wcc: loop-label stack guards its depth loudly, both stages

wwstage's unguarded loop-label push wrote out of bounds at depth 17
(compiler-heap corruption); cstage guarded but emitted a wrong break
target. Loud cap error at the limit, both stages, agreeing wording.

Makefile

@@ -261,6 +261,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_defdim_argslice_run \
 	  $(BIN)/test_slttypepref_run \
 	  $(BIN)/test_defercap_run \
+	  $(BIN)/test_loopcap_run \
 	  $(BIN)/test_ampfncollide_run \
 	  $(BIN)/test_trycallcollide_run \
 	  $(BIN)/test_gunsigned_run \
@@ -806,6 +807,16 @@ $(BIN)/test_defercap_run: test/wcc/989_defercap_run.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+# 989_loopcap_run (#42, F13 c2): the loop-label stack fails loud at its cap
+# (LOOP_MAX) in BOTH stages instead of an OOB heap write (ww) / wrong jump
+# target (cstage). Builds/rejects on both driver twins (rule-10). See header.
+$(BIN)/test_loopcap_run: test/wcc/989_loopcap_run.c \
+		$(BIN)/ww $(BIN)/ww_ww \
+		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 # 989_ampfncollide_run (#4, c2): `&fn` synthesis (unoptype TK_AMP +
 # assignableaddrfn) prefers the current module's fn when a same-leaf fn is
 # declared in a later module. Builds/rejects on BOTH driver twins (rule-10).

cmd/w6c/cgen.c

@@ -14282,11 +14282,13 @@ cgstmt(Cg *c, Node *n, Local **locals, int *frame)
 		 * continue. Dedicated `rpost` label; bootstrap-NEUTRAL (no
 		 * range-form continue callers in lib/ or selfhost/). */
 		char *rpost = mklabel(c, "rpost");
-		if (nloops < LOOP_MAX) {
+		/* #42: at the cap, fail loud rather than silently push a wrong
+		 * break/continue target (the ww twin in cgenstmt.ww guards too). */
+		if (nloops >= LOOP_MAX)
+			fatal("cgen: loop nesting too deep");
 		loop_cont[nloops] = rpost;
 		loop_brk[nloops] = end;
 		nloops++;
-		}
 		label(c, loop);
 		ins2(c, A_MOVQ, amem(D_BP, ioff), areg(D_AX));
 		ins2(c, A_MOVQ, amem(D_BP, loff), areg(D_BX));
@@ -14430,11 +14432,13 @@ cgstmt(Cg *c, Node *n, Local **locals, int *frame)
 			ins2(c, A_CMPQ, aimm(0), areg(D_AX));
 			ins1(c, A_JE, abranch(natural_exit));
 		}
-		if (nloops < LOOP_MAX) {
+		/* #42: at the cap, fail loud rather than silently push a wrong
+		 * break/continue target (the ww twin in cgenstmt.ww guards too). */
+		if (nloops >= LOOP_MAX)
+			fatal("cgen: loop nesting too deep");
 		loop_cont[nloops] = cont_target;
 		loop_brk[nloops] = end;
 		nloops++;
-		}
 		cgstmt(c, n->body, locals, frame);
 		if (nloops > 0) nloops--;
 		if (n->rhs) {

selfhost/cmd/w6c/main.combined.ww

@@ -38835,6 +38835,14 @@ fn cgfor(c: *cgen, n: *node) void = {
 		emitline("\tJE\t"); emitline(naturall); emitline("\n");
 	};
 
+	// #42: bound the push. The buffers are sized exactly LOOP_MAX, so an
+	// unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write;
+	// fail loud at the cap, both stages (cgen.c twin fatals too).
+	if (c.looptop >= LOOP_MAX) {
+		let msg: str = "cgen: loop nesting too deep\n";
+		os.write(2, msg.ptr, msg.len: u64);
+		os.exit(1);
+	};
 	c.loopendbuf[c.looptop]  = endl;
 	c.loopcontbuf[c.looptop] = conttgt;
 	c.looptop += 1;
@@ -39714,6 +39722,14 @@ fn cgforrange(c: *cgen, n: *node) void = {
 	// the value that triggered continue. Dedicated `rpost` label.
 	let rpost: str = mklabel(c, "rpost");
 
+	// #42: bound the push. The buffers are sized exactly LOOP_MAX, so an
+	// unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write;
+	// fail loud at the cap, both stages (cgen.c twin fatals too).
+	if (c.looptop >= LOOP_MAX) {
+		let msg: str = "cgen: loop nesting too deep\n";
+		os.write(2, msg.ptr, msg.len: u64);
+		os.exit(1);
+	};
 	c.loopcontbuf[c.looptop] = rpost;
 	c.loopendbuf[c.looptop]  = endl;
 	c.looptop += 1;

selfhost/cmd/wcc/cgenstmt.ww

@@ -3202,6 +3202,14 @@ fn cgfor(c: *cgen, n: *node) void = {
 		emitline("\tJE\t"); emitline(naturall); emitline("\n");
 	};
 
+	// #42: bound the push. The buffers are sized exactly LOOP_MAX, so an
+	// unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write;
+	// fail loud at the cap, both stages (cgen.c twin fatals too).
+	if (c.looptop >= LOOP_MAX) {
+		let msg: str = "cgen: loop nesting too deep\n";
+		os.write(2, msg.ptr, msg.len: u64);
+		os.exit(1);
+	};
 	c.loopendbuf[c.looptop]  = endl;
 	c.loopcontbuf[c.looptop] = conttgt;
 	c.looptop += 1;
@@ -4081,6 +4089,14 @@ fn cgforrange(c: *cgen, n: *node) void = {
 	// the value that triggered continue. Dedicated `rpost` label.
 	let rpost: str = mklabel(c, "rpost");
 
+	// #42: bound the push. The buffers are sized exactly LOOP_MAX, so an
+	// unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write;
+	// fail loud at the cap, both stages (cgen.c twin fatals too).
+	if (c.looptop >= LOOP_MAX) {
+		let msg: str = "cgen: loop nesting too deep\n";
+		os.write(2, msg.ptr, msg.len: u64);
+		os.exit(1);
+	};
 	c.loopcontbuf[c.looptop] = rpost;
 	c.loopendbuf[c.looptop]  = endl;
 	c.looptop += 1;

selfhost/cmd/wwdump/main.combined.ww

@@ -38835,6 +38835,14 @@ fn cgfor(c: *cgen, n: *node) void = {
 		emitline("\tJE\t"); emitline(naturall); emitline("\n");
 	};
 
+	// #42: bound the push. The buffers are sized exactly LOOP_MAX, so an
+	// unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write;
+	// fail loud at the cap, both stages (cgen.c twin fatals too).
+	if (c.looptop >= LOOP_MAX) {
+		let msg: str = "cgen: loop nesting too deep\n";
+		os.write(2, msg.ptr, msg.len: u64);
+		os.exit(1);
+	};
 	c.loopendbuf[c.looptop]  = endl;
 	c.loopcontbuf[c.looptop] = conttgt;
 	c.looptop += 1;
@@ -39714,6 +39722,14 @@ fn cgforrange(c: *cgen, n: *node) void = {
 	// the value that triggered continue. Dedicated `rpost` label.
 	let rpost: str = mklabel(c, "rpost");
 
+	// #42: bound the push. The buffers are sized exactly LOOP_MAX, so an
+	// unguarded push at nesting depth LOOP_MAX+1 is an OOB heap write;
+	// fail loud at the cap, both stages (cgen.c twin fatals too).
+	if (c.looptop >= LOOP_MAX) {
+		let msg: str = "cgen: loop nesting too deep\n";
+		os.write(2, msg.ptr, msg.len: u64);
+		os.exit(1);
+	};
 	c.loopcontbuf[c.looptop] = rpost;
 	c.loopendbuf[c.looptop]  = endl;
 	c.looptop += 1;

test/wcc/989_loopcap_run.c

@@ -0,0 +1,171 @@
+/*
+ * 989_loopcap_run (#42, F13 c2) — the loop-label stack must fail loud at its
+ * cap in BOTH stages, not silently corrupt the heap / emit a wrong target.
+ *
+ * THE BUG (cat-A): wwstage cgfor / cgforrange pushed end+continue labels into
+ * loopendbuf/loopcontbuf (sized exactly LOOP_MAX=16) with NO bounds check, so
+ * nesting depth 17 wrote one past the heap allocation — silent compiler-heap
+ * corruption. The cstage twins DID guard (`if (nloops < LOOP_MAX)`) but then
+ * silently emitted the 16th loop's break/continue label for the 17th loop — a
+ * wrong jump target, also silent. Both stages were wrong at the boundary and
+ * diverged. The runtime-correct target (CAP-SEMANTICS rule): a hard compile
+ * error at the shared cap (LOOP_MAX) in BOTH stages — ww adds the bounds
+ * check, cstage turns its silent skip into a fatal.
+ *
+ *   row         | depth | shape                       | result (cs==ww)
+ *   ------------+-------+-----------------------------+-----------------
+ *   at_cap_16   | 16    | exactly LOOP_MAX nested for | exit 0 (byte-id)
+ *   over_cap_17 | 17    | one past the cap            | build FAILS loud
+ *
+ * over_cap_17 was RED pre-c2 on BOTH stages (ww OOB write, cs wrong JMP
+ * target, divergent and silent under rc=0). at_cap_16 pins the boundary stays
+ * accepted byte-identically.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row { const char *label; int depth; int want_build_fail; int want_exit; };
+
+static const struct row rows[] = {
+	{ "at_cap_16",   16, 0, 0 },
+	{ "over_cap_17", 17, 1, 0 },
+};
+
+/* Emit `depth` nested `for (n < 1) { ... }` over one shared counter that the
+ * innermost body sets to 1, so every level terminates. */
+static int
+write_src(const char *path, int depth)
+{
+	FILE *f = fopen(path, "wb");
+	if (!f) return -1;
+	fputs("package main;\n"
+	      "export fn main() i32 = {\n"
+	      "\tlet n: i32 = 0;\n\t", f);
+	for (int i = 0; i < depth; i++) fputs("for (n < 1) { ", f);
+	fputs("n = 1;", f);
+	for (int i = 0; i < depth; i++) fputs(" };", f);
+	fputs("\n\treturn 0;\n};\n", f);
+	fclose(f);
+	return 0;
+}
+
+static int
+build_run(const char *driver, const struct row *r, int i, int *brc)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/lcap_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/lcap_%d_d_%d", getpid(), i);
+
+	if (write_src(src, r->depth) != 0) { *brc = -1; return -1; }
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, src);
+	*brc = runwait(cmd);
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+	int got = -1;
+	if (*brc == 0) got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return got;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024], wdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+	int have_ww = (access(wdrv, X_OK) == 0);
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int i = 0; i < n; i++) {
+		total++;
+		int cbrc, gc = build_run(cdrv, &rows[i], i, &cbrc);
+
+		if (rows[i].want_build_fail) {
+			if (cbrc == 0) {
+				fprintf(stderr, "loopcap[cstage][%s]: built rc=0, "
+				    "expected loud build failure (#42)\n", rows[i].label);
+				fail++;
+			}
+		} else {
+			if (cbrc != 0 || gc != rows[i].want_exit) {
+				fprintf(stderr, "loopcap[cstage][%s]: brc=%d exit=%d "
+				    "want_exit=%d\n", rows[i].label, cbrc, gc,
+				    rows[i].want_exit);
+				fail++;
+			}
+		}
+
+		if (!have_ww) {
+			fprintf(stderr, "loopcap: skip wwstage (no %s)\n", wdrv);
+			continue;
+		}
+		int wbrc, gw = build_run(wdrv, &rows[i], i, &wbrc);
+
+		if (rows[i].want_build_fail) {
+			if (wbrc == 0) {
+				fprintf(stderr, "loopcap[wwstage][%s]: built rc=0, "
+				    "expected loud build failure (#42)\n", rows[i].label);
+				fail++;
+			}
+			if ((cbrc == 0) != (wbrc == 0)) {
+				fprintf(stderr, "loopcap[%s]: build-fail divergence "
+				    "cs_rc=%d ww_rc=%d (#42)\n", rows[i].label, cbrc, wbrc);
+				fail++;
+			}
+		} else {
+			if (wbrc != 0 || gw != rows[i].want_exit) {
+				fprintf(stderr, "loopcap[wwstage][%s]: brc=%d exit=%d "
+				    "want_exit=%d\n", rows[i].label, wbrc, gw,
+				    rows[i].want_exit);
+				fail++;
+			}
+			if (gw != gc) {
+				fprintf(stderr, "loopcap[%s]: cs=%d != ww=%d "
+				    "(loop-cap divergence — #42)\n", rows[i].label, gc, gw);
+				fail++;
+			}
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "loopcap_run: %d/%d checks failed\n", fail, total);
+		return 1;
+	}
+	printf("loopcap_run: %d/%d ok\n", total, total);
+	return 0;
+}