Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wcc: loop-label stack guards its depth loudly, both stages

Browse Source 
wwstage's unguarded loop-label push wrote out of bounds at depth 17
(compiler-heap corruption); cstage guarded but emitted a wrong break
target. Loud cap error at the limit, both stages, agreeing wording.
This commit is contained in:
Hojun-Cho
2026-06-13 04:34:36 +09:00
parent 92cd573197
commit f7845057a7
6 changed files with 244 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
selfhost/cmd/wwdump/main.combined.ww
View File

@@ -38835,6 +38835,14 @@ fn cgfor(c: *cgen, n: *node) void = {
emitline("\tJE\t"); emitline(naturall); emitline("\n");
};
// #42: bound the push. The buffers are sized exactly LOOP_MAX, so an
// unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write;
// fail loud at the cap, both stages (cgen.c twin fatals too).
if (c.looptop >= LOOP_MAX) {
let msg: str = "cgen: loop nesting too deep\n";
os.write(2, msg.ptr, msg.len: u64);
os.exit(1);
};
c.loopendbuf[c.looptop] = endl;
c.loopcontbuf[c.looptop] = conttgt;
c.looptop += 1;
@@ -39714,6 +39722,14 @@ fn cgforrange(c: *cgen, n: *node) void = {
// the value that triggered continue. Dedicated `rpost` label.
let rpost: str = mklabel(c, "rpost");
// #42: bound the push. The buffers are sized exactly LOOP_MAX, so an
// unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write;
// fail loud at the cap, both stages (cgen.c twin fatals too).
if (c.looptop >= LOOP_MAX) {
let msg: str = "cgen: loop nesting too deep\n";
os.write(2, msg.ptr, msg.len: u64);
os.exit(1);
};
c.loopcontbuf[c.looptop] = rpost;
c.loopendbuf[c.looptop] = endl;
c.looptop += 1;