wcc/ww: dotbaseaddr #128b probe gates on an untyped module-qualifier inner
The probe accepted any inner ident, hijacking same-leaf locals as a module qualifier; gate on the untyped(module) inner only (mirror the cstage twin). Review item #20; dual-stage rows red-proven.
This commit is contained in:
11
Makefile
11
Makefile
@@ -258,6 +258,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
|
||||
$(BIN)/test_globslicefield_run \
|
||||
$(BIN)/test_globstrslice_run \
|
||||
$(BIN)/test_globtagisas_run \
|
||||
$(BIN)/test_dotbasehijack_run \
|
||||
$(BIN)/test_arr_ptr_global \
|
||||
$(BIN)/test_def_arr_infer_len \
|
||||
$(BIN)/test_def_arr_len \
|
||||
@@ -747,6 +748,16 @@ $(BIN)/test_globtagisas_run: test/wcc/989_globtagisas_run.c \
|
||||
$(LIB)/libwwrt.a | $(BIN)
|
||||
$(CC) $(CFLAGS) -o $@ $<
|
||||
|
||||
# 989_dotbasehijack_run (F8-c4, #20): indexing an [N]T field of a module-
|
||||
# global struct must not be hijacked by an unrelated global sharing the
|
||||
# field's name. Builds+runs on BOTH driver twins (rule-10); align-UP.
|
||||
$(BIN)/test_dotbasehijack_run: test/wcc/989_dotbasehijack_run.c \
|
||||
$(BIN)/ww $(BIN)/ww_ww \
|
||||
$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
|
||||
$(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
|
||||
$(LIB)/libwwrt.a | $(BIN)
|
||||
$(CC) $(CFLAGS) -o $@ $<
|
||||
|
||||
$(BIN)/test_let_global: test/wcc/630_let_global.c $(BIN)/ww $(BIN)/w6c \
|
||||
$(BIN)/w6a $(BIN)/w6l $(LIB)/libwwrt.a | $(BIN)
|
||||
$(CC) $(CFLAGS) -o $@ $<
|
||||
|
||||
@@ -24148,14 +24148,22 @@ fn dotbaseaddr(c: *cgen, base: *node, dstreg: str) bool = {
|
||||
if (!chained) {
|
||||
lc = localfindnode(c, inner.str);
|
||||
if (lc == nil) {
|
||||
let gt: *node = letvartnode(c, base.str);
|
||||
if (gt != nil && gt.kind == nkind.N_TARRAY) {
|
||||
emitline("\tLEAQ\t");
|
||||
emitsymname(c, base.str);
|
||||
emitline("(SB), ");
|
||||
emitline(dstreg);
|
||||
emitline("\n");
|
||||
return true;
|
||||
// #128b is for a module-QUALIFIER inner (mod.arr): inner has no
|
||||
// usable struct type. cstage gates it on inner->type==NULL||ty_err
|
||||
// (cgen.c:2109). Without the gate a typed-struct global inner whose
|
||||
// FIELD shares a name with an unrelated global array hijacks it
|
||||
// (gs.fld -> LEAQ fld(SB)) — #20. A typed inner falls to #249 below.
|
||||
let ibu: *tinfo = tichase(inner.type_: *tinfo);
|
||||
if (ibu == nil || ibu.kind == tykind.TY_ERR) {
|
||||
let gt: *node = letvartnode(c, base.str);
|
||||
if (gt != nil && gt.kind == nkind.N_TARRAY) {
|
||||
emitline("\tLEAQ\t");
|
||||
emitsymname(c, base.str);
|
||||
emitline("(SB), ");
|
||||
emitline(dstreg);
|
||||
emitline("\n");
|
||||
return true;
|
||||
};
|
||||
};
|
||||
// #249 (sibling of #135): inner is a module-GLOBAL struct value
|
||||
// (let/def), not a local — lc is nil but inner.type_ is a valid
|
||||
|
||||
@@ -1377,14 +1377,22 @@ fn dotbaseaddr(c: *cgen, base: *node, dstreg: str) bool = {
|
||||
if (!chained) {
|
||||
lc = localfindnode(c, inner.str);
|
||||
if (lc == nil) {
|
||||
let gt: *node = letvartnode(c, base.str);
|
||||
if (gt != nil && gt.kind == nkind.N_TARRAY) {
|
||||
emitline("\tLEAQ\t");
|
||||
emitsymname(c, base.str);
|
||||
emitline("(SB), ");
|
||||
emitline(dstreg);
|
||||
emitline("\n");
|
||||
return true;
|
||||
// #128b is for a module-QUALIFIER inner (mod.arr): inner has no
|
||||
// usable struct type. cstage gates it on inner->type==NULL||ty_err
|
||||
// (cgen.c:2109). Without the gate a typed-struct global inner whose
|
||||
// FIELD shares a name with an unrelated global array hijacks it
|
||||
// (gs.fld -> LEAQ fld(SB)) — #20. A typed inner falls to #249 below.
|
||||
let ibu: *tinfo = tichase(inner.type_: *tinfo);
|
||||
if (ibu == nil || ibu.kind == tykind.TY_ERR) {
|
||||
let gt: *node = letvartnode(c, base.str);
|
||||
if (gt != nil && gt.kind == nkind.N_TARRAY) {
|
||||
emitline("\tLEAQ\t");
|
||||
emitsymname(c, base.str);
|
||||
emitline("(SB), ");
|
||||
emitline(dstreg);
|
||||
emitline("\n");
|
||||
return true;
|
||||
};
|
||||
};
|
||||
// #249 (sibling of #135): inner is a module-GLOBAL struct value
|
||||
// (let/def), not a local — lc is nil but inner.type_ is a valid
|
||||
|
||||
@@ -24148,14 +24148,22 @@ fn dotbaseaddr(c: *cgen, base: *node, dstreg: str) bool = {
|
||||
if (!chained) {
|
||||
lc = localfindnode(c, inner.str);
|
||||
if (lc == nil) {
|
||||
let gt: *node = letvartnode(c, base.str);
|
||||
if (gt != nil && gt.kind == nkind.N_TARRAY) {
|
||||
emitline("\tLEAQ\t");
|
||||
emitsymname(c, base.str);
|
||||
emitline("(SB), ");
|
||||
emitline(dstreg);
|
||||
emitline("\n");
|
||||
return true;
|
||||
// #128b is for a module-QUALIFIER inner (mod.arr): inner has no
|
||||
// usable struct type. cstage gates it on inner->type==NULL||ty_err
|
||||
// (cgen.c:2109). Without the gate a typed-struct global inner whose
|
||||
// FIELD shares a name with an unrelated global array hijacks it
|
||||
// (gs.fld -> LEAQ fld(SB)) — #20. A typed inner falls to #249 below.
|
||||
let ibu: *tinfo = tichase(inner.type_: *tinfo);
|
||||
if (ibu == nil || ibu.kind == tykind.TY_ERR) {
|
||||
let gt: *node = letvartnode(c, base.str);
|
||||
if (gt != nil && gt.kind == nkind.N_TARRAY) {
|
||||
emitline("\tLEAQ\t");
|
||||
emitsymname(c, base.str);
|
||||
emitline("(SB), ");
|
||||
emitline(dstreg);
|
||||
emitline("\n");
|
||||
return true;
|
||||
};
|
||||
};
|
||||
// #249 (sibling of #135): inner is a module-GLOBAL struct value
|
||||
// (let/def), not a local — lc is nil but inner.type_ is a valid
|
||||
|
||||
166
test/wcc/989_dotbasehijack_run.c
Normal file
166
test/wcc/989_dotbasehijack_run.c
Normal file
@@ -0,0 +1,166 @@
|
||||
/*
|
||||
* 989_dotbasehijack_run — F8-c4 (report-item #20): indexing an `[N]T` field
|
||||
* of a module-GLOBAL struct (`gs.fld[i]`) must address gs's field, not be
|
||||
* hijacked by an unrelated module-global that shares the FIELD's name.
|
||||
*
|
||||
* THE BUG (cat-A silent miscompile, align-UP): cgenexpr.ww dotbaseaddr's
|
||||
* #128b probe (for a module-qualified `mod.arr` array base) did
|
||||
* `letvartnode(base.str)` — base.str is the DOT's FIELD name — whenever the
|
||||
* inner ident wasn't a local. For `gs.fld` with `gs` a module-global struct,
|
||||
* the inner gs is global (no local slot) so the probe fired and, finding an
|
||||
* unrelated module-global `fld: [N]T`, emitted `LEAQ fld(SB)` — addressing
|
||||
* the wrong symbol. cstage cg_dotbase_addr gates the #128b probe on
|
||||
* inner->type == NULL || ty_err (cgen.c:2109 — a module qualifier has no
|
||||
* struct type), so a typed-struct inner skips it and resolves the field off
|
||||
* the struct (LEAQ gs(SB) + foff). 990-997 never hit a field-name/global
|
||||
* collision, so the gate stayed green — a runtime row is the net.
|
||||
*
|
||||
* THE FIX: gate the wwstage #128b probe on tichase(inner.type_) == nil ||
|
||||
* TY_ERR (the untyped module-qualifier case); a typed struct inner falls to
|
||||
* the #249 isglobal struct path. align ww UP; the .s is byte-identical.
|
||||
*
|
||||
* Rows (build+run on cstage `ww` and wwstage `ww_ww`; rule-10 — agree+hit):
|
||||
* row | shape | want
|
||||
* -----------+------------------------------------------------+-----
|
||||
* collide_0 | gs:{pad,fld:[2]i64}; gs.fld=[7,8]; global fld= | 7 [#20:
|
||||
* | [9,10]; gs.fld[0] | pre-fix ww=9]
|
||||
* collide_1 | same; gs.fld[1] | 8 [#20:
|
||||
* | | pre-fix ww=10]
|
||||
* no_collide | gs2:{pad,arr:[2]i64}=[5,6]; NO global arr; | 5 (control:
|
||||
* | gs2.arr[0] | typed inner)
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/wait.h>
|
||||
|
||||
static int
|
||||
runwait(const char *cmd)
|
||||
{
|
||||
int rc = system(cmd);
|
||||
if (rc == -1) return -1;
|
||||
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
|
||||
return -1;
|
||||
}
|
||||
|
||||
struct row {
|
||||
const char *label;
|
||||
const char *src;
|
||||
int want_exit;
|
||||
};
|
||||
|
||||
#define PRELUDE \
|
||||
"package main;\n" \
|
||||
"type s = struct { pad: i64, fld: [2]i64 };\n" \
|
||||
"type s2 = struct { pad: i64, arr: [2]i64 };\n" \
|
||||
"let gs: s = s { pad = 0, fld = [7, 8] };\n" \
|
||||
"let gs2: s2 = s2 { pad = 0, arr = [5, 6] };\n" \
|
||||
"let fld: [2]i64 = [9, 10];\n"
|
||||
|
||||
static const struct row rows[] = {
|
||||
{ "collide_0",
|
||||
PRELUDE
|
||||
"export fn main() int = { return gs.fld[0]: int; };\n",
|
||||
7 },
|
||||
|
||||
{ "collide_1",
|
||||
PRELUDE
|
||||
"export fn main() int = { return gs.fld[1]: int; };\n",
|
||||
8 },
|
||||
|
||||
/* typed-struct inner with NO name collision — the probe-skip must not
|
||||
* break the ordinary global-struct array-field index. */
|
||||
{ "no_collide",
|
||||
PRELUDE
|
||||
"export fn main() int = { return gs2.arr[0]: int; };\n",
|
||||
5 },
|
||||
};
|
||||
|
||||
/* run_build — build+run `src` via `driver`; returns the binary's exit
|
||||
* code, or -1 on a build failure. */
|
||||
static int
|
||||
run_build(const char *driver, const struct row *r, int i)
|
||||
{
|
||||
char src[64], tmpdir[64], cmd[1024];
|
||||
snprintf(src, sizeof src, "/tmp/dbh_%d_%d.ww", getpid(), i);
|
||||
snprintf(tmpdir, sizeof tmpdir, "/tmp/dbh_%d_d_%d", getpid(), i);
|
||||
|
||||
FILE *f = fopen(src, "wb");
|
||||
if (!f) return -2;
|
||||
fputs(r->src, f);
|
||||
fclose(f);
|
||||
|
||||
mkdir(tmpdir, 0755);
|
||||
snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
|
||||
tmpdir, driver, src);
|
||||
int brc = runwait(cmd);
|
||||
|
||||
const char *base = strrchr(src, '/');
|
||||
base = base ? base + 1 : src;
|
||||
char outbin[128];
|
||||
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
|
||||
char *dot = strrchr(outbin, '.');
|
||||
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
|
||||
|
||||
int got = -1;
|
||||
if (brc == 0) got = runwait(outbin);
|
||||
|
||||
unlink(src); unlink(outbin); rmdir(tmpdir);
|
||||
return brc == 0 ? got : -1;
|
||||
}
|
||||
|
||||
int
|
||||
main(void)
|
||||
{
|
||||
const char *bin = getenv("BIN");
|
||||
if (!bin) bin = "out/bin";
|
||||
char absbin[1024];
|
||||
if (bin[0] != '/') {
|
||||
char cwd[1024];
|
||||
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
|
||||
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
|
||||
bin = absbin;
|
||||
}
|
||||
|
||||
char cdrv[1024], wdrv[1024];
|
||||
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
|
||||
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
|
||||
|
||||
struct { const char *name; const char *drv; int gated; }
|
||||
drivers[] = {
|
||||
{ "cstage", cdrv, 0 },
|
||||
{ "wwstage", wdrv, 1 },
|
||||
{ NULL, NULL, 0 },
|
||||
};
|
||||
|
||||
int n = (int)(sizeof rows / sizeof rows[0]);
|
||||
int total = 0, fail = 0;
|
||||
|
||||
for (int d = 0; drivers[d].name; d++) {
|
||||
if (drivers[d].gated && access(drivers[d].drv, X_OK) != 0) {
|
||||
fprintf(stderr, "dotbasehijack_run: skip %s (no %s)\n",
|
||||
drivers[d].name, drivers[d].drv);
|
||||
continue;
|
||||
}
|
||||
for (int i = 0; i < n; i++) {
|
||||
total++;
|
||||
int got = run_build(drivers[d].drv, &rows[i], i);
|
||||
if (got != rows[i].want_exit) {
|
||||
fprintf(stderr, "dotbasehijack_run[%s][%s]: exit=%d "
|
||||
"want=%d\n", drivers[d].name, rows[i].label,
|
||||
got, rows[i].want_exit);
|
||||
fail++;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (fail) {
|
||||
fprintf(stderr, "dotbasehijack_run: %d/%d fixtures failed\n",
|
||||
fail, total);
|
||||
return 1;
|
||||
}
|
||||
printf("dotbasehijack_run: %d/%d ok\n", total, total);
|
||||
return 0;
|
||||
}
|
||||
Reference in New Issue
Block a user