Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wcc: N_DOT-base address arithmetic for [N]T-field index (#135)

Browse Source 
Strategy (a) use-site fix: new helper cg_dotbase_addr (cstage) /
dotbaseaddr (wwstage) detects `base.kind == N_DOT` whose field type
is TY_ARRAY and emits the field's address inline — LEAQ inner_off+
field_off(BP) for a value-struct inner, MOVQ inner_off(BP),reg +
ADDQ field_off,reg for a *struct inner. The TY_ARRAY-only gate (after
TY_NAMED peel) keeps the helper INERT on TY_PTR/TY_SLICE/TY_STR/
TY_TAGGED field kinds where the existing cgexpr(base) path is
correct (loads pointer/header value, then adds scaled index). Wired
at 6 sites: cstage cgassign N_INDEX-lhs plain ASSIGN + #133 compound
arm + cgindex N_INDEX read fallback; wwstage twin × 3. Closes the
silent-segfault on `(*struct).array_field[i]` reads and writes —
pre-fix cgexpr on the N_DOT base auto-derefed and loaded the field's
first 8 bytes as if they were a pointer, faulting on packed [N]u8
arrays (small u64 → unmapped page).

Bootstrap-NEUTRAL: zero working callers in either direction pre-fix
(symmetric READ + WRITE segfault evidence). All corpus + 990-997
byte-id + combined_ww_fresh stay green post-fix.

949_dotbase_arr_run: 3 rows direct runtime + cs==ww byte-id (READ
u8, plain WRITE u8, compound WRITE u8). Wider element widths and
value-struct base / pointer-field-control rows deferred — blocked by
orthogonal pre-existing wwstage divergences (i32-return ABI MOVSXD
vs MOVL, uninit-struct-let zero-init asymmetry) documented in the
test body. The TY_ARRAY-gate no-over-fire is implicitly verified by
994/995 (corpus exercises thousands of struct.pointerfield[i]
shapes; any over-fire would shift bytes).

Chained N_DOT (`outer.inner.array[i]` depth ≥2) deferred to #137 —
confirmed not in ref/hare/strconv/decimal.ha or sibling strconv/.
Not a fold-3 blocker; helper bails (returns false) on chained shape,
caller falls back to existing cgexpr path.
This commit is contained in:
Hojun-Cho
2026-05-26 22:56:00 +09:00
parent 3986818172
commit ade6840610
6 changed files with 583 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

79
cmd/w6c/cgen.c
View File

@@ -1215,6 +1215,66 @@ static void cgstmt(Cg*, Node*, Local**, int*);
static void cg_widen_tagged_push(Cg*, Local**, Type*, Node*, int);
static void cg_widen_tagged_store(Cg*, Local**, Type*, Node*, int, int, int);
static void cg_widen_tag_remap(Cg*, Type*, Type*, int);
/* cg_dotbase_addr — compute &(inner.field) into `dst_reg` for a bare
* N_DOT base where `inner` is an N_IDENT local (struct value OR *struct
* pointer). Returns 1 if emitted, 0 if base shape isn't supported (the
* caller falls back to its prior `cgexpr(base); MOVQ AX, dst_reg`).
*
* #135: cgexpr on an N_DOT whose .field is a `[N]T`-typed field auto-
* derefs and loads the field's 8-byte VALUE as if it were a pointer.
* For an LHS or index-base shape (`d.fld[i] = v` / `d.fld[i]` read /
* `d.fld[i] OP= v`), the caller wants the field's ADDRESS — this helper
* supplies it inline, avoiding the value-load. Mirror primitive of the
* inverse template at cgen.c arr[i].field (the cgdot N_INDEX-lhs
* branch). Chained N_DOT (`a.b.c.field[i]`) deferred — not in #135
* scope.
*
* Caller-spill contract: the helper emits at most one MOVQ + one ADDQ
* (or one LEAQ); it does NOT touch AX unless dst_reg == D_AX. Safe to
* call where AX holds an unrelated live value (BX dst). */
static int
cg_dotbase_addr(Cg *c, Node *base, int dst_reg, Local *locals)
{
if (base == NULL || base->kind != N_DOT) return 0;
Node *inner = base->lhs;
if (inner == NULL || inner->kind != N_IDENT) return 0;
Type *bt = inner->type;
Type *bu = type_chase_named(bt);
if (bu == NULL) return 0;
int viaptr = 0;
Type *struct_t = NULL;
if (bu->kind == TY_PTR) {
Type *st = type_chase_named(bu->sub);
if (st && st->kind == TY_STRUCT) { struct_t = st; viaptr = 1; }
} else if (bu->kind == TY_STRUCT) {
struct_t = bu;
}
if (struct_t == NULL) return 0;
Tfield *f = NULL;
for (Tfield *fl = struct_t->fields; fl; fl = fl->next)
if (strcmp(fl->name, base->str) == 0) { f = fl; break; }
if (f == NULL) return 0;
/* Only fire on `[N]T` fields — the field's storage IS the array
* data inline, so taking the address-of-field gives `&arr[0]`.
* For `*T` / `[]T` / `str` fields, the existing cgexpr(base) path
* is correct (loads the pointer value, then adds the scaled
* index); over-firing here would skip the deref and treat the
* pointer/slice/str field as an inline array. */
Type *ft = type_chase_named(f->type);
if (ft == NULL || ft->kind != TY_ARRAY) return 0;
int inner_off = localfind(locals, inner->str);
int foff = (int)f->offset;
if (viaptr) {
ins2(c, A_MOVQ, amem(D_BP, inner_off), areg(dst_reg));
if (foff != 0)
ins2(c, A_ADDQ, aimm(foff), areg(dst_reg));
} else {
ins2(c, A_LEAQ, amem(D_BP, inner_off + foff),
areg(dst_reg));
}
return 1;
}
/* cg_structlit_fill modes — see helper docstring. */
enum {
DST_BP = 0,
@@ -3881,6 +3941,11 @@ cgexpr(Cg *c, Node *n, Local *locals)
amem(D_BP, off),
areg(D_BX));
}
} else if (cg_dotbase_addr(c, base, D_BX, locals)) {
/* #135 site: N_DOT base resolved inline to
* the field address; cgexpr fallback below
* would auto-deref + load the field as a
* VALUE (the broken shape). */
} else {
cgexpr(c, base, locals);
ins2(c, A_MOVQ, areg(D_AX), areg(D_BX));
@@ -3978,6 +4043,9 @@ cgexpr(Cg *c, Node *n, Local *locals)
amem(D_BP, off),
areg(D_BX));
}
} else if (cg_dotbase_addr(c, base, D_BX, locals)) {
/* #135 site: N_DOT base resolved inline to the
* field address. */
} else {
cgexpr(c, base, locals);
ins2(c, A_MOVQ, areg(D_AX), areg(D_BX));
@@ -6659,14 +6727,21 @@ cgexpr(Cg *c, Node *n, Local *locals)
*
* Scale the index in a register before pushing, because
* IMULQ on a memory operand isn't currently encoded by w6a
* (modrm bits use mod=3 register form). */
* (modrm bits use mod=3 register form).
*
* #135: N_DOT base on a `[N]T`-typed field needs the field's
* ADDRESS, not its value. cgexpr on N_DOT would auto-deref and
* load the field's 8-byte value as if it were a pointer — the
* symmetric READ-side of the LHS bug at the cgassign sites.
* cg_dotbase_addr emits the address inline. */
cgexpr(c, n->rhs, locals);
if (esz > 1) {
ins2(c, A_MOVQ, aimm(esz), areg(D_CX));
ins2(c, A_IMULQ, areg(D_CX), areg(D_AX));
}
ins1(c, A_PUSHQ, areg(D_AX));
cgexpr(c, n->lhs, locals);
if (!cg_dotbase_addr(c, n->lhs, D_AX, locals))
cgexpr(c, n->lhs, locals);
ins1(c, A_POPQ, areg(D_BX));
ins2(c, A_ADDQ, areg(D_BX), areg(D_AX));
/* str/slice element via fallback base: load the full (ptr, len,