diff --git a/Makefile b/Makefile index fa509fae..f0224416 100644 --- a/Makefile +++ b/Makefile @@ -258,6 +258,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_str_field_cap_run \ $(BIN)/test_str_chained_field_cap_run \ $(BIN)/test_str_tuple_elem_cap_run \ + $(BIN)/test_str_arrfield_cap_run \ $(BIN)/test_composite_call_arg \ $(BIN)/test_composite_call_arg_run \ $(BIN)/test_letdecl_zeroinit \ @@ -648,6 +649,12 @@ $(BIN)/test_str_tuple_elem_cap_run: test/wcc/935_str_tuple_elem_cap_run.c \ $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +$(BIN)/test_str_arrfield_cap_run: test/wcc/936_str_arrfield_cap_run.c \ + $(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + $(BIN)/test_composite_call_arg: test/wcc/723_composite_call_arg.c \ $(BIN)/w6c $(BIN)/w6c_ww | $(BIN) $(CC) $(CFLAGS) -o $@ $< diff --git a/cmd/w6c/cgen.c b/cmd/w6c/cgen.c index f7a6a0ad..49210065 100644 --- a/cmd/w6c/cgen.c +++ b/cmd/w6c/cgen.c @@ -6169,9 +6169,18 @@ cgexpr(Cg *c, Node *n, Local *locals) Type *fu = (ft && ft->kind == TY_NAMED) ? ft->under : ft; if (fu && fu->kind == TY_STR) { + /* str IS the 3-word {ptr,len,cap} + * slice header (#1). AX holds the + * element base, so load .ptr (which + * targets AX) LAST. Matches the + * caseB *struct slice arm and + * cgslicehdr(D_AX). */ ins2(c, A_MOVQ, amem(D_AX, foff + 8), areg(D_BX)); + ins2(c, A_MOVQ, + amem(D_AX, foff + 16), + areg(D_CX)); ins2(c, A_MOVQ, amem(D_AX, foff + 0), areg(D_AX)); diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index 777eb36f..af30d250 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -15606,10 +15606,19 @@ fn cgdot(c: *cgen, n: *node) void = { emitline("\tMOVQ\tBX, AX\n"); }; if (isstrtype(c, fi.tnode)) { + // str IS the 3-word {ptr,len,cap} + // slice header (#1). AX holds the + // element base, so load .ptr (which + // targets AX) LAST. Matches the + // caseB *struct slice arm and + // cgslicehdr(D_AX). emitline("\tMOVQ\t"); emitdispreg((fi.foff + 8): i64, "AX"); emitline(", BX\n"); emitline("\tMOVQ\t"); + emitdispreg((fi.foff + 16): i64, "AX"); + emitline(", CX\n"); + emitline("\tMOVQ\t"); emitdispreg(fi.foff: i64, "AX"); emitline(", AX\n"); return; diff --git a/selfhost/cmd/wcc/cgenexpr.ww b/selfhost/cmd/wcc/cgenexpr.ww index 2a11c9c4..85c3d615 100644 --- a/selfhost/cmd/wcc/cgenexpr.ww +++ b/selfhost/cmd/wcc/cgenexpr.ww @@ -1778,10 +1778,19 @@ fn cgdot(c: *cgen, n: *node) void = { emitline("\tMOVQ\tBX, AX\n"); }; if (isstrtype(c, fi.tnode)) { + // str IS the 3-word {ptr,len,cap} + // slice header (#1). AX holds the + // element base, so load .ptr (which + // targets AX) LAST. Matches the + // caseB *struct slice arm and + // cgslicehdr(D_AX). emitline("\tMOVQ\t"); emitdispreg((fi.foff + 8): i64, "AX"); emitline(", BX\n"); emitline("\tMOVQ\t"); + emitdispreg((fi.foff + 16): i64, "AX"); + emitline(", CX\n"); + emitline("\tMOVQ\t"); emitdispreg(fi.foff: i64, "AX"); emitline(", AX\n"); return; diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index 9575c45c..e3b19abe 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -15606,10 +15606,19 @@ fn cgdot(c: *cgen, n: *node) void = { emitline("\tMOVQ\tBX, AX\n"); }; if (isstrtype(c, fi.tnode)) { + // str IS the 3-word {ptr,len,cap} + // slice header (#1). AX holds the + // element base, so load .ptr (which + // targets AX) LAST. Matches the + // caseB *struct slice arm and + // cgslicehdr(D_AX). emitline("\tMOVQ\t"); emitdispreg((fi.foff + 8): i64, "AX"); emitline(", BX\n"); emitline("\tMOVQ\t"); + emitdispreg((fi.foff + 16): i64, "AX"); + emitline(", CX\n"); + emitline("\tMOVQ\t"); emitdispreg(fi.foff: i64, "AX"); emitline(", AX\n"); return; diff --git a/test/wcc/936_str_arrfield_cap_run.c b/test/wcc/936_str_arrfield_cap_run.c new file mode 100644 index 00000000..75c6790d --- /dev/null +++ b/test/wcc/936_str_arrfield_cap_run.c @@ -0,0 +1,234 @@ +/* + * 936_str_arrfield_cap_run — runtime coverage for the C4.6-arrfield fold: a + * str-typed FIELD of an INDEXED element `arr[i].f` (N_INDEX-rooted N_DOT) must + * load the full 24B {ptr,len,cap} header, not just {ptr,len}. str is 24B since + * Phase 2 (#1); pre-arrfield the `arr[i].f` str arm loaded 2 words (len in BX, + * ptr in AX) and dropped cap. + * + * This is the LAST member of the 3-word-value-read cluster. UNLIKE the other + * C4.6 arms there is no adjacent slice-element sibling at this leaf, so the + * 3-word triple is authored directly to the canonical slice-header ABI. By the + * leaf the element base is in AX, so the order is len->BX(foff+8), + * cap->CX(foff+16), ptr->AX(foff+0) LAST — matching the proven in-tree oracle + * cgslicehdr(D_AX) and the caseB chained-*struct slice arm. Sites: cgen.c's + * "arr[i].field" branch (N_DOT, N_INDEX lhs) and the cgenexpr.ww cgdot twin. + * + * The byte-id gates (990-997) can't catch a symmetric 2-word miscompile: if + * both stages drop cap identically, byte-id passes silently. So this pins the + * *runtime* contract — build through both the cstage `ww` and wwstage `ww_ww` + * driver and confirm the assertion holds (exit 0). + * + * Sub-cases (one leaf covers all; the differences — LEAQ vs MOVQ base, the + * pointer-element deref — are upstream of the leaf): + * A [N]S local array : `arr[i].f` (LEAQ base, value element). + * B []S local slice : `sl[i].f` (MOVQ slice.ptr base, value element). + * D [N]*S pointer-elem : `arr[i].f` (LEAQ base, MOVQ deref to the *S). + * + * POISONING: the store side of `arr[i].f = v` and whole-struct `arr[i] = st` + * are SEPARATE, still-broken store-side gaps (filed; out of scope for this + * read-side fold — they store only 1-2 words and drop cap). So the value + * elements (A, B) are poisoned through `&arr[i]` + a *struct field write + * (`let pr: *rec = &arr[i]; pr.f = p;` — both the &arr[i] index-address and + * the chained pointer-field store are landed/working), which lands a real + * cap into the element's +16 word. D points its element at a separately-built + * struct (`st.f = p`, the proven s1local 3-word field store). + * + * DISCRIMINATION (heed the 933/934/935 lesson): a 2-word read leaves CX + * holding whatever the index scale-multiply (`MOVQ $esz, CX; IMULQ`) left + * there, never the poison. spoil() additionally interposes a CX-clobbering + * call between the build and the `arr[i].f` read, so a broken 2-word read + * observes spoil's leftover (44), never the poison cap. Verified fail-before + * (stashed the +16 cap load: all rows exit 1 on both drivers) / pass-after + * (exit 0), both drivers. + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { const char *label; const char *src; int want; }; + +static const struct row rows[] = { + /* A — `arr[i].f` value element of a [N]S local array (LEAQ base). + * Poison cap=8 (len=2) via &arr[1] + a *struct field store. spoil() + * clobbers CX between the build and the read so a broken 2-word read + * cannot coincidentally pass on a stale CX. */ + { "arrfield_array_value", + "type rec = struct { f: str };\n" + "fn spoil() i32 = {\n" + " let z: str = \"zzzz\";\n" + " z.cap = 44i32;\n" + " let w: str = z;\n" + " return w.cap: i32;\n" + "};\n" + "export fn main() i32 = {\n" + " let p: str = \"hi\";\n" + " p.cap = 8i32;\n" + " let arr: [3]rec;\n" + " let pr: *rec = &arr[1];\n" + " pr.f = p;\n" + " let junk: i32 = spoil();\n" + " let s: str = arr[1].f;\n" + " if (s.cap: i32 != 8) { return 1; };\n" + " if (s.len: i32 != 2) { return 2; };\n" + " if (junk != 44) { return 3; };\n" + " return 0;\n" + "};\n", + 0 }, + /* B — `sl[i].f` value element of a []S local slice (MOVQ slice.ptr + * base). The slice views the same poisoned backing array. Poison + * cap=9 (len=5). */ + { "arrfield_slice_value", + "type rec = struct { f: str };\n" + "fn spoil() i32 = {\n" + " let z: str = \"zzzz\";\n" + " z.cap = 44i32;\n" + " let w: str = z;\n" + " return w.cap: i32;\n" + "};\n" + "export fn main() i32 = {\n" + " let p: str = \"world\";\n" + " p.cap = 9i32;\n" + " let arr: [3]rec;\n" + " let pr: *rec = &arr[1];\n" + " pr.f = p;\n" + " let sl: []rec = arr[0:3];\n" + " let junk: i32 = spoil();\n" + " let s: str = sl[1].f;\n" + " if (s.cap: i32 != 9) { return 1; };\n" + " if (s.len: i32 != 5) { return 2; };\n" + " if (junk != 44) { return 3; };\n" + " return 0;\n" + "};\n", + 0 }, + /* D — `arr[i].f` pointer element of a [N]*S array (LEAQ base, MOVQ + * deref to the *S, then the leaf field load). The element points at + * a separately-built struct so the poison rides the proven s1local + * 3-word field store, not the broken array-element store. Poison + * cap=7 (len=3). */ + { "arrfield_ptr_elem", + "type rec = struct { f: str };\n" + "fn spoil() i32 = {\n" + " let z: str = \"zzzz\";\n" + " z.cap = 44i32;\n" + " let w: str = z;\n" + " return w.cap: i32;\n" + "};\n" + "export fn main() i32 = {\n" + " let p: str = \"abc\";\n" + " p.cap = 7i32;\n" + " let st: rec;\n" + " st.f = p;\n" + " let arr: [3]*rec;\n" + " arr[1] = &st;\n" + " let junk: i32 = spoil();\n" + " let s: str = arr[1].f;\n" + " if (s.cap: i32 != 7) { return 1; };\n" + " if (s.len: i32 != 3) { return 2; };\n" + " if (junk != 44) { return 3; };\n" + " return 0;\n" + "};\n", + 0 }, +}; + +static int +run_driver(const char *driver, const struct row *r, int i) +{ + char src[96], tmpdir[96], cmd[1024]; + snprintf(src, sizeof src, "/tmp/strarrfieldcap_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/strarrfieldcap_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -1; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s", + tmpdir, driver, src); + if (runwait(cmd) != 0) { + fprintf(stderr, "row[%s]: build via %s failed\n", + r->label, driver); + unlink(src); rmdir(tmpdir); + return -1; + } + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[160]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + int got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return got; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[512]; + if (bin[0] != '/') { + char cwd[256]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[640]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + char wdrv[640]; + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *path; int gated_on_existence; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated_on_existence + && access(drivers[d].path, X_OK) != 0) { + fprintf(stderr, + "str_arrfield_cap_run: skip %s (no %s)\n", + drivers[d].name, drivers[d].path); + continue; + } + for (int i = 0; i < n; i++) { + int got = run_driver(drivers[d].path, &rows[i], i); + total++; + if (got != rows[i].want) { + fprintf(stderr, + "str_arrfield_cap_run[%s][%s]: exit=%d want=%d\n", + drivers[d].name, rows[i].label, + got, rows[i].want); + fail++; + } + } + } + + if (fail) { + fprintf(stderr, "str_arrfield_cap_run: %d/%d fixtures failed\n", + fail, total); + return 1; + } + printf("str_arrfield_cap_run: %d/%d ok\n", total, total); + return 0; +}