Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cgen: str arr[i].field = v store -> 3-word -- Phase 2 G1 (both stages)

Browse Source 
Storing a str into a field of an indexed element (arr[i].f = v) wrote only 2 words (ptr,len), dropping cap -- the write-side mirror of the arrfield read (c3bbe17), and the first STORE-cluster fold. The trap: the index scale (IMULQ via CX) clobbers CX=cap and the index-expr eval clobbers AX=ptr before the store. Fix composes two proven oracles -- arr[i]=v (cgen.c:3650) spills the value (PUSHQ CX/BX/AX) across the index/address computation, then s.f=v (cgen.c:2603) stages the dst address in DX (off the AX/BX/CX str convention) and stores ptr/len/cap at foff+{0,8,16}. Kind-gated (TY_STR/isstrtype, never size==24). cstage==wwstage byte-identical.

test/wcc/937: table-driven write-then-read-cap over [N]S / []S / [N]*S arr[i].f= ; rhs is a runtime cap!=len str (not a literal, which would be cap==len); all 3 slot words pre-poisoned via a DIFFERENT already-3-word store path so a stale 2-word store is detectable; asserts the full {ptr,len,cap} triple. Meaningful only now the reads are 3-word. fail-before/pass-after verified on both drivers.

main.combined.ww regenerated via the canonical make path (md5-stable).
This commit is contained in:
Hojun-Cho
2026-05-24 15:35:37 +09:00
parent c3bbe17163
commit c6929231dc
6 changed files with 315 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Makefile
View File

@@ -259,6 +259,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
$(BIN)/test_str_chained_field_cap_run \
$(BIN)/test_str_tuple_elem_cap_run \
$(BIN)/test_str_arrfield_cap_run \
$(BIN)/test_str_arrfield_store_cap_run \
$(BIN)/test_composite_call_arg \
$(BIN)/test_composite_call_arg_run \
$(BIN)/test_letdecl_zeroinit \
@@ -655,6 +656,12 @@ $(BIN)/test_str_arrfield_cap_run: test/wcc/936_str_arrfield_cap_run.c \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
$(BIN)/test_str_arrfield_store_cap_run: test/wcc/937_str_arrfield_store_cap_run.c \
$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
$(BIN)/test_composite_call_arg: test/wcc/723_composite_call_arg.c \
$(BIN)/w6c $(BIN)/w6c_ww | $(BIN)
$(CC) $(CFLAGS) -o $@ $<

37
cmd/w6c/cgen.c
View File

@@ -2916,11 +2916,21 @@ cgexpr(Cg *c, Node *n, Local *locals)
}
if (n->op == TK_ASSIGN
&& fu && fu->kind == TY_STR) {
/* str rhs: AX=ptr, BX=len.
* Stash both, compute addr
* in CX so the pop pair
* restores AX/BX cleanly. */
/* str IS []u8: rhs leaves
* AX=ptr, BX=len, CX=cap
* (#1/Phase 3). Spill all
* three across the index/
* address computation
* (IMULQ's CX scratch
* clobbers cap), stage
* &arr[i] in DX off the str
* AX/BX/CX convention
* (mirrors s.f=v), then store
* the full triple at
* foff+0/+8/+16. */
cgexpr(c, n->rhs, locals);
ins1(c, A_PUSHQ,
areg(D_CX));
ins1(c, A_PUSHQ,
areg(D_BX));
ins1(c, A_PUSHQ,
@@ -2937,28 +2947,33 @@ cgexpr(Cg *c, Node *n, Local *locals)
if (is_arr)
ins2(c, A_LEAQ,
amem(D_BP, off),
areg(D_CX));
areg(D_DX));
else
ins2(c, A_MOVQ,
amem(D_BP, off),
areg(D_CX));
areg(D_DX));
ins2(c, A_ADDQ,
areg(D_AX),
areg(D_CX));
areg(D_DX));
if (viaptr)
ins2(c, A_MOVQ,
amem(D_CX, 0),
areg(D_CX));
amem(D_DX, 0),
areg(D_DX));
ins1(c, A_POPQ,
areg(D_AX));
ins1(c, A_POPQ,
areg(D_BX));
ins1(c, A_POPQ,
areg(D_CX));
ins2(c, A_MOVQ,
areg(D_AX),
amem(D_CX, foff + 0));
amem(D_DX, foff + 0));
ins2(c, A_MOVQ,
areg(D_BX),
amem(D_CX, foff + 8));
amem(D_DX, foff + 8));
ins2(c, A_MOVQ,
areg(D_CX),
amem(D_DX, foff + 16));
break;
}
if (n->op == TK_ASSIGN) {

28
selfhost/cmd/w6c/main.combined.ww
View File

@@ -17870,11 +17870,17 @@ fn cgassign(c: *cgen, n: *node) void = {
emitline("\n");
return;
};
// str rhs: AX=ptr, BX=len. Stash both,
// compute addr in CX so the pop pair
// restores AX/BX intact.
// str IS []u8: rhs leaves AX=ptr,
// BX=len, CX=cap (#1/Phase 3). Spill
// all three across the index/address
// computation (IMULQ's CX scratch
// clobbers cap), stage &arr[i] in DX
// off the str AX/BX/CX convention
// (mirrors s.f=v), then store the full
// triple at foff+0/+8/+16.
if (isstrtype(c, fi.tnode)) {
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tCX\n");
emitline("\tPUSHQ\tBX\n");
emitline("\tPUSHQ\tAX\n");
cgexpr(c, idx);
@@ -17887,21 +17893,25 @@ fn cgassign(c: *cgen, n: *node) void = {
if (baseisarray) {
emitline("\tLEAQ\t");
emitoff(lc.off: i64);
emitline("(BP), CX\n");
emitline("(BP), DX\n");
} else {
emitline("\tMOVQ\t");
emitoff(lc.off: i64);
emitline("(BP), CX\n");
emitline("(BP), DX\n");
};
emitline("\tADDQ\tAX, CX\n");
if (viaptr) { emitline("\tMOVQ\t(CX), CX\n"); };
emitline("\tADDQ\tAX, DX\n");
if (viaptr) { emitline("\tMOVQ\t(DX), DX\n"); };
emitline("\tPOPQ\tAX\n");
emitline("\tPOPQ\tBX\n");
emitline("\tPOPQ\tCX\n");
emitline("\tMOVQ\tAX, ");
emitdispreg(fi.foff: i64, "CX");
emitdispreg(fi.foff: i64, "DX");
emitline("\n");
emitline("\tMOVQ\tBX, ");
emitdispreg((fi.foff + 8): i64, "CX");
emitdispreg((fi.foff + 8): i64, "DX");
emitline("\n");
emitline("\tMOVQ\tCX, ");
emitdispreg((fi.foff + 16): i64, "DX");
emitline("\n");
return;
};

28
selfhost/cmd/wcc/cgenexpr.ww
View File

@@ -4042,11 +4042,17 @@ fn cgassign(c: *cgen, n: *node) void = {
emitline("\n");
return;
};
// str rhs: AX=ptr, BX=len. Stash both,
// compute addr in CX so the pop pair
// restores AX/BX intact.
// str IS []u8: rhs leaves AX=ptr,
// BX=len, CX=cap (#1/Phase 3). Spill
// all three across the index/address
// computation (IMULQ's CX scratch
// clobbers cap), stage &arr[i] in DX
// off the str AX/BX/CX convention
// (mirrors s.f=v), then store the full
// triple at foff+0/+8/+16.
if (isstrtype(c, fi.tnode)) {
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tCX\n");
emitline("\tPUSHQ\tBX\n");
emitline("\tPUSHQ\tAX\n");
cgexpr(c, idx);
@@ -4059,21 +4065,25 @@ fn cgassign(c: *cgen, n: *node) void = {
if (baseisarray) {
emitline("\tLEAQ\t");
emitoff(lc.off: i64);
emitline("(BP), CX\n");
emitline("(BP), DX\n");
} else {
emitline("\tMOVQ\t");
emitoff(lc.off: i64);
emitline("(BP), CX\n");
emitline("(BP), DX\n");
};
emitline("\tADDQ\tAX, CX\n");
if (viaptr) { emitline("\tMOVQ\t(CX), CX\n"); };
emitline("\tADDQ\tAX, DX\n");
if (viaptr) { emitline("\tMOVQ\t(DX), DX\n"); };
emitline("\tPOPQ\tAX\n");
emitline("\tPOPQ\tBX\n");
emitline("\tPOPQ\tCX\n");
emitline("\tMOVQ\tAX, ");
emitdispreg(fi.foff: i64, "CX");
emitdispreg(fi.foff: i64, "DX");
emitline("\n");
emitline("\tMOVQ\tBX, ");
emitdispreg((fi.foff + 8): i64, "CX");
emitdispreg((fi.foff + 8): i64, "DX");
emitline("\n");
emitline("\tMOVQ\tCX, ");
emitdispreg((fi.foff + 16): i64, "DX");
emitline("\n");
return;
};

28
selfhost/cmd/wwdump/main.combined.ww
View File

@@ -17870,11 +17870,17 @@ fn cgassign(c: *cgen, n: *node) void = {
emitline("\n");
return;
};
// str rhs: AX=ptr, BX=len. Stash both,
// compute addr in CX so the pop pair
// restores AX/BX intact.
// str IS []u8: rhs leaves AX=ptr,
// BX=len, CX=cap (#1/Phase 3). Spill
// all three across the index/address
// computation (IMULQ's CX scratch
// clobbers cap), stage &arr[i] in DX
// off the str AX/BX/CX convention
// (mirrors s.f=v), then store the full
// triple at foff+0/+8/+16.
if (isstrtype(c, fi.tnode)) {
cgexpr(c, n.rhs);
emitline("\tPUSHQ\tCX\n");
emitline("\tPUSHQ\tBX\n");
emitline("\tPUSHQ\tAX\n");
cgexpr(c, idx);
@@ -17887,21 +17893,25 @@ fn cgassign(c: *cgen, n: *node) void = {
if (baseisarray) {
emitline("\tLEAQ\t");
emitoff(lc.off: i64);
emitline("(BP), CX\n");
emitline("(BP), DX\n");
} else {
emitline("\tMOVQ\t");
emitoff(lc.off: i64);
emitline("(BP), CX\n");
emitline("(BP), DX\n");
};
emitline("\tADDQ\tAX, CX\n");
if (viaptr) { emitline("\tMOVQ\t(CX), CX\n"); };
emitline("\tADDQ\tAX, DX\n");
if (viaptr) { emitline("\tMOVQ\t(DX), DX\n"); };
emitline("\tPOPQ\tAX\n");
emitline("\tPOPQ\tBX\n");
emitline("\tPOPQ\tCX\n");
emitline("\tMOVQ\tAX, ");
emitdispreg(fi.foff: i64, "CX");
emitdispreg(fi.foff: i64, "DX");
emitline("\n");
emitline("\tMOVQ\tBX, ");
emitdispreg((fi.foff + 8): i64, "CX");
emitdispreg((fi.foff + 8): i64, "DX");
emitline("\n");
emitline("\tMOVQ\tCX, ");
emitdispreg((fi.foff + 16): i64, "DX");
emitline("\n");
return;
};

225
test/wcc/937_str_arrfield_store_cap_run.c Normal file
View File

@@ -0,0 +1,225 @@
/*
* 937_str_arrfield_store_cap_run — runtime coverage for the G1 fold: STORING a
* str into a FIELD of an INDEXED element `arr[i].f = v` must write the full 24B
* {ptr,len,cap} header, not just {ptr,len}. str is 24B since Phase 2 (#1); the
* write-side mirror of the landed arrfield READ (936) previously stored only 2
* words (AX=ptr@foff+0, BX=len@foff+8) and silently DROPPED cap.
*
* This is only meaningful now that the arrfield READ is 3-word (936): before
* that fix the store+read were 2-word-symmetric and cap was untouched at both
* ends, so a dropped store-cap was invisible. Now the read returns the real
* +16 word, so a 2-word store is observable.
*
* Sites: cgen.c's `arr[i].field = v` str branch (N_DOT lhs, N_INDEX lhs.lhs,
* N_IDENT idxbase) and the cgenexpr.ww cgassign twin. The composed mechanic:
* the rhs str leaves AX=ptr/BX=len/CX=cap, all three spilled across the
* index/address computation (the index scale `MOVQ $esz, CX; IMULQ` would
* clobber cap), the element address staged in DX off the str AX/BX/CX
* convention (mirroring the s.f=v store), then the full triple stored at
* foff+0/+8/+16.
*
* Rows mirror the 936 arrfield READ rows:
* A [N]S local array : `arr[i].f = v` (LEAQ base, value element).
* B []S local slice : `sl[i].f = v` (MOVQ slice.ptr base, value elem).
* D [N]*S pointer-elem : `arr[i].f = v` (LEAQ base, MOVQ deref to the *S).
*
* RHS cap!=len: each test str is a literal whose .cap is mutated to a value
* DISTINCT from its len (NOT a bare literal — literals carry cap==len, which
* would hide a dropped cap; #12: global literal .cap reads 0). cap and len are
* both nonzero and unequal so a 2-word store that drops cap is detectable.
*
* PRE-POISON (B != A, both nonzero, != len): before the G1 store under test,
* all three slot words are seeded with a DIFFERENT str (ptr='q', len=4,
* cap=5=A) via a PROVEN already-3-word store path — never the G1 store itself
* (if G1 is broken its own poison write would also drop cap, leaving +16
* uninit rather than a controlled poison). A/B poison via `&arr[i]` + a
* *struct field store (`pr.f = q`); D poisons the pointee via the proven
* s1local field store (`st.f = q`). The G1 store then writes the test str
* (ptr='h', len=2, cap=8=B). A broken 2-word store never touches +16, so the
* 3-word read-back observes the poison cap 5, never 8 — deterministic
* discrimination with no reliance on a stale register.
*
* FULL-TRIPLE ASSERT: a register-reallocation slip in the 3-word store could
* clobber ptr or len while wiring cap, and a cap-only assert would miss it. So
* each row reads the value back (landed 3-word arrfield read) and checks all
* three words: ptr (first byte through it — 'h'=104), len (2), cap (8). The
* 2-word store writes ptr/len correctly (they ARE the two words it keeps), so
* cap is the fail-before discriminator; ptr/len guard the fix.
*
* Verified fail-before (stashed the store edit on BOTH stages → all rows exit
* 1, cap reads the poison 5) / pass-after (exit 0), both the cstage `ww` and
* wwstage `ww_ww` drivers.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
struct row { const char *label; const char *src; int want; };
static const struct row rows[] = {
/* A — `arr[i].f = v` into a [N]S local array (LEAQ base, value
* element). Poison the slot (cap=5,len=4,'q') via &arr[1] + a
* *struct field store; then the G1 store lands the test str
* (cap=8,len=2,'h'). */
{ "arrfield_store_array_value",
"type rec = struct { f: str };\n"
"export fn main() i32 = {\n"
" let q: str = \"qqqq\"; q.cap = 5i32;\n"
" let p: str = \"hi\"; p.cap = 8i32;\n"
" let arr: [3]rec;\n"
" let pr: *rec = &arr[1];\n"
" pr.f = q;\n"
" arr[1].f = p;\n"
" let s: str = arr[1].f;\n"
" if (s.cap: i32 != 8) { return 1; };\n"
" if (s.len: i32 != 2) { return 2; };\n"
" if (s[0] != 104u8) { return 3; };\n"
" return 0;\n"
"};\n",
0 },
/* B — `sl[i].f = v` into a []S local slice (MOVQ slice.ptr base,
* value element). The slice views the same backing array; poison the
* element through the array pointer, store the test str through the
* slice, read it back through the slice. */
{ "arrfield_store_slice_value",
"type rec = struct { f: str };\n"
"export fn main() i32 = {\n"
" let q: str = \"qqqq\"; q.cap = 5i32;\n"
" let p: str = \"hi\"; p.cap = 8i32;\n"
" let arr: [3]rec;\n"
" let pr: *rec = &arr[1];\n"
" pr.f = q;\n"
" let sl: []rec = arr[0:3];\n"
" sl[1].f = p;\n"
" let s: str = sl[1].f;\n"
" if (s.cap: i32 != 8) { return 1; };\n"
" if (s.len: i32 != 2) { return 2; };\n"
" if (s[0] != 104u8) { return 3; };\n"
" return 0;\n"
"};\n",
0 },
/* D — `arr[i].f = v` into a [N]*S pointer element (LEAQ base, MOVQ
* deref to the *S, then store at the field). The element points at a
* separately-built struct poisoned via the proven s1local field store
* (`st.f = q`); the G1 store derefs arr[1] and overwrites st.f. */
{ "arrfield_store_ptr_elem",
"type rec = struct { f: str };\n"
"export fn main() i32 = {\n"
" let q: str = \"qqqq\"; q.cap = 5i32;\n"
" let p: str = \"hi\"; p.cap = 8i32;\n"
" let st: rec;\n"
" st.f = q;\n"
" let arr: [3]*rec;\n"
" arr[1] = &st;\n"
" arr[1].f = p;\n"
" let s: str = arr[1].f;\n"
" if (s.cap: i32 != 8) { return 1; };\n"
" if (s.len: i32 != 2) { return 2; };\n"
" if (s[0] != 104u8) { return 3; };\n"
" return 0;\n"
"};\n",
0 },
};
static int
run_driver(const char *driver, const struct row *r, int i)
{
char src[96], tmpdir[96], cmd[1024];
snprintf(src, sizeof src, "/tmp/strarrfieldstore_%d_%d.ww", getpid(), i);
snprintf(tmpdir, sizeof tmpdir, "/tmp/strarrfieldstore_%d_d_%d", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
mkdir(tmpdir, 0755);
snprintf(cmd, sizeof cmd, "cd %s && %s build %s",
tmpdir, driver, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: build via %s failed\n",
r->label, driver);
unlink(src); rmdir(tmpdir);
return -1;
}
const char *base = strrchr(src, '/');
base = base ? base + 1 : src;
char outbin[160];
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
char *dot = strrchr(outbin, '.');
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
int got = runwait(outbin);
unlink(src); unlink(outbin); rmdir(tmpdir);
return got;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[512];
if (bin[0] != '/') {
char cwd[256];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char cdrv[640];
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
char wdrv[640];
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
struct { const char *name; const char *path; int gated_on_existence; }
drivers[] = {
{ "cstage", cdrv, 0 },
{ "wwstage", wdrv, 1 },
{ NULL, NULL, 0 },
};
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int d = 0; drivers[d].name; d++) {
if (drivers[d].gated_on_existence
&& access(drivers[d].path, X_OK) != 0) {
fprintf(stderr,
"str_arrfield_store_cap_run: skip %s (no %s)\n",
drivers[d].name, drivers[d].path);
continue;
}
for (int i = 0; i < n; i++) {
int got = run_driver(drivers[d].path, &rows[i], i);
total++;
if (got != rows[i].want) {
fprintf(stderr,
"str_arrfield_store_cap_run[%s][%s]: exit=%d want=%d\n",
drivers[d].name, rows[i].label,
got, rows[i].want);
fail++;
}
}
}
if (fail) {
fprintf(stderr, "str_arrfield_store_cap_run: %d/%d fixtures failed\n",
fail, total);
return 1;
}
printf("str_arrfield_store_cap_run: %d/%d ok\n", total, total);
return 0;
}