From f88dbb01e2675f33755bc7b705a032845f9b33d6 Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Fri, 5 Jun 2026 02:20:15 +0900 Subject: [PATCH] =?UTF-8?q?wcc=5Fww/check:=20inferred=20struct-lit=20let?= =?UTF-8?q?=20plants=20the=20synthesized=20TNAME=20=E2=80=94=20field(SB)?= =?UTF-8?q?=20name-leak=20+=20tagged-field=20assign=20bound=20(#24)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit For an annotation-less `let p = pt{...}` checkletassign planted exprtype's N_STRUCTLIT result — the struct decl's BODY node (N_TSTRUCT, per #66) — as the let's type. Every cgen local-arm dispatch (cgdot read, cgassign tagged-field store, the alias peel) is N_TNAME-keyed, so the body matched no arm: field reads fell to the module-qualified fallback and emitted the FIELD NAME as a global symbol (MOVQ f(SB) — link-fail, #211 name-leak family; silent corruption if a same-named global exists), and a tagged- field assign fell to the assign-resolver TY_TAGGED loud bound. Both PG5 wwstage symptoms, one root; plain structs leaked too. Normalizing the inferred binding to the synthesized TNAME (mktname + tinfofornode stamp) routes every consumer down the already-byte-id annotated path. cstage needs no twin: check.c:1477 clet carries Sym.type (tinfo) and its emission is annotation-invariant (probed). Test 811: 10 rows x 2 drivers + 10 asm-byte-id; pre-fix wwstage link-fails every unannotated row (incl. the `...` autofill and parenthesized forms; nested s.f.g ran but cs!=ww asm). --- Makefile | 14 + selfhost/cmd/w6c/main.combined.ww | 18 ++ selfhost/cmd/wcc/check.ww | 18 ++ selfhost/cmd/wwdump/main.combined.ww | 18 ++ test/wcc/811_inferred_let_struct.c | 367 +++++++++++++++++++++++++++ 5 files changed, 435 insertions(+) create mode 100644 test/wcc/811_inferred_let_struct.c diff --git a/Makefile b/Makefile index caa2b6bc..66ffde00 100644 --- a/Makefile +++ b/Makefile @@ -398,6 +398,7 @@ TESTS = $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \ $(BIN)/test_insert_elem \ $(BIN)/test_arrlit_overlong \ $(BIN)/test_idx_structlit_store \ + $(BIN)/test_inferred_let_struct \ $(BIN)/test_placeaddr_store \ $(BIN)/test_tryprop_multisuccess \ $(BIN)/test_append_place \ @@ -1086,6 +1087,19 @@ $(BIN)/test_idx_structlit_store: test/wcc/809_idx_structlit_store.c \ $(LIB)/libwwrt.a | $(BIN) $(CC) $(CFLAGS) -o $@ $< +# #24 (fold-5 prereq, PG5 wwstage pair): field read/assign through an +# annotation-less struct-literal binding `let p = pt{...}` — pre-fix +# the wwstage checker planted the struct BODY node (N_TSTRUCT) as the +# inferred let's type, no N_TNAME-keyed cgen arm matched, and `p.f` +# leaked the FIELD NAME as a global symbol (`MOVQ f(SB)`, link-fail; +# #211 name-leak family) while a tagged-field assign hit the +# assign-resolver loud bound. Runtime rows + asm byte-id per row. +$(BIN)/test_inferred_let_struct: test/wcc/811_inferred_let_struct.c \ + $(BIN)/ww $(BIN)/w6c $(BIN)/w6c_ww $(BIN)/w6a $(BIN)/w6l \ + $(BIN)/ww_ww \ + $(LIB)/libwwrt.a | $(BIN) + $(CC) $(CFLAGS) -o $@ $< + # F8+F9 (tasks #5/#12, regex fold-2b): `?` interim single-success gate # (|success| > 1 loud-rejected on BOTH stages until task #14's # subset-union typing) + direct `f()? is T` / `match (f()?)` reject diff --git a/selfhost/cmd/w6c/main.combined.ww b/selfhost/cmd/w6c/main.combined.ww index cc2b933e..9c2d958d 100644 --- a/selfhost/cmd/w6c/main.combined.ww +++ b/selfhost/cmd/w6c/main.combined.ww @@ -14627,6 +14627,24 @@ fn checkletassign(c: *checker, n: *node) void = { // Defaulting (untyped_int → i32, etc.) is exprtype's job at use // sites, not the binding site. if (n.lhs == nil) { + // #24 (fold-5 prereq): a struct-lit init's exprtype returns the + // decl's BODY node (N_TSTRUCT, L3103 per #66) — but every cgen + // local-arm dispatch (cgdot read, cgassign tagged-field store, + // cgun addr-of) is N_TNAME-keyed, so planting the body dropped + // `p.f` to the module-qualified `MOVQ f(SB)` fallback (link-fail + // name-leak; #211 family). Normalize to the synthesized TNAME so + // the inferred binding is indistinguishable from the annotated + // one downstream. cstage needs no twin: check.c:1477 clet carries + // Sym.type (tinfo), and its emission is annotation-invariant + // (probed identical asm annotated vs not). + if (src != nil && src.kind == nkind.N_TSTRUCT + && n.rhs.kind == nkind.N_STRUCTLIT + && n.rhs.lhs != nil && n.rhs.lhs.kind == nkind.N_IDENT) { + let ltn: *node = mktname(c, n.rhs.lhs.str); + ltn.type_ = tinfofornode(c, ltn): *void; + n.lhs = ltn; + return; + }; if (src != nil) { n.lhs = src; }; return; }; diff --git a/selfhost/cmd/wcc/check.ww b/selfhost/cmd/wcc/check.ww index a6c95419..0a8d2767 100644 --- a/selfhost/cmd/wcc/check.ww +++ b/selfhost/cmd/wcc/check.ww @@ -4363,6 +4363,24 @@ fn checkletassign(c: *checker, n: *node) void = { // Defaulting (untyped_int → i32, etc.) is exprtype's job at use // sites, not the binding site. if (n.lhs == nil) { + // #24 (fold-5 prereq): a struct-lit init's exprtype returns the + // decl's BODY node (N_TSTRUCT, L3103 per #66) — but every cgen + // local-arm dispatch (cgdot read, cgassign tagged-field store, + // cgun addr-of) is N_TNAME-keyed, so planting the body dropped + // `p.f` to the module-qualified `MOVQ f(SB)` fallback (link-fail + // name-leak; #211 family). Normalize to the synthesized TNAME so + // the inferred binding is indistinguishable from the annotated + // one downstream. cstage needs no twin: check.c:1477 clet carries + // Sym.type (tinfo), and its emission is annotation-invariant + // (probed identical asm annotated vs not). + if (src != nil && src.kind == nkind.N_TSTRUCT + && n.rhs.kind == nkind.N_STRUCTLIT + && n.rhs.lhs != nil && n.rhs.lhs.kind == nkind.N_IDENT) { + let ltn: *node = mktname(c, n.rhs.lhs.str); + ltn.type_ = tinfofornode(c, ltn): *void; + n.lhs = ltn; + return; + }; if (src != nil) { n.lhs = src; }; return; }; diff --git a/selfhost/cmd/wwdump/main.combined.ww b/selfhost/cmd/wwdump/main.combined.ww index d19d809a..071fb759 100644 --- a/selfhost/cmd/wwdump/main.combined.ww +++ b/selfhost/cmd/wwdump/main.combined.ww @@ -14627,6 +14627,24 @@ fn checkletassign(c: *checker, n: *node) void = { // Defaulting (untyped_int → i32, etc.) is exprtype's job at use // sites, not the binding site. if (n.lhs == nil) { + // #24 (fold-5 prereq): a struct-lit init's exprtype returns the + // decl's BODY node (N_TSTRUCT, L3103 per #66) — but every cgen + // local-arm dispatch (cgdot read, cgassign tagged-field store, + // cgun addr-of) is N_TNAME-keyed, so planting the body dropped + // `p.f` to the module-qualified `MOVQ f(SB)` fallback (link-fail + // name-leak; #211 family). Normalize to the synthesized TNAME so + // the inferred binding is indistinguishable from the annotated + // one downstream. cstage needs no twin: check.c:1477 clet carries + // Sym.type (tinfo), and its emission is annotation-invariant + // (probed identical asm annotated vs not). + if (src != nil && src.kind == nkind.N_TSTRUCT + && n.rhs.kind == nkind.N_STRUCTLIT + && n.rhs.lhs != nil && n.rhs.lhs.kind == nkind.N_IDENT) { + let ltn: *node = mktname(c, n.rhs.lhs.str); + ltn.type_ = tinfofornode(c, ltn): *void; + n.lhs = ltn; + return; + }; if (src != nil) { n.lhs = src; }; return; }; diff --git a/test/wcc/811_inferred_let_struct.c b/test/wcc/811_inferred_let_struct.c new file mode 100644 index 00000000..92d273b7 --- /dev/null +++ b/test/wcc/811_inferred_let_struct.c @@ -0,0 +1,367 @@ +/* + * 811_inferred_let_struct — cstage and wwstage agree, byte-for-byte and + * at runtime, on field access through an ANNOTATION-LESS struct-literal + * binding `let p = pt { ... };` (task #24, fold-5 prereq; the PG5 + * wwstage pair). + * + * The bug (wwstage only): for an inferred binding the checker planted + * the struct decl's BODY node (N_TSTRUCT, exprtype N_STRUCTLIT returns + * ms.decl.lhs per #66) as the let's type — but every cgen local-arm + * dispatch (cgdot field read, cgassign tagged-field store, the alias + * peel) is N_TNAME-keyed. The body matched no arm, so `p.f` fell + * through to the module-qualified fallback and emitted the FIELD NAME + * as a global symbol (`MOVQ f(SB), AX` — the #211 name-leak family; + * loud at link, silent corruption if a same-named global exists), and + * a tagged-field assign fell to the assign-resolver's TY_TAGGED loud + * bound ("assign-resolver: tagged field not wired"). cstage was + * unaffected: check.c:1477 clet carries Sym.type (tinfo) and its + * emission is annotation-invariant. + * + * The fix (wwstage checker, check.ww checkletassign): normalize the + * inferred binding to the synthesized N_TNAME (mktname), making it + * indistinguishable from the annotated form downstream — every read/ + * assign/is/as arm then takes the already-byte-id annotated route. + * + * Mutation coverage: on pre-fix wwstage every unannotated row LINK- + * FAILS (undefined reference to the field name), so run_driver's -1 + * catches a regression outright; the annotated rows pin that the + * normalization didn't perturb the annotated path (byte-id rows assert + * cstage == wwstage asm for all rows). + * + * row | shape | want + * ---------------------+------------------------------------+------ + * plain_read | let p = pt{..}; p.x*10 + p.y | 42 + * tagged_read_is_as | (void|size) field: read + is/as | 6 + * tagged_void_read | min=void; `is void` arm | 7 + * tagged_assign | r.min = 2: size through inferred | 3 + * tagged_str_field | (void|str): assign + as-str .len | 14 + * boxed_prebound | field-wise build, box into union, | 103 + * | match-extract, is/as (PG5h) | + * annotated_pin | same as tagged_assign but with an | 3 + * | explicit `: rep` annotation | + * nested_read | plain nested s.f.g read (master | 42 + * | ran right but cs!=ww asm) | + * ellipsis_fill | pt{ x = 4, ... } autofill (master | 40 + * | wwstage link-failed) | + * paren_form | (pt{..}) — parser unwraps parens, | 42 + * | same N_STRUCTLIT rhs (master | + * | wwstage link-failed) | + */ +#include +#include +#include +#include +#include +#include + +static int +runwait(const char *cmd) +{ + int rc = system(cmd); + if (rc == -1) return -1; + if (WIFEXITED(rc)) return WEXITSTATUS(rc); + return -1; +} + +struct row { const char *label; const char *src; int want; }; + +static const struct row rows[] = { + { "plain_read", + "package main;\n" + "type pt = struct { x: size, y: size };\n" + "export fn main() i32 = {\n" + "\tlet p = pt { x = 4: size, y = 2: size };\n" + "\treturn (p.x * 10 + p.y): i32;\n" + "};\n", + 42 }, + + { "tagged_read_is_as", + "package main;\n" + "type rep = struct { id: size, min: (void | size) };\n" + "export fn main() i32 = {\n" + "\tlet r = rep { id = 1: size, min = 5: size };\n" + "\tlet acc = 0: size;\n" + "\tacc += r.id;\n" + "\tif (r.min is size) { acc += r.min as size; };\n" + "\treturn acc: i32;\n" + "};\n", + 6 }, + + { "tagged_void_read", + "package main;\n" + "type rep = struct { id: size, min: (void | size) };\n" + "export fn main() i32 = {\n" + "\tlet r = rep { id = 0: size, min = void };\n" + "\tlet acc = 0: size;\n" + "\tif (r.min is void) { acc += 7; };\n" + "\tif (r.min is size) { acc += r.min as size; };\n" + "\treturn acc: i32;\n" + "};\n", + 7 }, + + { "tagged_assign", + "package main;\n" + "type rep = struct { id: size, min: (void | size) };\n" + "export fn main() i32 = {\n" + "\tlet r = rep { id = 0: size, min = void };\n" + "\tr.id = 1;\n" + "\tr.min = 2: size;\n" + "\tlet acc = 0: size;\n" + "\tacc += r.id;\n" + "\tif (r.min is size) { acc += r.min as size; };\n" + "\treturn acc: i32;\n" + "};\n", + 3 }, + + { "tagged_str_field", + "package main;\n" + "type rep = struct { id: size, min: (void | size), name: (void | str) };\n" + "export fn main() i32 = {\n" + "\tlet b = rep { id = 0: size, min = void, name = void };\n" + "\tb.id = 2;\n" + "\tb.min = 9: size;\n" + "\tb.name = \"hey\";\n" + "\tlet acc = 0: size;\n" + "\tacc += b.id;\n" + "\tif (b.min is size) { acc += b.min as size; };\n" + "\tif (b.name is str) { acc += (b.name as str).len: size; };\n" + "\treturn acc: i32;\n" + "};\n", + 14 }, + + /* PG5h: field-wise construction through the inferred binding, + * boxed into a tagged union, match-extracted, is/as off the + * binding — the fold-5b inst_repeat consumer shape. */ + { "boxed_prebound", + "package main;\n" + "type inst_lit = rune;\n" + "type rep3 = struct { id: size, min: (void | size), max: (void | size) };\n" + "type inst = (inst_lit | rep3);\n" + "export fn main() i32 = {\n" + "\tlet r = rep3 { id = 0: size, min = void, max = void };\n" + "\tr.id = 1;\n" + "\tr.min = 2: size;\n" + "\tr.max = 5: size;\n" + "\tlet pre = 0: size;\n" + "\tif (r.min is size) { pre += r.min as size; };\n" + "\tif (pre != 2) { return 200 + pre: i32; };\n" + "\tlet v: inst = r;\n" + "\tlet acc = 0: size;\n" + "\tmatch (v) {\n" + "\tcase let ir: rep3 => {\n" + "\t\tacc += ir.id;\n" + "\t\tif (ir.min is size) { acc += ir.min as size; };\n" + "\t\tif (ir.max is size && ir.max as size == 5) { acc += 100; };\n" + "\t};\n" + "\tcase let l: inst_lit => { acc += 1; };\n" + "\t};\n" + "\treturn acc: i32;\n" + "};\n", + 103 }, + + /* Regression pin: the explicit annotation must stay on its prior + * (already byte-id) route — the normalization only fires for the + * inferred binding. */ + { "annotated_pin", + "package main;\n" + "type rep = struct { id: size, min: (void | size) };\n" + "export fn main() i32 = {\n" + "\tlet r: rep = rep { id = 0: size, min = void };\n" + "\tr.id = 1;\n" + "\tr.min = 2: size;\n" + "\tlet acc = 0: size;\n" + "\tacc += r.id;\n" + "\tif (r.min is size) { acc += r.min as size; };\n" + "\treturn acc: i32;\n" + "};\n", + 3 }, + + /* Plain nested s.f.g through the inferred binding: on master + * wwstage this RAN correctly but emitted different asm (the body- + * node planting took a divergent cgdot route) — pins byte-id. */ + { "nested_read", + "package main;\n" + "type in_ = struct { g: size };\n" + "type out_ = struct { f: in_ };\n" + "export fn main() i32 = {\n" + "\tlet s = out_ { f = in_ { g = 6: size } };\n" + "\treturn (s.f.g * 7): i32;\n" + "};\n", + 42 }, + + /* Trailing-`...` autofill (parse/expr.ww TK_ELLIPSIS, stash on + * s.op): same N_STRUCTLIT rhs kind, so the normalization must + * cover it — master wwstage link-failed this form too. */ + { "ellipsis_fill", + "package main;\n" + "type pt = struct { x: size, y: size };\n" + "export fn main() i32 = {\n" + "\tlet p = pt { x = 4: size, ... };\n" + "\treturn (p.x * 10 + p.y): i32;\n" + "};\n", + 40 }, + + /* Parenthesized literal: the parser unwraps parens (no N_PAREN + * node), so the rhs is the same bare N_STRUCTLIT — pins that the + * form-coverage claim holds at the parse layer. */ + { "paren_form", + "package main;\n" + "type pt = struct { x: size, y: size };\n" + "export fn main() i32 = {\n" + "\tlet p = (pt { x = 4: size, y = 2: size });\n" + "\treturn (p.x * 10 + p.y): i32;\n" + "};\n", + 42 }, +}; + +static int +run_driver(const char *driver, const struct row *r, int i) +{ + char src[64], tmpdir[64], cmd[1024]; + snprintf(src, sizeof src, "/tmp/ils_%d_%d.ww", getpid(), i); + snprintf(tmpdir, sizeof tmpdir, "/tmp/ils_%d_d_%d", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -1; + fputs(r->src, f); + fclose(f); + + mkdir(tmpdir, 0755); + snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null", + tmpdir, driver, src); + if (runwait(cmd) != 0) { + fprintf(stderr, "row[%s]: build via %s failed\n", + r->label, driver); + unlink(src); rmdir(tmpdir); + return -1; + } + + const char *base = strrchr(src, '/'); + base = base ? base + 1 : src; + char outbin[128]; + snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); + char *dot = strrchr(outbin, '.'); + if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; + int got = runwait(outbin); + + unlink(src); unlink(outbin); rmdir(tmpdir); + return got; +} + +/* asm_byte_identical — generate .s via cstage's w6c and wwstage's + * w6c_ww and diff. Pre-fix the unannotated rows emitted `MOVQ + * (SB), AX` on wwstage only, so the diff was non-empty (and + * the wwstage link failed). */ +static int +asm_byte_identical(const char *bin, const struct row *r, int i) +{ + char src[64], cs[64], ws[64], cmd[1024]; + snprintf(src, sizeof src, "/tmp/ils_asm_%d_%d.ww", getpid(), i); + snprintf(cs, sizeof cs, "/tmp/ils_asm_%d_%d_c.s", getpid(), i); + snprintf(ws, sizeof ws, "/tmp/ils_asm_%d_%d_w.s", getpid(), i); + + FILE *f = fopen(src, "wb"); + if (!f) return -1; + fputs(r->src, f); + fclose(f); + + snprintf(cmd, sizeof cmd, "%s/w6c -o %s %s 2>/dev/null", bin, cs, src); + if (runwait(cmd) != 0) { + fprintf(stderr, "row[%s]: w6c errored\n", r->label); + unlink(src); + return -1; + } + snprintf(cmd, sizeof cmd, "%s/w6c_ww -o %s %s 2>/dev/null", + bin, ws, src); + if (runwait(cmd) != 0) { + fprintf(stderr, "row[%s]: w6c_ww errored\n", r->label); + unlink(src); unlink(cs); + return -1; + } + + FILE *fc = fopen(cs, "rb"); + FILE *fw = fopen(ws, "rb"); + int rc = 0; + if (!fc || !fw) { + rc = -1; + } else { + for (;;) { + int a = fgetc(fc); + int b = fgetc(fw); + if (a != b) { rc = -1; break; } + if (a == EOF) break; + } + } + if (fc) fclose(fc); + if (fw) fclose(fw); + if (rc != 0) + fprintf(stderr, "row[%s]: cstage vs wwstage asm differs\n", + r->label); + unlink(src); unlink(cs); unlink(ws); + return rc; +} + +int +main(void) +{ + const char *bin = getenv("BIN"); + if (!bin) bin = "out/bin"; + char absbin[1024]; + if (bin[0] != '/') { + char cwd[1024]; + if (getcwd(cwd, sizeof cwd) == NULL) return 1; + snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); + bin = absbin; + } + + char cdrv[1024]; + snprintf(cdrv, sizeof cdrv, "%s/ww", bin); + char wdrv[1024]; + snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); + + struct { const char *name; const char *path; int gated_on_existence; } + drivers[] = { + { "cstage", cdrv, 0 }, + { "wwstage", wdrv, 1 }, + { NULL, NULL, 0 }, + }; + + int n = (int)(sizeof rows / sizeof rows[0]); + int total = 0, fail = 0; + + for (int d = 0; drivers[d].name; d++) { + if (drivers[d].gated_on_existence + && access(drivers[d].path, X_OK) != 0) { + fprintf(stderr, "inferred_let_struct: skip %s (no %s)\n", + drivers[d].name, drivers[d].path); + continue; + } + for (int i = 0; i < n; i++) { + int got = run_driver(drivers[d].path, &rows[i], i); + total++; + if (got != rows[i].want) { + fprintf(stderr, + "inferred_let_struct[%s][%s]: exit=%d want=%d\n", + drivers[d].name, rows[i].label, + got, rows[i].want); + fail++; + } + } + } + + if (access(wdrv, X_OK) == 0) { + for (int i = 0; i < n; i++) { + total++; + if (asm_byte_identical(bin, &rows[i], i) != 0) + fail++; + } + } + + if (fail) { + fprintf(stderr, + "inferred_let_struct: %d/%d fixtures failed\n", fail, total); + return 1; + } + printf("inferred_let_struct: all %d fixtures passed\n", total); + return 0; +}