From c6929231dccda6e63ae74bc3a512632925a2f68d Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Sun, 24 May 2026 15:35:37 +0900 Subject: [PATCH] cgen: str arr[i].field = v store -> 3-word -- Phase 2 G1 (both stages) Storing a str into a field of an indexed element (arr[i].f = v) wrote only 2 words (ptr,len), dropping cap -- the write-side mirror of the arrfield read (c3bbe17), and the first STORE-cluster fold. The trap: the index scale (IMULQ via CX) clobbers CX=cap and the index-expr eval clobbers AX=ptr before the store. Fix composes two proven oracles -- arr[i]=v (cgen.c:3650) spills the value (PUSHQ CX/BX/AX) across the index/address computation, then s.f=v (cgen.c:2603) stages the dst address in DX (off the AX/BX/CX str convention) and stores ptr/len/cap at foff+{0,8,16}. Kind-gated (TY_STR/isstrtype, never size==24). cstage==wwstage byte-identical. test/wcc/937: table-driven write-then-read-cap over [N]S / []S / [N]*S arr[i].f= ; rhs is a runtime cap!=len str (not a literal, which would be cap==len); all 3 slot words pre-poisoned via a DIFFERENT already-3-word store path so a stale 2-word store is detectable; asserts the full {ptr,len,cap} triple. Meaningful only now the reads are 3-word. fail-before/pass-after verified on both drivers. main.combined.ww regenerated via the canonical make path (md5-stable). --- Makefile | 7 + cmd/w6c/cgen.c | 37 ++-- selfhost/cmd/w6c/main.combined.ww | 28 ++- selfhost/cmd/wcc/cgenexpr.ww | 28 ++- selfhost/cmd/wwdump/main.combined.ww | 28 ++- test/wcc/937_str_arrfield_store_cap_run.c | 225 ++++++++++++++++++++++ 6 files changed, 315 insertions(+), 38 deletions(-) create mode 100644 test/wcc/937_str_arrfield_store_cap_run.c diff --git a/Makefile b/Makefile index f0224416..2d45905a 100644 --- a/Makefile +++ b/Makefile @@ -259,6 +259,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_str_chained_field_cap_run \ $(BIN)/test_str_tuple_elem_cap_run \ $(BIN)/test_str_arrfield_cap_run \ + $(BIN)/test_str_arrfield_store_cap_run \ $(BIN)/test_composite_call_arg \ $(BIN)/test_composite_call_arg_run \ $(BIN)/test_letdecl_zeroinit \ @@ -655,6 +656,12 @@ $(BIN)/test_str_arrfield_cap_run: test/wcc/936_str_arrfield_cap_run.c \ $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +$(BIN)/test_str_arrfield_store_cap_run: test/wcc/937_str_arrfield_store_cap_run.c \ + $(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + $(BIN)/test_composite_call_arg: test/wcc/723_composite_call_arg.c \ $(BIN)/w6c $(BIN)/w6c_ww | $(BIN) $(CC) $(CFLAGS) -o $@ $< diff --git a/cmd/w6c/cgen.c b/cmd/w6c/cgen.c index 49210065..80d1a189 100644 --- a/cmd/w6c/cgen.c +++ b/cmd/w6c/cgen.c @@ -2916,11 +2916,21 @@ cgexpr(Cg *c, Node *n, Local *locals) } if (n->op == TK_ASSIGN && fu && fu->kind == TY_STR) { - /* str rhs: AX=ptr, BX=len. - * Stash both, compute addr - * in CX so the pop pair - * restores AX/BX cleanly. */ + /* str IS []u8: rhs leaves + * AX=ptr, BX=len, CX=cap + * (#1/Phase 3). Spill all + * three across the index/ + * address computation + * (IMULQ's CX scratch + * clobbers cap), stage + * &arr[i] in DX off the str + * AX/BX/CX convention + * (mirrors s.f=v), then store + * the full triple at + * foff+0/+8/+16. */ cgexpr(c, n->rhs, locals); + ins1(c, A_PUSHQ, + areg(D_CX)); ins1(c, A_PUSHQ, areg(D_BX)); ins1(c, A_PUSHQ, @@ -2937,28 +2947,33 @@ cgexpr(Cg *c, Node *n, Local *locals) if (is_arr) ins2(c, A_LEAQ, amem(D_BP, off), - areg(D_CX)); + areg(D_DX)); else ins2(c, A_MOVQ, amem(D_BP, off), - areg(D_CX)); + areg(D_DX)); ins2(c, A_ADDQ, areg(D_AX), - areg(D_CX)); + areg(D_DX)); if (viaptr) ins2(c, A_MOVQ, - amem(D_CX, 0), - areg(D_CX)); + amem(D_DX, 0), + areg(D_DX)); ins1(c, A_POPQ, areg(D_AX)); ins1(c, A_POPQ, areg(D_BX)); + ins1(c, A_POPQ, + areg(D_CX)); ins2(c, A_MOVQ, areg(D_AX), - amem(D_CX, foff + 0)); + amem(D_DX, foff + 0)); ins2(c, A_MOVQ, areg(D_BX), - amem(D_CX, foff + 8)); + amem(D_DX, foff + 8)); + ins2(c, A_MOVQ, + areg(D_CX), + amem(D_DX, foff + 16)); break; } if (n->op == TK_ASSIGN) { diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index af30d250..c6c8b1ab 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -17870,11 +17870,17 @@ fn cgassign(c: *cgen, n: *node) void = { emitline("\n"); return; }; - // str rhs: AX=ptr, BX=len. Stash both, - // compute addr in CX so the pop pair - // restores AX/BX intact. + // str IS []u8: rhs leaves AX=ptr, + // BX=len, CX=cap (#1/Phase 3). Spill + // all three across the index/address + // computation (IMULQ's CX scratch + // clobbers cap), stage &arr[i] in DX + // off the str AX/BX/CX convention + // (mirrors s.f=v), then store the full + // triple at foff+0/+8/+16. if (isstrtype(c, fi.tnode)) { cgexpr(c, n.rhs); + emitline("\tPUSHQ\tCX\n"); emitline("\tPUSHQ\tBX\n"); emitline("\tPUSHQ\tAX\n"); cgexpr(c, idx); @@ -17887,21 +17893,25 @@ fn cgassign(c: *cgen, n: *node) void = { if (baseisarray) { emitline("\tLEAQ\t"); emitoff(lc.off: i64); - emitline("(BP), CX\n"); + emitline("(BP), DX\n"); } else { emitline("\tMOVQ\t"); emitoff(lc.off: i64); - emitline("(BP), CX\n"); + emitline("(BP), DX\n"); }; - emitline("\tADDQ\tAX, CX\n"); - if (viaptr) { emitline("\tMOVQ\t(CX), CX\n"); }; + emitline("\tADDQ\tAX, DX\n"); + if (viaptr) { emitline("\tMOVQ\t(DX), DX\n"); }; emitline("\tPOPQ\tAX\n"); emitline("\tPOPQ\tBX\n"); + emitline("\tPOPQ\tCX\n"); emitline("\tMOVQ\tAX, "); - emitdispreg(fi.foff: i64, "CX"); + emitdispreg(fi.foff: i64, "DX"); emitline("\n"); emitline("\tMOVQ\tBX, "); - emitdispreg((fi.foff + 8): i64, "CX"); + emitdispreg((fi.foff + 8): i64, "DX"); + emitline("\n"); + emitline("\tMOVQ\tCX, "); + emitdispreg((fi.foff + 16): i64, "DX"); emitline("\n"); return; }; diff --git a/selfhost/cmd/wcc/cgenexpr.ww b/selfhost/cmd/wcc/cgenexpr.ww index 85c3d615..88aa09af 100644 --- a/selfhost/cmd/wcc/cgenexpr.ww +++ b/selfhost/cmd/wcc/cgenexpr.ww @@ -4042,11 +4042,17 @@ fn cgassign(c: *cgen, n: *node) void = { emitline("\n"); return; }; - // str rhs: AX=ptr, BX=len. Stash both, - // compute addr in CX so the pop pair - // restores AX/BX intact. + // str IS []u8: rhs leaves AX=ptr, + // BX=len, CX=cap (#1/Phase 3). Spill + // all three across the index/address + // computation (IMULQ's CX scratch + // clobbers cap), stage &arr[i] in DX + // off the str AX/BX/CX convention + // (mirrors s.f=v), then store the full + // triple at foff+0/+8/+16. if (isstrtype(c, fi.tnode)) { cgexpr(c, n.rhs); + emitline("\tPUSHQ\tCX\n"); emitline("\tPUSHQ\tBX\n"); emitline("\tPUSHQ\tAX\n"); cgexpr(c, idx); @@ -4059,21 +4065,25 @@ fn cgassign(c: *cgen, n: *node) void = { if (baseisarray) { emitline("\tLEAQ\t"); emitoff(lc.off: i64); - emitline("(BP), CX\n"); + emitline("(BP), DX\n"); } else { emitline("\tMOVQ\t"); emitoff(lc.off: i64); - emitline("(BP), CX\n"); + emitline("(BP), DX\n"); }; - emitline("\tADDQ\tAX, CX\n"); - if (viaptr) { emitline("\tMOVQ\t(CX), CX\n"); }; + emitline("\tADDQ\tAX, DX\n"); + if (viaptr) { emitline("\tMOVQ\t(DX), DX\n"); }; emitline("\tPOPQ\tAX\n"); emitline("\tPOPQ\tBX\n"); + emitline("\tPOPQ\tCX\n"); emitline("\tMOVQ\tAX, "); - emitdispreg(fi.foff: i64, "CX"); + emitdispreg(fi.foff: i64, "DX"); emitline("\n"); emitline("\tMOVQ\tBX, "); - emitdispreg((fi.foff + 8): i64, "CX"); + emitdispreg((fi.foff + 8): i64, "DX"); + emitline("\n"); + emitline("\tMOVQ\tCX, "); + emitdispreg((fi.foff + 16): i64, "DX"); emitline("\n"); return; }; diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index e3b19abe..88c1ffaf 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -17870,11 +17870,17 @@ fn cgassign(c: *cgen, n: *node) void = { emitline("\n"); return; }; - // str rhs: AX=ptr, BX=len. Stash both, - // compute addr in CX so the pop pair - // restores AX/BX intact. + // str IS []u8: rhs leaves AX=ptr, + // BX=len, CX=cap (#1/Phase 3). Spill + // all three across the index/address + // computation (IMULQ's CX scratch + // clobbers cap), stage &arr[i] in DX + // off the str AX/BX/CX convention + // (mirrors s.f=v), then store the full + // triple at foff+0/+8/+16. if (isstrtype(c, fi.tnode)) { cgexpr(c, n.rhs); + emitline("\tPUSHQ\tCX\n"); emitline("\tPUSHQ\tBX\n"); emitline("\tPUSHQ\tAX\n"); cgexpr(c, idx); @@ -17887,21 +17893,25 @@ fn cgassign(c: *cgen, n: *node) void = { if (baseisarray) { emitline("\tLEAQ\t"); emitoff(lc.off: i64); - emitline("(BP), CX\n"); + emitline("(BP), DX\n"); } else { emitline("\tMOVQ\t"); emitoff(lc.off: i64); - emitline("(BP), CX\n"); + emitline("(BP), DX\n"); }; - emitline("\tADDQ\tAX, CX\n"); - if (viaptr) { emitline("\tMOVQ\t(CX), CX\n"); }; + emitline("\tADDQ\tAX, DX\n"); + if (viaptr) { emitline("\tMOVQ\t(DX), DX\n"); }; emitline("\tPOPQ\tAX\n"); emitline("\tPOPQ\tBX\n"); + emitline("\tPOPQ\tCX\n"); emitline("\tMOVQ\tAX, "); - emitdispreg(fi.foff: i64, "CX"); + emitdispreg(fi.foff: i64, "DX"); emitline("\n"); emitline("\tMOVQ\tBX, "); - emitdispreg((fi.foff + 8): i64, "CX"); + emitdispreg((fi.foff + 8): i64, "DX"); + emitline("\n"); + emitline("\tMOVQ\tCX, "); + emitdispreg((fi.foff + 16): i64, "DX"); emitline("\n"); return; }; diff --git a/test/wcc/937_str_arrfield_store_cap_run.c b/test/wcc/937_str_arrfield_store_cap_run.c new file mode 100644 index 00000000..bea97996 --- /dev/null +++ b/test/wcc/937_str_arrfield_store_cap_run.c @@ -0,0 +1,225 @@ +/* + * 937_str_arrfield_store_cap_run — runtime coverage for the G1 fold: STORING a + * str into a FIELD of an INDEXED element `arr[i].f = v` must write the full 24B + * {ptr,len,cap} header, not just {ptr,len}. str is 24B since Phase 2 (#1); the + * write-side mirror of the landed arrfield READ (936) previously stored only 2 + * words (AX=ptr@foff+0, BX=len@foff+8) and silently DROPPED cap. + * + * This is only meaningful now that the arrfield READ is 3-word (936): before + * that fix the store+read were 2-word-symmetric and cap was untouched at both + * ends, so a dropped store-cap was invisible. Now the read returns the real + * +16 word, so a 2-word store is observable. + * + * Sites: cgen.c's `arr[i].field = v` str branch (N_DOT lhs, N_INDEX lhs.lhs, + * N_IDENT idxbase) and the cgenexpr.ww cgassign twin. The composed mechanic: + * the rhs str leaves AX=ptr/BX=len/CX=cap, all three spilled across the + * index/address computation (the index scale `MOVQ $esz, CX; IMULQ` would + * clobber cap), the element address staged in DX off the str AX/BX/CX + * convention (mirroring the s.f=v store), then the full triple stored at + * foff+0/+8/+16. + * + * Rows mirror the 936 arrfield READ rows: + * A [N]S local array : `arr[i].f = v` (LEAQ base, value element). + * B []S local slice : `sl[i].f = v` (MOVQ slice.ptr base, value elem). + * D [N]*S pointer-elem : `arr[i].f = v` (LEAQ base, MOVQ deref to the *S). + * + * RHS cap!=len: each test str is a literal whose .cap is mutated to a value + * DISTINCT from its len (NOT a bare literal — literals carry cap==len, which + * would hide a dropped cap; #12: global literal .cap reads 0). cap and len are + * both nonzero and unequal so a 2-word store that drops cap is detectable. + * + * PRE-POISON (B != A, both nonzero, != len): before the G1 store under test, + * all three slot words are seeded with a DIFFERENT str (ptr='q', len=4, + * cap=5=A) via a PROVEN already-3-word store path — never the G1 store itself + * (if G1 is broken its own poison write would also drop cap, leaving +16 + * uninit rather than a controlled poison). A/B poison via `&arr[i]` + a + * *struct field store (`pr.f = q`); D poisons the pointee via the proven + * s1local field store (`st.f = q`). The G1 store then writes the test str + * (ptr='h', len=2, cap=8=B). A broken 2-word store never touches +16, so the + * 3-word read-back observes the poison cap 5, never 8 — deterministic + * discrimination with no reliance on a stale register. + * + * FULL-TRIPLE ASSERT: a register-reallocation slip in the 3-word store could + * clobber ptr or len while wiring cap, and a cap-only assert would miss it. So + * each row reads the value back (landed 3-word arrfield read) and checks all + * three words: ptr (first byte through it — 'h'=104), len (2), cap (8). The + * 2-word store writes ptr/len correctly (they ARE the two words it keeps), so + * cap is the fail-before discriminator; ptr/len guard the fix. + * + * Verified fail-before (stashed the store edit on BOTH stages → all rows exit + * 1, cap reads the poison 5) / pass-after (exit 0), both the cstage `ww` and + * wwstage `ww_ww` drivers. + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { const char *label; const char *src; int want; }; + +static const struct row rows[] = { + /* A — `arr[i].f = v` into a [N]S local array (LEAQ base, value + * element). Poison the slot (cap=5,len=4,'q') via &arr[1] + a + * *struct field store; then the G1 store lands the test str + * (cap=8,len=2,'h'). */ + { "arrfield_store_array_value", + "type rec = struct { f: str };\n" + "export fn main() i32 = {\n" + " let q: str = \"qqqq\"; q.cap = 5i32;\n" + " let p: str = \"hi\"; p.cap = 8i32;\n" + " let arr: [3]rec;\n" + " let pr: *rec = &arr[1];\n" + " pr.f = q;\n" + " arr[1].f = p;\n" + " let s: str = arr[1].f;\n" + " if (s.cap: i32 != 8) { return 1; };\n" + " if (s.len: i32 != 2) { return 2; };\n" + " if (s[0] != 104u8) { return 3; };\n" + " return 0;\n" + "};\n", + 0 }, + /* B — `sl[i].f = v` into a []S local slice (MOVQ slice.ptr base, + * value element). The slice views the same backing array; poison the + * element through the array pointer, store the test str through the + * slice, read it back through the slice. */ + { "arrfield_store_slice_value", + "type rec = struct { f: str };\n" + "export fn main() i32 = {\n" + " let q: str = \"qqqq\"; q.cap = 5i32;\n" + " let p: str = \"hi\"; p.cap = 8i32;\n" + " let arr: [3]rec;\n" + " let pr: *rec = &arr[1];\n" + " pr.f = q;\n" + " let sl: []rec = arr[0:3];\n" + " sl[1].f = p;\n" + " let s: str = sl[1].f;\n" + " if (s.cap: i32 != 8) { return 1; };\n" + " if (s.len: i32 != 2) { return 2; };\n" + " if (s[0] != 104u8) { return 3; };\n" + " return 0;\n" + "};\n", + 0 }, + /* D — `arr[i].f = v` into a [N]*S pointer element (LEAQ base, MOVQ + * deref to the *S, then store at the field). The element points at a + * separately-built struct poisoned via the proven s1local field store + * (`st.f = q`); the G1 store derefs arr[1] and overwrites st.f. */ + { "arrfield_store_ptr_elem", + "type rec = struct { f: str };\n" + "export fn main() i32 = {\n" + " let q: str = \"qqqq\"; q.cap = 5i32;\n" + " let p: str = \"hi\"; p.cap = 8i32;\n" + " let st: rec;\n" + " st.f = q;\n" + " let arr: [3]*rec;\n" + " arr[1] = &st;\n" + " arr[1].f = p;\n" + " let s: str = arr[1].f;\n" + " if (s.cap: i32 != 8) { return 1; };\n" + " if (s.len: i32 != 2) { return 2; };\n" + " if (s[0] != 104u8) { return 3; };\n" + " return 0;\n" + "};\n", + 0 }, +}; + +static int +run_driver(const char *driver, const struct row *r, int i) +{ + char src[96], tmpdir[96], cmd[1024]; + snprintf(src, sizeof src, "/tmp/strarrfieldstore_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/strarrfieldstore_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -1; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s", + tmpdir, driver, src); + if (runwait(cmd) != 0) { + fprintf(stderr, "row[%s]: build via %s failed\n", + r->label, driver); + unlink(src); rmdir(tmpdir); + return -1; + } + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[160]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + int got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return got; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[512]; + if (bin[0] != '/') { + char cwd[256]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[640]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + char wdrv[640]; + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *path; int gated_on_existence; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated_on_existence + && access(drivers[d].path, X_OK) != 0) { + fprintf(stderr, + "str_arrfield_store_cap_run: skip %s (no %s)\n", + drivers[d].name, drivers[d].path); + continue; + } + for (int i = 0; i < n; i++) { + int got = run_driver(drivers[d].path, &rows[i], i); + total++; + if (got != rows[i].want) { + fprintf(stderr, + "str_arrfield_store_cap_run[%s][%s]: exit=%d want=%d\n", + drivers[d].name, rows[i].label, + got, rows[i].want); + fail++; + } + } + } + + if (fail) { + fprintf(stderr, "str_arrfield_store_cap_run: %d/%d fixtures failed\n", + fail, total); + return 1; + } + printf("str_arrfield_store_cap_run: %d/%d ok\n", total, total); + return 0; +}