selfhost+test: graduate bare-leaf fnparamslookup same-module-first (#4d)

Class A silent miscompile, latent until two modules export the same
fn leaf name with diverging tagged-vs-scalar param shapes. Wwstage's
fnparamslookup (selfhost/cmd/wcc/cgen.ww) walked c.fnrets head-first
by fname and returned the FIRST match's params. cgcall's N_IDENT
branch (cgenexpr.ww:2875) handed it the bare leaf; pushargsrev's
istaggedtype(c, pt) then fired against the wrong-module foo's
param-type. A foo(7) call against a same-leaf (i32 | void) param
re-laid the i32 arg into a 2-word tagged slot (MOVQ $7 push + MOVQ
$0 tag push + 2 POPs into DI/SI) instead of the caller-intended
single push (MOVQ $7 push + POPQ DI).

Cstage carries no sister bug: cmd/wcc/check.c N_CALL routes
cexpr(c, n->lhs) through scope_lookup_prefer for an N_IDENT callee,
then cmd/w6c/cgen.c reads params from the typed n->lhs->type's
TY_FN sig — module-aware via typed AST, sidestepping any bare-leaf
table. cs vs ws diverged on every same-leaf fn collision but no
in-tree corpus declares two same-leaf fns with diverging tagged-vs-
scalar param shapes (same surfacing pattern as #4a enumlookup
post-strings, #4b structlookup, #4c def): 995 stays green.

Seventh leaf of the trio graduation (after #27 aliaslookup, #28
fnparams *mod*-variant, #31 fnret *mod*-variant, #4a enum, #4b
struct, #4c def). fnparamslookupmod (the N_DOT consumer at
cgenexpr.ww:2876) already exists post-#28; this commit graduates
only the BARE-LEAF entry point with a same-module-first walk
mirroring aliaslookup's two-pass shape (cgen.ww:75). Three bare-
leaf callsites consume the graduated lookup uniformly: cgcall
N_IDENT branch at cgenexpr.ww:2875 (load-bearing for the tagged-
widening shape), cglocalsize scratch reservation at cgendecl.ww:420
(fires only on tagged-param + struct-payload arg), and
callee_variadic_param at cgenutil.ww:66 (fires only on variadic
callee). The latter two also accept N_DOT callees and feed the
bare leaf — pre-graduation those head-picked, post-graduation
they prefer same-module. NOT separately re-routed to
fnparamslookupmod in this commit: the only in-tree N_DOT cross-
module fn collisions (strings.next vs utf8.next; bytes.hasprefix
vs strings.hasprefix and equivalents) all have invariant param
shape across the colliding overloads, so widening/scratch/variadic
behavior is invariant either way for sites 2 and 3 on the present
corpus. A future stdlib port introducing a tagged-vs-scalar or
variadic-vs-non-variadic same-leaf N_DOT collision shape will
need the *mod re-routing — file at that surfacing.

732_fnparams_bare_leaf_shadow pins the fix with 1 row: alpha
defines fn foo(x: i32) i32 and fn alphacaller() i32 = {
return foo(7); }, beta defines fn foo(x: (i32|void)) i32
declared LAST in source so beta.foo prepends to the head of
c.fnrets. alphacaller's bare foo(7) must compile against
alpha.foo's i32 param (single PUSHQ/POPQ DI shape) even with
beta.foo at the head of c.fnrets. Asserts the matching POPQ DI
inside the right TEXT sym + bad_imm POPQ SI anti-check on each
stage plus cs-vs-ws byte-id per row.

Makefile

@@ -265,6 +265,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_enum_modshadow \
 	  $(BIN)/test_struct_modshadow \
 	  $(BIN)/test_def_modshadow \
+	  $(BIN)/test_fnparams_bare_leaf_shadow \
 	  $(BIN)/test_param_shadow_mod \
 	  $(BIN)/test_localoff_scope \
 	  $(BIN)/test_cast_enum_movl \
@@ -623,6 +624,10 @@ $(BIN)/test_def_modshadow: test/wcc/735_def_modshadow.c \
 		$(BIN)/w6c $(BIN)/w6c_ww | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_fnparams_bare_leaf_shadow: test/wcc/732_fnparams_bare_leaf_shadow.c \
+		$(BIN)/w6c $(BIN)/w6c_ww | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_match_4arm_cross_module_run: test/wcc/929_match_4arm_cross_module_run.c \
 		$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
 		$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \

selfhost/cmd/w6c/main.combined.ww

@@ -20326,11 +20326,24 @@ fn fnretlookupmod(c: *cgen, name: str, mod: str) *node = {
 };
 
 // fnparamslookup — head of the declared param-list for a fn, or nil
-// if the name isn't a registered fn. Used by cgcall / pushargsrev to
+// if the name isn't a registered fn. Same-module-first walk before the
-// detect implicit widening from a concrete variant into a tagged-union
+// head-walk fallback. Trio-leaf graduation (#4d) mirroring aliaslookup
-// parameter slot.
+// (#27), fnret/fnparamslookupmod (#28/#31), enum/struct/deflookup
+// (#4a/#4b/#4c): without the prefer pass a bare-leaf `foo(x)` call in
+// module M (callee N_IDENT) silently picks another module's same-leaf
+// `foo` from the head of c.fnrets, then pushargsrev's widening
+// detection fires (or doesn't) against the wrong param-type — `foo(7)`
+// against a same-leaf `(i32 | void)` param re-layouts 7 into a 2-word
+// tagged slot vs the same-module `i32` param's single push.
 fn fnparamslookup(c: *cgen, name: str) *node = {
 	let f: *fnret = c.fnrets;
+	for (f != nil) {
+		if (streq(f.fname, name)) {
+			if (streq(f.fmod, c.curmod)) { return f.params; };
+		};
+		f = f.frnext;
+	};
+	f = c.fnrets;
 	for (f != nil) {
 		if (streq(f.fname, name)) { return f.params; };
 		f = f.frnext;

selfhost/cmd/wcc/cgen.ww

@@ -1596,11 +1596,24 @@ fn fnretlookupmod(c: *cgen, name: str, mod: str) *node = {
 };
 
 // fnparamslookup — head of the declared param-list for a fn, or nil
-// if the name isn't a registered fn. Used by cgcall / pushargsrev to
+// if the name isn't a registered fn. Same-module-first walk before the
-// detect implicit widening from a concrete variant into a tagged-union
+// head-walk fallback. Trio-leaf graduation (#4d) mirroring aliaslookup
-// parameter slot.
+// (#27), fnret/fnparamslookupmod (#28/#31), enum/struct/deflookup
+// (#4a/#4b/#4c): without the prefer pass a bare-leaf `foo(x)` call in
+// module M (callee N_IDENT) silently picks another module's same-leaf
+// `foo` from the head of c.fnrets, then pushargsrev's widening
+// detection fires (or doesn't) against the wrong param-type — `foo(7)`
+// against a same-leaf `(i32 | void)` param re-layouts 7 into a 2-word
+// tagged slot vs the same-module `i32` param's single push.
 fn fnparamslookup(c: *cgen, name: str) *node = {
 	let f: *fnret = c.fnrets;
+	for (f != nil) {
+		if (streq(f.fname, name)) {
+			if (streq(f.fmod, c.curmod)) { return f.params; };
+		};
+		f = f.frnext;
+	};
+	f = c.fnrets;
 	for (f != nil) {
 		if (streq(f.fname, name)) { return f.params; };
 		f = f.frnext;

selfhost/cmd/wwdump/main.combined.ww

@@ -20326,11 +20326,24 @@ fn fnretlookupmod(c: *cgen, name: str, mod: str) *node = {
 };
 
 // fnparamslookup — head of the declared param-list for a fn, or nil
-// if the name isn't a registered fn. Used by cgcall / pushargsrev to
+// if the name isn't a registered fn. Same-module-first walk before the
-// detect implicit widening from a concrete variant into a tagged-union
+// head-walk fallback. Trio-leaf graduation (#4d) mirroring aliaslookup
-// parameter slot.
+// (#27), fnret/fnparamslookupmod (#28/#31), enum/struct/deflookup
+// (#4a/#4b/#4c): without the prefer pass a bare-leaf `foo(x)` call in
+// module M (callee N_IDENT) silently picks another module's same-leaf
+// `foo` from the head of c.fnrets, then pushargsrev's widening
+// detection fires (or doesn't) against the wrong param-type — `foo(7)`
+// against a same-leaf `(i32 | void)` param re-layouts 7 into a 2-word
+// tagged slot vs the same-module `i32` param's single push.
 fn fnparamslookup(c: *cgen, name: str) *node = {
 	let f: *fnret = c.fnrets;
+	for (f != nil) {
+		if (streq(f.fname, name)) {
+			if (streq(f.fmod, c.curmod)) { return f.params; };
+		};
+		f = f.frnext;
+	};
+	f = c.fnrets;
 	for (f != nil) {
 		if (streq(f.fname, name)) { return f.params; };
 		f = f.frnext;

test/wcc/732_fnparams_bare_leaf_shadow.c

@@ -0,0 +1,240 @@
+/*
+ * 732_fnparams_bare_leaf_shadow — sentinel for the trio leaf-name
+ * pattern's 7th leaf: wwstage's bare-leaf fnparamslookup
+ * (selfhost/cmd/wcc/cgen.ww). Pins bare-leaf `foo(x)` calls (N_IDENT
+ * callee) to a same-module-first walk so cgcall's widening detection
+ * fires against the caller's own foo's param-type, not another
+ * module's same-leaf-name foo sitting at the head of c.fnrets.
+ *
+ * Pre-fix wwstage's `fnparamslookup` walked c.fnrets head-first by
+ * fname and returned the FIRST match's params. cgcall handed it
+ * `callee.str` (the bare leaf from an N_IDENT callee) and the head-
+ * pick silently picked a sibling module's same-leaf foo. When that
+ * foo had a tagged-union param and the caller's own foo had a plain
+ * scalar param, pushargsrev's `istaggedtype(c, pt)` then fired
+ * against the wrong type and re-laid the i32 arg into a 2-word
+ * tagged slot (MOVQ $7 push + MOVQ $0 tag push + 2 POPs into DI/SI)
+ * instead of the caller-intended single push (MOVQ $7 push + POPQ DI).
+ *
+ * Cstage carries no sister bug: cmd/wcc/check.c N_CALL routes
+ * `cexpr(c, n->lhs)` through scope_lookup_prefer for an N_IDENT
+ * callee, then cmd/w6c/cgen.c reads params from the typed
+ * `n->lhs->type`'s TY_FN sig — module-aware via the typed AST,
+ * sidestepping any bare-leaf table. Same shape as #4a/#4b/#4c: cs vs
+ * ws diverge on every same-leaf fn collision, but no in-tree corpus
+ * declares two same-leaf fns with diverging tagged-vs-scalar param
+ * shapes today, so 995_self_rebuild stays green.
+ *
+ * Seventh leaf of the trio graduation (after #27 aliaslookup, #28
+ * fnparams *mod*-variant, #31 fnret *mod*-variant, #4a enum, #4b
+ * struct, #4c def). fnparamslookupmod (the N_DOT consumer at
+ * cgenexpr.ww:2876) already exists post-#28; this commit graduates
+ * only the BARE-LEAF entry point. The two other bare-leaf callsites
+ * (cgendecl.ww:420 scratch-reservation, cgenutil.ww:66
+ * callee_variadic_param) consume the graduated lookup uniformly for
+ * N_IDENT callees and stay structurally aligned with cgcall's
+ * N_IDENT-branch — the cstage-natively-correct path. No
+ * fnparamslookupmod re-routing of those two sites in this commit:
+ * their N_DOT consumer surface (utf8.next called from strings, etc.)
+ * has non-tagged param shape on both sides of every in-tree leaf
+ * collision today, so the pre-existing head-pick stays accidentally
+ * correct. A future stdlib port introducing a tagged-vs-scalar N_DOT
+ * leaf collision will need the *mod re-routing — file at that
+ * surfacing.
+ *
+ * Pin: row 1 sentinel-flips the bare-leaf graduation on wwstage —
+ * revert the prefer pass and row 1 fails on wwstage (the extra
+ * `POPQ SI` for the wrong-param-shape widening sneaks in). Cstage
+ * sees one POPQ DI either way (typed AST is module-aware). Asserts
+ * the single-pop shape inside the right TEXT sym + bad_imm
+ * (`POPQ\tSI`) anti-check on each stage plus cs-vs-ws byte-id per
+ * row.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row {
+	const char *label;
+	const char *src;
+	const char *textsym;	/* TEXT sym containing the call */
+	const char *want_imm;	/* substring that MUST appear */
+	const char *bad_imm;	/* substring that MUST NOT appear */
+};
+
+/* Source ordering picks which module's `fn foo` sits at the head of
+ * c.fnrets after collectfnrets' head-prepend walk. The LAST `fn foo`
+ * in source order ends at the head — that's the leaf-collision the
+ * same-module-first walk must beat. Caller is inside alpha; alpha's
+ * foo has plain i32 param (no widening), beta's foo has tagged
+ * `(i32 | void)` param (widening would re-lay 7 into a 2-word slot
+ * + emit a tag push + 2 POPs). */
+static const struct row rows[] = {
+	{ "bare_leaf_same_module",
+	  "// MODULE: gamma\n"
+	  "use alpha;\n"
+	  "use beta;\n"
+	  "export fn main() i32 = { return 0; };\n"
+	  "// MODULE: alpha\n"
+	  "export fn foo(x: i32) i32 = { return x; };\n"
+	  "export fn alphacaller() i32 = { return foo(7); };\n"
+	  "// MODULE: beta\n"
+	  "export fn foo(x: (i32 | void)) i32 = {\n"
+	  "    match (x) {\n"
+	  "    case let v: i32 => return v;\n"
+	  "    case void       => return 0;\n"
+	  "    };\n"
+	  "};\n",
+	  "TEXT alpha.alphacaller", "POPQ\tDI", "POPQ\tSI" },
+};
+
+static int
+slurp(const char *path, char *buf, size_t cap)
+{
+	FILE *f = fopen(path, "rb");
+	if (!f) return -1;
+	size_t n = fread(buf, 1, cap - 1, f);
+	fclose(f);
+	buf[n] = '\0';
+	return (int)n;
+}
+
+static int
+emit_s(const char *w6c, const struct row *r, int i, char *out_s, size_t cap)
+{
+	char src[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/fpb_%d_%d.ww", getpid(), i);
+	snprintf(out_s, cap, "/tmp/fpb_%d_%d_%s.s",
+	    getpid(), i, w6c[strlen(w6c) - 1] == 'w' ? "ww" : "c");
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -1;
+	fputs(r->src, f);
+	fclose(f);
+
+	snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null", w6c, out_s, src);
+	int rc = runwait(cmd);
+	unlink(src);
+	return rc;
+}
+
+/* Inside the named TEXT sym, before its first RET, the want_imm MUST
+ * appear and the bad_imm MUST NOT. bad_imm flags pre-fix bare-leaf
+ * head-walk picking beta's (i32|void)-param foo and emitting the
+ * extra POPQ SI for the wrongly-widened 2-word tagged slot. */
+static int
+check_imm(const char *spath, const struct row *r, const char *stage)
+{
+	char buf[1 << 14];
+	if (slurp(spath, buf, sizeof buf) < 0) {
+		fprintf(stderr, "row[%s][%s]: cannot read %s\n",
+		    r->label, stage, spath);
+		return -1;
+	}
+	const char *fn = strstr(buf, r->textsym);
+	if (!fn) {
+		fprintf(stderr, "row[%s][%s]: no %s in %s\n",
+		    r->label, stage, r->textsym, spath);
+		return -1;
+	}
+	const char *ret = strstr(fn, "\tRET");
+	if (!ret) {
+		fprintf(stderr, "row[%s][%s]: no RET inside %s\n",
+		    r->label, stage, r->textsym);
+		return -1;
+	}
+	const char *good = strstr(fn, r->want_imm);
+	if (!good || good >= ret) {
+		fprintf(stderr,
+		    "row[%s][%s]: want_imm %s missing inside %s\n",
+		    r->label, stage, r->want_imm, r->textsym);
+		return -1;
+	}
+	const char *bad = strstr(fn, r->bad_imm);
+	if (bad && bad < ret) {
+		fprintf(stderr,
+		    "row[%s][%s]: bad_imm %s present inside %s — wrong-module foo widened\n",
+		    r->label, stage, r->bad_imm, r->textsym);
+		return -1;
+	}
+	return 0;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[512];
+	if (bin[0] != '/') {
+		char cwd[256];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char w6c[640], w6c_ww[640];
+	snprintf(w6c, sizeof w6c, "%s/w6c", bin);
+	snprintf(w6c_ww, sizeof w6c_ww, "%s/w6c_ww", bin);
+
+	int have_ww = (access(w6c_ww, X_OK) == 0);
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int i = 0; i < n; i++) {
+		char cs_path[128], ws_path[128];
+
+		if (emit_s(w6c, &rows[i], i, cs_path, sizeof cs_path) != 0) {
+			fprintf(stderr,
+			    "fnparams_bare_leaf_shadow[cstage][%s]: w6c failed\n",
+			    rows[i].label);
+			fail++; total++; continue;
+		}
+		total++;
+		if (check_imm(cs_path, &rows[i], "cstage") != 0) fail++;
+
+		if (!have_ww) { unlink(cs_path); continue; }
+
+		if (emit_s(w6c_ww, &rows[i], i, ws_path, sizeof ws_path) != 0) {
+			fprintf(stderr,
+			    "fnparams_bare_leaf_shadow[wwstage][%s]: w6c_ww failed\n",
+			    rows[i].label);
+			fail++; total++;
+			unlink(cs_path); continue;
+		}
+		total++;
+		if (check_imm(ws_path, &rows[i], "wwstage") != 0) fail++;
+
+		total++;
+		char cmd[512];
+		snprintf(cmd, sizeof cmd, "cmp -s %s %s", cs_path, ws_path);
+		if (runwait(cmd) != 0) {
+			fprintf(stderr,
+			    "fnparams_bare_leaf_shadow[%s]: cstage vs wwstage asm differs\n",
+			    rows[i].label);
+			fail++;
+		}
+
+		unlink(cs_path); unlink(ws_path);
+	}
+
+	if (fail) {
+		fprintf(stderr,
+		    "fnparams_bare_leaf_shadow: %d/%d fixtures failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("fnparams_bare_leaf_shadow: %d/%d ok\n", total, total);
+	return 0;
+}