diff --git a/Makefile b/Makefile index 4260809f..7dc1287b 100644 --- a/Makefile +++ b/Makefile @@ -261,6 +261,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_defdim_argslice_run \ $(BIN)/test_slttypepref_run \ $(BIN)/test_defercap_run \ + $(BIN)/test_loopcap_run \ $(BIN)/test_ampfncollide_run \ $(BIN)/test_trycallcollide_run \ $(BIN)/test_gunsigned_run \ @@ -806,6 +807,16 @@ $(BIN)/test_defercap_run: test/wcc/989_defercap_run.c \ $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +# 989_loopcap_run (#42, F13 c2): the loop-label stack fails loud at its cap +# (LOOP_MAX) in BOTH stages instead of an OOB heap write (ww) / wrong jump +# target (cstage). Builds/rejects on both driver twins (rule-10). See header. +$(BIN)/test_loopcap_run: test/wcc/989_loopcap_run.c \ + $(BIN)/ww $(BIN)/ww_ww \ + $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + # 989_ampfncollide_run (#4, c2): `&fn` synthesis (unoptype TK_AMP + # assignableaddrfn) prefers the current module's fn when a same-leaf fn is # declared in a later module. Builds/rejects on BOTH driver twins (rule-10). diff --git a/cmd/w6c/cgen.c b/cmd/w6c/cgen.c index f126b079..9275403f 100644 --- a/cmd/w6c/cgen.c +++ b/cmd/w6c/cgen.c @@ -14282,11 +14282,13 @@ cgstmt(Cg *c, Node *n, Local **locals, int *frame) * continue. Dedicated `rpost` label; bootstrap-NEUTRAL (no * range-form continue callers in lib/ or selfhost/). */ char *rpost = mklabel(c, "rpost"); - if (nloops < LOOP_MAX) { - loop_cont[nloops] = rpost; - loop_brk[nloops] = end; - nloops++; - } + /* #42: at the cap, fail loud rather than silently push a wrong + * break/continue target (the ww twin in cgenstmt.ww guards too). */ + if (nloops >= LOOP_MAX) + fatal("cgen: loop nesting too deep"); + loop_cont[nloops] = rpost; + loop_brk[nloops] = end; + nloops++; label(c, loop); ins2(c, A_MOVQ, amem(D_BP, ioff), areg(D_AX)); ins2(c, A_MOVQ, amem(D_BP, loff), areg(D_BX)); @@ -14430,11 +14432,13 @@ cgstmt(Cg *c, Node *n, Local **locals, int *frame) ins2(c, A_CMPQ, aimm(0), areg(D_AX)); ins1(c, A_JE, abranch(natural_exit)); } - if (nloops < LOOP_MAX) { - loop_cont[nloops] = cont_target; - loop_brk[nloops] = end; - nloops++; - } + /* #42: at the cap, fail loud rather than silently push a wrong + * break/continue target (the ww twin in cgenstmt.ww guards too). */ + if (nloops >= LOOP_MAX) + fatal("cgen: loop nesting too deep"); + loop_cont[nloops] = cont_target; + loop_brk[nloops] = end; + nloops++; cgstmt(c, n->body, locals, frame); if (nloops > 0) nloops--; if (n->rhs) { diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index 970e9f59..225db528 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -38835,6 +38835,14 @@ fn cgfor(c: *cgen, n: *node) void = { emitline("\tJE\t"); emitline(naturall); emitline("\n"); }; + // #42: bound the push. The buffers are sized exactly LOOP_MAX, so an + // unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write; + // fail loud at the cap, both stages (cgen.c twin fatals too). + if (c.looptop >= LOOP_MAX) { + let msg: str = "cgen: loop nesting too deep\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); + }; c.loopendbuf[c.looptop] = endl; c.loopcontbuf[c.looptop] = conttgt; c.looptop += 1; @@ -39714,6 +39722,14 @@ fn cgforrange(c: *cgen, n: *node) void = { // the value that triggered continue. Dedicated `rpost` label. let rpost: str = mklabel(c, "rpost"); + // #42: bound the push. The buffers are sized exactly LOOP_MAX, so an + // unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write; + // fail loud at the cap, both stages (cgen.c twin fatals too). + if (c.looptop >= LOOP_MAX) { + let msg: str = "cgen: loop nesting too deep\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); + }; c.loopcontbuf[c.looptop] = rpost; c.loopendbuf[c.looptop] = endl; c.looptop += 1; diff --git a/selfhost/cmd/wcc/cgenstmt.ww b/selfhost/cmd/wcc/cgenstmt.ww index b14acc54..d2c8422c 100644 --- a/selfhost/cmd/wcc/cgenstmt.ww +++ b/selfhost/cmd/wcc/cgenstmt.ww @@ -3202,6 +3202,14 @@ fn cgfor(c: *cgen, n: *node) void = { emitline("\tJE\t"); emitline(naturall); emitline("\n"); }; + // #42: bound the push. The buffers are sized exactly LOOP_MAX, so an + // unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write; + // fail loud at the cap, both stages (cgen.c twin fatals too). + if (c.looptop >= LOOP_MAX) { + let msg: str = "cgen: loop nesting too deep\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); + }; c.loopendbuf[c.looptop] = endl; c.loopcontbuf[c.looptop] = conttgt; c.looptop += 1; @@ -4081,6 +4089,14 @@ fn cgforrange(c: *cgen, n: *node) void = { // the value that triggered continue. Dedicated `rpost` label. let rpost: str = mklabel(c, "rpost"); + // #42: bound the push. The buffers are sized exactly LOOP_MAX, so an + // unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write; + // fail loud at the cap, both stages (cgen.c twin fatals too). + if (c.looptop >= LOOP_MAX) { + let msg: str = "cgen: loop nesting too deep\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); + }; c.loopcontbuf[c.looptop] = rpost; c.loopendbuf[c.looptop] = endl; c.looptop += 1; diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index c01d0271..10e1654a 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -38835,6 +38835,14 @@ fn cgfor(c: *cgen, n: *node) void = { emitline("\tJE\t"); emitline(naturall); emitline("\n"); }; + // #42: bound the push. The buffers are sized exactly LOOP_MAX, so an + // unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write; + // fail loud at the cap, both stages (cgen.c twin fatals too). + if (c.looptop >= LOOP_MAX) { + let msg: str = "cgen: loop nesting too deep\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); + }; c.loopendbuf[c.looptop] = endl; c.loopcontbuf[c.looptop] = conttgt; c.looptop += 1; @@ -39714,6 +39722,14 @@ fn cgforrange(c: *cgen, n: *node) void = { // the value that triggered continue. Dedicated `rpost` label. let rpost: str = mklabel(c, "rpost"); + // #42: bound the push. The buffers are sized exactly LOOP_MAX, so an + // unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write; + // fail loud at the cap, both stages (cgen.c twin fatals too). + if (c.looptop >= LOOP_MAX) { + let msg: str = "cgen: loop nesting too deep\n"; + os.write(2, msg.ptr, msg.len: u64); + os.exit(1); + }; c.loopcontbuf[c.looptop] = rpost; c.loopendbuf[c.looptop] = endl; c.looptop += 1; diff --git a/test/wcc/989_loopcap_run.c b/test/wcc/989_loopcap_run.c new file mode 100644 index 00000000..5fee08ba --- /dev/null +++ b/test/wcc/989_loopcap_run.c @@ -0,0 +1,171 @@ +/* + * 989_loopcap_run (#42, F13 c2) — the loop-label stack must fail loud at its + * cap in BOTH stages, not silently corrupt the heap / emit a wrong target. + * + * THE BUG (cat-A): wwstage cgfor / cgforrange pushed end+continue labels into + * loopendbuf/loopcontbuf (sized exactly LOOP_MAX=16) with NO bounds check, so + * nesting depth 17 wrote one past the heap allocation — silent compiler-heap + * corruption. The cstage twins DID guard (`if (nloops < LOOP_MAX)`) but then + * silently emitted the 16th loop's break/continue label for the 17th loop — a + * wrong jump target, also silent. Both stages were wrong at the boundary and + * diverged. The runtime-correct target (CAP-SEMANTICS rule): a hard compile + * error at the shared cap (LOOP_MAX) in BOTH stages — ww adds the bounds + * check, cstage turns its silent skip into a fatal. + * + * row | depth | shape | result (cs==ww) + * ------------+-------+-----------------------------+----------------- + * at_cap_16 | 16 | exactly LOOP_MAX nested for | exit 0 (byte-id) + * over_cap_17 | 17 | one past the cap | build FAILS loud + * + * over_cap_17 was RED pre-c2 on BOTH stages (ww OOB write, cs wrong JMP + * target, divergent and silent under rc=0). at_cap_16 pins the boundary stays + * accepted byte-identically. + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { const char *label; int depth; int want_build_fail; int want_exit; }; + +static const struct row rows[] = { + { "at_cap_16", 16, 0, 0 }, + { "over_cap_17", 17, 1, 0 }, +}; + +/* Emit `depth` nested `for (n < 1) { ... }` over one shared counter that the + * innermost body sets to 1, so every level terminates. */ +static int +write_src(const char *path, int depth) +{ + FILE *f = fopen(path, "wb"); + if (!f) return -1; + fputs("package main;\n" + "export fn main() i32 = {\n" + "\tlet n: i32 = 0;\n\t", f); + for (int i = 0; i < depth; i++) fputs("for (n < 1) { ", f); + fputs("n = 1;", f); + for (int i = 0; i < depth; i++) fputs(" };", f); + fputs("\n\treturn 0;\n};\n", f); + fclose(f); + return 0; +} + +static int +build_run(const char *driver, const struct row *r, int i, int *brc) +{ + char src[64], tmpdir[64], cmd[1024]; + snprintf(src, sizeof src, "/tmp/lcap_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/lcap_%d_d_%d", getpid(), i); + + if (write_src(src, r->depth) != 0) { *brc = -1; return -1; } + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null", + tmpdir, driver, src); + *brc = runwait(cmd); + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[128]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + + int got = -1; + if (*brc == 0) got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return got; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[1024]; + if (bin[0] != '/') { + char cwd[1024]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[1024], wdrv[1024]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + int have_ww = (access(wdrv, X_OK) == 0); + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + + for (int i = 0; i < n; i++) { + total++; + int cbrc, gc = build_run(cdrv, &rows[i], i, &cbrc); + + if (rows[i].want_build_fail) { + if (cbrc == 0) { + fprintf(stderr, "loopcap[cstage][%s]: built rc=0, " + "expected loud build failure (#42)\n", rows[i].label); + fail++; + } + } else { + if (cbrc != 0 || gc != rows[i].want_exit) { + fprintf(stderr, "loopcap[cstage][%s]: brc=%d exit=%d " + "want_exit=%d\n", rows[i].label, cbrc, gc, + rows[i].want_exit); + fail++; + } + } + + if (!have_ww) { + fprintf(stderr, "loopcap: skip wwstage (no %s)\n", wdrv); + continue; + } + int wbrc, gw = build_run(wdrv, &rows[i], i, &wbrc); + + if (rows[i].want_build_fail) { + if (wbrc == 0) { + fprintf(stderr, "loopcap[wwstage][%s]: built rc=0, " + "expected loud build failure (#42)\n", rows[i].label); + fail++; + } + if ((cbrc == 0) != (wbrc == 0)) { + fprintf(stderr, "loopcap[%s]: build-fail divergence " + "cs_rc=%d ww_rc=%d (#42)\n", rows[i].label, cbrc, wbrc); + fail++; + } + } else { + if (wbrc != 0 || gw != rows[i].want_exit) { + fprintf(stderr, "loopcap[wwstage][%s]: brc=%d exit=%d " + "want_exit=%d\n", rows[i].label, wbrc, gw, + rows[i].want_exit); + fail++; + } + if (gw != gc) { + fprintf(stderr, "loopcap[%s]: cs=%d != ww=%d " + "(loop-cap divergence — #42)\n", rows[i].label, gc, gw); + fail++; + } + } + } + + if (fail) { + fprintf(stderr, "loopcap_run: %d/%d checks failed\n", fail, total); + return 1; + } + printf("loopcap_run: %d/%d ok\n", total, total); + return 0; +}