Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cgen: str chained <expr>.field = v store -> 3-word -- Phase 2 G2 (both stages)

Browse Source 
Storing a str into a field reached through a *struct-valued expression (e.g. r.sym.flag = v) wrote only 2 words (ptr,len), dropping cap -- the second STORE-cluster fold. Direct transfer of G1 (c692923): the prior arm spilled only ptr/len across the base eval; now spill the full value (PUSHQ CX/BX/AX) after the rhs eval and before the base-expr eval (the stack slot insulates it, base-formation-agnostic), stage the *struct ptr in DX (off the AX/BX/CX str convention), store ptr/len/cap at foff+{0,8,16}. Mirrors the s.f=v oracle (cgen.c:2603); G2 adds the spill the oracle skips because the oracle's base is a slot read, not a clobbering expr. Kind-gated (TY_STR/typeisstr, never size==24). cstage==wwstage byte-identical at the store site.

test/wcc/938: table-driven write-then-read-cap over depth-2 (r.sym.f=) and depth-3 (r.a.b.f=) chained bases, both asm-confirmed to hit the chained arm. rhs is a cap!=len str; all 3 slot words pre-poisoned via a non-G2 direct store; full {ptr,len,cap} triple asserted. fail-before/pass-after verified on both drivers.

main.combined.ww regenerated via the canonical make path (md5-stable).
This commit is contained in:
Hojun-Cho
2026-05-24 16:18:49 +09:00
parent c6929231dc
commit b51a7daa25
6 changed files with 287 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Makefile
View File

@@ -260,6 +260,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
$(BIN)/test_str_tuple_elem_cap_run \
$(BIN)/test_str_arrfield_cap_run \
$(BIN)/test_str_arrfield_store_cap_run \
$(BIN)/test_str_chainfield_store_cap_run \
$(BIN)/test_composite_call_arg \
$(BIN)/test_composite_call_arg_run \
$(BIN)/test_letdecl_zeroinit \
@@ -662,6 +663,12 @@ $(BIN)/test_str_arrfield_store_cap_run: test/wcc/937_str_arrfield_store_cap_run.
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
$(BIN)/test_str_chainfield_store_cap_run: test/wcc/938_str_chainfield_store_cap_run.c \
$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
$(BIN)/test_composite_call_arg: test/wcc/723_composite_call_arg.c \
$(BIN)/w6c $(BIN)/w6c_ww | $(BIN)
$(CC) $(CFLAGS) -o $@ $<

21
cmd/w6c/cgen.c
View File

@@ -3140,21 +3140,30 @@ cgexpr(Cg *c, Node *n, Local *locals)
break;
}
if (fu && fu->kind == TY_STR) {
/* str rhs: (AX=ptr, BX=len). Stash
* both, then load the struct ptr
* into CX and write both halves. */
/* str IS []u8: rhs leaves AX=ptr,
* BX=len, CX=cap (#1/Phase 3). Spill
* all three across the base-expr eval
* (it may clobber any reg), stage the
* *struct ptr in DX off the str
* AX/BX/CX convention (mirrors s.f=v),
* then store the full triple at
* foff+0/+8/+16. */
cgexpr(c, n->rhs, locals);
ins1(c, A_PUSHQ, areg(D_CX));
ins1(c, A_PUSHQ, areg(D_BX));
ins1(c, A_PUSHQ, areg(D_AX));
cgexpr(c, n->lhs->lhs, locals);
ins2(c, A_MOVQ, areg(D_AX),
areg(D_CX));
areg(D_DX));
ins1(c, A_POPQ, areg(D_AX));
ins1(c, A_POPQ, areg(D_BX));
ins1(c, A_POPQ, areg(D_CX));
ins2(c, A_MOVQ, areg(D_AX),
amem(D_CX, foff + 0));
amem(D_DX, foff + 0));
ins2(c, A_MOVQ, areg(D_BX),
amem(D_CX, foff + 8));
amem(D_DX, foff + 8));
ins2(c, A_MOVQ, areg(D_CX),
amem(D_DX, foff + 16));
} else {
cgexpr(c, n->rhs, locals);
ins1(c, A_PUSHQ, areg(D_AX));

23
selfhost/cmd/w6c/main.combined.ww
View File

@@ -18819,22 +18819,31 @@ fn cgassign(c: *cgen, n: *node) void = {
let ft: *tinfo = tf.type_;
if (n.op == tkind.TK_ASSIGN) {
if (typeisstr(ft)) {
// str rhs: AX=ptr, BX=len.
// Stash both, then load
// the struct ptr into CX
// and write both halves.
// str IS []u8: rhs leaves AX=ptr,
// BX=len, CX=cap (#1/Phase 3). Spill
// all three across the base-expr eval
// (it may clobber any reg), stage the
// *struct ptr in DX off the str
// AX/BX/CX convention (mirrors s.f=v),
// then store the full triple at
// foff+0/+8/+16.
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tCX\n");
emitline("\tPUSHQ\tBX\n");
emitline("\tPUSHQ\tAX\n");
cgexpr(c, base);
emitline("\tMOVQ\tAX, CX\n");
emitline("\tMOVQ\tAX, DX\n");
emitline("\tPOPQ\tAX\n");
emitline("\tPOPQ\tBX\n");
emitline("\tPOPQ\tCX\n");
emitline("\tMOVQ\tAX, ");
emitdispreg(tf.offset: i64, "CX");
emitdispreg(tf.offset: i64, "DX");
emitline("\n");
emitline("\tMOVQ\tBX, ");
emitdispreg((tf.offset + 8u64): i64, "CX");
emitdispreg((tf.offset + 8u64): i64, "DX");
emitline("\n");
emitline("\tMOVQ\tCX, ");
emitdispreg((tf.offset + 16u64): i64, "DX");
emitline("\n");
return;
};

23
selfhost/cmd/wcc/cgenexpr.ww
View File

@@ -4991,22 +4991,31 @@ fn cgassign(c: *cgen, n: *node) void = {
let ft: *tinfo = tf.type_;
if (n.op == tkind.TK_ASSIGN) {
if (typeisstr(ft)) {
// str rhs: AX=ptr, BX=len.
// Stash both, then load
// the struct ptr into CX
// and write both halves.
// str IS []u8: rhs leaves AX=ptr,
// BX=len, CX=cap (#1/Phase 3). Spill
// all three across the base-expr eval
// (it may clobber any reg), stage the
// *struct ptr in DX off the str
// AX/BX/CX convention (mirrors s.f=v),
// then store the full triple at
// foff+0/+8/+16.
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tCX\n");
emitline("\tPUSHQ\tBX\n");
emitline("\tPUSHQ\tAX\n");
cgexpr(c, base);
emitline("\tMOVQ\tAX, CX\n");
emitline("\tMOVQ\tAX, DX\n");
emitline("\tPOPQ\tAX\n");
emitline("\tPOPQ\tBX\n");
emitline("\tPOPQ\tCX\n");
emitline("\tMOVQ\tAX, ");
emitdispreg(tf.offset: i64, "CX");
emitdispreg(tf.offset: i64, "DX");
emitline("\n");
emitline("\tMOVQ\tBX, ");
emitdispreg((tf.offset + 8u64): i64, "CX");
emitdispreg((tf.offset + 8u64): i64, "DX");
emitline("\n");
emitline("\tMOVQ\tCX, ");
emitdispreg((tf.offset + 16u64): i64, "DX");
emitline("\n");
return;
};

23
selfhost/cmd/wwdump/main.combined.ww
View File

@@ -18819,22 +18819,31 @@ fn cgassign(c: *cgen, n: *node) void = {
let ft: *tinfo = tf.type_;
if (n.op == tkind.TK_ASSIGN) {
if (typeisstr(ft)) {
// str rhs: AX=ptr, BX=len.
// Stash both, then load
// the struct ptr into CX
// and write both halves.
// str IS []u8: rhs leaves AX=ptr,
// BX=len, CX=cap (#1/Phase 3). Spill
// all three across the base-expr eval
// (it may clobber any reg), stage the
// *struct ptr in DX off the str
// AX/BX/CX convention (mirrors s.f=v),
// then store the full triple at
// foff+0/+8/+16.
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tCX\n");
emitline("\tPUSHQ\tBX\n");
emitline("\tPUSHQ\tAX\n");
cgexpr(c, base);
emitline("\tMOVQ\tAX, CX\n");
emitline("\tMOVQ\tAX, DX\n");
emitline("\tPOPQ\tAX\n");
emitline("\tPOPQ\tBX\n");
emitline("\tPOPQ\tCX\n");
emitline("\tMOVQ\tAX, ");
emitdispreg(tf.offset: i64, "CX");
emitdispreg(tf.offset: i64, "DX");
emitline("\n");
emitline("\tMOVQ\tBX, ");
emitdispreg((tf.offset + 8u64): i64, "CX");
emitdispreg((tf.offset + 8u64): i64, "DX");
emitline("\n");
emitline("\tMOVQ\tCX, ");
emitdispreg((tf.offset + 16u64): i64, "DX");
emitline("\n");
return;
};

217
test/wcc/938_str_chainfield_store_cap_run.c Normal file
View File

@@ -0,0 +1,217 @@
/*
* 938_str_chainfield_store_cap_run — runtime coverage for the G2 fold: STORING a
* str into a FIELD reached through a *struct-VALUED EXPRESSION (`r.sym.f = v`,
* the chained-N_DOT store) must write the full 24B {ptr,len,cap} header, not
* just {ptr,len}. str is 24B since Phase 2 (#1); the chained-store arm
* previously stored only 2 words (AX=ptr@foff+0, BX=len@foff+8) and silently
* DROPPED cap — the second STORE-cluster fold, after the arrfield store (937).
*
* This is the write-side mirror of the landed chained *struct str-field READ
* (caseB, #11) and is only meaningful now that read is 3-word: before that the
* store+read were 2-word-symmetric and cap was untouched at both ends, so a
* dropped store-cap was invisible. Now the read returns the real +16 word, so a
* 2-word store is observable.
*
* Sites: cgen.c's chained-N_DOT `<expr>.field = v` str branch (n->lhs is N_DOT,
* n->lhs->lhs is N_DOT/non-IDENT evaluating to a *struct) and the cgenexpr.ww
* cgassign twin (strict gate: chain root is a LOCAL ident, every dot resolves
* through a *struct). The mechanic is a direct transfer of G1 (arrfield store):
* the rhs str leaves AX=ptr/BX=len/CX=cap, all three spilled (PUSHQ CX/BX/AX)
* across the base-expr eval (which may clobber any register), the resolved
* *struct ptr staged in DX off the str AX/BX/CX convention (mirroring the
* s.f=v store), then the full triple stored at foff+0/+8/+16. The base here is
* a single-word *struct pointer, so it does not contend for the spilled slots.
*
* Rows exercise the CHAINED arm at two depths (a direct-field `s.f=` probe would
* MISS this arm and test the already-3-word IDENT-base path):
* A depth-2 `r.sym.f = v` (r: outer, outer.sym: *inner, inner.f: str).
* B depth-3 `r.a.b.f = v` (two pointer hops; deeper base eval clobbers
* more registers, stressing the spill).
*
* RHS cap!=len: each test str is a literal whose .cap is mutated to a value
* DISTINCT from its len (NOT a bare literal — literals carry cap==len, which
* would hide a dropped cap; a str sub-slice was rejected too: ww yields cap==len
* for `buf[0:2]`, equally hiding the drop). cap=8 and len=2 are both nonzero and
* unequal so a 2-word store that drops cap is detectable.
*
* PRE-POISON (cap=5 != 8, both nonzero, != len): before the G2 store under test,
* all three slot words are seeded with a DIFFERENT str (ptr='q', len=4, cap=5)
* via the PROVEN already-3-word DIRECT field store (`st.f = q`, the s.f=v
* oracle, N_IDENT base) — never the G2 chained store itself (if G2 is broken its
* own poison write would also drop cap, leaving +16 uninit rather than a
* controlled poison). The pointee is a local struct; the chain's leaf points at
* it, so the G2 store overwrites the poisoned field. The G2 store then writes
* the test str (ptr='h', len=2, cap=8). A broken 2-word store never touches +16,
* so the 3-word read-back observes the poison cap 5, never 8 — deterministic
* discrimination with no reliance on a stale register.
*
* FULL-TRIPLE ASSERT: a register-reallocation slip in the 3-word store could
* clobber ptr or len while wiring cap, and a cap-only assert would miss it. So
* each row reads the value back (landed 3-word chained read, caseB) and checks
* all three words: ptr (first byte through it — 'h'=104), len (2), cap (8). The
* 2-word store writes ptr/len correctly (they ARE the two words it keeps), so
* cap is the fail-before discriminator; ptr/len guard the fix.
*
* Verified fail-before (stashed the store edit on BOTH stages → all rows exit 1,
* cap reads the poison 5) / pass-after (exit 0), both the cstage `ww` and
* wwstage `ww_ww` drivers.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
struct row { const char *label; const char *src; int want; };
static const struct row rows[] = {
/* A — depth-2 `r.sym.f = v`. r is a local outer; r.sym is a *inner
* pointing at a local struct st. Poison st.f (cap=5,len=4,'q') via the
* DIRECT s.f=v 3-word store; then the G2 chained store lands the test
* str (cap=8,len=2,'h') through r.sym. */
{ "chainfield_store_depth2",
"type inner = struct { f: str };\n"
"type outer = struct { sym: *inner };\n"
"export fn main() i32 = {\n"
" let q: str = \"qqqq\"; q.cap = 5i32;\n"
" let p: str = \"hi\"; p.cap = 8i32;\n"
" let st: inner;\n"
" st.f = q;\n"
" let r: outer;\n"
" r.sym = &st;\n"
" r.sym.f = p;\n"
" let s: str = r.sym.f;\n"
" if (s.cap: i32 != 8) { return 1; };\n"
" if (s.len: i32 != 2) { return 2; };\n"
" if (s[0] != 104u8) { return 3; };\n"
" return 0;\n"
"};\n",
0 },
/* B — depth-3 `r.a.b.f = v`. Two pointer hops (r.a: *mid, mid.b:
* *inner). Poison the leaf via the DIRECT store (`leaf.f = q`); the G2
* chained store derefs r.a then .b and overwrites leaf.f. The deeper
* base eval clobbers more registers, confirming the spilled triple
* survives an arbitrary base-formation. */
{ "chainfield_store_depth3",
"type inner = struct { f: str };\n"
"type mid = struct { b: *inner };\n"
"type outer = struct { a: *mid };\n"
"export fn main() i32 = {\n"
" let q: str = \"qqqq\"; q.cap = 5i32;\n"
" let p: str = \"hi\"; p.cap = 8i32;\n"
" let leaf: inner;\n"
" leaf.f = q;\n"
" let m: mid;\n"
" m.b = &leaf;\n"
" let r: outer;\n"
" r.a = &m;\n"
" r.a.b.f = p;\n"
" let s: str = r.a.b.f;\n"
" if (s.cap: i32 != 8) { return 1; };\n"
" if (s.len: i32 != 2) { return 2; };\n"
" if (s[0] != 104u8) { return 3; };\n"
" return 0;\n"
"};\n",
0 },
};
static int
run_driver(const char *driver, const struct row *r, int i)
{
char src[96], tmpdir[96], cmd[1024];
snprintf(src, sizeof src, "/tmp/strchainfieldstore_%d_%d.ww", getpid(), i);
snprintf(tmpdir, sizeof tmpdir, "/tmp/strchainfieldstore_%d_d_%d", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
mkdir(tmpdir, 0755);
snprintf(cmd, sizeof cmd, "cd %s && %s build %s",
tmpdir, driver, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: build via %s failed\n",
r->label, driver);
unlink(src); rmdir(tmpdir);
return -1;
}
const char *base = strrchr(src, '/');
base = base ? base + 1 : src;
char outbin[160];
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
char *dot = strrchr(outbin, '.');
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
int got = runwait(outbin);
unlink(src); unlink(outbin); rmdir(tmpdir);
return got;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[512];
if (bin[0] != '/') {
char cwd[256];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char cdrv[640];
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
char wdrv[640];
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
struct { const char *name; const char *path; int gated_on_existence; }
drivers[] = {
{ "cstage", cdrv, 0 },
{ "wwstage", wdrv, 1 },
{ NULL, NULL, 0 },
};
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int d = 0; drivers[d].name; d++) {
if (drivers[d].gated_on_existence
&& access(drivers[d].path, X_OK) != 0) {
fprintf(stderr,
"str_chainfield_store_cap_run: skip %s (no %s)\n",
drivers[d].name, drivers[d].path);
continue;
}
for (int i = 0; i < n; i++) {
int got = run_driver(drivers[d].path, &rows[i], i);
total++;
if (got != rows[i].want) {
fprintf(stderr,
"str_chainfield_store_cap_run[%s][%s]: exit=%d want=%d\n",
drivers[d].name, rows[i].label,
got, rows[i].want);
fail++;
}
}
}
if (fail) {
fprintf(stderr, "str_chainfield_store_cap_run: %d/%d fixtures failed\n",
fail, total);
return 1;
}
printf("str_chainfield_store_cap_run: %d/%d ok\n", total, total);
return 0;
}