From 94bfca761c367e3b47a58033cb96958a157f47e6 Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Fri, 12 Jun 2026 09:06:51 +0900 Subject: [PATCH] wcc/ww: dotbaseaddr #128b probe gates on an untyped module-qualifier inner The probe accepted any inner ident, hijacking same-leaf locals as a module qualifier; gate on the untyped(module) inner only (mirror the cstage twin). Review item #20; dual-stage rows red-proven. --- Makefile | 11 ++ selfhost/cmd/w6c/main.combined.ww | 24 ++-- selfhost/cmd/wcc/cgenexpr.ww | 24 ++-- selfhost/cmd/wwdump/main.combined.ww | 24 ++-- test/wcc/989_dotbasehijack_run.c | 166 +++++++++++++++++++++++++++ 5 files changed, 225 insertions(+), 24 deletions(-) create mode 100644 test/wcc/989_dotbasehijack_run.c diff --git a/Makefile b/Makefile index cef59940..6d343064 100644 --- a/Makefile +++ b/Makefile @@ -258,6 +258,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_globslicefield_run \ $(BIN)/test_globstrslice_run \ $(BIN)/test_globtagisas_run \ + $(BIN)/test_dotbasehijack_run \ $(BIN)/test_arr_ptr_global \ $(BIN)/test_def_arr_infer_len \ $(BIN)/test_def_arr_len \ @@ -747,6 +748,16 @@ $(BIN)/test_globtagisas_run: test/wcc/989_globtagisas_run.c \ $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +# 989_dotbasehijack_run (F8-c4, #20): indexing an [N]T field of a module- +# global struct must not be hijacked by an unrelated global sharing the +# field's name. Builds+runs on BOTH driver twins (rule-10); align-UP. +$(BIN)/test_dotbasehijack_run: test/wcc/989_dotbasehijack_run.c \ + $(BIN)/ww $(BIN)/ww_ww \ + $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + $(BIN)/test_let_global: test/wcc/630_let_global.c $(BIN)/ww $(BIN)/w6c \ $(BIN)/w6a $(BIN)/w6l $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index f791d753..a3f18a8f 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -24148,14 +24148,22 @@ fn dotbaseaddr(c: *cgen, base: *node, dstreg: str) bool = { if (!chained) { lc = localfindnode(c, inner.str); if (lc == nil) { - let gt: *node = letvartnode(c, base.str); - if (gt != nil && gt.kind == nkind.N_TARRAY) { - emitline("\tLEAQ\t"); - emitsymname(c, base.str); - emitline("(SB), "); - emitline(dstreg); - emitline("\n"); - return true; + // #128b is for a module-QUALIFIER inner (mod.arr): inner has no + // usable struct type. cstage gates it on inner->type==NULL||ty_err + // (cgen.c:2109). Without the gate a typed-struct global inner whose + // FIELD shares a name with an unrelated global array hijacks it + // (gs.fld -> LEAQ fld(SB)) — #20. A typed inner falls to #249 below. + let ibu: *tinfo = tichase(inner.type_: *tinfo); + if (ibu == nil || ibu.kind == tykind.TY_ERR) { + let gt: *node = letvartnode(c, base.str); + if (gt != nil && gt.kind == nkind.N_TARRAY) { + emitline("\tLEAQ\t"); + emitsymname(c, base.str); + emitline("(SB), "); + emitline(dstreg); + emitline("\n"); + return true; + }; }; // #249 (sibling of #135): inner is a module-GLOBAL struct value // (let/def), not a local — lc is nil but inner.type_ is a valid diff --git a/selfhost/cmd/wcc/cgenexpr.ww b/selfhost/cmd/wcc/cgenexpr.ww index d9cd6f3e..298f2cab 100644 --- a/selfhost/cmd/wcc/cgenexpr.ww +++ b/selfhost/cmd/wcc/cgenexpr.ww @@ -1377,14 +1377,22 @@ fn dotbaseaddr(c: *cgen, base: *node, dstreg: str) bool = { if (!chained) { lc = localfindnode(c, inner.str); if (lc == nil) { - let gt: *node = letvartnode(c, base.str); - if (gt != nil && gt.kind == nkind.N_TARRAY) { - emitline("\tLEAQ\t"); - emitsymname(c, base.str); - emitline("(SB), "); - emitline(dstreg); - emitline("\n"); - return true; + // #128b is for a module-QUALIFIER inner (mod.arr): inner has no + // usable struct type. cstage gates it on inner->type==NULL||ty_err + // (cgen.c:2109). Without the gate a typed-struct global inner whose + // FIELD shares a name with an unrelated global array hijacks it + // (gs.fld -> LEAQ fld(SB)) — #20. A typed inner falls to #249 below. + let ibu: *tinfo = tichase(inner.type_: *tinfo); + if (ibu == nil || ibu.kind == tykind.TY_ERR) { + let gt: *node = letvartnode(c, base.str); + if (gt != nil && gt.kind == nkind.N_TARRAY) { + emitline("\tLEAQ\t"); + emitsymname(c, base.str); + emitline("(SB), "); + emitline(dstreg); + emitline("\n"); + return true; + }; }; // #249 (sibling of #135): inner is a module-GLOBAL struct value // (let/def), not a local — lc is nil but inner.type_ is a valid diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index 2a70ee38..51c6d368 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -24148,14 +24148,22 @@ fn dotbaseaddr(c: *cgen, base: *node, dstreg: str) bool = { if (!chained) { lc = localfindnode(c, inner.str); if (lc == nil) { - let gt: *node = letvartnode(c, base.str); - if (gt != nil && gt.kind == nkind.N_TARRAY) { - emitline("\tLEAQ\t"); - emitsymname(c, base.str); - emitline("(SB), "); - emitline(dstreg); - emitline("\n"); - return true; + // #128b is for a module-QUALIFIER inner (mod.arr): inner has no + // usable struct type. cstage gates it on inner->type==NULL||ty_err + // (cgen.c:2109). Without the gate a typed-struct global inner whose + // FIELD shares a name with an unrelated global array hijacks it + // (gs.fld -> LEAQ fld(SB)) — #20. A typed inner falls to #249 below. + let ibu: *tinfo = tichase(inner.type_: *tinfo); + if (ibu == nil || ibu.kind == tykind.TY_ERR) { + let gt: *node = letvartnode(c, base.str); + if (gt != nil && gt.kind == nkind.N_TARRAY) { + emitline("\tLEAQ\t"); + emitsymname(c, base.str); + emitline("(SB), "); + emitline(dstreg); + emitline("\n"); + return true; + }; }; // #249 (sibling of #135): inner is a module-GLOBAL struct value // (let/def), not a local — lc is nil but inner.type_ is a valid diff --git a/test/wcc/989_dotbasehijack_run.c b/test/wcc/989_dotbasehijack_run.c new file mode 100644 index 00000000..3fd58c6a --- /dev/null +++ b/test/wcc/989_dotbasehijack_run.c @@ -0,0 +1,166 @@ +/* + * 989_dotbasehijack_run — F8-c4 (report-item #20): indexing an `[N]T` field + * of a module-GLOBAL struct (`gs.fld[i]`) must address gs's field, not be + * hijacked by an unrelated module-global that shares the FIELD's name. + * + * THE BUG (cat-A silent miscompile, align-UP): cgenexpr.ww dotbaseaddr's + * #128b probe (for a module-qualified `mod.arr` array base) did + * `letvartnode(base.str)` — base.str is the DOT's FIELD name — whenever the + * inner ident wasn't a local. For `gs.fld` with `gs` a module-global struct, + * the inner gs is global (no local slot) so the probe fired and, finding an + * unrelated module-global `fld: [N]T`, emitted `LEAQ fld(SB)` — addressing + * the wrong symbol. cstage cg_dotbase_addr gates the #128b probe on + * inner->type == NULL || ty_err (cgen.c:2109 — a module qualifier has no + * struct type), so a typed-struct inner skips it and resolves the field off + * the struct (LEAQ gs(SB) + foff). 990-997 never hit a field-name/global + * collision, so the gate stayed green — a runtime row is the net. + * + * THE FIX: gate the wwstage #128b probe on tichase(inner.type_) == nil || + * TY_ERR (the untyped module-qualifier case); a typed struct inner falls to + * the #249 isglobal struct path. align ww UP; the .s is byte-identical. + * + * Rows (build+run on cstage `ww` and wwstage `ww_ww`; rule-10 — agree+hit): + * row | shape | want + * -----------+------------------------------------------------+----- + * collide_0 | gs:{pad,fld:[2]i64}; gs.fld=[7,8]; global fld= | 7 [#20: + * | [9,10]; gs.fld[0] | pre-fix ww=9] + * collide_1 | same; gs.fld[1] | 8 [#20: + * | | pre-fix ww=10] + * no_collide | gs2:{pad,arr:[2]i64}=[5,6]; NO global arr; | 5 (control: + * | gs2.arr[0] | typed inner) + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { + const char *label; + const char *src; + int want_exit; +}; + +#define PRELUDE \ + "package main;\n" \ + "type s = struct { pad: i64, fld: [2]i64 };\n" \ + "type s2 = struct { pad: i64, arr: [2]i64 };\n" \ + "let gs: s = s { pad = 0, fld = [7, 8] };\n" \ + "let gs2: s2 = s2 { pad = 0, arr = [5, 6] };\n" \ + "let fld: [2]i64 = [9, 10];\n" + +static const struct row rows[] = { + { "collide_0", + PRELUDE + "export fn main() int = { return gs.fld[0]: int; };\n", + 7 }, + + { "collide_1", + PRELUDE + "export fn main() int = { return gs.fld[1]: int; };\n", + 8 }, + + /* typed-struct inner with NO name collision — the probe-skip must not + * break the ordinary global-struct array-field index. */ + { "no_collide", + PRELUDE + "export fn main() int = { return gs2.arr[0]: int; };\n", + 5 }, +}; + +/* run_build — build+run `src` via `driver`; returns the binary's exit + * code, or -1 on a build failure. */ +static int +run_build(const char *driver, const struct row *r, int i) +{ + char src[64], tmpdir[64], cmd[1024]; + snprintf(src, sizeof src, "/tmp/dbh_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/dbh_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -2; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null", + tmpdir, driver, src); + int brc = runwait(cmd); + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[128]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + + int got = -1; + if (brc == 0) got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return brc == 0 ? got : -1; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[1024]; + if (bin[0] != '/') { + char cwd[1024]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[1024], wdrv[1024]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *drv; int gated; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated && access(drivers[d].drv, X_OK) != 0) { + fprintf(stderr, "dotbasehijack_run: skip %s (no %s)\n", + drivers[d].name, drivers[d].drv); + continue; + } + for (int i = 0; i < n; i++) { + total++; + int got = run_build(drivers[d].drv, &rows[i], i); + if (got != rows[i].want_exit) { + fprintf(stderr, "dotbasehijack_run[%s][%s]: exit=%d " + "want=%d\n", drivers[d].name, rows[i].label, + got, rows[i].want_exit); + fail++; + } + } + } + + if (fail) { + fprintf(stderr, "dotbasehijack_run: %d/%d fixtures failed\n", + fail, total); + return 1; + } + printf("dotbasehijack_run: %d/%d ok\n", total, total); + return 0; +}