test: port 989_ffivariadic_run to ww; retire the C carrier

Makefile

@@ -431,7 +431,7 @@ MISC_WW_TARGETS = $(MISC_WW_TESTS:%=wwtest/%)
 TOOL_WW_TESTS = test/tool/rejects_test.ww test/tool/driver_test.ww \
 	  test/tool/wwdump_test.ww test/tool/ffi_test.ww \
 	  test/tool/attest_test.ww test/tool/wwirune_test.ww \
-	  test/tool/c6soak_test.ww
+	  test/tool/c6soak_test.ww test/tool/ffivariadic_test.ww
 TOOL_WW_TARGETS = $(TOOL_WW_TESTS:%=wwtest/%)
 BOOTSTRAP_WRAPPER_SOURCES = test/wcc/950_selfcheck.c \
 	  test/wcc/991_w6a_ww.c \
@@ -464,18 +464,19 @@ $(BIN)/test_400_w6c: test/wcc/400_w6c.c \
 $(BIN)/test_%: test/wcc/%.c test/wcc/wwtestpkg.h $(LIB)/libwcc.a | $(BIN)
 	$(CC) $(CFLAGS) $(INCS) -o $@ $< $(LIB)/libwcc.a
 
-# 989_ffivariadic depends on a C callee archive the harness finds via
+# test/tool/ffivariadic_test.ww links a C callee archive it reaches
-# $(BIN)/../ffivariadic. The fixture is built self-contained (zero
+# via testenv.repo() + /out/ffivariadic. The fixture is built
-# relocs + undef syms) so w6l links it with no libc; flags are fixed,
+# self-contained (zero relocs + undef syms) so w6l links it with no
-# NOT $(CFLAGS), to keep that property. The rule was dropped in the
+# libc; flags are fixed, NOT $(CFLAGS), to keep that property. The
-# test-graph rewrite (228a632a) and a stale out/ tree masked it.
+# rule was dropped in the test-graph rewrite (228a632a) and a stale
+# out/ tree masked it.
 $(OUT)/ffivariadic/libffifix.a: test/wcc/data/ffivariadic/fixture.c
 	@mkdir -p $(OUT)/ffivariadic
 	$(CC) -O1 -fno-stack-protector -fno-asynchronous-unwind-tables \
 		-fcf-protection=none -c -o $(OUT)/ffivariadic/fixture.o $<
 	$(AR) rcs $@ $(OUT)/ffivariadic/fixture.o
 
-$(BIN)/test_989_ffivariadic_run: $(OUT)/ffivariadic/libffifix.a
+wwtest/test/tool/ffivariadic_test.ww: $(OUT)/ffivariadic/libffifix.a
 
 # Native library tests execute their source owner directly.  The retired C
 # launchers added no assertion beyond this exit status.

test/tool/ffivariadic_test.ww

@@ -0,0 +1,127 @@
+package ffivariadic_test;
+
+// SysV variadic-FFI AL contract, runtime-gated on both driver stages.
+// Port of the retired native carrier test/wcc/989_ffivariadic_run.c;
+// every assertion preserved.
+//
+// A ww caller of a C variadic fn (`@symbol("fixture") fn fixture(n:
+// i64, ...) f64;`) must set AL to the count of XMM regs used for the
+// variadic FLOAT args: the C callee gates its xmm-save-area stores on
+// `test %al,%al`, so a wrong AL makes va_arg(double) read garbage.
+// The pre-fix bug hardcoded AL=0 (`XORQ AX,AX`) — correct only for a
+// zero-float call. Ref SysV §3.5.7, ref/qbe/amd64/sysv.c:384.
+//
+// Byte-id can never see AL correctness, so each row builds a ww
+// caller against the host-cc-built va_arg(double) summer
+// (test/wcc/data/ffivariadic/fixture.c archived as
+// out/ffivariadic/libffifix.a, self-contained: zero relocs/undef
+// syms, no libc, so w6l links it hermetically) and asserts the
+// runtime sum via the binary's exit code, on BOTH `ww` and `ww_ww`.
+//
+// NON-VACUITY: fixture(2,1.0,2.0) is vacuous on this box — with AL=0
+// the two skipped xmm slots alias stale stack already holding
+// 1.0/2.0. At >=3 floats the coincidence breaks deterministically,
+// so every f64 row uses >=3 floats and reverting the fix FAILS here.
+//
+// f32 rows (#14): C default argument promotion widens each f32 arg
+// to f64. f32three — exact values, unpromoted MOVSS leaves stale
+// high 4B, sum misses 7.0. f32inexact — 0.1 is INEXACT in f32; the
+// expected side `(x: f64)` is the SAME var widened at runtime, so
+// equality holds iff the f32-ROUNDED value was promoted (not the f64
+// literal, not garbage); single f32 arg also lands the fi==1
+// boundary. f32mixed — only the f32 args promote; the native-f64 arg
+// passes at width, never double-promoted.
+//
+// Dropped C machinery, not assertions: the ww_ww-absent skip gate
+// (the Make target declares both drivers) and the unlink/rmdir
+// accounting (testenv.clean asserts the removal).
+
+import os;
+import os.exec;
+import strings;
+import testenv;
+import time;
+
+fn fail(label: str, why: str) void = {
+	let m: str = strings.concat("ffivariadic FAIL: ", label, " -- ",
+		why, "\n");
+	os.write(2, m.ptr, m.len: u64);
+	assert(false);
+};
+
+fn tmo() time.duration = {
+	return (240i64 * (time.second: i64)): time.duration;
+};
+
+// -1 encodes an abnormal (non-EXIT) termination, never a valid code.
+fn runcode(dir: str, name: str, argv: []str) i32 = {
+	let co: testenv.commandout;
+	testenv.runcommand(dir, dir, name, argv, tmo(), &co);
+	if (co.termination != exec.termination.EXIT) { return -1; };
+	return co.code;
+};
+
+fn caller(call: str, want: str) str = {
+	return strings.concat(
+		"package main;\n",
+		"@symbol(\"fixture\") fn fixture(n: i64, ...) f64;\n",
+		"export fn main() int = {\n",
+		"\tlet r: f64 = ", call, ";\n",
+		"\tif (r == ", want, ") { return 0; };\n",
+		"\treturn 1;\n",
+		"};\n");
+};
+
+@test fn variadic_al() void = {
+	let labels: []str = ["three", "five", "eight", "f32three",
+		"f32inexact", "f32mixed"];
+	let srcs: []str = [
+		caller("fixture(3, 1.0, 2.0, 3.0)", "6.0"),
+		caller("fixture(5, 1.0, 2.0, 3.0, 4.0, 5.0)", "15.0"),
+		caller("fixture(8, 1.0, 2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0)",
+			"36.0"),
+		caller("fixture(3, 1.5: f32, 2.5: f32, 3.0: f32)", "7.0"),
+		strings.concat(
+			"package main;\n",
+			"@symbol(\"fixture\") fn fixture(n: i64, ...) f64;\n",
+			"export fn main() int = {\n",
+			"\tlet x: f32 = 0.1: f32;\n",
+			"\tlet r: f64 = fixture(1, x);\n",
+			"\tif (r == (x: f64)) { return 0; };\n",
+			"\treturn 1;\n",
+			"};\n"),
+		caller("fixture(3, 1.5: f32, 2.0, 3.5: f32)", "7.0"),
+	];
+	let libdir: str = strings.concat(testenv.repo(), "/out/ffivariadic");
+	let drvs: []str = ["ww", "ww_ww"];
+	let td: str = testenv.fresh();
+	let i: i32 = 0;
+	for (i < labels.len) {
+		let src: str = strings.concat(td, "/", labels[i], ".ww");
+		testenv.writefile(src, srcs[i]);
+		let s: i32 = 0;
+		for (s < 2) {
+			// "out." prefix: a bare <label>.<drv> stem collides with
+			// the <label>.ww SOURCE name on the cstage driver leg
+			let out: str = strings.concat(td, "/out.", labels[i], ".",
+				drvs[s]);
+			let av: []str = [testenv.driver(drvs[s]), "build",
+				strings.concat("-L", libdir), "-lffifix", "-o", out,
+				src];
+			if (runcode(td, strings.concat("build_", labels[i], "_",
+				drvs[s]), av) != 0) {
+				fail(labels[i], strings.concat(drvs[s],
+					" build failed (-lffifix link)"));
+			};
+			let rav: []str = [out];
+			if (runcode(td, strings.concat("run_", labels[i], "_",
+				drvs[s]), rav) != 0) {
+				fail(labels[i], strings.concat(drvs[s],
+					" wrong variadic sum (AL/promotion contract)"));
+			};
+			s += 1;
+		};
+		i += 1;
+	};
+	testenv.clean(td);
+};

test/wcc/989_ffivariadic_run.c

@@ -1,256 +0,0 @@
-/*
- * 989_ffivariadic_run — C1 (catB-54): a ww caller of a C variadic function
- * (`@symbol("f") fn f(a: i64, ...) f64;`) must set the SysV AL register to
- * the number of XMM regs used to pass the variadic FLOAT args. The C callee
- * gates its xmm-save-area stores on `test %al,%al`, so a wrong AL makes
- * va_arg(double) read garbage.
- *
- * THE BUG (cat-A silent miscompile, byte-id-blind): cgen.c hardcoded AL=0
- * (`XORQ AX,AX`) at the variadic-call site — correct only for a zero-float
- * variadic call. THE FIX: emit AL = the XMM cursor `fi` (the count of float
- * args placed in XMM regs). Ref SysV §3.5.7, ref/qbe/amd64/sysv.c:384.
- *
- * RUNTIME gate (byte-id can never see AL correctness): each row builds a ww
- * caller that calls the C fixture `double fixture(long n, ...)` (a
- * va_arg(double) summer, test/wcc/data/ffivariadic/fixture.c, linked from
- * libffifix.a) and asserts the returned sum. Runs on BOTH the cstage `ww`
- * and wwstage `ww_ww` drivers (C2): AL is byte-id-blind, so a wwstage fi /
- * f32-promotion divergence is caught only by a wrong runtime sum here.
- *
- * NON-VACUITY DEVIATION (reported to lead): the spec's `fixture(2,1.0,2.0)`
- * is VACUOUS on this box — with AL=0 the two skipped xmm slots happen to
- * alias stale stack that already holds 1.0/2.0, so the 2-float call returns
- * the correct 3.0 even unfixed. At 3+ floats the coincidence breaks: AL=0
- * deterministically returns the wrong sum. Every row below uses >=3 floats,
- * so reverting the fix to `XORQ AX,AX` FAILS this test (proven). A 2-float
- * row would pass both ways and prove nothing.
- */
-#include <stdio.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <unistd.h>
-#include <sys/stat.h>
-#include <sys/wait.h>
-
-static int
-runwait(const char *cmd)
-{
-	int rc = system(cmd);
-	if (rc == -1) return -1;
-	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
-	return -1;
-}
-
-struct row {
-	const char *label;
-	const char *src;
-	int want_exit;	/* 0 == sum matched */
-};
-
-static const struct row rows[] = {
-	/* 3 floats: 1+2+3 == 6. The smallest non-vacuous count (see header). */
-	{ "three",
-	  "package main;\n"
-	  "@symbol(\"fixture\") fn fixture(n: i64, ...) f64;\n"
-	  "export fn main() int = {\n"
-	  "	let r: f64 = fixture(3, 1.0, 2.0, 3.0);\n"
-	  "	if (r == 6.0) { return 0; };\n"
-	  "	return 1;\n"
-	  "};\n",
-	  0 },
-
-	/* 5 floats, fewer than the 8 XMM arg regs: 1+2+3+4+5 == 15. */
-	{ "five",
-	  "package main;\n"
-	  "@symbol(\"fixture\") fn fixture(n: i64, ...) f64;\n"
-	  "export fn main() int = {\n"
-	  "	let r: f64 = fixture(5, 1.0, 2.0, 3.0, 4.0, 5.0);\n"
-	  "	if (r == 15.0) { return 0; };\n"
-	  "	return 1;\n"
-	  "};\n",
-	  0 },
-
-	/* 8 floats == all XMM arg regs (AL caps at 8): 1+..+8 == 36. */
-	{ "eight",
-	  "package main;\n"
-	  "@symbol(\"fixture\") fn fixture(n: i64, ...) f64;\n"
-	  "export fn main() int = {\n"
-	  "	let r: f64 = fixture(8, 1.0, 2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0);\n"
-	  "	if (r == 36.0) { return 0; };\n"
-	  "	return 1;\n"
-	  "};\n",
-	  0 },
-
-	/* 3 f32 args (#14): C default arg promotion widens each to f64, so
-	 * the callee's va_arg(double) reads 1.5+2.5+3.0 == 7.0. Values are
-	 * exact in f32, so the f64 compare is exact. Unpromoted (MOVSS, 4B)
-	 * the high 4B of each 8B slot is stale stack, so va_arg(double)
-	 * pulls garbage and the sum misses 7.0 — this row FAILS pre-fix. */
-	{ "f32three",
-	  "package main;\n"
-	  "@symbol(\"fixture\") fn fixture(n: i64, ...) f64;\n"
-	  "export fn main() int = {\n"
-	  "	let r: f64 = fixture(3, 1.5: f32, 2.5: f32, 3.0: f32);\n"
-	  "	if (r == 7.0) { return 0; };\n"
-	  "	return 1;\n"
-	  "};\n",
-	  0 },
-
-	/* Sharper than f32three: 0.1 is INEXACT in f32, so the f32-rounded
-	 * value differs from the f64 literal 0.1. The expected side `(x: f64)`
-	 * is the SAME f32 var widened at runtime (CVTSS2SD), so equality holds
-	 * iff the variadic arg carried the f32-rounded value promoted to f64 —
-	 * NOT the original f64 literal and NOT stale-high-bit garbage. Both a
-	 * no-promote (MOVSS) and a hypothetical direct-f64 pass would miss it.
-	 * Single f32 arg also exercises the fi==1 boundary. */
-	{ "f32inexact",
-	  "package main;\n"
-	  "@symbol(\"fixture\") fn fixture(n: i64, ...) f64;\n"
-	  "export fn main() int = {\n"
-	  "	let x: f32 = 0.1: f32;\n"
-	  "	let r: f64 = fixture(1, x);\n"
-	  "	if (r == (x: f64)) { return 0; };\n"
-	  "	return 1;\n"
-	  "};\n",
-	  0 },
-
-	/* Mixed f32 + f64 in one variadic call: only the f32 args (1.5, 3.5)
-	 * promote; the f64 arg (2.0) passes at its native width and must NOT be
-	 * double-promoted or skewed. 1.5+2.0+3.5 == 7.0, exact in both widths. */
-	{ "f32mixed",
-	  "package main;\n"
-	  "@symbol(\"fixture\") fn fixture(n: i64, ...) f64;\n"
-	  "export fn main() int = {\n"
-	  "	let r: f64 = fixture(3, 1.5: f32, 2.0, 3.5: f32);\n"
-	  "	if (r == 7.0) { return 0; };\n"
-	  "	return 1;\n"
-	  "};\n",
-	  0 },
-};
-
-/* run_build — build+run `src` via cstage `driver`, linking libffifix.a from
- * `libdir`. Returns the binary's exit code, or -1 on a build failure. */
-static int
-run_build(const char *driver, const char *libdir, const struct row *r, int i)
-{
-	char src[128], tmpdir[64], outbin[128], work[160], cmd[1024];
-	snprintf(tmpdir, sizeof tmpdir, "/tmp/ffivar_%d_%d", getpid(), i);
-	if (mkdir(tmpdir, 0755) != 0) {
-		perror(tmpdir);
-		return -2;
-	}
-	snprintf(src, sizeof src, "%s/ffivar_%d_%d.ww", tmpdir, getpid(), i);
-	snprintf(outbin, sizeof outbin, "%s/out", tmpdir);
-	int result = -2, cleanfail = 0;
-
-	FILE *f = fopen(src, "wb");
-	if (!f) {
-		perror(src);
-		goto cleanup;
-	}
-	int werr = fputs(r->src, f) == EOF;
-	if (fclose(f) != 0) werr = 1;
-	if (werr) {
-		perror(src);
-		goto cleanup;
-	}
-
-	/* explicit -o so both the binary and out.sepwork land INSIDE tmpdir */
-	snprintf(cmd, sizeof cmd,
-	    "%s build -L%s -lffifix -o %s %s 2>/dev/null",
-	    driver, libdir, outbin, src);
-	int brc = runwait(cmd);
-
-	int got = -1;
-	if (brc == 0) got = runwait(outbin);
-	result = brc == 0 ? got : -1;
-
-cleanup:
-	if (unlink(src) != 0 && errno != ENOENT) {
-		perror(src);
-		cleanfail = 1;
-	}
-	if (unlink(outbin) != 0 && errno != ENOENT) {
-		perror(outbin);
-		cleanfail = 1;
-	}
-	snprintf(work, sizeof work, "%s.sepwork", outbin);
-	snprintf(cmd, sizeof cmd, "rm -rf %s", work);
-	if (runwait(cmd) != 0) {
-		fprintf(stderr, "ffivariadic[%s]: cleanup failed: %s\n", r->label, work);
-		cleanfail = 1;
-	}
-	if (rmdir(tmpdir) != 0) {
-		perror(tmpdir);
-		cleanfail = 1;
-	}
-	if (cleanfail) {
-		fprintf(stderr, "ffivariadic[%s]: temporary cleanup failed\n", r->label);
-		if (result == r->want_exit) result = -2;
-	}
-	return result;
-}
-
-int
-main(void)
-{
-	const char *bin = getenv("BIN");
-	if (!bin) bin = "out/bin";
-	char absbin[1024];
-	if (bin[0] != '/') {
-		char cwd[1024];
-		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
-		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
-		bin = absbin;
-	}
-
-	char cdrv[1024], wdrv[1024], libdir[1024];
-	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
-	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
-	/* libffifix.a lives beside $(BIN) under $(OUT)/ffivariadic — the
-	 * Makefile builds it there as a prereq of this test binary. */
-	snprintf(libdir, sizeof libdir, "%s/../ffivariadic", bin);
-
-	/* C2: run each row on BOTH the cstage `ww` and the wwstage `ww_ww`
-	 * driver. AL correctness is byte-id-blind, so a wwstage fi/promotion
-	 * divergence is invisible to the 990-997 gates but caught here as a
-	 * wrong sum (nonzero exit). wwstage is access-gated like the other
-	 * dual-stage runtime tests (989_chainidx_run) so a cstage-only tree
-	 * still runs the cstage rows. */
-	struct { const char *name; const char *drv; int gated; }
-	drivers[] = {
-		{ "cstage",  cdrv, 0 },
-		{ "wwstage", wdrv, 1 },
-		{ NULL, NULL, 0 },
-	};
-
-	int n = (int)(sizeof rows / sizeof rows[0]);
-	int total = 0, fail = 0;
-
-	for (int d = 0; drivers[d].name; d++) {
-		if (drivers[d].gated && access(drivers[d].drv, X_OK) != 0) {
-			fprintf(stderr, "ffivariadic: skip %s (no %s)\n",
-			    drivers[d].name, drivers[d].drv);
-			continue;
-		}
-		for (int i = 0; i < n; i++) {
-			total++;
-			int got = run_build(drivers[d].drv, libdir, &rows[i], i);
-			if (got != rows[i].want_exit) {
-				fprintf(stderr,
-				    "ffivariadic[%s][%s]: exit=%d want=%d\n",
-				    drivers[d].name, rows[i].label, got,
-				    rows[i].want_exit);
-				fail++;
-			}
-		}
-	}
-
-	if (fail) {
-		fprintf(stderr, "ffivariadic: %d/%d fixtures failed\n",
-		    fail, total);
-		return 1;
-	}
-	printf("ffivariadic: %d/%d ok\n", total, total);
-	return 0;
-}