Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cgen: str arr[i].field read -> 3-word -- Phase 2 C4.6 arrfield (both stages)

Browse Source 
A str-typed field read of an INDEXED element (arr[i].f) loaded 2 words (ptr,len), dropping cap -- the last 2-word str VALUE-read in the cluster. At the leaf the element base is always in AX; insert cap->CX at foff+16 (final order len->BX+8, cap->CX+16, ptr->AX+0 LAST). ONE shared leaf covers value-array / slice / pointer-element sub-cases (base-formation differs upstream, unaffected). Author-to-ABI, matched to the proven cgslicehdr(D_AX) / caseB slice-arm shape. Kind-gated (TY_STR / isstrtype, never size==24). cstage==wwstage byte-identical at the leaf.

test/wcc/936: table-driven runtime .cap-survives over [N]S-local / []S-local / [N]*S-pointer-elem reads; a 2-word read cannot coincidentally pass (the index scale-multiply clobbers CX, plus an interposed call). fail-before/pass-after verified independently on both drivers.

main.combined.ww regenerated via the canonical make path (md5-stable). Completes the str 3-word VALUE-read cluster (F2 element; C4.6/caseB/S3 fields; arrfield indexed-field). Store-side cap-drop and a struct-slice-creation divergence are separately filed.
This commit is contained in:
Hojun-Cho
2026-05-24 14:57:05 +09:00
parent 877a1af6d3
commit c3bbe17163
6 changed files with 277 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Makefile
View File

@@ -258,6 +258,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
$(BIN)/test_str_field_cap_run \
$(BIN)/test_str_chained_field_cap_run \
$(BIN)/test_str_tuple_elem_cap_run \
$(BIN)/test_str_arrfield_cap_run \
$(BIN)/test_composite_call_arg \
$(BIN)/test_composite_call_arg_run \
$(BIN)/test_letdecl_zeroinit \
@@ -648,6 +649,12 @@ $(BIN)/test_str_tuple_elem_cap_run: test/wcc/935_str_tuple_elem_cap_run.c \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
$(BIN)/test_str_arrfield_cap_run: test/wcc/936_str_arrfield_cap_run.c \
$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
$(BIN)/test_composite_call_arg: test/wcc/723_composite_call_arg.c \
$(BIN)/w6c $(BIN)/w6c_ww | $(BIN)
$(CC) $(CFLAGS) -o $@ $<

9
cmd/w6c/cgen.c
View File

@@ -6169,9 +6169,18 @@ cgexpr(Cg *c, Node *n, Local *locals)
Type *fu = (ft && ft->kind == TY_NAMED)
? ft->under : ft;
if (fu && fu->kind == TY_STR) {
/* str IS the 3-word {ptr,len,cap}
* slice header (#1). AX holds the
* element base, so load .ptr (which
* targets AX) LAST. Matches the
* caseB *struct slice arm and
* cgslicehdr(D_AX). */
ins2(c, A_MOVQ,
amem(D_AX, foff + 8),
areg(D_BX));
ins2(c, A_MOVQ,
amem(D_AX, foff + 16),
areg(D_CX));
ins2(c, A_MOVQ,
amem(D_AX, foff + 0),
areg(D_AX));

9
selfhost/cmd/w6c/main.combined.ww
View File

@@ -15606,10 +15606,19 @@ fn cgdot(c: *cgen, n: *node) void = {
emitline("\tMOVQ\tBX, AX\n");
};
if (isstrtype(c, fi.tnode)) {
// str IS the 3-word {ptr,len,cap}
// slice header (#1). AX holds the
// element base, so load .ptr (which
// targets AX) LAST. Matches the
// caseB *struct slice arm and
// cgslicehdr(D_AX).
emitline("\tMOVQ\t");
emitdispreg((fi.foff + 8): i64, "AX");
emitline(", BX\n");
emitline("\tMOVQ\t");
emitdispreg((fi.foff + 16): i64, "AX");
emitline(", CX\n");
emitline("\tMOVQ\t");
emitdispreg(fi.foff: i64, "AX");
emitline(", AX\n");
return;

9
selfhost/cmd/wcc/cgenexpr.ww
View File

@@ -1778,10 +1778,19 @@ fn cgdot(c: *cgen, n: *node) void = {
emitline("\tMOVQ\tBX, AX\n");
};
if (isstrtype(c, fi.tnode)) {
// str IS the 3-word {ptr,len,cap}
// slice header (#1). AX holds the
// element base, so load .ptr (which
// targets AX) LAST. Matches the
// caseB *struct slice arm and
// cgslicehdr(D_AX).
emitline("\tMOVQ\t");
emitdispreg((fi.foff + 8): i64, "AX");
emitline(", BX\n");
emitline("\tMOVQ\t");
emitdispreg((fi.foff + 16): i64, "AX");
emitline(", CX\n");
emitline("\tMOVQ\t");
emitdispreg(fi.foff: i64, "AX");
emitline(", AX\n");
return;

9
selfhost/cmd/wwdump/main.combined.ww
View File

@@ -15606,10 +15606,19 @@ fn cgdot(c: *cgen, n: *node) void = {
emitline("\tMOVQ\tBX, AX\n");
};
if (isstrtype(c, fi.tnode)) {
// str IS the 3-word {ptr,len,cap}
// slice header (#1). AX holds the
// element base, so load .ptr (which
// targets AX) LAST. Matches the
// caseB *struct slice arm and
// cgslicehdr(D_AX).
emitline("\tMOVQ\t");
emitdispreg((fi.foff + 8): i64, "AX");
emitline(", BX\n");
emitline("\tMOVQ\t");
emitdispreg((fi.foff + 16): i64, "AX");
emitline(", CX\n");
emitline("\tMOVQ\t");
emitdispreg(fi.foff: i64, "AX");
emitline(", AX\n");
return;

234
test/wcc/936_str_arrfield_cap_run.c Normal file
View File

@@ -0,0 +1,234 @@
/*
* 936_str_arrfield_cap_run — runtime coverage for the C4.6-arrfield fold: a
* str-typed FIELD of an INDEXED element `arr[i].f` (N_INDEX-rooted N_DOT) must
* load the full 24B {ptr,len,cap} header, not just {ptr,len}. str is 24B since
* Phase 2 (#1); pre-arrfield the `arr[i].f` str arm loaded 2 words (len in BX,
* ptr in AX) and dropped cap.
*
* This is the LAST member of the 3-word-value-read cluster. UNLIKE the other
* C4.6 arms there is no adjacent slice-element sibling at this leaf, so the
* 3-word triple is authored directly to the canonical slice-header ABI. By the
* leaf the element base is in AX, so the order is len->BX(foff+8),
* cap->CX(foff+16), ptr->AX(foff+0) LAST — matching the proven in-tree oracle
* cgslicehdr(D_AX) and the caseB chained-*struct slice arm. Sites: cgen.c's
* "arr[i].field" branch (N_DOT, N_INDEX lhs) and the cgenexpr.ww cgdot twin.
*
* The byte-id gates (990-997) can't catch a symmetric 2-word miscompile: if
* both stages drop cap identically, byte-id passes silently. So this pins the
* *runtime* contract — build through both the cstage `ww` and wwstage `ww_ww`
* driver and confirm the assertion holds (exit 0).
*
* Sub-cases (one leaf covers all; the differences — LEAQ vs MOVQ base, the
* pointer-element deref — are upstream of the leaf):
* A [N]S local array : `arr[i].f` (LEAQ base, value element).
* B []S local slice : `sl[i].f` (MOVQ slice.ptr base, value element).
* D [N]*S pointer-elem : `arr[i].f` (LEAQ base, MOVQ deref to the *S).
*
* POISONING: the store side of `arr[i].f = v` and whole-struct `arr[i] = st`
* are SEPARATE, still-broken store-side gaps (filed; out of scope for this
* read-side fold — they store only 1-2 words and drop cap). So the value
* elements (A, B) are poisoned through `&arr[i]` + a *struct field write
* (`let pr: *rec = &arr[i]; pr.f = p;` — both the &arr[i] index-address and
* the chained pointer-field store are landed/working), which lands a real
* cap into the element's +16 word. D points its element at a separately-built
* struct (`st.f = p`, the proven s1local 3-word field store).
*
* DISCRIMINATION (heed the 933/934/935 lesson): a 2-word read leaves CX
* holding whatever the index scale-multiply (`MOVQ $esz, CX; IMULQ`) left
* there, never the poison. spoil() additionally interposes a CX-clobbering
* call between the build and the `arr[i].f` read, so a broken 2-word read
* observes spoil's leftover (44), never the poison cap. Verified fail-before
* (stashed the +16 cap load: all rows exit 1 on both drivers) / pass-after
* (exit 0), both drivers.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
struct row { const char *label; const char *src; int want; };
static const struct row rows[] = {
/* A — `arr[i].f` value element of a [N]S local array (LEAQ base).
* Poison cap=8 (len=2) via &arr[1] + a *struct field store. spoil()
* clobbers CX between the build and the read so a broken 2-word read
* cannot coincidentally pass on a stale CX. */
{ "arrfield_array_value",
"type rec = struct { f: str };\n"
"fn spoil() i32 = {\n"
" let z: str = \"zzzz\";\n"
" z.cap = 44i32;\n"
" let w: str = z;\n"
" return w.cap: i32;\n"
"};\n"
"export fn main() i32 = {\n"
" let p: str = \"hi\";\n"
" p.cap = 8i32;\n"
" let arr: [3]rec;\n"
" let pr: *rec = &arr[1];\n"
" pr.f = p;\n"
" let junk: i32 = spoil();\n"
" let s: str = arr[1].f;\n"
" if (s.cap: i32 != 8) { return 1; };\n"
" if (s.len: i32 != 2) { return 2; };\n"
" if (junk != 44) { return 3; };\n"
" return 0;\n"
"};\n",
0 },
/* B — `sl[i].f` value element of a []S local slice (MOVQ slice.ptr
* base). The slice views the same poisoned backing array. Poison
* cap=9 (len=5). */
{ "arrfield_slice_value",
"type rec = struct { f: str };\n"
"fn spoil() i32 = {\n"
" let z: str = \"zzzz\";\n"
" z.cap = 44i32;\n"
" let w: str = z;\n"
" return w.cap: i32;\n"
"};\n"
"export fn main() i32 = {\n"
" let p: str = \"world\";\n"
" p.cap = 9i32;\n"
" let arr: [3]rec;\n"
" let pr: *rec = &arr[1];\n"
" pr.f = p;\n"
" let sl: []rec = arr[0:3];\n"
" let junk: i32 = spoil();\n"
" let s: str = sl[1].f;\n"
" if (s.cap: i32 != 9) { return 1; };\n"
" if (s.len: i32 != 5) { return 2; };\n"
" if (junk != 44) { return 3; };\n"
" return 0;\n"
"};\n",
0 },
/* D — `arr[i].f` pointer element of a [N]*S array (LEAQ base, MOVQ
* deref to the *S, then the leaf field load). The element points at
* a separately-built struct so the poison rides the proven s1local
* 3-word field store, not the broken array-element store. Poison
* cap=7 (len=3). */
{ "arrfield_ptr_elem",
"type rec = struct { f: str };\n"
"fn spoil() i32 = {\n"
" let z: str = \"zzzz\";\n"
" z.cap = 44i32;\n"
" let w: str = z;\n"
" return w.cap: i32;\n"
"};\n"
"export fn main() i32 = {\n"
" let p: str = \"abc\";\n"
" p.cap = 7i32;\n"
" let st: rec;\n"
" st.f = p;\n"
" let arr: [3]*rec;\n"
" arr[1] = &st;\n"
" let junk: i32 = spoil();\n"
" let s: str = arr[1].f;\n"
" if (s.cap: i32 != 7) { return 1; };\n"
" if (s.len: i32 != 3) { return 2; };\n"
" if (junk != 44) { return 3; };\n"
" return 0;\n"
"};\n",
0 },
};
static int
run_driver(const char *driver, const struct row *r, int i)
{
char src[96], tmpdir[96], cmd[1024];
snprintf(src, sizeof src, "/tmp/strarrfieldcap_%d_%d.ww", getpid(), i);
snprintf(tmpdir, sizeof tmpdir, "/tmp/strarrfieldcap_%d_d_%d", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
mkdir(tmpdir, 0755);
snprintf(cmd, sizeof cmd, "cd %s && %s build %s",
tmpdir, driver, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: build via %s failed\n",
r->label, driver);
unlink(src); rmdir(tmpdir);
return -1;
}
const char *base = strrchr(src, '/');
base = base ? base + 1 : src;
char outbin[160];
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
char *dot = strrchr(outbin, '.');
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
int got = runwait(outbin);
unlink(src); unlink(outbin); rmdir(tmpdir);
return got;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[512];
if (bin[0] != '/') {
char cwd[256];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char cdrv[640];
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
char wdrv[640];
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
struct { const char *name; const char *path; int gated_on_existence; }
drivers[] = {
{ "cstage", cdrv, 0 },
{ "wwstage", wdrv, 1 },
{ NULL, NULL, 0 },
};
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int d = 0; drivers[d].name; d++) {
if (drivers[d].gated_on_existence
&& access(drivers[d].path, X_OK) != 0) {
fprintf(stderr,
"str_arrfield_cap_run: skip %s (no %s)\n",
drivers[d].name, drivers[d].path);
continue;
}
for (int i = 0; i < n; i++) {
int got = run_driver(drivers[d].path, &rows[i], i);
total++;
if (got != rows[i].want) {
fprintf(stderr,
"str_arrfield_cap_run[%s][%s]: exit=%d want=%d\n",
drivers[d].name, rows[i].label,
got, rows[i].want);
fail++;
}
}
}
if (fail) {
fprintf(stderr, "str_arrfield_cap_run: %d/%d fixtures failed\n",
fail, total);
return 1;
}
printf("str_arrfield_cap_run: %d/%d ok\n", total, total);
return 0;
}