative
* fill helper. Same store sequence the
* ≤24B path emits, but the base reg is
* reloaded from @sretarg(BP) before each
* field store. Mirrors DST_PTR_LOCAL
* usage at N_ASSIGN N_DOT via_ptr. */
cg_structlit_fill(c, locals, rt,
n->lhs, DST_PTR_LOCAL,
cg_sret_arg_off, NULL, 0);
} else {
/* N_IDENT: word-copy from rhs slot to
* *(@sretarg). Whole 8B words via MOVQ;
* trailing partial words via MOVL/MOVB
* so the read stays inside the source
* slot's declared size. */
int rhsoff = localfind(*locals,
n->lhs->str);
ins2(c, A_MOVQ,
amem(D_BP, cg_sret_arg_off),
areg(D_BX));
int k = 0;
while (k + 8 <= sz) {
ins2(c, A_MOVQ,
amem(D_BP, rhsoff + k),
areg(D_AX));
ins2(c, A_MOVQ, areg(D_AX),
amem(D_BX, k));
k += 8;
}
while (k + 4 <= sz) {
ins2(c, A_MOVL,
amem(D_BP, rhsoff + k),
areg(D_AX));
ins2(c, A_MOVL, areg(D_AX),
amem(D_BX, k));
k += 4;
}
while (k < sz) {
ins2(c, A_MOVB,
amem(D_BP, rhsoff + k),
areg(D_AX));
ins2(c, A_MOVB, areg(D_AX),
amem(D_BX, k));
k += 1;
}
}
/* sret return: RAX = dest pointer. */
ins2(c, A_MOVQ,
amem(D_BP, cg_sret_arg_off), areg(D_AX));
ins2(c, A_MOVQ, areg(D_BP), areg(D_SP));
ins1(c, A_POPQ, areg(D_BP));
ins0(c, A_RET);
break;
}
}
/* Whole-struct return for sizes ≤24B. ABI: AX=bytes[0..7],
* DX=bytes[8..15], CX=bytes[16..23]. Sizes >24B are not
* wired (sret deferred); they fall through to the scalar
* path below and return only AX. Materialise rhs into a
* DX=bytes[8..15], CX=bytes[16..23]. Sizes >24B route
* through the sret arm above. Materialise rhs into a
* zero-padded 24B scratch slot, then emit AX/DX/CX loads
* unconditionally so the instruction shape is constant
* regardless of declared struct size. The receive side
@@ -6872,6 +7057,10 @@ cgfn(Cg *c, FILE *out, Node *fn)
nloops = 0;
cg_ret_type = fn->type ? fn->type->ret : NULL;
cg_retscr = 0;
cg_sret_arg_off = 0;
cg_sret_dest_off = 0;
cg_sretscr_off = 0;
cg_sretscr_sz = 0;
int frame = 0;
Local *locals = NULL;
@@ -6893,10 +7082,23 @@ cgfn(Cg *c, FILE *out, Node *fn)
subsp->to = areg(D_SP);
emit(c, subsp);
/* sret discipline (#23): plain TY_STRUCT return > 24B consumes
* RDI as a hidden first-arg dest pointer. Spill it to @sretarg
* before the user-param loop so cgreturn can write through it,
* and start the user-arg register counter at 1 to shift every
* declared arg right by one (SI/DX/CX/R8/R9/+stack). */
if (cg_sret_retsize(cg_ret_type) > 0) {
cg_sret_arg_off = local_alloc(c, &locals, "@sretarg",
8, &frame);
ins2(c, A_MOVQ, areg(D_DI),
amem(D_BP, cg_sret_arg_off));
}
/* spill incoming arg registers to local slots. Slice params
* occupy 24 bytes; float params land in XMM0..7 (counted
* separately from integer DI/SI/DX/CX/R8/R9). */
int argi = 0, fargi = 0;
int argi = (cg_sret_arg_off != 0) ? 1 : 0;
int fargi = 0;
Tparam *tp = fn->type ? fn->type->params : NULL;
for (Node *p = fn->list; p; p = p->next) {
if (p->str == NULL || strcmp(p->str, "...") == 0) {

292
selfhost/cmd/w6c/main.combined.ww
View File

@@ -7738,6 +7738,49 @@ fn structnaturalsize(si: *structinfo) i32 = {
return n;
};
// sretretsize — if `t` ultimately denotes a plain TY_STRUCT > 24B,
// return its natural size; else 0. Tagged unions, tuples, str,
// slices, scalars route through their existing register-return ABIs
// (AX/DX/CX/[R8]) regardless of size. Task #23 mirrors cstage's
// cg_sret_retsize predicate. Resolves N_TNAME → struct via structlookup
// and unwraps one leading N_TBANG so `type box = !big;` still
// triggers sret on the underlying big.
export fn sretretsize(c: *cgen, t: *node) i32 = {
if (t == nil) { return 0; };
let r: *node = t;
if (r.kind == nkind.N_TBANG) {
r = r.lhs;
if (r == nil) { return 0; };
};
if (r.kind != nkind.N_TNAME) { return 0; };
// Primitives / aliased-to-primitives are never sret.
if (primsize(r.str) > 0) { return 0; };
if (streq(r.str, "str")) { return 0; };
let si: *structinfo = structlookup(c, r.str);
if (si == nil) { return 0; };
let n: i32 = structnaturalsize(si);
if (n <= 24) { return 0; };
return n;
};
// callsretsize — if N_CALL `n`'s callee returns a plain TY_STRUCT
// > 24B, return its natural size; else 0. Wraps sretretsize over the
// callee's resolved return type, used by cglet / cgassign receive
// sites and cgcall to detect sret at the receive / emit boundaries.
export fn callsretsize(c: *cgen, n: *node) i32 = {
if (n == nil) { return 0; };
if (n.kind != nkind.N_CALL) { return 0; };
let callee: *node = n.lhs;
if (callee == nil) { return 0; };
let cn: str;
cn.ptr = nil; cn.len = 0;
if (callee.kind == nkind.N_IDENT) { cn = callee.str; };
if (callee.kind == nkind.N_DOT) { cn = callee.str; };
if (cn.len == 0) { return 0; };
let rt: *node = fnretlookup(c, cn);
return sretretsize(c, rt);
};
fn structlookup(c: *cgen, name: str) *structinfo = {
// Exact match first: bare-from-source struct names and already-
// leafed lookups hit here directly.
@@ -12942,6 +12985,24 @@ fn cgcall(c: *cgen, n: *node) void = {
};
};
let nargs: i32 = pushargsrev(c, n.list, calleeparams);
// sret call (#23): callee returns plain TY_STRUCT > 24B. The
// dest pointer lands in RDI; start intidx at 1 to skip RDI in
// the user-arg pop loop and emit `LEAQ off(BP), DI` AFTER all
// pops have finished (so they don't clobber RDI). The dest off
// is either the receive site's slot (c.sretdestoff, propagated
// from cglet / cgassign ident) or the per-fn @sretscr discard
// slot reserved by scanlocals.
let sretcs: i32 = callsretsize(c, n);
let sretcalloff: i32 = 0;
if (sretcs > 0) {
if (c.sretdestoff != 0) {
sretcalloff = c.sretdestoff;
c.sretdestoff = 0;
} else {
sretcalloff = localadd(c, "@sretscr",
c.sretscrsz, nil);
};
};
// Pop forward. Float args were pushed as 8 bytes from X0 via
// SUBQ+MOVSD; pop into the XMM stream (X0..X7). Everything else
// pops into the int stream (DI..R9) per the SysV ABI. Walk the
@@ -12950,6 +13011,7 @@ fn cgcall(c: *cgen, n: *node) void = {
// the remaining slots stay on the stack and the callee reads them
// via 16+8*k(BP). Caller-cleanup is emitted after the CALL.
let intidx: i32 = 0;
if (sretcs > 0) { intidx = 1; };
let fpidx: i32 = 0;
let a: *node = n.list;
let popped: i32 = 0;
@@ -13080,6 +13142,14 @@ fn cgcall(c: *cgen, n: *node) void = {
};
};
};
// sret hidden first-arg (#23): load &dest into RDI AFTER all
// user-arg pops have finished — intidx started at 1 so RDI was
// never written. The CALL emit follows immediately.
if (sretcs > 0) {
emitline("\tLEAQ\t");
emitoff(sretcalloff: i64);
emitline("(BP), DI\n");
};
if (isfnptrcall) {
// Load fn-ptr field value into AX; CALL AX. We emit the
// load AFTER the args have been popped (so AX/BX/etc
@@ -15255,6 +15325,21 @@ fn cgassign(c: *cgen, n: *node) void = {
};
if (n.rhs != nil
&& n.rhs.kind == nkind.N_CALL) {
// sret receive (#23): plain
// TY_STRUCT > 24B from a CALL.
// `s` is the prealloc dest; the
// callee writes through hidden RDI
// directly into off(BP). Mirror of
// cglet's sret branch.
if (lcnsz > 24) {
let rscs: i32 = callsretsize(c, n.rhs);
if (rscs > 0) {
c.sretdestoff = off;
cgexpr(c, n.rhs);
c.sretdestoff = 0;
return;
};
};
let lcsz: i32 = lcnsz;
if (lcsz <= 24) {
let tlm: i32 = lcsz - (lcsz / 8) * 8;
@@ -15744,15 +15829,106 @@ fn cgreturn(c: *cgen, n: *node) void = {
c.lastwasreturn = 1;
return;
};
// sret return (#23): plain TY_STRUCT > 24B. Callee writes
// through *(@sretarg) (the caller-prealloc dest saved at
// the prologue), then loads @sretarg into RAX and rets —
// the SysV "return the pointer" discipline. Two rhs shapes
// are wired: N_IDENT (word-copy from rhs slot to *(dest))
// and N_STRUCTLIT (cgstructlitfill with mode=1 PTR_LOCAL).
if (c.sretargoff != 0) {
let scs: i32 = sretretsize(c, c.fnret);
if (scs > 0) {
// `return f();` from a sret callee would silent-
// miscompile: cgexpr writes inner's result to
// @sretscr but outer never copies into *@sretarg
// and never sets RAX. Fail loud per CLAUDE.md
// rule 7; the `let r = f(); return r;` workaround
// is already wired and byte-id with cstage.
if (rhs.kind == nkind.N_CALL) {
let m: str = "ww: cgreturn: sret return-forwarding for >24B struct not wired (task #23)\n";
os.write(2, m.ptr, m.len: u64);
os.exit(1);
};
let okrhs: bool = false;
if (rhs.kind == nkind.N_IDENT) { okrhs = true; };
if (rhs.kind == nkind.N_STRUCTLIT) { okrhs = true; };
if (okrhs) {
if (rhs.kind == nkind.N_STRUCTLIT) {
let trefn: *node = rhs.lhs;
let sname: str;
sname.ptr = nil; sname.len = 0;
if (trefn != nil) {
if (trefn.kind == nkind.N_IDENT) { sname = trefn.str; }
else { if (trefn.kind == nkind.N_TNAME) { sname = trefn.str; }; };
};
let sret_si: *structinfo = structlookup(c, sname);
if (sret_si != nil) {
let emptys: str;
emptys.ptr = nil; emptys.len = 0;
// mode=1 (PTR_LOCAL): base reg = BX,
// reloaded from @sretarg(BP) before
// each field store. disp = 0 because
// the dest pointer IS the struct base.
cgstructlitfill(c, sret_si, rhs,
1, c.sretargoff, emptys,
0, scs);
};
} else {
let rl: *local = localfindnode(c, rhs.str);
if (rl != nil) {
emitline("\tMOVQ\t");
emitoff(c.sretargoff: i64);
emitline("(BP), BX\n");
let k: i32 = 0;
for (k + 8 <= scs) {
emitline("\tMOVQ\t");
emitoff((rl.off + k): i64);
emitline("(BP), AX\n");
emitline("\tMOVQ\tAX, ");
emitoff(k: i64);
emitline("(BX)\n");
k += 8;
};
for (k + 4 <= scs) {
emitline("\tMOVL\t");
emitoff((rl.off + k): i64);
emitline("(BP), AX\n");
emitline("\tMOVL\tAX, ");
emitoff(k: i64);
emitline("(BX)\n");
k += 4;
};
for (k < scs) {
emitline("\tMOVB\t");
emitoff((rl.off + k): i64);
emitline("(BP), AX\n");
emitline("\tMOVB\tAX, ");
emitoff(k: i64);
emitline("(BX)\n");
k += 1;
};
};
};
// sret return: RAX = dest pointer.
emitline("\tMOVQ\t");
emitoff(c.sretargoff: i64);
emitline("(BP), AX\n");
emitline("\tMOVQ\tBP, SP\n");
emitline("\tPOPQ\tBP\n");
emitline("\tRET\n");
c.lastwasreturn = 1;
return;
};
};
};
// Whole-struct return for sizes <= 24B. ABI: AX=bytes[0..7],
// DX=bytes[8..15], CX=bytes[16..23]. Mirrors cstage cgen.c
// N_RETURN TY_STRUCT branch. Two rhs shapes are wired:
// N_IDENT (word-copy from rhs local slot) and N_STRUCTLIT
// (field-by-field store at scratch+foff, with tagged fields
// delegated to cgwidentaggedstore). Call-result chain return
// is deferred to #5's receive side. Sizes > 24B fall through
// to the scalar path below (only AX gets the first qword),
// pending sret.
// is deferred to #5's receive side. Sizes > 24B route through
// the sret arm above.
let rname: str;
rname.ptr = nil; rname.len = 0;
if (c.fnret != nil) {
@@ -16076,6 +16252,22 @@ fn cglet(c: *cgen, n: *node) void = {
return;
};
};
// sret receive (#23): plain TY_STRUCT > 24B from a call.
// The let's own slot IS the caller-prealloc dest; the
// nested cgexpr → cgcall path emits `LEAQ off(BP), DI`
// before the CALL and the callee writes through it. No
// AX/DX/CX shuffle; AX returns the dest pointer per SysV
// sret discipline (irrelevant here).
if (rhs.kind == nkind.N_CALL) {
let scs: i32 = callsretsize(c, rhs);
if (scs > 0) {
c.sretdestoff = off;
cgexpr(c, rhs);
c.sretdestoff = 0;
c.lastwasreturn = 0;
return;
};
};
// Whole-struct receive for sizes <=24B (call-result rhs).
// Counterpart of #4's cgreturn ABI: cgexpr leaves
// AX=bytes[0..7], DX=bytes[8..15], CX=bytes[16..23],
@@ -16804,6 +16996,20 @@ fn tagscrbump(c: *cgen, need: i32) i32 = {
return delta;
};
// sretscrbump — sister of tagscrbump for the sret discard slot
// (#23). Tracks max sret return type used as a CALL discard / nested
// receiver. Returns frame-byte delta vs the previous high water mark
// (rounded up to 8B).
fn sretscrbump(c: *cgen, need: i32) i32 = {
let n: i32 = need;
if (n < 8) { n = 8; };
if ((n & 7) != 0) { n = (n + 7) & ~7; };
if (n <= c.sretscrsz) { return 0; };
let delta: i32 = n - c.sretscrsz;
c.sretscrsz = n;
return delta;
};
//
// Recursively walks the body to count every local `let`. Each gets a
// slot sized by slotsize(typ); 8-byte default. Match-bindings + for-
@@ -17140,6 +17346,17 @@ fn scanlocals(c: *cgen, n: *node) i32 = {
};
};
};
// sret CALL (#23): callee returns plain TY_STRUCT > 24B. The
// receive site (cglet / cgassign ident) overrides at emit time
// with the dest local's own slot; discards / nested calls fall
// back to @sretscr. Single-slot per fn sized to the max sret
// return — sretscrbump tracks the high-water mark so a later
// larger call grows the frame without re-counting the prior
// reservation. Mirrors @tagscr's cumulative tagscrbump.
if (n.kind == nkind.N_CALL) {
let scs: i32 = callsretsize(c, n);
if (scs > 0) { total += sretscrbump(c, scs); };
};
// Call-site struct-payload widening uses @tagscr — when the
// arg is a struct literal/ident and the callee's param is
// tagged, pushargsrev materialises in scratch and pushes.
@@ -17254,7 +17471,11 @@ fn scanlocals(c: *cgen, n: *node) i32 = {
fn cgfnparams(c: *cgen, params: *node) void = {
let p: *node = params;
// sret (#23): RDI is consumed by the hidden dest pointer
// (already spilled to @sretarg by cgfn); the first user param
// lands in SI.
let idx: i32 = 0;
if (c.sretargoff != 0) { idx = 1; };
let fidx: i32 = 0;
// Cursor for args that overflow the SysV reg windows. Each
// stack-passed arg lives at 16+8*k(BP) — no spill, the local
@@ -17564,6 +17785,14 @@ fn cgfn(c: *cgen, fn_: *node) void = {
c.curmod = fn_.module;
c.fnret = fn_.lhs;
// sret callee (#23): return type is plain TY_STRUCT > 24B.
// Reserve 8B for @sretarg (holds the saved hidden RDI dest
// pointer); cgfnparams skips DI for user args, cgreturn writes
// through *(@sretarg) and returns @sretarg in RAX. Decision
// made here so the frame pre-scan and cgfnparams see the same
// view of the int-arg cursor.
let sret_callee: bool = sretretsize(c, c.fnret) > 0;
// Emit the TEXT label via emitfnname so the def site picks up the
// same skip rule (FFI / `main` / empty-module) and the same module
// hint (this fn's own module) that the call sites use. Drops the
@@ -17586,6 +17815,12 @@ fn cgfn(c: *cgen, fn_: *node) void = {
let frame: i32 = 0;
let argi: i32 = 0;
let fargi: i32 = 0;
// Reserve @sretarg (8B) BEFORE the param-induced frame, and
// start argi at 1 so the param walker sees RDI as consumed.
if (sret_callee) {
frame += 8;
argi = 1;
};
for (scanp != nil) {
if (scanp.kind == nkind.N_PARAM) {
let isvar: bool = scanp.op == tkind.TK_ELLIPSIS;
@@ -17678,6 +17913,13 @@ fn cgfn(c: *cgen, fn_: *node) void = {
emitint(frame: i64);
emitline(", SP\n");
if (sret_callee) {
let saoff: i32 = localadd(c, "@sretarg", 8, nil);
emitline("\tMOVQ\tDI, ");
emitoff(saoff: i64);
emitline("(BP)\n");
};
cgfnparams(c, fn_.list);
c.lastwasreturn = 0;
// Iterate the fn body's statements directly rather than dispatching
@@ -18179,6 +18421,29 @@ type cgen = struct {
// later emit reuses. Mirrors c.tagscrsz pattern (#38) but tracks
// offset, not size (per-fn return type is fixed, so size is too).
retscroff: i32,
// System V AMD64 sret discipline (#23). Plain TY_STRUCT returns
// with size > 24B are passed via a hidden first-arg pointer
// (RDI) to a caller-prealloc dest; the callee writes through
// that pointer and returns it in RAX.
//
// sretargoff — callee-side @sretarg slot (8B, holds saved RDI).
// Set in cgfn prologue when the fn's return type
// triggers sret. 0 means N/A.
// sretdestoff — caller-side dest BP offset, propagated from a
// receive site (cglet / cgassign ident) to the
// nested cgexpr → cgcall so the call emits
// `LEAQ off(BP), DI` instead of allocating a
// scratch. 0 means no receiver wired.
// sretscroff — per-fn @sretscr discard slot, used by sret CALLs
// whose result has no named receiver. Single-slot
// SSoT mirroring c.retscroff; the scanlocals walk
// sums c.sretscrsz to pre-reserve.
// sretscrsz — max sret discard size in this fn (sums during
// scanlocals, consumed by localadd("@sretscr", ...)).
sretargoff: i32,
sretdestoff: i32,
sretscroff: i32,
sretscrsz: i32,
};
// Top-level mutable `let` registry. Mirrors cmd/w6c/cgen.c LetVar.
@@ -18202,6 +18467,10 @@ fn cgeninit(c: *cgen, a: *arena) void = {
c.varargseq = 0;
c.tagscrsz = 0;
c.retscroff = 0;
c.sretargoff = 0;
c.sretdestoff = 0;
c.sretscroff = 0;
c.sretscrsz = 0;
// Note: strlit_seq, strlits, ffis are *not* reset here; they
// persist across cgfn calls within one file. cgfile resets them
// at the start of each compilation unit.
@@ -18285,6 +18554,23 @@ fn localadd(c: *cgen, name: str, sz: i32, tnode: *node) i32 = {
c.retscroff = off;
return off;
};
// @sretarg / @sretscr (#23): same single-slot SSoT
// pattern as @retscr. @sretarg holds the saved hidden
// RDI for sret callees (8B, set once per fn at the
// prologue); @sretscr is the caller-side discard slot
// for sret CALLs whose result is dropped.
if (streq(name, "@sretarg")) {
if (c.sretargoff != 0) { return c.sretargoff; };
let off: i32 = localalloc(c, name, sz, tnode);
c.sretargoff = off;
return off;
};
if (streq(name, "@sretscr")) {
if (c.sretscroff != 0) { return c.sretscroff; };
let off: i32 = localalloc(c, name, sz, tnode);
c.sretscroff = off;
return off;
};
let cur: *local = c.locals;
for (cur != nil) {
let cn: str = cur.name;

44
selfhost/cmd/wcc/cgen.ww
View File

@@ -431,6 +431,29 @@ type cgen = struct {
// later emit reuses. Mirrors c.tagscrsz pattern (#38) but tracks
// offset, not size (per-fn return type is fixed, so size is too).
retscroff: i32,
// System V AMD64 sret discipline (#23). Plain TY_STRUCT returns
// with size > 24B are passed via a hidden first-arg pointer
// (RDI) to a caller-prealloc dest; the callee writes through
// that pointer and returns it in RAX.
//
// sretargoff — callee-side @sretarg slot (8B, holds saved RDI).
// Set in cgfn prologue when the fn's return type
// triggers sret. 0 means N/A.
// sretdestoff — caller-side dest BP offset, propagated from a
// receive site (cglet / cgassign ident) to the
// nested cgexpr → cgcall so the call emits
// `LEAQ off(BP), DI` instead of allocating a
// scratch. 0 means no receiver wired.
// sretscroff — per-fn @sretscr discard slot, used by sret CALLs
// whose result has no named receiver. Single-slot
// SSoT mirroring c.retscroff; the scanlocals walk
// sums c.sretscrsz to pre-reserve.
// sretscrsz — max sret discard size in this fn (sums during
// scanlocals, consumed by localadd("@sretscr", ...)).
sretargoff: i32,
sretdestoff: i32,
sretscroff: i32,
sretscrsz: i32,
};
// Top-level mutable `let` registry. Mirrors cmd/w6c/cgen.c LetVar.
@@ -454,6 +477,10 @@ fn cgeninit(c: *cgen, a: *arena) void = {
c.varargseq = 0;
c.tagscrsz = 0;
c.retscroff = 0;
c.sretargoff = 0;
c.sretdestoff = 0;
c.sretscroff = 0;
c.sretscrsz = 0;
// Note: strlit_seq, strlits, ffis are *not* reset here; they
// persist across cgfn calls within one file. cgfile resets them
// at the start of each compilation unit.
@@ -537,6 +564,23 @@ fn localadd(c: *cgen, name: str, sz: i32, tnode: *node) i32 = {
c.retscroff = off;
return off;
};
// @sretarg / @sretscr (#23): same single-slot SSoT
// pattern as @retscr. @sretarg holds the saved hidden
// RDI for sret callees (8B, set once per fn at the
// prologue); @sretscr is the caller-side discard slot
// for sret CALLs whose result is dropped.
if (streq(name, "@sretarg")) {
if (c.sretargoff != 0) { return c.sretargoff; };
let off: i32 = localalloc(c, name, sz, tnode);
c.sretargoff = off;
return off;
};
if (streq(name, "@sretscr")) {
if (c.sretscroff != 0) { return c.sretscroff; };
let off: i32 = localalloc(c, name, sz, tnode);
c.sretscroff = off;
return off;
};
let cur: *local = c.locals;
for (cur != nil) {
let cn: str = cur.name;

50
selfhost/cmd/wcc/cgendecl.ww
View File

@@ -39,6 +39,20 @@ fn tagscrbump(c: *cgen, need: i32) i32 = {
return delta;
};
// sretscrbump — sister of tagscrbump for the sret discard slot
// (#23). Tracks max sret return type used as a CALL discard / nested
// receiver. Returns frame-byte delta vs the previous high water mark
// (rounded up to 8B).
fn sretscrbump(c: *cgen, need: i32) i32 = {
let n: i32 = need;
if (n < 8) { n = 8; };
if ((n & 7) != 0) { n = (n + 7) & ~7; };
if (n <= c.sretscrsz) { return 0; };
let delta: i32 = n - c.sretscrsz;
c.sretscrsz = n;
return delta;
};
//
// Recursively walks the body to count every local `let`. Each gets a
// slot sized by slotsize(typ); 8-byte default. Match-bindings + for-
@@ -375,6 +389,17 @@ fn scanlocals(c: *cgen, n: *node) i32 = {
};
};
};
// sret CALL (#23): callee returns plain TY_STRUCT > 24B. The
// receive site (cglet / cgassign ident) overrides at emit time
// with the dest local's own slot; discards / nested calls fall
// back to @sretscr. Single-slot per fn sized to the max sret
// return — sretscrbump tracks the high-water mark so a later
// larger call grows the frame without re-counting the prior
// reservation. Mirrors @tagscr's cumulative tagscrbump.
if (n.kind == nkind.N_CALL) {
let scs: i32 = callsretsize(c, n);
if (scs > 0) { total += sretscrbump(c, scs); };
};
// Call-site struct-payload widening uses @tagscr — when the
// arg is a struct literal/ident and the callee's param is
// tagged, pushargsrev materialises in scratch and pushes.
@@ -489,7 +514,11 @@ fn scanlocals(c: *cgen, n: *node) i32 = {
fn cgfnparams(c: *cgen, params: *node) void = {
let p: *node = params;
// sret (#23): RDI is consumed by the hidden dest pointer
// (already spilled to @sretarg by cgfn); the first user param
// lands in SI.
let idx: i32 = 0;
if (c.sretargoff != 0) { idx = 1; };
let fidx: i32 = 0;
// Cursor for args that overflow the SysV reg windows. Each
// stack-passed arg lives at 16+8*k(BP) — no spill, the local
@@ -799,6 +828,14 @@ fn cgfn(c: *cgen, fn_: *node) void = {
c.curmod = fn_.module;
c.fnret = fn_.lhs;
// sret callee (#23): return type is plain TY_STRUCT > 24B.
// Reserve 8B for @sretarg (holds the saved hidden RDI dest
// pointer); cgfnparams skips DI for user args, cgreturn writes
// through *(@sretarg) and returns @sretarg in RAX. Decision
// made here so the frame pre-scan and cgfnparams see the same
// view of the int-arg cursor.
let sret_callee: bool = sretretsize(c, c.fnret) > 0;
// Emit the TEXT label via emitfnname so the def site picks up the
// same skip rule (FFI / `main` / empty-module) and the same module
// hint (this fn's own module) that the call sites use. Drops the
@@ -821,6 +858,12 @@ fn cgfn(c: *cgen, fn_: *node) void = {
let frame: i32 = 0;
let argi: i32 = 0;
let fargi: i32 = 0;
// Reserve @sretarg (8B) BEFORE the param-induced frame, and
// start argi at 1 so the param walker sees RDI as consumed.
if (sret_callee) {
frame += 8;
argi = 1;
};
for (scanp != nil) {
if (scanp.kind == nkind.N_PARAM) {
let isvar: bool = scanp.op == tkind.TK_ELLIPSIS;
@@ -913,6 +956,13 @@ fn cgfn(c: *cgen, fn_: *node) void = {
emitint(frame: i64);
emitline(", SP\n");
if (sret_callee) {
let saoff: i32 = localadd(c, "@sretarg", 8, nil);
emitline("\tMOVQ\tDI, ");
emitoff(saoff: i64);
emitline("(BP)\n");
};
cgfnparams(c, fn_.list);
c.lastwasreturn = 0;
// Iterate the fn body's statements directly rather than dispatching

42
selfhost/cmd/wcc/cgenexpr.ww
View File

@@ -2991,6 +2991,24 @@ fn cgcall(c: *cgen, n: *node) void = {
};
};
let nargs: i32 = pushargsrev(c, n.list, calleeparams);
// sret call (#23): callee returns plain TY_STRUCT > 24B. The
// dest pointer lands in RDI; start intidx at 1 to skip RDI in
// the user-arg pop loop and emit `LEAQ off(BP), DI` AFTER all
// pops have finished (so they don't clobber RDI). The dest off
// is either the receive site's slot (c.sretdestoff, propagated
// from cglet / cgassign ident) or the per-fn @sretscr discard
// slot reserved by scanlocals.
let sretcs: i32 = callsretsize(c, n);
let sretcalloff: i32 = 0;
if (sretcs > 0) {
if (c.sretdestoff != 0) {
sretcalloff = c.sretdestoff;
c.sretdestoff = 0;
} else {
sretcalloff = localadd(c, "@sretscr",
c.sretscrsz, nil);
};
};
// Pop forward. Float args were pushed as 8 bytes from X0 via
// SUBQ+MOVSD; pop into the XMM stream (X0..X7). Everything else
// pops into the int stream (DI..R9) per the SysV ABI. Walk the
@@ -2999,6 +3017,7 @@ fn cgcall(c: *cgen, n: *node) void = {
// the remaining slots stay on the stack and the callee reads them
// via 16+8*k(BP). Caller-cleanup is emitted after the CALL.
let intidx: i32 = 0;
if (sretcs > 0) { intidx = 1; };
let fpidx: i32 = 0;
let a: *node = n.list;
let popped: i32 = 0;
@@ -3129,6 +3148,14 @@ fn cgcall(c: *cgen, n: *node) void = {
};
};
};
// sret hidden first-arg (#23): load &dest into RDI AFTER all
// user-arg pops have finished — intidx started at 1 so RDI was
// never written. The CALL emit follows immediately.
if (sretcs > 0) {
emitline("\tLEAQ\t");
emitoff(sretcalloff: i64);
emitline("(BP), DI\n");
};
if (isfnptrcall) {
// Load fn-ptr field value into AX; CALL AX. We emit the
// load AFTER the args have been popped (so AX/BX/etc
@@ -5304,6 +5331,21 @@ fn cgassign(c: *cgen, n: *node) void = {
};
if (n.rhs != nil
&& n.rhs.kind == nkind.N_CALL) {
// sret receive (#23): plain
// TY_STRUCT > 24B from a CALL.
// `s` is the prealloc dest; the
// callee writes through hidden RDI
// directly into off(BP). Mirror of
// cglet's sret branch.
if (lcnsz > 24) {
let rscs: i32 = callsretsize(c, n.rhs);
if (rscs > 0) {
c.sretdestoff = off;
cgexpr(c, n.rhs);
c.sretdestoff = 0;
return;
};
};
let lcsz: i32 = lcnsz;
if (lcsz <= 24) {
let tlm: i32 = lcsz - (lcsz / 8) * 8;

113
selfhost/cmd/wcc/cgenstmt.ww
View File

@@ -291,15 +291,106 @@ fn cgreturn(c: *cgen, n: *node) void = {
c.lastwasreturn = 1;
return;
};
// sret return (#23): plain TY_STRUCT > 24B. Callee writes
// through *(@sretarg) (the caller-prealloc dest saved at
// the prologue), then loads @sretarg into RAX and rets —
// the SysV "return the pointer" discipline. Two rhs shapes
// are wired: N_IDENT (word-copy from rhs slot to *(dest))
// and N_STRUCTLIT (cgstructlitfill with mode=1 PTR_LOCAL).
if (c.sretargoff != 0) {
let scs: i32 = sretretsize(c, c.fnret);
if (scs > 0) {
// `return f();` from a sret callee would silent-
// miscompile: cgexpr writes inner's result to
// @sretscr but outer never copies into *@sretarg
// and never sets RAX. Fail loud per CLAUDE.md
// rule 7; the `let r = f(); return r;` workaround
// is already wired and byte-id with cstage.
if (rhs.kind == nkind.N_CALL) {
let m: str = "ww: cgreturn: sret return-forwarding for >24B struct not wired (task #23)\n";
os.write(2, m.ptr, m.len: u64);
os.exit(1);
};
let okrhs: bool = false;
if (rhs.kind == nkind.N_IDENT) { okrhs = true; };
if (rhs.kind == nkind.N_STRUCTLIT) { okrhs = true; };
if (okrhs) {
if (rhs.kind == nkind.N_STRUCTLIT) {
let trefn: *node = rhs.lhs;
let sname: str;
sname.ptr = nil; sname.len = 0;
if (trefn != nil) {
if (trefn.kind == nkind.N_IDENT) { sname = trefn.str; }
else { if (trefn.kind == nkind.N_TNAME) { sname = trefn.str; }; };
};
let sret_si: *structinfo = structlookup(c, sname);
if (sret_si != nil) {
let emptys: str;
emptys.ptr = nil; emptys.len = 0;
// mode=1 (PTR_LOCAL): base reg = BX,
// reloaded from @sretarg(BP) before
// each field store. disp = 0 because
// the dest pointer IS the struct base.
cgstructlitfill(c, sret_si, rhs,
1, c.sretargoff, emptys,
0, scs);
};
} else {
let rl: *local = localfindnode(c, rhs.str);
if (rl != nil) {
emitline("\tMOVQ\t");
emitoff(c.sretargoff: i64);
emitline("(BP), BX\n");
let k: i32 = 0;
for (k + 8 <= scs) {
emitline("\tMOVQ\t");
emitoff((rl.off + k): i64);
emitline("(BP), AX\n");
emitline("\tMOVQ\tAX, ");
emitoff(k: i64);
emitline("(BX)\n");
k += 8;
};
for (k + 4 <= scs) {
emitline("\tMOVL\t");
emitoff((rl.off + k): i64);
emitline("(BP), AX\n");
emitline("\tMOVL\tAX, ");
emitoff(k: i64);
emitline("(BX)\n");
k += 4;
};
for (k < scs) {
emitline("\tMOVB\t");
emitoff((rl.off + k): i64);
emitline("(BP), AX\n");
emitline("\tMOVB\tAX, ");
emitoff(k: i64);
emitline("(BX)\n");
k += 1;
};
};
};
// sret return: RAX = dest pointer.
emitline("\tMOVQ\t");
emitoff(c.sretargoff: i64);
emitline("(BP), AX\n");
emitline("\tMOVQ\tBP, SP\n");
emitline("\tPOPQ\tBP\n");
emitline("\tRET\n");
c.lastwasreturn = 1;
return;
};
};
};
// Whole-struct return for sizes <= 24B. ABI: AX=bytes[0..7],
// DX=bytes[8..15], CX=bytes[16..23]. Mirrors cstage cgen.c
// N_RETURN TY_STRUCT branch. Two rhs shapes are wired:
// N_IDENT (word-copy from rhs local slot) and N_STRUCTLIT
// (field-by-field store at scratch+foff, with tagged fields
// delegated to cgwidentaggedstore). Call-result chain return
// is deferred to #5's receive side. Sizes > 24B fall through
// to the scalar path below (only AX gets the first qword),
// pending sret.
// is deferred to #5's receive side. Sizes > 24B route through
// the sret arm above.
let rname: str;
rname.ptr = nil; rname.len = 0;
if (c.fnret != nil) {
@@ -623,6 +714,22 @@ fn cglet(c: *cgen, n: *node) void = {
return;
};
};
// sret receive (#23): plain TY_STRUCT > 24B from a call.
// The let's own slot IS the caller-prealloc dest; the
// nested cgexpr → cgcall path emits `LEAQ off(BP), DI`
// before the CALL and the callee writes through it. No
// AX/DX/CX shuffle; AX returns the dest pointer per SysV
// sret discipline (irrelevant here).
if (rhs.kind == nkind.N_CALL) {
let scs: i32 = callsretsize(c, rhs);
if (scs > 0) {
c.sretdestoff = off;
cgexpr(c, rhs);
c.sretdestoff = 0;
c.lastwasreturn = 0;
return;
};
};
// Whole-struct receive for sizes <=24B (call-result rhs).
// Counterpart of #4's cgreturn ABI: cgexpr leaves
// AX=bytes[0..7], DX=bytes[8..15], CX=bytes[16..23],

43
selfhost/cmd/wcc/cgenutil.ww
View File

@@ -1348,6 +1348,49 @@ fn structnaturalsize(si: *structinfo) i32 = {
return n;
};
// sretretsize — if `t` ultimately denotes a plain TY_STRUCT > 24B,
// return its natural size; else 0. Tagged unions, tuples, str,
// slices, scalars route through their existing register-return ABIs
// (AX/DX/CX/[R8]) regardless of size. Task #23 mirrors cstage's
// cg_sret_retsize predicate. Resolves N_TNAME → struct via structlookup
// and unwraps one leading N_TBANG so `type box = !big;` still
// triggers sret on the underlying big.
export fn sretretsize(c: *cgen, t: *node) i32 = {
if (t == nil) { return 0; };
let r: *node = t;
if (r.kind == nkind.N_TBANG) {
r = r.lhs;
if (r == nil) { return 0; };
};
if (r.kind != nkind.N_TNAME) { return 0; };
// Primitives / aliased-to-primitives are never sret.
if (primsize(r.str) > 0) { return 0; };
if (streq(r.str, "str")) { return 0; };
let si: *structinfo = structlookup(c, r.str);
if (si == nil) { return 0; };
let n: i32 = structnaturalsize(si);
if (n <= 24) { return 0; };
return n;
};
// callsretsize — if N_CALL `n`'s callee returns a plain TY_STRUCT
// > 24B, return its natural size; else 0. Wraps sretretsize over the
// callee's resolved return type, used by cglet / cgassign receive
// sites and cgcall to detect sret at the receive / emit boundaries.
export fn callsretsize(c: *cgen, n: *node) i32 = {
if (n == nil) { return 0; };
if (n.kind != nkind.N_CALL) { return 0; };
let callee: *node = n.lhs;
if (callee == nil) { return 0; };
let cn: str;
cn.ptr = nil; cn.len = 0;
if (callee.kind == nkind.N_IDENT) { cn = callee.str; };
if (callee.kind == nkind.N_DOT) { cn = callee.str; };
if (cn.len == 0) { return 0; };
let rt: *node = fnretlookup(c, cn);
return sretretsize(c, rt);
};
fn structlookup(c: *cgen, name: str) *structinfo = {
// Exact match first: bare-from-source struct names and already-
// leafed lookups hit here directly.

292
selfhost/cmd/wwdump/main.combined.ww
View File

@@ -7738,6 +7738,49 @@ fn structnaturalsize(si: *structinfo) i32 = {
return n;
};
// sretretsize — if `t` ultimately denotes a plain TY_STRUCT > 24B,
// return its natural size; else 0. Tagged unions, tuples, str,
// slices, scalars route through their existing register-return ABIs
// (AX/DX/CX/[R8]) regardless of size. Task #23 mirrors cstage's
// cg_sret_retsize predicate. Resolves N_TNAME → struct via structlookup
// and unwraps one leading N_TBANG so `type box = !big;` still
// triggers sret on the underlying big.
export fn sretretsize(c: *cgen, t: *node) i32 = {
if (t == nil) { return 0; };
let r: *node = t;
if (r.kind == nkind.N_TBANG) {
r = r.lhs;
if (r == nil) { return 0; };
};
if (r.kind != nkind.N_TNAME) { return 0; };
// Primitives / aliased-to-primitives are never sret.
if (primsize(r.str) > 0) { return 0; };
if (streq(r.str, "str")) { return 0; };
let si: *structinfo = structlookup(c, r.str);
if (si == nil) { return 0; };
let n: i32 = structnaturalsize(si);
if (n <= 24) { return 0; };
return n;
};
// callsretsize — if N_CALL `n`'s callee returns a plain TY_STRUCT
// > 24B, return its natural size; else 0. Wraps sretretsize over the
// callee's resolved return type, used by cglet / cgassign receive
// sites and cgcall to detect sret at the receive / emit boundaries.
export fn callsretsize(c: *cgen, n: *node) i32 = {
if (n == nil) { return 0; };
if (n.kind != nkind.N_CALL) { return 0; };
let callee: *node = n.lhs;
if (callee == nil) { return 0; };
let cn: str;
cn.ptr = nil; cn.len = 0;
if (callee.kind == nkind.N_IDENT) { cn = callee.str; };
if (callee.kind == nkind.N_DOT) { cn = callee.str; };
if (cn.len == 0) { return 0; };
let rt: *node = fnretlookup(c, cn);
return sretretsize(c, rt);
};
fn structlookup(c: *cgen, name: str) *structinfo = {
// Exact match first: bare-from-source struct names and already-
// leafed lookups hit here directly.
@@ -12942,6 +12985,24 @@ fn cgcall(c: *cgen, n: *node) void = {
};
};
let nargs: i32 = pushargsrev(c, n.list, calleeparams);
// sret call (#23): callee returns plain TY_STRUCT > 24B. The
// dest pointer lands in RDI; start intidx at 1 to skip RDI in
// the user-arg pop loop and emit `LEAQ off(BP), DI` AFTER all
// pops have finished (so they don't clobber RDI). The dest off
// is either the receive site's slot (c.sretdestoff, propagated
// from cglet / cgassign ident) or the per-fn @sretscr discard
// slot reserved by scanlocals.
let sretcs: i32 = callsretsize(c, n);
let sretcalloff: i32 = 0;
if (sretcs > 0) {
if (c.sretdestoff != 0) {
sretcalloff = c.sretdestoff;
c.sretdestoff = 0;
} else {
sretcalloff = localadd(c, "@sretscr",
c.sretscrsz, nil);
};
};
// Pop forward. Float args were pushed as 8 bytes from X0 via
// SUBQ+MOVSD; pop into the XMM stream (X0..X7). Everything else
// pops into the int stream (DI..R9) per the SysV ABI. Walk the
@@ -12950,6 +13011,7 @@ fn cgcall(c: *cgen, n: *node) void = {
// the remaining slots stay on the stack and the callee reads them
// via 16+8*k(BP). Caller-cleanup is emitted after the CALL.
let intidx: i32 = 0;
if (sretcs > 0) { intidx = 1; };
let fpidx: i32 = 0;
let a: *node = n.list;
let popped: i32 = 0;
@@ -13080,6 +13142,14 @@ fn cgcall(c: *cgen, n: *node) void = {
};
};
};
// sret hidden first-arg (#23): load &dest into RDI AFTER all
// user-arg pops have finished — intidx started at 1 so RDI was
// never written. The CALL emit follows immediately.
if (sretcs > 0) {
emitline("\tLEAQ\t");
emitoff(sretcalloff: i64);
emitline("(BP), DI\n");
};
if (isfnptrcall) {
// Load fn-ptr field value into AX; CALL AX. We emit the
// load AFTER the args have been popped (so AX/BX/etc
@@ -15255,6 +15325,21 @@ fn cgassign(c: *cgen, n: *node) void = {
};
if (n.rhs != nil
&& n.rhs.kind == nkind.N_CALL) {
// sret receive (#23): plain
// TY_STRUCT > 24B from a CALL.
// `s` is the prealloc dest; the
// callee writes through hidden RDI
// directly into off(BP). Mirror of
// cglet's sret branch.
if (lcnsz > 24) {
let rscs: i32 = callsretsize(c, n.rhs);
if (rscs > 0) {
c.sretdestoff = off;
cgexpr(c, n.rhs);
c.sretdestoff = 0;
return;
};
};
let lcsz: i32 = lcnsz;
if (lcsz <= 24) {
let tlm: i32 = lcsz - (lcsz / 8) * 8;
@@ -15744,15 +15829,106 @@ fn cgreturn(c: *cgen, n: *node) void = {
c.lastwasreturn = 1;
return;
};
// sret return (#23): plain TY_STRUCT > 24B. Callee writes
// through *(@sretarg) (the caller-prealloc dest saved at
// the prologue), then loads @sretarg into RAX and rets —
// the SysV "return the pointer" discipline. Two rhs shapes
// are wired: N_IDENT (word-copy from rhs slot to *(dest))
// and N_STRUCTLIT (cgstructlitfill with mode=1 PTR_LOCAL).
if (c.sretargoff != 0) {
let scs: i32 = sretretsize(c, c.fnret);
if (scs > 0) {
// `return f();` from a sret callee would silent-
// miscompile: cgexpr writes inner's result to
// @sretscr but outer never copies into *@sretarg
// and never sets RAX. Fail loud per CLAUDE.md
// rule 7; the `let r = f(); return r;` workaround
// is already wired and byte-id with cstage.
if (rhs.kind == nkind.N_CALL) {
let m: str = "ww: cgreturn: sret return-forwarding for >24B struct not wired (task #23)\n";
os.write(2, m.ptr, m.len: u64);
os.exit(1);
};
let okrhs: bool = false;
if (rhs.kind == nkind.N_IDENT) { okrhs = true; };
if (rhs.kind == nkind.N_STRUCTLIT) { okrhs = true; };
if (okrhs) {
if (rhs.kind == nkind.N_STRUCTLIT) {
let trefn: *node = rhs.lhs;
let sname: str;
sname.ptr = nil; sname.len = 0;
if (trefn != nil) {
if (trefn.kind == nkind.N_IDENT) { sname = trefn.str; }
else { if (trefn.kind == nkind.N_TNAME) { sname = trefn.str; }; };
};
let sret_si: *structinfo = structlookup(c, sname);
if (sret_si != nil) {
let emptys: str;
emptys.ptr = nil; emptys.len = 0;
// mode=1 (PTR_LOCAL): base reg = BX,
// reloaded from @sretarg(BP) before
// each field store. disp = 0 because
// the dest pointer IS the struct base.
cgstructlitfill(c, sret_si, rhs,
1, c.sretargoff, emptys,
0, scs);
};
} else {
let rl: *local = localfindnode(c, rhs.str);
if (rl != nil) {
emitline("\tMOVQ\t");
emitoff(c.sretargoff: i64);
emitline("(BP), BX\n");
let k: i32 = 0;
for (k + 8 <= scs) {
emitline("\tMOVQ\t");
emitoff((rl.off + k): i64);
emitline("(BP), AX\n");
emitline("\tMOVQ\tAX, ");
emitoff(k: i64);
emitline("(BX)\n");
k += 8;
};
for (k + 4 <= scs) {
emitline("\tMOVL\t");
emitoff((rl.off + k): i64);
emitline("(BP), AX\n");
emitline("\tMOVL\tAX, ");
emitoff(k: i64);
emitline("(BX)\n");
k += 4;
};
for (k < scs) {
emitline("\tMOVB\t");
emitoff((rl.off + k): i64);
emitline("(BP), AX\n");
emitline("\tMOVB\tAX, ");
emitoff(k: i64);
emitline("(BX)\n");
k += 1;
};
};
};
// sret return: RAX = dest pointer.
emitline("\tMOVQ\t");
emitoff(c.sretargoff: i64);
emitline("(BP), AX\n");
emitline("\tMOVQ\tBP, SP\n");
emitline("\tPOPQ\tBP\n");
emitline("\tRET\n");
c.lastwasreturn = 1;
return;
};
};
};
// Whole-struct return for sizes <= 24B. ABI: AX=bytes[0..7],
// DX=bytes[8..15], CX=bytes[16..23]. Mirrors cstage cgen.c
// N_RETURN TY_STRUCT branch. Two rhs shapes are wired:
// N_IDENT (word-copy from rhs local slot) and N_STRUCTLIT
// (field-by-field store at scratch+foff, with tagged fields
// delegated to cgwidentaggedstore). Call-result chain return
// is deferred to #5's receive side. Sizes > 24B fall through
// to the scalar path below (only AX gets the first qword),
// pending sret.
// is deferred to #5's receive side. Sizes > 24B route through
// the sret arm above.
let rname: str;
rname.ptr = nil; rname.len = 0;
if (c.fnret != nil) {
@@ -16076,6 +16252,22 @@ fn cglet(c: *cgen, n: *node) void = {
return;
};
};
// sret receive (#23): plain TY_STRUCT > 24B from a call.
// The let's own slot IS the caller-prealloc dest; the
// nested cgexpr → cgcall path emits `LEAQ off(BP), DI`
// before the CALL and the callee writes through it. No
// AX/DX/CX shuffle; AX returns the dest pointer per SysV
// sret discipline (irrelevant here).
if (rhs.kind == nkind.N_CALL) {
let scs: i32 = callsretsize(c, rhs);
if (scs > 0) {
c.sretdestoff = off;
cgexpr(c, rhs);
c.sretdestoff = 0;
c.lastwasreturn = 0;
return;
};
};
// Whole-struct receive for sizes <=24B (call-result rhs).
// Counterpart of #4's cgreturn ABI: cgexpr leaves
// AX=bytes[0..7], DX=bytes[8..15], CX=bytes[16..23],
@@ -16804,6 +16996,20 @@ fn tagscrbump(c: *cgen, need: i32) i32 = {
return delta;
};
// sretscrbump — sister of tagscrbump for the sret discard slot
// (#23). Tracks max sret return type used as a CALL discard / nested
// receiver. Returns frame-byte delta vs the previous high water mark
// (rounded up to 8B).
fn sretscrbump(c: *cgen, need: i32) i32 = {
let n: i32 = need;
if (n < 8) { n = 8; };
if ((n & 7) != 0) { n = (n + 7) & ~7; };
if (n <= c.sretscrsz) { return 0; };
let delta: i32 = n - c.sretscrsz;
c.sretscrsz = n;
return delta;
};
//
// Recursively walks the body to count every local `let`. Each gets a
// slot sized by slotsize(typ); 8-byte default. Match-bindings + for-
@@ -17140,6 +17346,17 @@ fn scanlocals(c: *cgen, n: *node) i32 = {
};
};
};
// sret CALL (#23): callee returns plain TY_STRUCT > 24B. The
// receive site (cglet / cgassign ident) overrides at emit time
// with the dest local's own slot; discards / nested calls fall
// back to @sretscr. Single-slot per fn sized to the max sret
// return — sretscrbump tracks the high-water mark so a later
// larger call grows the frame without re-counting the prior
// reservation. Mirrors @tagscr's cumulative tagscrbump.
if (n.kind == nkind.N_CALL) {
let scs: i32 = callsretsize(c, n);
if (scs > 0) { total += sretscrbump(c, scs); };
};
// Call-site struct-payload widening uses @tagscr — when the
// arg is a struct literal/ident and the callee's param is
// tagged, pushargsrev materialises in scratch and pushes.
@@ -17254,7 +17471,11 @@ fn scanlocals(c: *cgen, n: *node) i32 = {
fn cgfnparams(c: *cgen, params: *node) void = {
let p: *node = params;
// sret (#23): RDI is consumed by the hidden dest pointer
// (already spilled to @sretarg by cgfn); the first user param
// lands in SI.
let idx: i32 = 0;
if (c.sretargoff != 0) { idx = 1; };
let fidx: i32 = 0;
// Cursor for args that overflow the SysV reg windows. Each
// stack-passed arg lives at 16+8*k(BP) — no spill, the local
@@ -17564,6 +17785,14 @@ fn cgfn(c: *cgen, fn_: *node) void = {
c.curmod = fn_.module;
c.fnret = fn_.lhs;
// sret callee (#23): return type is plain TY_STRUCT > 24B.
// Reserve 8B for @sretarg (holds the saved hidden RDI dest
// pointer); cgfnparams skips DI for user args, cgreturn writes
// through *(@sretarg) and returns @sretarg in RAX. Decision
// made here so the frame pre-scan and cgfnparams see the same
// view of the int-arg cursor.
let sret_callee: bool = sretretsize(c, c.fnret) > 0;
// Emit the TEXT label via emitfnname so the def site picks up the
// same skip rule (FFI / `main` / empty-module) and the same module
// hint (this fn's own module) that the call sites use. Drops the
@@ -17586,6 +17815,12 @@ fn cgfn(c: *cgen, fn_: *node) void = {
let frame: i32 = 0;
let argi: i32 = 0;
let fargi: i32 = 0;
// Reserve @sretarg (8B) BEFORE the param-induced frame, and
// start argi at 1 so the param walker sees RDI as consumed.
if (sret_callee) {
frame += 8;
argi = 1;
};
for (scanp != nil) {
if (scanp.kind == nkind.N_PARAM) {
let isvar: bool = scanp.op == tkind.TK_ELLIPSIS;
@@ -17678,6 +17913,13 @@ fn cgfn(c: *cgen, fn_: *node) void = {
emitint(frame: i64);
emitline(", SP\n");
if (sret_callee) {
let saoff: i32 = localadd(c, "@sretarg", 8, nil);
emitline("\tMOVQ\tDI, ");
emitoff(saoff: i64);
emitline("(BP)\n");
};
cgfnparams(c, fn_.list);
c.lastwasreturn = 0;
// Iterate the fn body's statements directly rather than dispatching
@@ -18179,6 +18421,29 @@ type cgen = struct {
// later emit reuses. Mirrors c.tagscrsz pattern (#38) but tracks
// offset, not size (per-fn return type is fixed, so size is too).
retscroff: i32,
// System V AMD64 sret discipline (#23). Plain TY_STRUCT returns
// with size > 24B are passed via a hidden first-arg pointer
// (RDI) to a caller-prealloc dest; the callee writes through
// that pointer and returns it in RAX.
//
// sretargoff — callee-side @sretarg slot (8B, holds saved RDI).
// Set in cgfn prologue when the fn's return type
// triggers sret. 0 means N/A.
// sretdestoff — caller-side dest BP offset, propagated from a
// receive site (cglet / cgassign ident) to the
// nested cgexpr → cgcall so the call emits
// `LEAQ off(BP), DI` instead of allocating a
// scratch. 0 means no receiver wired.
// sretscroff — per-fn @sretscr discard slot, used by sret CALLs
// whose result has no named receiver. Single-slot
// SSoT mirroring c.retscroff; the scanlocals walk
// sums c.sretscrsz to pre-reserve.
// sretscrsz — max sret discard size in this fn (sums during
// scanlocals, consumed by localadd("@sretscr", ...)).
sretargoff: i32,
sretdestoff: i32,
sretscroff: i32,
sretscrsz: i32,
};
// Top-level mutable `let` registry. Mirrors cmd/w6c/cgen.c LetVar.
@@ -18202,6 +18467,10 @@ fn cgeninit(c: *cgen, a: *arena) void = {
c.varargseq = 0;
c.tagscrsz = 0;
c.retscroff = 0;
c.sretargoff = 0;
c.sretdestoff = 0;
c.sretscroff = 0;
c.sretscrsz = 0;
// Note: strlit_seq, strlits, ffis are *not* reset here; they
// persist across cgfn calls within one file. cgfile resets them
// at the start of each compilation unit.
@@ -18285,6 +18554,23 @@ fn localadd(c: *cgen, name: str, sz: i32, tnode: *node) i32 = {
c.retscroff = off;
return off;
};
// @sretarg / @sretscr (#23): same single-slot SSoT
// pattern as @retscr. @sretarg holds the saved hidden
// RDI for sret callees (8B, set once per fn at the
// prologue); @sretscr is the caller-side discard slot
// for sret CALLs whose result is dropped.
if (streq(name, "@sretarg")) {
if (c.sretargoff != 0) { return c.sretargoff; };
let off: i32 = localalloc(c, name, sz, tnode);
c.sretargoff = off;
return off;
};
if (streq(name, "@sretscr")) {
if (c.sretscroff != 0) { return c.sretscroff; };
let off: i32 = localalloc(c, name, sz, tnode);
c.sretscroff = off;
return off;
};
let cur: *local = c.locals;
for (cur != nil) {
let cn: str = cur.name;

90
test/wcc/698_cgreturn_struct.c
View File

@@ -1,41 +1,39 @@
/*
* 698_cgreturn_struct — whole-struct return ABI for sizes <= 24B.
* 698_cgreturn_struct — whole-struct return ABI across both 3-reg
* register-return (≤24B) and SysV sret (>24B, task #23) paths.
*
* Pre-#7: `return s;` from a struct-returning fn fell through to the
* scalar path: only the first 8 bytes of the struct made it to AX,
* the rest was silently dropped. Compounded with the receive side
* (#5 N_ASSIGN whole-STRUCT rhs) being unwired, struct returns were
* a no-op end-to-end.
*
* #7 wires the producer side: cgreturn now materialises the struct
* into a zero-padded 24B scratch slot (`@retscr`), then loads
* AX/DX/CX from the slot unconditionally — three MOVQs regardless of
* declared size — so receiver code (landing in #5) can read all
* three words and mask by the declared struct size. R8 stays
* reserved for the tagged-return 4th word; sret for sizes > 24B is
* a separate future task.
* the rest was silently dropped. #7 wired the ≤24B producer side
* (materialise into @retscr, load AX/DX/CX). The >24B case stayed
* OUT OF SCOPE — fell through to the same scalar path — until task
* #23 landed standard SysV sret discipline (caller pre-allocates
* dest, passes &dest in RDI, callee writes through *RDI and returns
* RDI in RAX). Surfaced by lib/encoding/utf8 pre-flight when the
* Hoehrmann decoder (`struct { offs: size, src: []u8 }`, 32B) hit
* the OUT-OF-SCOPE path; the marker pattern bit precisely when its
* scope hit, which is the right escalation signal.
*
* What this test pins:
* - cstage and wwstage emit byte-identical asm for every fixture
* (the bootstrap byte-identity invariant — if either stage's
* scanlocals / cgreturn drifts, the diff catches it).
* - cstage and wwstage emit byte-identical asm for every fixture,
* including the new 25B+ sret rows (the bootstrap byte-identity
* invariant — if either stage's scanlocals / cgreturn / cgcall
* drifts, the diff catches it).
* - Each fixture compiles+links+runs without crashing under both
* drivers (proves the prologue SUBQ reserves enough frame for
* the @retscr scratch; an under-booked frame would smash the
* saved BP / return address on the load-back).
* @retscr / @sretarg / @sretscr; an under-booked frame would
* smash the saved BP / return address).
* - End-to-end value verification (caller reads AX/DX/CX into a
* dst slot) is deferred to #5's test surface, since that's the
* receive side. Until then the call's result is discarded and
* main returns a literal exit code; we're checking the cgreturn
* side doesn't crash or produce invalid asm.
* dst slot, or sret writes through *RDI) is deferred to #5's
* test surface and the new 9xx semantic test for #23. Here we
* check the cgreturn side doesn't crash or produce invalid asm.
*
* Coverage: five struct shapes — 8B one-field, 16B two-i64, 24B
* three-i64 (the headline ABI shape), mixed-alignment i32+i32+i64+i64
* (totsize 24 with the i32-pair packed), and N_IDENT rhs (let-init
* then `return p;`) vs N_STRUCTLIT rhs (`return T{...};`). The
* 25B+ sret case is explicitly OUT OF SCOPE — falls through to the
* existing scalar path (only AX gets the first qword); not pinned
* here.
* Coverage: ≤24B shapes — 8B one-field, 16B two-i64, 24B three-i64,
* mixed-alignment i32+i32+i64+i64 (totsize 24 with the i32-pair
* packed), and N_IDENT rhs (let-init then `return p;`). Plus the
* new 25B+ rows added with #23: 32B i64×4, the utf8 decoder shape
* (i64 + []u8 = 32B aligned, the canonical surfacing case), and
* 40B i64×5.
*/
#include <stdio.h>
#include <stdlib.h>
@@ -99,6 +97,42 @@ static const struct row rows[] = {
"};\n"
"fn main() i32 = { mk(); return 0; };\n",
0 },
/* 32B four-i64 — first row past the 24B → sret threshold.
* Hits the sret prologue (@sretarg ← DI), the structlit-fill
* through *(@sretarg), and `MOVQ @sretarg(BP), AX; RET`. */
{ "quad_i64_lit_sret",
"type quad = struct { a: i64, b: i64, c: i64, d: i64 };\n"
"fn mk() quad = { return quad { a = 1i64, b = 2i64, c = 3i64, d = 4i64 }; };\n"
"fn main() i32 = { let q: quad = mk(); return 0; };\n",
0 },
/* utf8 decoder shape (the surfacing case for #23):
* `struct { offs: i64, src: []u8 }` — i64 at +0, slice at +8
* (16B+8B alignment, totsize 32). N_IDENT rhs exercises the
* sret word-copy-from-rhs-slot branch. */
{ "decoder_ident_sret",
"type decoder = struct { offs: i64, src: []u8 };\n"
"fn mk(s: []u8) decoder = {\n"
" let r: decoder;\n"
" r.offs = 0i64;\n"
" r.src = s;\n"
" return r;\n"
"};\n"
"fn main() i32 = {\n"
" let b: [1]u8;\n"
" let d: decoder = mk(b[0:1]);\n"
" return 0;\n"
"};\n",
0 },
/* 40B five-i64 — second sret row, sized past 32B to exercise
* the sretscr / @sretarg sizing for a larger struct in the
* same fn family. */
{ "five_i64_lit_sret",
"type five = struct { a: i64, b: i64, c: i64, d: i64, e: i64 };\n"
"fn mk() five = {\n"
" return five { a = 1i64, b = 2i64, c = 3i64, d = 4i64, e = 5i64 };\n"
"};\n"
"fn main() i32 = { let f: five = mk(); return 0; };\n",
0 },
};
static int

304
test/wcc/721_sret_struct_return.c Normal file
View File

@@ -0,0 +1,304 @@
/*
* 721_sret_struct_return — Class A asm-presence sentinels for the
* System V AMD64 sret ABI lowering (task #23).
*
* #23 wires both stages to lower a plain TY_STRUCT return > 24B
* through the standard SysV sret discipline: caller pre-allocates
* dest, passes &dest in RDI as a hidden first arg (shifting all
* declared args right by one — SI/DX/CX/R8/R9/+stack), callee saves
* RDI to @sretarg in the prologue, writes the return value through
* the saved pointer, then `MOVQ @sretarg(BP), AX; RET` (the SysV
* "return the pointer" discipline). 4 lowering sites: caller arg-
* shift+receive, callee prologue, callee return — receive collapses
* into the caller-prealloc because the named LHS slot IS the
* prealloc dest.
*
* Pre-#23: cstage skipped the CALL emit entirely at the receive
* site (frame layout collapsed; exit 11). wwstage emitted the CALL
* but truncated the 32B return to RAX only (slice payload garbage;
* segfault). Surfaced by lib/encoding/utf8 pre-flight when the
* Hoehrmann decoder `struct { offs: size, src: []u8 }` (32B) hit
* the documented OUT-OF-SCOPE marker at 698.
*
* Three sentinels per row pinned here (rob-pike's triangle):
* (a) caller emits `LEAQ <K>(BP), DI` immediately before `CALL` —
* the hidden RDI dest pointer (asm-presence positive).
* (b) callee emits `MOVQ <K>(BP), AX` BEFORE the final `RET` —
* the sret return-the-pointer load (asm-presence positive).
* The K is the @sretarg offset; we don't pin it, but we pin
* that an `(BP), AX` load lives in the last three lines
* before RET in any fn whose return type is > 24B struct.
* (c) caller emits NO `MOVQ AX, <K>(BP)` capture of the call
* result for a return type > 24B (asm-presence negative).
* Pre-#23 wwstage emitted such a capture and truncated.
*
* Plus byte-id between stages per row (a future Class A divergence
* via either site catches here).
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
struct row { const char *label; const char *src; };
/* Each row's mk fn returns a >24B struct; main does a `let r: T = mk(...)`
* so the receive site is wired and the sret discipline fires. */
static const struct row rows[] = {
/* 32B four-i64: the smallest-padded sret return shape. */
{ "quad_i64",
"type quad = struct { a: i64, b: i64, c: i64, d: i64 };\n"
"fn mk() quad = {\n"
" return quad { a = 1i64, b = 2i64, c = 3i64, d = 4i64 };\n"
"};\n"
"fn main() i32 = { let q: quad = mk(); return 0; };\n" },
/* utf8 decoder shape (surfacing case for #23): i64 + []u8. The
* []u8 field's slice layout (ptr/len/cap) crosses the AX/DX/CX
* boundary — the wwstage truncation bug dropped the slice tail. */
{ "decoder",
"type decoder = struct { offs: i64, src: []u8 };\n"
"fn mk(s: []u8) decoder = {\n"
" let r: decoder;\n"
" r.offs = 0i64;\n"
" r.src = s;\n"
" return r;\n"
"};\n"
"fn main() i32 = {\n"
" let b: [1]u8;\n"
" let d: decoder = mk(b[0:1]);\n"
" return 0;\n"
"};\n" },
/* 40B five-i64: second size past 24B, exercises @sretscr sizing. */
{ "five_i64",
"type five = struct { a: i64, b: i64, c: i64, d: i64, e: i64 };\n"
"fn mk() five = {\n"
" return five { a = 1i64, b = 2i64, c = 3i64, d = 4i64, e = 5i64 };\n"
"};\n"
"fn main() i32 = { let f: five = mk(); return 0; };\n" },
};
static int
slurp(const char *path, char *buf, size_t cap)
{
FILE *f = fopen(path, "rb");
if (!f) return -1;
size_t n = fread(buf, 1, cap - 1, f);
fclose(f);
buf[n] = '\0';
return (int)n;
}
static int
emit_s(const char *w6c, const struct row *r, int i, char *out_s, size_t cap)
{
char src[96], cmd[1024];
snprintf(src, sizeof src, "/tmp/sret_asm_%d_%d.ww", getpid(), i);
snprintf(out_s, cap, "/tmp/sret_asm_%d_%d_%s.s",
getpid(), i, w6c[strlen(w6c) - 1] == 'w' ? "ww" : "c");
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null", w6c, out_s, src);
int rc = runwait(cmd);
unlink(src);
return rc;
}
/* (a) caller-side prealloc sentinel: `LEAQ -K(BP), DI` must appear
* on the line immediately preceding `CALL mk(SB)`. */
static int
check_leaq_di_before_call(const char *path, const struct row *r)
{
FILE *f = fopen(path, "rb");
if (!f) return -1;
char prev[256] = {0};
char line[1024];
int ok = -1;
while (fgets(line, sizeof line, f)) {
if (strstr(line, "CALL\tmk(SB)")
|| strstr(line, "CALL mk(SB)")) {
if (strstr(prev, "LEAQ\t")
&& strstr(prev, "(BP), DI")) {
ok = 0;
}
break;
}
strncpy(prev, line, sizeof prev - 1);
prev[sizeof prev - 1] = '\0';
}
fclose(f);
if (ok != 0)
fprintf(stderr,
"row[%s]: LEAQ -K(BP), DI before CALL mk(SB) missing\n",
r->label);
return ok;
}
/* (b) callee-side return-the-pointer sentinel: in the mk fn body
* (between `TEXT mk,` and the FIRST `RET` after it), assert a
* `MOVQ -K(BP), AX` appears within the last few lines before that
* RET — the @sretarg reload. */
static int
check_movq_bp_ax_before_ret(const char *path, const struct row *r)
{
FILE *f = fopen(path, "rb");
if (!f) return -1;
char line[1024];
int in_mk = 0;
char window[8][256] = {{0}};
int wi = 0;
int ok = -1;
while (fgets(line, sizeof line, f)) {
if (!in_mk) {
if (strstr(line, "TEXT mk,") || strstr(line, "TEXT\tmk,"))
in_mk = 1;
continue;
}
if (strstr(line, "\tRET\n")) {
for (int k = 0; k < 8; k++) {
if (strstr(window[k], "MOVQ\t")
&& strstr(window[k], "(BP), AX")) {
ok = 0;
break;
}
}
break;
}
strncpy(window[wi % 8], line, sizeof window[0] - 1);
window[wi % 8][sizeof window[0] - 1] = '\0';
wi++;
}
fclose(f);
if (ok != 0)
fprintf(stderr,
"row[%s]: MOVQ -K(BP), AX before RET in mk missing\n",
r->label);
return ok;
}
/* (c) caller-side negative-assert: between `CALL mk(SB)` and the
* NEXT instruction line, there must be NO `MOVQ AX, -K(BP)` (the
* pre-#23 wwstage truncation pattern). The natural sret receive
* leaves the value in the slot already; AX holds the dest ptr but
* we don't store it back. */
static int
check_no_movq_ax_bp_after_call(const char *path, const struct row *r)
{
FILE *f = fopen(path, "rb");
if (!f) return -1;
char line[1024];
int seen_call = 0;
int peek = 0;
int ok = 0;
while (fgets(line, sizeof line, f)) {
if (!seen_call) {
if (strstr(line, "CALL\tmk(SB)")
|| strstr(line, "CALL mk(SB)")) {
seen_call = 1;
}
continue;
}
/* Inspect the next few instruction lines. A `MOVQ AX, -N(BP)`
* within ~3 lines after CALL would be the truncation
* pattern. */
if (peek++ >= 3) break;
if (strstr(line, "MOVQ\tAX,") && strstr(line, "(BP)")) {
ok = -1;
break;
}
}
fclose(f);
if (ok != 0)
fprintf(stderr,
"row[%s]: unexpected MOVQ AX, -K(BP) after CALL mk(SB)"
" (pre-#23 truncation pattern)\n", r->label);
return ok;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[512];
if (bin[0] != '/') {
char cwd[256];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char w6c[640], w6c_ww[640];
snprintf(w6c, sizeof w6c, "%s/w6c", bin);
snprintf(w6c_ww, sizeof w6c_ww, "%s/w6c_ww", bin);
int have_ww = (access(w6c_ww, X_OK) == 0);
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int i = 0; i < n; i++) {
char cs_path[128], ws_path[128];
/* cstage asm + three sentinels. */
if (emit_s(w6c, &rows[i], i, cs_path, sizeof cs_path) != 0) {
fprintf(stderr, "row[%s]: w6c failed\n", rows[i].label);
fail++; total++; continue;
}
total += 3;
if (check_leaq_di_before_call(cs_path, &rows[i]) != 0) fail++;
if (check_movq_bp_ax_before_ret(cs_path, &rows[i]) != 0) fail++;
if (check_no_movq_ax_bp_after_call(cs_path, &rows[i]) != 0) fail++;
if (!have_ww) { unlink(cs_path); continue; }
/* wwstage asm + three sentinels. */
if (emit_s(w6c_ww, &rows[i], i, ws_path, sizeof ws_path) != 0) {
fprintf(stderr,
"row[%s]: w6c_ww failed\n", rows[i].label);
fail++; total++;
unlink(cs_path);
continue;
}
total += 3;
if (check_leaq_di_before_call(ws_path, &rows[i]) != 0) fail++;
if (check_movq_bp_ax_before_ret(ws_path, &rows[i]) != 0) fail++;
if (check_no_movq_ax_bp_after_call(ws_path, &rows[i]) != 0) fail++;
/* Byte-id diff between stages. */
total++;
char cmd[512];
snprintf(cmd, sizeof cmd, "cmp -s %s %s", cs_path, ws_path);
if (runwait(cmd) != 0) {
fprintf(stderr,
"row[%s]: cstage vs wwstage asm differs\n",
rows[i].label);
fail++;
}
unlink(cs_path); unlink(ws_path);
}
if (fail) {
fprintf(stderr,
"sret_struct_return: %d/%d fixtures failed\n",
fail, total);
return 1;
}
printf("sret_struct_return: %d/%d ok\n", total, total);
return 0;
}

271
test/wcc/925_sret_struct_return_run.c Normal file
View File

@@ -0,0 +1,271 @@
/*
* 925_sret_struct_return_run — Class B semantic test for the System V
* AMD64 sret ABI lowering (task #23). End-to-end round-trip pinning
* that values cross the >24B struct-return boundary intact under
* both cstage and wwstage.
*
* Class A asm-presence is pinned at 721; Class B (this file) catches
* shared miscompiles that asm byte-id can't see. Pre-#23 both stages
* were broken in different ways — cstage skipped the CALL emit
* (exit 11), wwstage truncated to AX only (segfault). Post-#23 both
* round-trip cleanly across 32B / 40B / nested / slice-payload
* shapes.
*
* Critical row: a 25B+ struct that is BOTH returned AND passed by-
* value as an arg (collision with #11's struct-by-value param
* decompose). Catches arg-shift bugs where the hidden RDI displaces
* a declared struct-by-value arg into the wrong reg.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
struct row { const char *label; const char *src; int want; };
static const struct row rows[] = {
/* 32B four-i64: smallest sret shape. All four words must
* round-trip; pre-#23 wwstage dropped DX/CX/R8 silently. */
{ "quad_i64_roundtrip",
"type quad = struct { a: i64, b: i64, c: i64, d: i64 };\n"
"fn mk(x: i64) quad = {\n"
" return quad { a = x, b = x + 1i64, c = x + 2i64, d = x + 3i64 };\n"
"};\n"
"export fn main() i32 = {\n"
" let q: quad = mk(10i64);\n"
" if (q.a != 10i64) { return 1; };\n"
" if (q.b != 11i64) { return 2; };\n"
" if (q.c != 12i64) { return 3; };\n"
" if (q.d != 13i64) { return 4; };\n"
" return 0;\n"
"};\n",
0 },
/* utf8 decoder shape — the surfacing case for #23. i64 + []u8
* (slice ptr/len/cap). Slice-tail words pre-#23 leaked into
* the wrong slot or stayed garbage. */
{ "decoder_slice_payload",
"type decoder = struct { offs: i64, src: []u8 };\n"
"fn mk(s: []u8) decoder = {\n"
" let r: decoder;\n"
" r.offs = 42i64;\n"
" r.src = s;\n"
" return r;\n"
"};\n"
"export fn main() i32 = {\n"
" let buf: [3]u8;\n"
" buf[0] = 0xa1u8;\n"
" buf[1] = 0xb2u8;\n"
" buf[2] = 0xc3u8;\n"
" let d: decoder = mk(buf[0:3]);\n"
" if (d.offs != 42i64) { return 1; };\n"
" if (d.src.len != 3) { return 2; };\n"
" if (d.src[0] != 0xa1u8) { return 3; };\n"
" if (d.src[1] != 0xb2u8) { return 4; };\n"
" if (d.src[2] != 0xc3u8) { return 5; };\n"
" return 0;\n"
"};\n",
0 },
/* 40B five-i64: second past-24B size. Exercises @sretscr /
* @sretarg sizing for a larger struct in the same fn family. */
{ "five_i64_roundtrip",
"type five = struct { a: i64, b: i64, c: i64, d: i64, e: i64 };\n"
"fn mk() five = {\n"
" return five { a = 1i64, b = 2i64, c = 3i64, d = 4i64, e = 5i64 };\n"
"};\n"
"export fn main() i32 = {\n"
" let f: five = mk();\n"
" if (f.a != 1i64) { return 1; };\n"
" if (f.b != 2i64) { return 2; };\n"
" if (f.c != 3i64) { return 3; };\n"
" if (f.d != 4i64) { return 4; };\n"
" if (f.e != 5i64) { return 5; };\n"
" return 0;\n"
"};\n",
0 },
/* Nested struct payload: outer 32B struct contains a 16B inner.
* Pin that the inner's field offsets land correctly via the
* `cg_structlit_fill` recursion through *(@sretarg). */
{ "nested_struct_payload",
"type inner = struct { p: i64, q: i64 };\n"
"type outer = struct { i: inner, s: i64, t: i64 };\n"
"fn mk() outer = {\n"
" return outer {\n"
" i = inner { p = 100i64, q = 200i64 },\n"
" s = 300i64, t = 400i64\n"
" };\n"
"};\n"
"export fn main() i32 = {\n"
" let o: outer = mk();\n"
" if (o.i.p != 100i64) { return 1; };\n"
" if (o.i.q != 200i64) { return 2; };\n"
" if (o.s != 300i64) { return 3; };\n"
" if (o.t != 400i64) { return 4; };\n"
" return 0;\n"
"};\n",
0 },
/* Reassignment receive: `let x: T;` followed by `x = mk();`
* routes through cgassign's sret branch (vs cglet's). */
{ "reassign_receive",
"type quad = struct { a: i64, b: i64, c: i64, d: i64 };\n"
"fn mk(s: i64) quad = {\n"
" return quad { a = s, b = s, c = s, d = s };\n"
"};\n"
"export fn main() i32 = {\n"
" let q: quad;\n"
" q = mk(7i64);\n"
" if (q.a != 7i64) { return 1; };\n"
" if (q.b != 7i64) { return 2; };\n"
" if (q.c != 7i64) { return 3; };\n"
" if (q.d != 7i64) { return 4; };\n"
" return 0;\n"
"};\n",
0 },
/* Collision row: a 16B struct passed by-value as an arg into a
* fn that ALSO returns a >24B struct. Pre-fix the hidden RDI
* would displace SI/DX (the struct-by-value pair) — caller would
* pop the i64 struct-words into DX/CX and emit LEAQ into DI,
* leaving SI uninitialised and the callee reading garbage. The
* arg-shift fix routes the int-arg cursor starting at 1, so the
* 16B struct lands cleanly in SI/DX. (Sister site of #11.) */
{ "sret_with_struct16_arg",
"type pair = struct { x: i64, y: i64 };\n"
"type quad = struct { a: i64, b: i64, c: i64, d: i64 };\n"
"fn mk(p: pair, k: i64) quad = {\n"
" return quad { a = p.x, b = p.y, c = k, d = p.x + p.y + k };\n"
"};\n"
"export fn main() i32 = {\n"
" let p: pair = pair { x = 3i64, y = 5i64 };\n"
" let q: quad = mk(p, 11i64);\n"
" if (q.a != 3i64) { return 1; };\n"
" if (q.b != 5i64) { return 2; };\n"
" if (q.c != 11i64) { return 3; };\n"
" if (q.d != 19i64) { return 4; };\n"
" return 0;\n"
"};\n",
0 },
/* N_IDENT return rhs: callee builds the struct in a local
* `let r: T;` then `return r;` — exercises the word-copy-from-
* rhs-slot arm of cgreturn (vs the structlit fill arm). */
{ "ident_return_rhs",
"type pos = struct { x: i64, y: i64, z: i64, w: i64 };\n"
"fn mk() pos = {\n"
" let r: pos;\n"
" r.x = 11i64;\n"
" r.y = 22i64;\n"
" r.z = 33i64;\n"
" r.w = 44i64;\n"
" return r;\n"
"};\n"
"export fn main() i32 = {\n"
" let p: pos = mk();\n"
" if (p.x != 11i64) { return 1; };\n"
" if (p.y != 22i64) { return 2; };\n"
" if (p.z != 33i64) { return 3; };\n"
" if (p.w != 44i64) { return 4; };\n"
" return 0;\n"
"};\n",
0 },
};
static int
run_driver(const char *driver, const struct row *r, int i)
{
char src[96], tmpdir[96], cmd[1024];
snprintf(src, sizeof src, "/tmp/sret_run_%d_%d.ww", getpid(), i);
snprintf(tmpdir, sizeof tmpdir, "/tmp/sret_run_%d_d_%d", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
mkdir(tmpdir, 0755);
snprintf(cmd, sizeof cmd, "cd %s && %s build %s",
tmpdir, driver, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: build via %s failed\n",
r->label, driver);
unlink(src); rmdir(tmpdir);
return -1;
}
const char *base = strrchr(src, '/');
base = base ? base + 1 : src;
char outbin[160];
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
char *dot = strrchr(outbin, '.');
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
int got = runwait(outbin);
unlink(src); unlink(outbin); rmdir(tmpdir);
return got;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[512];
if (bin[0] != '/') {
char cwd[256];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char cdrv[640];
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
char wdrv[640];
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
struct { const char *name; const char *path; int gated_on_existence; }
drivers[] = {
{ "cstage", cdrv, 0 },
{ "wwstage", wdrv, 1 },
{ NULL, NULL, 0 },
};
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int d = 0; drivers[d].name; d++) {
if (drivers[d].gated_on_existence
&& access(drivers[d].path, X_OK) != 0) {
fprintf(stderr,
"sret_struct_return_run: skip %s (no %s)\n",
drivers[d].name, drivers[d].path);
continue;
}
for (int i = 0; i < n; i++) {
int got = run_driver(drivers[d].path, &rows[i], i);
total++;
if (got != rows[i].want) {
fprintf(stderr,
"sret_struct_return_run[%s][%s]: exit=%d want=%d\n",
drivers[d].name, rows[i].label,
got, rows[i].want);
fail++;
}
}
}
if (fail) {
fprintf(stderr,
"sret_struct_return_run: %d/%d fixtures failed\n",
fail, total);
return 1;
}
printf("sret_struct_return_run: %d/%d ok\n", total, total);
return 0;
}