wcc_ww/check: inferred struct-lit let plants the synthesized TNAME — field(SB) name-leak + tagged-field assign bound (#24)

For an annotation-less `let p = pt{...}` checkletassign planted exprtype's
N_STRUCTLIT result — the struct decl's BODY node (N_TSTRUCT, per #66) — as
the let's type. Every cgen local-arm dispatch (cgdot read, cgassign
tagged-field store, the alias peel) is N_TNAME-keyed, so the body matched
no arm: field reads fell to the module-qualified fallback and emitted the
FIELD NAME as a global symbol (MOVQ f(SB) — link-fail, #211 name-leak
family; silent corruption if a same-named global exists), and a tagged-
field assign fell to the assign-resolver TY_TAGGED loud bound. Both PG5
wwstage symptoms, one root; plain structs leaked too. Normalizing the
inferred binding to the synthesized TNAME (mktname + tinfofornode stamp)
routes every consumer down the already-byte-id annotated path. cstage
needs no twin: check.c:1477 clet carries Sym.type (tinfo) and its
emission is annotation-invariant (probed). Test 811: 10 rows x 2 drivers
+ 10 asm-byte-id; pre-fix wwstage link-fails every unannotated row
(incl. the `...` autofill and parenthesized forms; nested s.f.g ran
but cs!=ww asm).
This commit is contained in:
2026-06-05 02:20:15 +09:00
parent 413aafa599
commit f88dbb01e2
5 changed files with 435 additions and 0 deletions

View File

@@ -398,6 +398,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
$(BIN)/test_insert_elem \
$(BIN)/test_arrlit_overlong \
$(BIN)/test_idx_structlit_store \
$(BIN)/test_inferred_let_struct \
$(BIN)/test_placeaddr_store \
$(BIN)/test_tryprop_multisuccess \
$(BIN)/test_append_place \
@@ -1086,6 +1087,19 @@ $(BIN)/test_idx_structlit_store: test/wcc/809_idx_structlit_store.c \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
# #24 (fold-5 prereq, PG5 wwstage pair): field read/assign through an
# annotation-less struct-literal binding `let p = pt{...}` — pre-fix
# the wwstage checker planted the struct BODY node (N_TSTRUCT) as the
# inferred let's type, no N_TNAME-keyed cgen arm matched, and `p.f`
# leaked the FIELD NAME as a global symbol (`MOVQ f(SB)`, link-fail;
# #211 name-leak family) while a tagged-field assign hit the
# assign-resolver loud bound. Runtime rows + asm byte-id per row.
$(BIN)/test_inferred_let_struct: test/wcc/811_inferred_let_struct.c \
$(BIN)/ww $(BIN)/w6c $(BIN)/w6c_ww $(BIN)/w6a $(BIN)/w6l \
$(BIN)/ww_ww \
$(LIB)/libwwrt.a | $(BIN)
$(CC) $(CFLAGS) -o $@ $<
# F8+F9 (tasks #5/#12, regex fold-2b): `?` interim single-success gate
# (|success| > 1 loud-rejected on BOTH stages until task #14's
# subset-union typing) + direct `f()? is T` / `match (f()?)` reject

View File

@@ -14627,6 +14627,24 @@ fn checkletassign(c: *checker, n: *node) void = {
// Defaulting (untyped_int → i32, etc.) is exprtype's job at use
// sites, not the binding site.
if (n.lhs == nil) {
// #24 (fold-5 prereq): a struct-lit init's exprtype returns the
// decl's BODY node (N_TSTRUCT, L3103 per #66) — but every cgen
// local-arm dispatch (cgdot read, cgassign tagged-field store,
// cgun addr-of) is N_TNAME-keyed, so planting the body dropped
// `p.f` to the module-qualified `MOVQ f(SB)` fallback (link-fail
// name-leak; #211 family). Normalize to the synthesized TNAME so
// the inferred binding is indistinguishable from the annotated
// one downstream. cstage needs no twin: check.c:1477 clet carries
// Sym.type (tinfo), and its emission is annotation-invariant
// (probed identical asm annotated vs not).
if (src != nil && src.kind == nkind.N_TSTRUCT
&& n.rhs.kind == nkind.N_STRUCTLIT
&& n.rhs.lhs != nil && n.rhs.lhs.kind == nkind.N_IDENT) {
let ltn: *node = mktname(c, n.rhs.lhs.str);
ltn.type_ = tinfofornode(c, ltn): *void;
n.lhs = ltn;
return;
};
if (src != nil) { n.lhs = src; };
return;
};

View File

@@ -4363,6 +4363,24 @@ fn checkletassign(c: *checker, n: *node) void = {
// Defaulting (untyped_int → i32, etc.) is exprtype's job at use
// sites, not the binding site.
if (n.lhs == nil) {
// #24 (fold-5 prereq): a struct-lit init's exprtype returns the
// decl's BODY node (N_TSTRUCT, L3103 per #66) — but every cgen
// local-arm dispatch (cgdot read, cgassign tagged-field store,
// cgun addr-of) is N_TNAME-keyed, so planting the body dropped
// `p.f` to the module-qualified `MOVQ f(SB)` fallback (link-fail
// name-leak; #211 family). Normalize to the synthesized TNAME so
// the inferred binding is indistinguishable from the annotated
// one downstream. cstage needs no twin: check.c:1477 clet carries
// Sym.type (tinfo), and its emission is annotation-invariant
// (probed identical asm annotated vs not).
if (src != nil && src.kind == nkind.N_TSTRUCT
&& n.rhs.kind == nkind.N_STRUCTLIT
&& n.rhs.lhs != nil && n.rhs.lhs.kind == nkind.N_IDENT) {
let ltn: *node = mktname(c, n.rhs.lhs.str);
ltn.type_ = tinfofornode(c, ltn): *void;
n.lhs = ltn;
return;
};
if (src != nil) { n.lhs = src; };
return;
};

View File

@@ -14627,6 +14627,24 @@ fn checkletassign(c: *checker, n: *node) void = {
// Defaulting (untyped_int → i32, etc.) is exprtype's job at use
// sites, not the binding site.
if (n.lhs == nil) {
// #24 (fold-5 prereq): a struct-lit init's exprtype returns the
// decl's BODY node (N_TSTRUCT, L3103 per #66) — but every cgen
// local-arm dispatch (cgdot read, cgassign tagged-field store,
// cgun addr-of) is N_TNAME-keyed, so planting the body dropped
// `p.f` to the module-qualified `MOVQ f(SB)` fallback (link-fail
// name-leak; #211 family). Normalize to the synthesized TNAME so
// the inferred binding is indistinguishable from the annotated
// one downstream. cstage needs no twin: check.c:1477 clet carries
// Sym.type (tinfo), and its emission is annotation-invariant
// (probed identical asm annotated vs not).
if (src != nil && src.kind == nkind.N_TSTRUCT
&& n.rhs.kind == nkind.N_STRUCTLIT
&& n.rhs.lhs != nil && n.rhs.lhs.kind == nkind.N_IDENT) {
let ltn: *node = mktname(c, n.rhs.lhs.str);
ltn.type_ = tinfofornode(c, ltn): *void;
n.lhs = ltn;
return;
};
if (src != nil) { n.lhs = src; };
return;
};

View File

@@ -0,0 +1,367 @@
/*
* 811_inferred_let_struct — cstage and wwstage agree, byte-for-byte and
* at runtime, on field access through an ANNOTATION-LESS struct-literal
* binding `let p = pt { ... };` (task #24, fold-5 prereq; the PG5
* wwstage pair).
*
* The bug (wwstage only): for an inferred binding the checker planted
* the struct decl's BODY node (N_TSTRUCT, exprtype N_STRUCTLIT returns
* ms.decl.lhs per #66) as the let's type — but every cgen local-arm
* dispatch (cgdot field read, cgassign tagged-field store, the alias
* peel) is N_TNAME-keyed. The body matched no arm, so `p.f` fell
* through to the module-qualified fallback and emitted the FIELD NAME
* as a global symbol (`MOVQ f(SB), AX` — the #211 name-leak family;
* loud at link, silent corruption if a same-named global exists), and
* a tagged-field assign fell to the assign-resolver's TY_TAGGED loud
* bound ("assign-resolver: tagged field not wired"). cstage was
* unaffected: check.c:1477 clet carries Sym.type (tinfo) and its
* emission is annotation-invariant.
*
* The fix (wwstage checker, check.ww checkletassign): normalize the
* inferred binding to the synthesized N_TNAME (mktname), making it
* indistinguishable from the annotated form downstream — every read/
* assign/is/as arm then takes the already-byte-id annotated route.
*
* Mutation coverage: on pre-fix wwstage every unannotated row LINK-
* FAILS (undefined reference to the field name), so run_driver's -1
* catches a regression outright; the annotated rows pin that the
* normalization didn't perturb the annotated path (byte-id rows assert
* cstage == wwstage asm for all rows).
*
* row | shape | want
* ---------------------+------------------------------------+------
* plain_read | let p = pt{..}; p.x*10 + p.y | 42
* tagged_read_is_as | (void|size) field: read + is/as | 6
* tagged_void_read | min=void; `is void` arm | 7
* tagged_assign | r.min = 2: size through inferred | 3
* tagged_str_field | (void|str): assign + as-str .len | 14
* boxed_prebound | field-wise build, box into union, | 103
* | match-extract, is/as (PG5h) |
* annotated_pin | same as tagged_assign but with an | 3
* | explicit `: rep` annotation |
* nested_read | plain nested s.f.g read (master | 42
* | ran right but cs!=ww asm) |
* ellipsis_fill | pt{ x = 4, ... } autofill (master | 40
* | wwstage link-failed) |
* paren_form | (pt{..}) — parser unwraps parens, | 42
* | same N_STRUCTLIT rhs (master |
* | wwstage link-failed) |
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
struct row { const char *label; const char *src; int want; };
static const struct row rows[] = {
{ "plain_read",
"package main;\n"
"type pt = struct { x: size, y: size };\n"
"export fn main() i32 = {\n"
"\tlet p = pt { x = 4: size, y = 2: size };\n"
"\treturn (p.x * 10 + p.y): i32;\n"
"};\n",
42 },
{ "tagged_read_is_as",
"package main;\n"
"type rep = struct { id: size, min: (void | size) };\n"
"export fn main() i32 = {\n"
"\tlet r = rep { id = 1: size, min = 5: size };\n"
"\tlet acc = 0: size;\n"
"\tacc += r.id;\n"
"\tif (r.min is size) { acc += r.min as size; };\n"
"\treturn acc: i32;\n"
"};\n",
6 },
{ "tagged_void_read",
"package main;\n"
"type rep = struct { id: size, min: (void | size) };\n"
"export fn main() i32 = {\n"
"\tlet r = rep { id = 0: size, min = void };\n"
"\tlet acc = 0: size;\n"
"\tif (r.min is void) { acc += 7; };\n"
"\tif (r.min is size) { acc += r.min as size; };\n"
"\treturn acc: i32;\n"
"};\n",
7 },
{ "tagged_assign",
"package main;\n"
"type rep = struct { id: size, min: (void | size) };\n"
"export fn main() i32 = {\n"
"\tlet r = rep { id = 0: size, min = void };\n"
"\tr.id = 1;\n"
"\tr.min = 2: size;\n"
"\tlet acc = 0: size;\n"
"\tacc += r.id;\n"
"\tif (r.min is size) { acc += r.min as size; };\n"
"\treturn acc: i32;\n"
"};\n",
3 },
{ "tagged_str_field",
"package main;\n"
"type rep = struct { id: size, min: (void | size), name: (void | str) };\n"
"export fn main() i32 = {\n"
"\tlet b = rep { id = 0: size, min = void, name = void };\n"
"\tb.id = 2;\n"
"\tb.min = 9: size;\n"
"\tb.name = \"hey\";\n"
"\tlet acc = 0: size;\n"
"\tacc += b.id;\n"
"\tif (b.min is size) { acc += b.min as size; };\n"
"\tif (b.name is str) { acc += (b.name as str).len: size; };\n"
"\treturn acc: i32;\n"
"};\n",
14 },
/* PG5h: field-wise construction through the inferred binding,
* boxed into a tagged union, match-extracted, is/as off the
* binding — the fold-5b inst_repeat consumer shape. */
{ "boxed_prebound",
"package main;\n"
"type inst_lit = rune;\n"
"type rep3 = struct { id: size, min: (void | size), max: (void | size) };\n"
"type inst = (inst_lit | rep3);\n"
"export fn main() i32 = {\n"
"\tlet r = rep3 { id = 0: size, min = void, max = void };\n"
"\tr.id = 1;\n"
"\tr.min = 2: size;\n"
"\tr.max = 5: size;\n"
"\tlet pre = 0: size;\n"
"\tif (r.min is size) { pre += r.min as size; };\n"
"\tif (pre != 2) { return 200 + pre: i32; };\n"
"\tlet v: inst = r;\n"
"\tlet acc = 0: size;\n"
"\tmatch (v) {\n"
"\tcase let ir: rep3 => {\n"
"\t\tacc += ir.id;\n"
"\t\tif (ir.min is size) { acc += ir.min as size; };\n"
"\t\tif (ir.max is size && ir.max as size == 5) { acc += 100; };\n"
"\t};\n"
"\tcase let l: inst_lit => { acc += 1; };\n"
"\t};\n"
"\treturn acc: i32;\n"
"};\n",
103 },
/* Regression pin: the explicit annotation must stay on its prior
* (already byte-id) route — the normalization only fires for the
* inferred binding. */
{ "annotated_pin",
"package main;\n"
"type rep = struct { id: size, min: (void | size) };\n"
"export fn main() i32 = {\n"
"\tlet r: rep = rep { id = 0: size, min = void };\n"
"\tr.id = 1;\n"
"\tr.min = 2: size;\n"
"\tlet acc = 0: size;\n"
"\tacc += r.id;\n"
"\tif (r.min is size) { acc += r.min as size; };\n"
"\treturn acc: i32;\n"
"};\n",
3 },
/* Plain nested s.f.g through the inferred binding: on master
* wwstage this RAN correctly but emitted different asm (the body-
* node planting took a divergent cgdot route) — pins byte-id. */
{ "nested_read",
"package main;\n"
"type in_ = struct { g: size };\n"
"type out_ = struct { f: in_ };\n"
"export fn main() i32 = {\n"
"\tlet s = out_ { f = in_ { g = 6: size } };\n"
"\treturn (s.f.g * 7): i32;\n"
"};\n",
42 },
/* Trailing-`...` autofill (parse/expr.ww TK_ELLIPSIS, stash on
* s.op): same N_STRUCTLIT rhs kind, so the normalization must
* cover it — master wwstage link-failed this form too. */
{ "ellipsis_fill",
"package main;\n"
"type pt = struct { x: size, y: size };\n"
"export fn main() i32 = {\n"
"\tlet p = pt { x = 4: size, ... };\n"
"\treturn (p.x * 10 + p.y): i32;\n"
"};\n",
40 },
/* Parenthesized literal: the parser unwraps parens (no N_PAREN
* node), so the rhs is the same bare N_STRUCTLIT — pins that the
* form-coverage claim holds at the parse layer. */
{ "paren_form",
"package main;\n"
"type pt = struct { x: size, y: size };\n"
"export fn main() i32 = {\n"
"\tlet p = (pt { x = 4: size, y = 2: size });\n"
"\treturn (p.x * 10 + p.y): i32;\n"
"};\n",
42 },
};
static int
run_driver(const char *driver, const struct row *r, int i)
{
char src[64], tmpdir[64], cmd[1024];
snprintf(src, sizeof src, "/tmp/ils_%d_%d.ww", getpid(), i);
snprintf(tmpdir, sizeof tmpdir, "/tmp/ils_%d_d_%d", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
mkdir(tmpdir, 0755);
snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
tmpdir, driver, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: build via %s failed\n",
r->label, driver);
unlink(src); rmdir(tmpdir);
return -1;
}
const char *base = strrchr(src, '/');
base = base ? base + 1 : src;
char outbin[128];
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
char *dot = strrchr(outbin, '.');
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
int got = runwait(outbin);
unlink(src); unlink(outbin); rmdir(tmpdir);
return got;
}
/* asm_byte_identical — generate .s via cstage's w6c and wwstage's
* w6c_ww and diff. Pre-fix the unannotated rows emitted `MOVQ
* <field>(SB), AX` on wwstage only, so the diff was non-empty (and
* the wwstage link failed). */
static int
asm_byte_identical(const char *bin, const struct row *r, int i)
{
char src[64], cs[64], ws[64], cmd[1024];
snprintf(src, sizeof src, "/tmp/ils_asm_%d_%d.ww", getpid(), i);
snprintf(cs, sizeof cs, "/tmp/ils_asm_%d_%d_c.s", getpid(), i);
snprintf(ws, sizeof ws, "/tmp/ils_asm_%d_%d_w.s", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
snprintf(cmd, sizeof cmd, "%s/w6c -o %s %s 2>/dev/null", bin, cs, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: w6c errored\n", r->label);
unlink(src);
return -1;
}
snprintf(cmd, sizeof cmd, "%s/w6c_ww -o %s %s 2>/dev/null",
bin, ws, src);
if (runwait(cmd) != 0) {
fprintf(stderr, "row[%s]: w6c_ww errored\n", r->label);
unlink(src); unlink(cs);
return -1;
}
FILE *fc = fopen(cs, "rb");
FILE *fw = fopen(ws, "rb");
int rc = 0;
if (!fc || !fw) {
rc = -1;
} else {
for (;;) {
int a = fgetc(fc);
int b = fgetc(fw);
if (a != b) { rc = -1; break; }
if (a == EOF) break;
}
}
if (fc) fclose(fc);
if (fw) fclose(fw);
if (rc != 0)
fprintf(stderr, "row[%s]: cstage vs wwstage asm differs\n",
r->label);
unlink(src); unlink(cs); unlink(ws);
return rc;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[1024];
if (bin[0] != '/') {
char cwd[1024];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char cdrv[1024];
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
char wdrv[1024];
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
struct { const char *name; const char *path; int gated_on_existence; }
drivers[] = {
{ "cstage", cdrv, 0 },
{ "wwstage", wdrv, 1 },
{ NULL, NULL, 0 },
};
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int d = 0; drivers[d].name; d++) {
if (drivers[d].gated_on_existence
&& access(drivers[d].path, X_OK) != 0) {
fprintf(stderr, "inferred_let_struct: skip %s (no %s)\n",
drivers[d].name, drivers[d].path);
continue;
}
for (int i = 0; i < n; i++) {
int got = run_driver(drivers[d].path, &rows[i], i);
total++;
if (got != rows[i].want) {
fprintf(stderr,
"inferred_let_struct[%s][%s]: exit=%d want=%d\n",
drivers[d].name, rows[i].label,
got, rows[i].want);
fail++;
}
}
}
if (access(wdrv, X_OK) == 0) {
for (int i = 0; i < n; i++) {
total++;
if (asm_byte_identical(bin, &rows[i], i) != 0)
fail++;
}
}
if (fail) {
fprintf(stderr,
"inferred_let_struct: %d/%d fixtures failed\n", fail, total);
return 1;
}
printf("inferred_let_struct: all %d fixtures passed\n", total);
return 0;
}