wcc/ww: chained-index str/slice element loads the full header

cgindex read one word for a str/slice ELEMENT of a chained index
(xs[i][j], f().s[i]) — the element-kind gate keyed on node shape and
missed non-simple bases, dropping the 24B/16B header load (review
finding #22). Key on the element-type stamp; 989_chainidx_run pins
cs==ww (red 3/8 pre-fix).

Makefile

@@ -249,6 +249,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_tagged_subset_reject \
 	  $(BIN)/test_callarg_typecheck \
 	  $(BIN)/test_idxarg_run \
+	  $(BIN)/test_chainidx_run \
 	  $(BIN)/test_arr_ptr_global \
 	  $(BIN)/test_def_arr_infer_len \
 	  $(BIN)/test_def_arr_len \
@@ -644,6 +645,16 @@ $(BIN)/test_idxarg_run: test/wcc/989_idxarg_run.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+# 989_chainidx_run (F7-c3, #22): a chained index `m[i][k]` whose element is
+# a str/slice must load the full 24B/16B header. Builds+runs each fixture on
+# BOTH the cstage `ww` and wwstage `ww_ww` drivers (rule-10).
+$(BIN)/test_chainidx_run: test/wcc/989_chainidx_run.c \
+		$(BIN)/ww $(BIN)/ww_ww \
+		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_let_global: test/wcc/630_let_global.c $(BIN)/ww $(BIN)/w6c \
 		$(BIN)/w6a $(BIN)/w6l $(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<

selfhost/cmd/w6c/main.combined.ww

@@ -24573,13 +24573,23 @@ fn cgindex(c: *cgen, n: *node) void = {
 			// stamped outer element tinfo (indexresult over the inner
 			// index's value type). cstage reads base->type->sub->size
 			// for esz (cmd/w6c/cgen.c:2070-2071). Drops the
-			// indexvaluetnode walk. Kept as its OWN arm (it does not set
+			// indexvaluetnode walk.
-			// elemisstr/elemisslice) so the chained-index byte-id is
+			// #22 (F7-c3): also stamp elemisstr/elemisslice off the same
-			// preserved verbatim; the catch-all below would re-stamp it.
+			// chased element tinfo. Without them a chained index whose
+			// element is a str/slice (`m[i][k]` over [N][M]str) loaded
+			// only the ptr word — the 24B/16B header (len/cap) was
+			// dropped (stale BX/CX) → garbage .len downstream. cstage's
+			// idx_eff path classifies the element uniformly via
+			// type_isstr/type_isslice (cmd/w6c/cgen.c); align ww UP by
+			// reading the SAME stamp the esz read above uses. CLASS-N:
+			// the corpus has no chained str/slice element, so the prior
+			// byte-id is preserved (this only fires on the missed shape).
 			let et: *tinfo = n.type_: *tinfo;
 			if (et != nil) {
 				esz = et.size: i32;
 				signed_elem = typeissigned(et);
+				elemisstr = typeisstr(et);
+				elemisslice = typeisslice(et);
 				float_elem = typeisfloat(et);
 				f32_elem = typeisf32(et);
 				elem_isarray = tinfoisarray(et);

selfhost/cmd/wcc/cgenexpr.ww

@@ -1875,13 +1875,23 @@ fn cgindex(c: *cgen, n: *node) void = {
 			// stamped outer element tinfo (indexresult over the inner
 			// index's value type). cstage reads base->type->sub->size
 			// for esz (cmd/w6c/cgen.c:2070-2071). Drops the
-			// indexvaluetnode walk. Kept as its OWN arm (it does not set
+			// indexvaluetnode walk.
-			// elemisstr/elemisslice) so the chained-index byte-id is
+			// #22 (F7-c3): also stamp elemisstr/elemisslice off the same
-			// preserved verbatim; the catch-all below would re-stamp it.
+			// chased element tinfo. Without them a chained index whose
+			// element is a str/slice (`m[i][k]` over [N][M]str) loaded
+			// only the ptr word — the 24B/16B header (len/cap) was
+			// dropped (stale BX/CX) → garbage .len downstream. cstage's
+			// idx_eff path classifies the element uniformly via
+			// type_isstr/type_isslice (cmd/w6c/cgen.c); align ww UP by
+			// reading the SAME stamp the esz read above uses. CLASS-N:
+			// the corpus has no chained str/slice element, so the prior
+			// byte-id is preserved (this only fires on the missed shape).
 			let et: *tinfo = n.type_: *tinfo;
 			if (et != nil) {
 				esz = et.size: i32;
 				signed_elem = typeissigned(et);
+				elemisstr = typeisstr(et);
+				elemisslice = typeisslice(et);
 				float_elem = typeisfloat(et);
 				f32_elem = typeisf32(et);
 				elem_isarray = tinfoisarray(et);

selfhost/cmd/wwdump/main.combined.ww

@@ -24573,13 +24573,23 @@ fn cgindex(c: *cgen, n: *node) void = {
 			// stamped outer element tinfo (indexresult over the inner
 			// index's value type). cstage reads base->type->sub->size
 			// for esz (cmd/w6c/cgen.c:2070-2071). Drops the
-			// indexvaluetnode walk. Kept as its OWN arm (it does not set
+			// indexvaluetnode walk.
-			// elemisstr/elemisslice) so the chained-index byte-id is
+			// #22 (F7-c3): also stamp elemisstr/elemisslice off the same
-			// preserved verbatim; the catch-all below would re-stamp it.
+			// chased element tinfo. Without them a chained index whose
+			// element is a str/slice (`m[i][k]` over [N][M]str) loaded
+			// only the ptr word — the 24B/16B header (len/cap) was
+			// dropped (stale BX/CX) → garbage .len downstream. cstage's
+			// idx_eff path classifies the element uniformly via
+			// type_isstr/type_isslice (cmd/w6c/cgen.c); align ww UP by
+			// reading the SAME stamp the esz read above uses. CLASS-N:
+			// the corpus has no chained str/slice element, so the prior
+			// byte-id is preserved (this only fires on the missed shape).
 			let et: *tinfo = n.type_: *tinfo;
 			if (et != nil) {
 				esz = et.size: i32;
 				signed_elem = typeissigned(et);
+				elemisstr = typeisstr(et);
+				elemisslice = typeisslice(et);
 				float_elem = typeisfloat(et);
 				f32_elem = typeisf32(et);
 				elem_isarray = tinfoisarray(et);

test/wcc/989_chainidx_run.c

@@ -0,0 +1,196 @@
+/*
+ * 989_chainidx_run — F7-c3 (#22): a CHAINED index `m[i][k]` whose element
+ * is a str/slice must load the full 24B/16B header, both stages.
+ *
+ * THE BUG (cat-A silent miscompile, gate-blind): cgindex
+ * (selfhost/cmd/wcc/cgenexpr.ww) has a dedicated arm for a chained index
+ * (the outer index's base is itself an N_INDEX). That arm read the
+ * checker-stamped element tinfo for esz/signedness/float-ness but NOT for
+ * elemisstr/elemisslice — so a chained index over [N][M]str / [N][M][]T
+ * loaded only the .ptr word and left .len/.cap as stale BX/CX. cstage's
+ * idx_eff path classifies the element uniformly (type_isstr/type_isslice),
+ * so it loaded the full header and ran correct — the cat-A divergence.
+ * 990-997 stay green because the bootstrap corpus never chains an index
+ * to a str/slice element; only a runtime row catches it. THE FIX: the
+ * chained-index arm stamps elemisstr/elemisslice off the SAME element
+ * tinfo it already reads for esz, aligning wwstage UP.
+ *
+ * NB: the [N][M] arrays are built by per-element store — the nested array
+ * literal `[[..],[..]]` is independently #270-1c-blocked (orthogonal).
+ *
+ * Rows (each builds+runs on cstage `ww` and, when present, wwstage `ww_ww`;
+ * rule-10 — both stages must agree AND hit want_exit):
+ *   row                | shape                              | want
+ *   -------------------+------------------------------------+------
+ *   chain_str_read     | let s = m[1][1]; len(s)  m:[2][2]str | 5  [#22 bug]
+ *   chain_str_call     | take(m[1][1])            m:[2][2]str | 5  [#22+#46:
+ *                      |   needs the c2 push AND this c3 read]
+ *   chain_slice_read   | let xs = m[1][1]; len(xs) m:[2][2][]int | 7 [#22 bug]
+ *   chain_scalar_read  | m[1][1]                  m:[2][2]int  | 42 (control:
+ *                      |   the scalar chained index the arm already handled —
+ *                      |   c3 must not regress its byte-id)
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row {
+	const char *label;
+	const char *src;
+	int want_exit;
+};
+
+static const struct row rows[] = {
+	/* (1) #22 — chained str element READ. m[1][1] = "ddddd", len 5. The
+	 * chained-index arm dropped the .len load → garbage. */
+	{ "chain_str_read",
+	  "package main;\n"
+	  "export fn main() int = {\n"
+	  "	let m: [2][2]str;\n"
+	  "	m[0][0] = \"aa\"; m[0][1] = \"bbb\";\n"
+	  "	m[1][0] = \"c\";  m[1][1] = \"ddddd\";\n"
+	  "	let s: str = m[1][1];\n"
+	  "	return len(s): int;\n"
+	  "};\n",
+	  5 },
+
+	/* (2) #22+#46 — chained str element as a CALL ARG. Needs both the c2
+	 * push-side recognizer (nodeisstr N_INDEX arm) AND this c3 read-side
+	 * header load; pinned here where both halves are present. len 5. */
+	{ "chain_str_call",
+	  "package main;\n"
+	  "fn take(s: str) int = { return len(s): int; };\n"
+	  "export fn main() int = {\n"
+	  "	let m: [2][2]str;\n"
+	  "	m[0][0] = \"aa\"; m[0][1] = \"bbb\";\n"
+	  "	m[1][0] = \"c\";  m[1][1] = \"ddddd\";\n"
+	  "	return take(m[1][1]);\n"
+	  "};\n",
+	  5 },
+
+	/* (3) #22 — chained slice element READ. m[1][1] = b (len 7). The arm
+	 * dropped the .len/.cap load for the 24B slice header. */
+	{ "chain_slice_read",
+	  "package main;\n"
+	  "export fn main() int = {\n"
+	  "	let a: []int = [1, 2];\n"
+	  "	let b: []int = [9, 9, 9, 9, 9, 9, 9];\n"
+	  "	let m: [2][2][]int;\n"
+	  "	m[0][0] = a; m[0][1] = a;\n"
+	  "	m[1][0] = a; m[1][1] = b;\n"
+	  "	let xs: []int = m[1][1];\n"
+	  "	return len(xs): int;\n"
+	  "};\n",
+	  7 },
+
+	/* (4) control — chained SCALAR element. The arm already handled the
+	 * scalar esz; c3 must not regress its byte-id. m[1][1] == 42. */
+	{ "chain_scalar_read",
+	  "package main;\n"
+	  "export fn main() int = {\n"
+	  "	let m: [2][2]int;\n"
+	  "	m[0][0] = 1; m[0][1] = 2;\n"
+	  "	m[1][0] = 3; m[1][1] = 42;\n"
+	  "	return m[1][1]: int;\n"
+	  "};\n",
+	  42 },
+};
+
+/* run_build — build+run `src` via `driver`; returns the binary's exit
+ * code, or -1 on a build failure. */
+static int
+run_build(const char *driver, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/chainidx_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/chainidx_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -2;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, src);
+	int brc = runwait(cmd);
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+	int got = -1;
+	if (brc == 0) got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return brc == 0 ? got : -1;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024], wdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+
+	struct { const char *name; const char *drv; int gated; }
+	drivers[] = {
+		{ "cstage",  cdrv, 0 },
+		{ "wwstage", wdrv, 1 },
+		{ NULL, NULL, 0 },
+	};
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int d = 0; drivers[d].name; d++) {
+		if (drivers[d].gated && access(drivers[d].drv, X_OK) != 0) {
+			fprintf(stderr, "chainidx_run: skip %s (no %s)\n",
+			    drivers[d].name, drivers[d].drv);
+			continue;
+		}
+		for (int i = 0; i < n; i++) {
+			total++;
+			int got = run_build(drivers[d].drv, &rows[i], i);
+			if (got != rows[i].want_exit) {
+				fprintf(stderr, "chainidx_run[%s][%s]: exit=%d "
+				    "want=%d\n", drivers[d].name, rows[i].label,
+				    got, rows[i].want_exit);
+				fail++;
+			}
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "chainidx_run: %d/%d fixtures failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("chainidx_run: %d/%d ok\n", total, total);
+	return 0;
+}