From b51a7daa2542d6e20dd99200bd31f3a862d8615a Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Sun, 24 May 2026 16:18:49 +0900 Subject: [PATCH] cgen: str chained .field = v store -> 3-word -- Phase 2 G2 (both stages) Storing a str into a field reached through a *struct-valued expression (e.g. r.sym.flag = v) wrote only 2 words (ptr,len), dropping cap -- the second STORE-cluster fold. Direct transfer of G1 (c692923): the prior arm spilled only ptr/len across the base eval; now spill the full value (PUSHQ CX/BX/AX) after the rhs eval and before the base-expr eval (the stack slot insulates it, base-formation-agnostic), stage the *struct ptr in DX (off the AX/BX/CX str convention), store ptr/len/cap at foff+{0,8,16}. Mirrors the s.f=v oracle (cgen.c:2603); G2 adds the spill the oracle skips because the oracle's base is a slot read, not a clobbering expr. Kind-gated (TY_STR/typeisstr, never size==24). cstage==wwstage byte-identical at the store site. test/wcc/938: table-driven write-then-read-cap over depth-2 (r.sym.f=) and depth-3 (r.a.b.f=) chained bases, both asm-confirmed to hit the chained arm. rhs is a cap!=len str; all 3 slot words pre-poisoned via a non-G2 direct store; full {ptr,len,cap} triple asserted. fail-before/pass-after verified on both drivers. main.combined.ww regenerated via the canonical make path (md5-stable). --- Makefile | 7 + cmd/w6c/cgen.c | 21 +- selfhost/cmd/w6c/main.combined.ww | 23 ++- selfhost/cmd/wcc/cgenexpr.ww | 23 ++- selfhost/cmd/wwdump/main.combined.ww | 23 ++- test/wcc/938_str_chainfield_store_cap_run.c | 217 ++++++++++++++++++++ 6 files changed, 287 insertions(+), 27 deletions(-) create mode 100644 test/wcc/938_str_chainfield_store_cap_run.c diff --git a/Makefile b/Makefile index 2d45905a..d3026803 100644 --- a/Makefile +++ b/Makefile @@ -260,6 +260,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_str_tuple_elem_cap_run \ $(BIN)/test_str_arrfield_cap_run \ $(BIN)/test_str_arrfield_store_cap_run \ + $(BIN)/test_str_chainfield_store_cap_run \ $(BIN)/test_composite_call_arg \ $(BIN)/test_composite_call_arg_run \ $(BIN)/test_letdecl_zeroinit \ @@ -662,6 +663,12 @@ $(BIN)/test_str_arrfield_store_cap_run: test/wcc/937_str_arrfield_store_cap_run. $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +$(BIN)/test_str_chainfield_store_cap_run: test/wcc/938_str_chainfield_store_cap_run.c \ + $(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + $(BIN)/test_composite_call_arg: test/wcc/723_composite_call_arg.c \ $(BIN)/w6c $(BIN)/w6c_ww | $(BIN) $(CC) $(CFLAGS) -o $@ $< diff --git a/cmd/w6c/cgen.c b/cmd/w6c/cgen.c index 80d1a189..6c010708 100644 --- a/cmd/w6c/cgen.c +++ b/cmd/w6c/cgen.c @@ -3140,21 +3140,30 @@ cgexpr(Cg *c, Node *n, Local *locals) break; } if (fu && fu->kind == TY_STR) { - /* str rhs: (AX=ptr, BX=len). Stash - * both, then load the struct ptr - * into CX and write both halves. */ + /* str IS []u8: rhs leaves AX=ptr, + * BX=len, CX=cap (#1/Phase 3). Spill + * all three across the base-expr eval + * (it may clobber any reg), stage the + * *struct ptr in DX off the str + * AX/BX/CX convention (mirrors s.f=v), + * then store the full triple at + * foff+0/+8/+16. */ cgexpr(c, n->rhs, locals); + ins1(c, A_PUSHQ, areg(D_CX)); ins1(c, A_PUSHQ, areg(D_BX)); ins1(c, A_PUSHQ, areg(D_AX)); cgexpr(c, n->lhs->lhs, locals); ins2(c, A_MOVQ, areg(D_AX), - areg(D_CX)); + areg(D_DX)); ins1(c, A_POPQ, areg(D_AX)); ins1(c, A_POPQ, areg(D_BX)); + ins1(c, A_POPQ, areg(D_CX)); ins2(c, A_MOVQ, areg(D_AX), - amem(D_CX, foff + 0)); + amem(D_DX, foff + 0)); ins2(c, A_MOVQ, areg(D_BX), - amem(D_CX, foff + 8)); + amem(D_DX, foff + 8)); + ins2(c, A_MOVQ, areg(D_CX), + amem(D_DX, foff + 16)); } else { cgexpr(c, n->rhs, locals); ins1(c, A_PUSHQ, areg(D_AX)); diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index c6c8b1ab..52def505 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -18819,22 +18819,31 @@ fn cgassign(c: *cgen, n: *node) void = { let ft: *tinfo = tf.type_; if (n.op == tkind.TK_ASSIGN) { if (typeisstr(ft)) { - // str rhs: AX=ptr, BX=len. - // Stash both, then load - // the struct ptr into CX - // and write both halves. + // str IS []u8: rhs leaves AX=ptr, + // BX=len, CX=cap (#1/Phase 3). Spill + // all three across the base-expr eval + // (it may clobber any reg), stage the + // *struct ptr in DX off the str + // AX/BX/CX convention (mirrors s.f=v), + // then store the full triple at + // foff+0/+8/+16. cgexpr(c, n.rhs); + emitline("\tPUSHQ\tCX\n"); emitline("\tPUSHQ\tBX\n"); emitline("\tPUSHQ\tAX\n"); cgexpr(c, base); - emitline("\tMOVQ\tAX, CX\n"); + emitline("\tMOVQ\tAX, DX\n"); emitline("\tPOPQ\tAX\n"); emitline("\tPOPQ\tBX\n"); + emitline("\tPOPQ\tCX\n"); emitline("\tMOVQ\tAX, "); - emitdispreg(tf.offset: i64, "CX"); + emitdispreg(tf.offset: i64, "DX"); emitline("\n"); emitline("\tMOVQ\tBX, "); - emitdispreg((tf.offset + 8u64): i64, "CX"); + emitdispreg((tf.offset + 8u64): i64, "DX"); + emitline("\n"); + emitline("\tMOVQ\tCX, "); + emitdispreg((tf.offset + 16u64): i64, "DX"); emitline("\n"); return; }; diff --git a/selfhost/cmd/wcc/cgenexpr.ww b/selfhost/cmd/wcc/cgenexpr.ww index 88aa09af..b0a221c7 100644 --- a/selfhost/cmd/wcc/cgenexpr.ww +++ b/selfhost/cmd/wcc/cgenexpr.ww @@ -4991,22 +4991,31 @@ fn cgassign(c: *cgen, n: *node) void = { let ft: *tinfo = tf.type_; if (n.op == tkind.TK_ASSIGN) { if (typeisstr(ft)) { - // str rhs: AX=ptr, BX=len. - // Stash both, then load - // the struct ptr into CX - // and write both halves. + // str IS []u8: rhs leaves AX=ptr, + // BX=len, CX=cap (#1/Phase 3). Spill + // all three across the base-expr eval + // (it may clobber any reg), stage the + // *struct ptr in DX off the str + // AX/BX/CX convention (mirrors s.f=v), + // then store the full triple at + // foff+0/+8/+16. cgexpr(c, n.rhs); + emitline("\tPUSHQ\tCX\n"); emitline("\tPUSHQ\tBX\n"); emitline("\tPUSHQ\tAX\n"); cgexpr(c, base); - emitline("\tMOVQ\tAX, CX\n"); + emitline("\tMOVQ\tAX, DX\n"); emitline("\tPOPQ\tAX\n"); emitline("\tPOPQ\tBX\n"); + emitline("\tPOPQ\tCX\n"); emitline("\tMOVQ\tAX, "); - emitdispreg(tf.offset: i64, "CX"); + emitdispreg(tf.offset: i64, "DX"); emitline("\n"); emitline("\tMOVQ\tBX, "); - emitdispreg((tf.offset + 8u64): i64, "CX"); + emitdispreg((tf.offset + 8u64): i64, "DX"); + emitline("\n"); + emitline("\tMOVQ\tCX, "); + emitdispreg((tf.offset + 16u64): i64, "DX"); emitline("\n"); return; }; diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index 88c1ffaf..ce25fe57 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -18819,22 +18819,31 @@ fn cgassign(c: *cgen, n: *node) void = { let ft: *tinfo = tf.type_; if (n.op == tkind.TK_ASSIGN) { if (typeisstr(ft)) { - // str rhs: AX=ptr, BX=len. - // Stash both, then load - // the struct ptr into CX - // and write both halves. + // str IS []u8: rhs leaves AX=ptr, + // BX=len, CX=cap (#1/Phase 3). Spill + // all three across the base-expr eval + // (it may clobber any reg), stage the + // *struct ptr in DX off the str + // AX/BX/CX convention (mirrors s.f=v), + // then store the full triple at + // foff+0/+8/+16. cgexpr(c, n.rhs); + emitline("\tPUSHQ\tCX\n"); emitline("\tPUSHQ\tBX\n"); emitline("\tPUSHQ\tAX\n"); cgexpr(c, base); - emitline("\tMOVQ\tAX, CX\n"); + emitline("\tMOVQ\tAX, DX\n"); emitline("\tPOPQ\tAX\n"); emitline("\tPOPQ\tBX\n"); + emitline("\tPOPQ\tCX\n"); emitline("\tMOVQ\tAX, "); - emitdispreg(tf.offset: i64, "CX"); + emitdispreg(tf.offset: i64, "DX"); emitline("\n"); emitline("\tMOVQ\tBX, "); - emitdispreg((tf.offset + 8u64): i64, "CX"); + emitdispreg((tf.offset + 8u64): i64, "DX"); + emitline("\n"); + emitline("\tMOVQ\tCX, "); + emitdispreg((tf.offset + 16u64): i64, "DX"); emitline("\n"); return; }; diff --git a/test/wcc/938_str_chainfield_store_cap_run.c b/test/wcc/938_str_chainfield_store_cap_run.c new file mode 100644 index 00000000..e829ce1d --- /dev/null +++ b/test/wcc/938_str_chainfield_store_cap_run.c @@ -0,0 +1,217 @@ +/* + * 938_str_chainfield_store_cap_run — runtime coverage for the G2 fold: STORING a + * str into a FIELD reached through a *struct-VALUED EXPRESSION (`r.sym.f = v`, + * the chained-N_DOT store) must write the full 24B {ptr,len,cap} header, not + * just {ptr,len}. str is 24B since Phase 2 (#1); the chained-store arm + * previously stored only 2 words (AX=ptr@foff+0, BX=len@foff+8) and silently + * DROPPED cap — the second STORE-cluster fold, after the arrfield store (937). + * + * This is the write-side mirror of the landed chained *struct str-field READ + * (caseB, #11) and is only meaningful now that read is 3-word: before that the + * store+read were 2-word-symmetric and cap was untouched at both ends, so a + * dropped store-cap was invisible. Now the read returns the real +16 word, so a + * 2-word store is observable. + * + * Sites: cgen.c's chained-N_DOT `.field = v` str branch (n->lhs is N_DOT, + * n->lhs->lhs is N_DOT/non-IDENT evaluating to a *struct) and the cgenexpr.ww + * cgassign twin (strict gate: chain root is a LOCAL ident, every dot resolves + * through a *struct). The mechanic is a direct transfer of G1 (arrfield store): + * the rhs str leaves AX=ptr/BX=len/CX=cap, all three spilled (PUSHQ CX/BX/AX) + * across the base-expr eval (which may clobber any register), the resolved + * *struct ptr staged in DX off the str AX/BX/CX convention (mirroring the + * s.f=v store), then the full triple stored at foff+0/+8/+16. The base here is + * a single-word *struct pointer, so it does not contend for the spilled slots. + * + * Rows exercise the CHAINED arm at two depths (a direct-field `s.f=` probe would + * MISS this arm and test the already-3-word IDENT-base path): + * A depth-2 `r.sym.f = v` (r: outer, outer.sym: *inner, inner.f: str). + * B depth-3 `r.a.b.f = v` (two pointer hops; deeper base eval clobbers + * more registers, stressing the spill). + * + * RHS cap!=len: each test str is a literal whose .cap is mutated to a value + * DISTINCT from its len (NOT a bare literal — literals carry cap==len, which + * would hide a dropped cap; a str sub-slice was rejected too: ww yields cap==len + * for `buf[0:2]`, equally hiding the drop). cap=8 and len=2 are both nonzero and + * unequal so a 2-word store that drops cap is detectable. + * + * PRE-POISON (cap=5 != 8, both nonzero, != len): before the G2 store under test, + * all three slot words are seeded with a DIFFERENT str (ptr='q', len=4, cap=5) + * via the PROVEN already-3-word DIRECT field store (`st.f = q`, the s.f=v + * oracle, N_IDENT base) — never the G2 chained store itself (if G2 is broken its + * own poison write would also drop cap, leaving +16 uninit rather than a + * controlled poison). The pointee is a local struct; the chain's leaf points at + * it, so the G2 store overwrites the poisoned field. The G2 store then writes + * the test str (ptr='h', len=2, cap=8). A broken 2-word store never touches +16, + * so the 3-word read-back observes the poison cap 5, never 8 — deterministic + * discrimination with no reliance on a stale register. + * + * FULL-TRIPLE ASSERT: a register-reallocation slip in the 3-word store could + * clobber ptr or len while wiring cap, and a cap-only assert would miss it. So + * each row reads the value back (landed 3-word chained read, caseB) and checks + * all three words: ptr (first byte through it — 'h'=104), len (2), cap (8). The + * 2-word store writes ptr/len correctly (they ARE the two words it keeps), so + * cap is the fail-before discriminator; ptr/len guard the fix. + * + * Verified fail-before (stashed the store edit on BOTH stages → all rows exit 1, + * cap reads the poison 5) / pass-after (exit 0), both the cstage `ww` and + * wwstage `ww_ww` drivers. + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { const char *label; const char *src; int want; }; + +static const struct row rows[] = { + /* A — depth-2 `r.sym.f = v`. r is a local outer; r.sym is a *inner + * pointing at a local struct st. Poison st.f (cap=5,len=4,'q') via the + * DIRECT s.f=v 3-word store; then the G2 chained store lands the test + * str (cap=8,len=2,'h') through r.sym. */ + { "chainfield_store_depth2", + "type inner = struct { f: str };\n" + "type outer = struct { sym: *inner };\n" + "export fn main() i32 = {\n" + " let q: str = \"qqqq\"; q.cap = 5i32;\n" + " let p: str = \"hi\"; p.cap = 8i32;\n" + " let st: inner;\n" + " st.f = q;\n" + " let r: outer;\n" + " r.sym = &st;\n" + " r.sym.f = p;\n" + " let s: str = r.sym.f;\n" + " if (s.cap: i32 != 8) { return 1; };\n" + " if (s.len: i32 != 2) { return 2; };\n" + " if (s[0] != 104u8) { return 3; };\n" + " return 0;\n" + "};\n", + 0 }, + /* B — depth-3 `r.a.b.f = v`. Two pointer hops (r.a: *mid, mid.b: + * *inner). Poison the leaf via the DIRECT store (`leaf.f = q`); the G2 + * chained store derefs r.a then .b and overwrites leaf.f. The deeper + * base eval clobbers more registers, confirming the spilled triple + * survives an arbitrary base-formation. */ + { "chainfield_store_depth3", + "type inner = struct { f: str };\n" + "type mid = struct { b: *inner };\n" + "type outer = struct { a: *mid };\n" + "export fn main() i32 = {\n" + " let q: str = \"qqqq\"; q.cap = 5i32;\n" + " let p: str = \"hi\"; p.cap = 8i32;\n" + " let leaf: inner;\n" + " leaf.f = q;\n" + " let m: mid;\n" + " m.b = &leaf;\n" + " let r: outer;\n" + " r.a = &m;\n" + " r.a.b.f = p;\n" + " let s: str = r.a.b.f;\n" + " if (s.cap: i32 != 8) { return 1; };\n" + " if (s.len: i32 != 2) { return 2; };\n" + " if (s[0] != 104u8) { return 3; };\n" + " return 0;\n" + "};\n", + 0 }, +}; + +static int +run_driver(const char *driver, const struct row *r, int i) +{ + char src[96], tmpdir[96], cmd[1024]; + snprintf(src, sizeof src, "/tmp/strchainfieldstore_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/strchainfieldstore_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -1; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s", + tmpdir, driver, src); + if (runwait(cmd) != 0) { + fprintf(stderr, "row[%s]: build via %s failed\n", + r->label, driver); + unlink(src); rmdir(tmpdir); + return -1; + } + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[160]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + int got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return got; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[512]; + if (bin[0] != '/') { + char cwd[256]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[640]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + char wdrv[640]; + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *path; int gated_on_existence; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated_on_existence + && access(drivers[d].path, X_OK) != 0) { + fprintf(stderr, + "str_chainfield_store_cap_run: skip %s (no %s)\n", + drivers[d].name, drivers[d].path); + continue; + } + for (int i = 0; i < n; i++) { + int got = run_driver(drivers[d].path, &rows[i], i); + total++; + if (got != rows[i].want) { + fprintf(stderr, + "str_chainfield_store_cap_run[%s][%s]: exit=%d want=%d\n", + drivers[d].name, rows[i].label, + got, rows[i].want); + fail++; + } + } + } + + if (fail) { + fprintf(stderr, "str_chainfield_store_cap_run: %d/%d fixtures failed\n", + fail, total); + return 1; + } + printf("str_chainfield_store_cap_run: %d/%d ok\n", total, total); + return 0; +}