cstage+selfhost+test: fix (*p).f silent drop in N_DOT lhs (read+write)

Pre-existing landmine surfaced by #5 (whole-STRUCT N_ASSIGN). Both
stages' N_DOT dispatch gated on `lhs->lhs->kind == N_IDENT`; the
parser produces N_UN(STAR, IDENT(p)) for `(*p).f`, so both sides fell
off:
  - Write side (cgassign N_DOT base): emitted nothing, store dropped.
  - Read side (case N_DOT pointer-auto-deref): cgexpr derefed the
    pointer as a scalar, AX = first qword of struct, field offset
    dropped.

Fix: retarget base / dot_lhs to the inner IDENT when shape is
N_UN(STAR, IDENT). The existing via_ptr branch fires identically to
`p.f`. v1 scope is bare-IDENT inner only; `(*expr).f` (non-IDENT
pointer expression) is tracked separately as task #19.

702 covers 7 rows: write_i64/i32/str, read_i64/i32/str_len, roundtrip
This commit is contained in:
2026-05-15 18:13:02 +09:00
parent f24fc113a7
commit c4347499ee
6 changed files with 456 additions and 21 deletions

View File

@@ -0,0 +1,297 @@
/*
* 702_dot_explicit_deref — silent miscompile of `(*p).f` (task #16).
*
* Pre-existing landmine surfaced by worker-cgnassign during #5
* (whole-struct N_ASSIGN). Both cstage cgen.c N_ASSIGN N_DOT and
* wwstage cgenexpr.ww cgassign single-dot dispatch gated on
* `n->lhs->lhs->kind == N_IDENT`. The parser produces N_UN(STAR,
* IDENT(p)) for `(*p).f`, so the store fell off the dispatch and
* silently emitted nothing. Read-side N_DOT had the same gap —
* the pointer-auto-deref load branch required N_IDENT and fell
* through to cgexpr on the N_UN, which derefs the pointer as a
* scalar (load 8B from p into AX, then the field part is dropped).
*
* Not exercised by current selfhost source (auto-deref `p.f` was
* used throughout) so 995_self_rebuild didn't catch it. Latent for
* any future user code that types out the explicit deref.
*
* The fix in both stages is a base/lhs retarget: when the parser
* shape is N_UN(STAR, IDENT(p)), substitute the inner IDENT so
* the existing via_ptr / pointer-auto-deref branch fires the same
* as `p.f`. v1 scope is bare-IDENT inner only; `(*expr).f` with a
* non-IDENT pointer expression (`(*arr[i]).f`, `(*g.p).f`) still
* drops silently, tracked as a follow-up — needs cgexpr(inner) →
* reg + RHS-spill scheduling, which is a different design.
*
* Each row pins:
* - cstage value correctness (process exit code).
* - wwstage value correctness (when ww_ww exists).
* - cstage vs wwstage byte-identical .s output (catches drift).
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
struct row { const char *label; const char *src; int want; };
static const struct row rows[] = {
/* Write side, scalar i64 field via explicit deref.
* Pre-fix: cgassign single-dot dispatch fell off (base.kind
* was N_UN, not N_IDENT) and emitted no store. f stayed 0. */
{ "write_i64",
"type pt = struct { x: i64, y: i64 };\n"
"fn main() i32 = {\n"
" let s: pt = pt { x = 0i64, y = 0i64 };\n"
" let p: *pt = &s;\n"
" (*p).x = 7i64;\n"
" (*p).y = 35i64;\n"
" return (s.x + s.y): i32;\n"
"};\n",
42 },
/* Write side, narrow i32 field. Pins fldstoreop sizing on
* the via_ptr path — MOVL not MOVQ (which would stomp 4 bytes
* past the field). */
{ "write_i32",
"type box = struct { a: i32, b: i32, c: i32 };\n"
"fn main() i32 = {\n"
" let s: box = box { a = 0, b = 0, c = 0 };\n"
" let p: *box = &s;\n"
" (*p).a = 5;\n"
" (*p).b = 11;\n"
" (*p).c = 19;\n"
" return s.a + s.b + s.c;\n"
"};\n",
35 },
/* Write side, str field. Pins the str-typed field branch in
* the via_ptr path (cgexpr → AX=ptr/BX=len, store both halves
* at +0/+8 — not just AX). Initialiser uses `let v: box;`
* (zero-fill) instead of a struct literal because N_LET
* N_STRUCTLIT silently drops the .len half of a str-typed
* field — a separate pre-existing bug, out of scope here. */
{ "write_str",
"type box = struct { s: str, n: i64 };\n"
"fn main() i32 = {\n"
" let v: box;\n"
" let p: *box = &v;\n"
" (*p).s = \"hi\";\n"
" (*p).n = 40i64;\n"
" return (v.s.len: i64 + v.n): i32;\n"
"};\n",
42 },
/* Read side, scalar i64 field via explicit deref.
* Pre-fix: case N_DOT's pointer-auto-deref branch required
* N_IDENT and fell through to `cgexpr(c, n->lhs, ...)` —
* derefed the pointer as if loading a scalar, so AX held the
* first qword of the struct (s.x = 50). Field offset for .y
* (+8) was dropped → returned 50 instead of 80. */
{ "read_i64",
"type pt = struct { x: i64, y: i64 };\n"
"fn main() i32 = {\n"
" let s: pt = pt { x = 50i64, y = 80i64 };\n"
" let p: *pt = &s;\n"
" return (*p).y: i32;\n"
"};\n",
80 },
/* Read side, narrow i32 field. Pins fldloadop sizing — MOVL
* with sign-extend, not raw MOVQ. */
{ "read_i32",
"type box = struct { a: i32, b: i32, c: i32 };\n"
"fn main() i32 = {\n"
" let s: box = box { a = 1, b = 2, c = 3 };\n"
" let p: *box = &s;\n"
" return (*p).a + (*p).b + (*p).c;\n"
"};\n",
6 },
/* Read side, str field. Pins the str-typed field load path —
* AX=ptr, BX=len. .len is the receive-side check. Initialiser
* uses write-by-field (same str-in-structlit-init bug avoided
* as in write_str). */
{ "read_str_len",
"type box = struct { s: str };\n"
"fn main() i32 = {\n"
" let v: box;\n"
" v.s = \"hello\";\n"
" let p: *box = &v;\n"
" return (*p).s.len: i32;\n"
"};\n",
5 },
/* Mixed: write via (*p).f then read via (*p).f. End-to-end
* round-trip pins both sides agreeing on the same offset and
* width. */
{ "roundtrip",
"type pt = struct { x: i32, y: i32, z: i32 };\n"
"fn main() i32 = {\n"
" let s: pt = pt { x = 0, y = 0, z = 0 };\n"
" let p: *pt = &s;\n"
" (*p).x = 4;\n"
" (*p).y = 7;\n"
" (*p).z = 13;\n"
" return (*p).x + (*p).y + (*p).z;\n"
"};\n",
24 },
};
/* run_driver — compile r->src via the given driver and exec; return
* the process exit code. Mirror of 701's helper. */
static int
run_driver(const char *driver, const struct row *r, int i)
{
char src[64], tmpdir[64], cmd[1024];
snprintf(src, sizeof src, "/tmp/wded_%d_%d.ww", getpid(), i);
snprintf(tmpdir, sizeof tmpdir, "/tmp/wded_%d_d_%d", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
mkdir(tmpdir, 0755);
snprintf(cmd, sizeof cmd, "cd %s && %s build %s",
tmpdir, driver, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: build via %s failed\n",
r->label, driver);
unlink(src); rmdir(tmpdir);
return -1;
}
const char *base = strrchr(src, '/');
base = base ? base + 1 : src;
char outbin[128];
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
char *dot = strrchr(outbin, '.');
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
int got = runwait(outbin);
unlink(src); unlink(outbin); rmdir(tmpdir);
return got;
}
/* asm_byte_identical — generate .s via cstage's w6c and wwstage's
* w6c_ww and diff. Mirror of 701. */
static int
asm_byte_identical(const char *bin, const struct row *r, int i)
{
char src[64], cs[64], ws[64], cmd[1024];
snprintf(src, sizeof src, "/tmp/wded_asm_%d_%d.ww", getpid(), i);
snprintf(cs, sizeof cs, "/tmp/wded_asm_%d_%d_c.s", getpid(), i);
snprintf(ws, sizeof ws, "/tmp/wded_asm_%d_%d_w.s", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
snprintf(cmd, sizeof cmd, "%s/w6c -o %s %s 2>/dev/null", bin, cs, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: w6c errored\n", r->label);
unlink(src);
return -1;
}
snprintf(cmd, sizeof cmd, "%s/w6c_ww -o %s %s 2>/dev/null",
bin, ws, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: w6c_ww errored\n", r->label);
unlink(src); unlink(cs);
return -1;
}
FILE *fc = fopen(cs, "rb");
FILE *fw = fopen(ws, "rb");
int rc = 0;
if (!fc || !fw) {
rc = -1;
} else {
for (;;) {
int a = fgetc(fc);
int b = fgetc(fw);
if (a != b) { rc = -1; break; }
if (a == EOF) break;
}
}
if (fc) fclose(fc);
if (fw) fclose(fw);
if (rc != 0)
fprintf(stderr, "row[%s]: cstage vs wwstage asm differs\n",
r->label);
unlink(src); unlink(cs); unlink(ws);
return rc;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[1024];
if (bin[0] != '/') {
char cwd[1024];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char cdrv[1024];
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
char wdrv[1024];
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
struct { const char *name; const char *path; int gated_on_existence; }
drivers[] = {
{ "cstage", cdrv, 0 },
{ "wwstage", wdrv, 1 },
{ NULL, NULL, 0 },
};
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int d = 0; drivers[d].name; d++) {
if (drivers[d].gated_on_existence
&& access(drivers[d].path, X_OK) != 0) {
fprintf(stderr, "dot_explicit_deref: skip %s (no %s)\n",
drivers[d].name, drivers[d].path);
continue;
}
for (int i = 0; i < n; i++) {
int got = run_driver(drivers[d].path, &rows[i], i);
total++;
if (got != rows[i].want) {
fprintf(stderr,
"dot_explicit_deref[%s][%s]: exit=%d want=%d\n",
drivers[d].name, rows[i].label,
got, rows[i].want);
fail++;
}
}
}
if (access(wdrv, X_OK) == 0) {
for (int i = 0; i < n; i++) {
total++;
if (asm_byte_identical(bin, &rows[i], i) != 0)
fail++;
}
}
if (fail) {
fprintf(stderr,
"dot_explicit_deref: %d/%d fixtures failed\n",
fail, total);
return 1;
}
printf("dot_explicit_deref: %d/%d ok\n", total, total);
return 0;
}