w6c+selfhost: cgdot N_DOT tagged-field source ABI (closes #28)

cgdot of a tagged-union struct field previously dropped the AX/DX/CX/R8
payload-register convention used by tagged-union returns: cstage's
direct-struct branch stopped at CX (size > 16) and never loaded R8
(slice-payload variants, slot 32B); the via_ptr branch had no TY_TAGGED
handler at all, falling through to fldloadop and yielding only the tag
in AX. The N_DOT scrutinee fallback in N_MATCH similarly stored only AX
into the spill slot. Wwstage cgdot had no TY_TAGGED branch in any of
the direct, *struct, or top-level-global field-load paths, and cgmatch's
non-ident scrutinee branch didn't recognise N_DOT — dispatch always
computed want = 0 and the spill scratch was hardcoded 24B. The combined
effect: any code reading `s.taggedfield` and consuming more than one
quadword of the payload saw garbage in the upper halves.

Cstage: extended the direct-struct TY_TAGGED branch with an R8 load for
size > 24 (CX still loaded last so global LEAQ-into-CX rooting
survives), added a parallel TY_TAGGED handler to the via_ptr (TY_PTR
inner TY_STRUCT) field branch, and extended the N_DOT scrutinee spill
fallback in N_MATCH to write DX/CX/R8 alongside AX.

Wwstage: new cgloadtaggedfield helper emits the four-register load with
CX-last ordering, and dotfieldtnode resolves a field's declared type
node for a local-ident or *struct base. cgdot grew three TY_TAGGED
branches (direct local, *struct deref staging in BX, top-level global
through CX). cgmatch's non-ident-scrutinee branch grew an N_DOT type-
extraction path mirroring the N_CALL / N_INDEX shapes and now sizes the
@match_spill slot from slotsize(scrutt) so slice-payload variants don't
overflow the historical 24B alloc. rhstaggedabicall accepts N_DOT so
`let copy: ev = h.e;` and tagged-arg call sites pass through the
tagged-source spill branch of cgwidentaggedstore.

Out of scope for #28 and left as separate latents: wwstage's match-arm
bind for a TY_STRUCT-typed variant copies only 8B (cstage falls back
to bu->size; wwstage's bsz=8 default), and the variant-index lookup
for an i64 literal in (i32 | i64) picks the wrong tag on the write
side. Both surface in struct-payload tagged unions and merit their
own tasks; the new test rows steer clear so #28's fix verifies
end-to-end on scalar / str / slice payloads.

Test 693_dot_tagged_source — three variant shapes (16B i64, 24B str,
32B slice) read from direct local, *struct param, top-level global,
and let-init round-trip. The 32B-slice rows verify v.cap (R8 / +24)
so dropping the upper-word load isn't masked by len-only checks; the
top-level-global row routes the write through *p because the direct
global-LHS tagged store is a separate wwstage gap (followup). Three
negative controls (untagged i32 / str / slice fields) keep the new
TY_TAGGED guard from shadowing the existing field-load paths. Wired
into make test; 37 tests total. Bootstrap ww2 == ww3 == ww4
byte-identical.
This commit is contained in:
2026-05-15 00:45:14 +09:00
parent 49e39a4cf3
commit bacbf4b845
7 changed files with 948 additions and 47 deletions

View File

@@ -0,0 +1,395 @@
/*
* 693_dot_tagged_source — `s.f` where `f` is a tagged-union field
* (read-side counterpart of 681's tagged-field write rows). Both stages
* previously misread the SysV classification of the source slot:
*
* cstage's direct-struct / global TY_STRUCT N_DOT branch loaded only
* AX (+0=tag), DX (+8=val0), and CX (+16=val1 when size > 16). The
* R8 (+24=val2) word was never read, so slice-payload variants (slot
* 32B) consumed garbage in the high word.
*
* cstage's TY_PTR N_DOT branch (via_ptr) had no TY_TAGGED handler at
* all — fell through to fldloadop, loading only the tag into AX. The
* N_DOT scrutinee spill path in N_MATCH likewise stored only AX.
*
* wwstage's cgdot had no TY_TAGGED handler in the direct, via_ptr,
* or top-level-global branches. cgmatch's non-ident-scrutinee path
* never recognised N_DOT, so the dispatch always computed
* want = 0 and the spill scratch was hardcoded 24B (overflowing for
* slice-payload variants). rhstaggedabicall didn't accept N_DOT, so
* `let copy: ev = h.e;` and call-arg pushes of `h.e` fell into the
* scalar/struct/str/slice branches.
*
* Closed in task #28 by:
* - cstage cgen.c: extending the direct-struct tagged branch to also
* load R8 for size > 24, adding a TY_TAGGED handler in the via_ptr
* branch, and extending the N_DOT scrutinee spill in N_MATCH to
* write DX/CX/R8 alongside AX.
* - wwstage cgenutil.ww: new helpers dotfieldtnode + cgloadtaggedfield,
* and a new N_DOT branch in rhstaggedabicall.
* - wwstage cgenexpr.ww: TY_TAGGED branches in cgdot for direct
* struct local / *struct deref / top-level-global, plus a new
* N_DOT branch in cgmatch's non-ident-scrutinee spill with the
* scratch sized by the resolved scrutinee type.
*
* Coverage — three variant shapes (16B i64, 24B str, 32B slice) read
* from a direct local struct, a *struct param, and a top-level global,
* plus a let-init round-trip that exercises rhstaggedabicall's N_DOT
* acceptance. The non-tagged str/slice/scalar rows pin that the new
* TY_TAGGED branch doesn't shadow the existing field-load paths.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
struct row { const char *label; const char *src; int want; };
static const struct row rows[] = {
/* 16B slot, scalar payload, direct local struct. ev = (i64 | i32)
* puts i64 at variant 0 so h.e = 42i64 sets tag = 0 and word0 =
* 42. match on h.e in the i64 arm reads the value. Pre-#28
* cgdot dropped DX; the match-spill stored a stale DX and the
* bind returned garbage. Now returns 42. */
{ "local_struct_i64_variant",
"type ev = (i64 | i32);\n"
"type holder = struct { e: ev, mark: i32 };\n"
"fn main() i32 = {\n"
" let h: holder;\n"
" h.mark = 99;\n"
" h.e = 42i64;\n"
" match (h.e) {\n"
" case let v: i64 => { return v: i32; };\n"
" case let z: i32 => { return -1; };\n"
" };\n"
"};\n",
42 },
/* 24B slot, str payload, direct local struct. ev = (i32 | str)
* — str at variant 1. Reading h.e must leave AX=tag, DX=ptr,
* CX=len for the match dispatch+bind to copy 16B (ptr,len)
* into v. Returns v.len = 5. */
{ "local_struct_str_variant",
"type ev = (i32 | str);\n"
"type holder = struct { e: ev, mark: i32 };\n"
"fn main() i32 = {\n"
" let h: holder;\n"
" h.mark = 99;\n"
" h.e = (\"hello\": ev);\n"
" match (h.e) {\n"
" case let s: str => { return s.len: i32; };\n"
" case let z: i32 => { return -1; };\n"
" };\n"
"};\n",
5 },
/* 32B slot, slice payload, direct local struct. ev = (i32 | []u8)
* — slice at variant 1, slot 8 + 24 = 32B. Reading h.e must
* leave AX=tag, DX=ptr, CX=len, R8=cap; pre-#28 R8 was never
* loaded. The match scratch must also be sized to 32B, or the
* R8 spill writes past the allocated slot. The arm verifies
* v.cap (which traces back through R8/spill+24) — testing only
* v.len wouldn't notice an R8 drop because v.len comes from CX
* which was already loaded pre-#28. */
{ "local_struct_slice_variant",
"type ev = (i32 | []u8);\n"
"type holder = struct { e: ev, mark: i32 };\n"
"fn main() i32 = {\n"
" let raw: [8]u8;\n"
" raw[0] = 1u8; raw[1] = 2u8; raw[2] = 3u8;\n"
" let h: holder;\n"
" h.mark = 99;\n"
" h.e = (raw[0:3]: ev);\n"
" match (h.e) {\n"
" case let v: []u8 => {\n"
" if (v.cap != 3) { return 1; };\n"
" return v.len: i32;\n"
" };\n"
" case let z: i32 => { return -1; };\n"
" };\n"
"};\n",
3 },
/* *struct base, 16B slot, scalar payload — exercises the via_ptr
* arm of cstage's TY_PTR N_DOT branch (newly added in #28) and
* the wwstage TPTR cgdot branch's tagged handler. The match
* spill path through cgmatch's N_DOT fallback also fires here
* (h: *holder makes `match (h.e)` not an ident scrutinee). */
{ "via_ptr_i64_variant",
"type ev = (i64 | i32);\n"
"type holder = struct { e: ev, mark: i32 };\n"
"fn f(h: *holder) i32 = {\n"
" match (h.e) {\n"
" case let v: i64 => { return v: i32; };\n"
" case let z: i32 => { return -1; };\n"
" };\n"
"};\n"
"fn main() i32 = {\n"
" let h: holder;\n"
" h.mark = 99;\n"
" h.e = 42i64;\n"
" return f(&h);\n"
"};\n",
42 },
/* *struct base, 24B slot, str payload — verifies CX is loaded for
* the via_ptr path. */
{ "via_ptr_str_variant",
"type ev = (i32 | str);\n"
"type holder = struct { e: ev, mark: i32 };\n"
"fn f(h: *holder) i32 = {\n"
" match (h.e) {\n"
" case let s: str => { return s.len: i32; };\n"
" case let z: i32 => { return -1; };\n"
" };\n"
"};\n"
"fn main() i32 = {\n"
" let h: holder;\n"
" h.mark = 99;\n"
" h.e = (\"hello\": ev);\n"
" return f(&h);\n"
"};\n",
5 },
/* *struct base, 32B slot, slice payload — exercises R8 (cap) load
* in cstage's via_ptr TY_TAGGED branch and the wwstage cgdot
* via_ptr cgloadtaggedfield slice case. The cstage N_DOT-scrutinee
* spill in N_MATCH (the inner else when bu->kind != TY_STRUCT)
* also has to store R8 to spill+24; without it v.cap reads stack
* garbage. v.cap is verified in the arm — testing only v.len would
* mask an R8 drop. */
{ "via_ptr_slice_variant",
"type ev = (i32 | []u8);\n"
"type holder = struct { e: ev, mark: i32 };\n"
"fn f(h: *holder) i32 = {\n"
" match (h.e) {\n"
" case let v: []u8 => {\n"
" if (v.cap != 3) { return 1; };\n"
" return v.len: i32;\n"
" };\n"
" case let z: i32 => { return -1; };\n"
" };\n"
"};\n"
"fn main() i32 = {\n"
" let raw: [8]u8;\n"
" raw[0] = 1u8; raw[1] = 2u8; raw[2] = 3u8;\n"
" let h: holder;\n"
" h.mark = 99;\n"
" h.e = (raw[0:3]: ev);\n"
" return f(&h);\n"
"};\n",
3 },
/* let-init round-trip, 16B slot — `let copy = h.e` exercises the
* cgwidentaggedstore tagged-source path. Without rhstaggedabicall
* recognising N_DOT, src would have fallen into the scalar
* branch and only AX (the tag) would have been spilled into
* copy's slot. Variant order matters for the write side too —
* (i64 | i32) makes i64 = variant 0 so the write side picks the
* right tag for the literal i64. */
{ "letinit_roundtrip",
"type ev = (i64 | i32);\n"
"type holder = struct { e: ev, mark: i32 };\n"
"fn main() i32 = {\n"
" let h: holder;\n"
" h.mark = 99;\n"
" h.e = 42i64;\n"
" let copy: ev = h.e;\n"
" match (copy) {\n"
" case let v: i64 => { return v: i32; };\n"
" case let z: i32 => { return -1; };\n"
" };\n"
"};\n",
42 },
/* let-init round-trip, 32B slice slot — the only test row that
* actually fires cstage's direct-local cgdot TY_TAGGED branch on
* the 32B path (rows 1-3's `match (h.e)` is bypassed by cstage's
* N_DOT-in-N_IDENT specialization, which reads tag/value directly
* from h's stack slot without invoking cgdot). The let-init forces
* cgexpr → cgdot → AX/DX/CX/R8 register shape; cgwidentaggedstore
* then spills all four into copy's slot. Without the R8 load in
* cgdot, copy.cap is whatever R8 held going in. */
{ "letinit_slice_roundtrip",
"type ev = (i32 | []u8);\n"
"type holder = struct { e: ev, mark: i32 };\n"
"fn main() i32 = {\n"
" let raw: [8]u8;\n"
" raw[0] = 1u8; raw[1] = 2u8; raw[2] = 3u8;\n"
" let h: holder;\n"
" h.mark = 99;\n"
" h.e = (raw[0:3]: ev);\n"
" let copy: ev = h.e;\n"
" match (copy) {\n"
" case let v: []u8 => {\n"
" if (v.cap != 3) { return 1; };\n"
" return v.len: i32;\n"
" };\n"
" case let z: i32 => { return -1; };\n"
" };\n"
"};\n",
3 },
/* Top-level global with slice-variant tagged field — exercises
* wwstage cgdot's third new TY_TAGGED branch (top-level global,
* base reg = CX via LEAQ name(SB)) and cstage's direct-struct
* tagged branch with base_reg = CX (the same R8 load with global
* rooting). The let-init copy fires cgdot on g.e in expression
* context — `match (g.e)` directly doesn't address globals in
* cstage's N_DOT-in-N_IDENT match specialization. The write side
* routes through `*p` because the direct global LHS path
* `g.e = (slice: ev)` is a separate pre-existing wwstage gap
* (filed as a follow-up); isolating the read keeps #28's coverage
* intent clean. */
{ "top_level_global_slice",
"type ev = (i32 | []u8);\n"
"type holder = struct { e: ev, mark: i32 };\n"
"let g: holder;\n"
"fn main() i32 = {\n"
" let raw: [8]u8;\n"
" raw[0] = 1u8; raw[1] = 2u8; raw[2] = 3u8;\n"
" let p: *holder = &g;\n"
" p.mark = 99;\n"
" p.e = (raw[0:3]: ev);\n"
" let copy: ev = g.e;\n"
" match (copy) {\n"
" case let v: []u8 => {\n"
" if (v.cap != 3) { return 1; };\n"
" return v.len: i32;\n"
" };\n"
" case let z: i32 => { return -1; };\n"
" };\n"
"};\n",
3 },
/* Negative control: untagged scalar struct field — pin that the
* new TY_TAGGED branch doesn't fire on plain i32 reads (would
* pollute DX/CX with random struct bytes). Mirror of the
* scalar-field regression rows from earlier read-side tasks. */
{ "untagged_i32_field_regression",
"type holder = struct { a: i32, b: i32, c: i32 };\n"
"fn main() i32 = {\n"
" let h: holder;\n"
" h.a = 10; h.b = 20; h.c = 12;\n"
" return h.a + h.b + h.c;\n"
"};\n",
42 },
/* Negative control: str field, direct local — pin that the
* str-field branch still fires (it sits below the new tagged
* branch in the field-walk; an over-broad istaggedtype guard
* could mask it). Reads len through the existing str-rhs
* convention. */
{ "untagged_str_field_regression",
"type holder = struct { s: str, mark: i32 };\n"
"fn main() i32 = {\n"
" let h: holder;\n"
" h.s = \"hello\";\n"
" return h.s.len: i32;\n"
"};\n",
5 },
/* Negative control: slice field via *struct — verifies the new
* tagged via_ptr branch doesn't intercept slice-field reads,
* which already have a dedicated load path. */
{ "untagged_slice_field_via_ptr_regression",
"type holder = struct { rbuf: []u8, mark: i32 };\n"
"fn f(h: *holder) i32 = { return h.rbuf.len: i32; };\n"
"fn main() i32 = {\n"
" let raw: [8]u8;\n"
" raw[0] = 0u8;\n"
" let h: holder;\n"
" h.rbuf = raw[0:5];\n"
" return f(&h);\n"
"};\n",
5 },
};
static int
run_driver(const char *driver, const struct row *r, int i)
{
char src[64], tmpdir[64], cmd[1024];
snprintf(src, sizeof src, "/tmp/waew_%d_%d.ww", getpid(), i);
snprintf(tmpdir, sizeof tmpdir, "/tmp/waew_%d_d_%d", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
mkdir(tmpdir, 0755);
snprintf(cmd, sizeof cmd, "cd %s && %s build %s",
tmpdir, driver, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: build via %s failed\n",
r->label, driver);
unlink(src); rmdir(tmpdir);
return -1;
}
const char *base = strrchr(src, '/');
base = base ? base + 1 : src;
char outbin[128];
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
char *dot = strrchr(outbin, '.');
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
int got = runwait(outbin);
unlink(src); unlink(outbin); rmdir(tmpdir);
return got;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[1024];
if (bin[0] != '/') {
char cwd[1024];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char cdrv[1024];
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
char wdrv[1024];
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
struct { const char *name; const char *path; int gated_on_existence; }
drivers[] = {
{ "cstage", cdrv, 0 },
{ "wwstage", wdrv, 1 },
{ NULL, NULL, 0 },
};
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int d = 0; drivers[d].name; d++) {
if (drivers[d].gated_on_existence
&& access(drivers[d].path, X_OK) != 0) {
fprintf(stderr, "dot_tagged_source: skip %s (no %s)\n",
drivers[d].name, drivers[d].path);
continue;
}
for (int i = 0; i < n; i++) {
int got = run_driver(drivers[d].path, &rows[i], i);
total++;
if (got != rows[i].want) {
fprintf(stderr,
"dot_tagged_source[%s][%s]: exit=%d want=%d\n",
drivers[d].name, rows[i].label,
got, rows[i].want);
fail++;
}
}
}
if (fail) {
fprintf(stderr,
"dot_tagged_source: %d/%d fixtures failed\n", fail, total);
return 1;
}
printf("dot_tagged_source: %d/%d ok\n", total, total);
return 0;
}