Wwstage's N_INDEX-lhs cgassign dispatch chain had a triple-site
N_DOT base gap (sister latents filed during #24 / #27 review):
Read (#28): `obj.mat[i][k]` over a struct field mat: **u8.
cgindex routes the outer N_INDEX's N_INDEX base through
indexvaluetnode; the recursion bottomed out at the inner
N_INDEX's N_DOT base with bt=nil. esz fell through to 8 +
signed_elem to false — wwstage emitted a stray outer
`MOVQ $8, CX; IMULQ CX, AX` plus `MOVQ (AX), AX` (8-byte
read over a 1-byte u8) instead of cstage's bare
`MOVZBQ (AX), AX`.
Write (#30): `obj.arr[i] = v` over a struct field arr:
[N]Tagged (e.g. (i64|str)). cgassign's N_DOT-base arm
computed esz via indexbaseesz but never set elemtn, so the
tagged-element store gate missed and the 24-byte tagged slot
was overwritten by a single scalar MOVQ — wrong-width store
+ tag/payload junk in the upper 16 bytes.
Cstage walks `n->lhs->type` directly via the typed AST
(cmd/w6c/cgen.c idx_eff + the N_INDEX-lhs N_ASSIGN branch).
Wwstage now mirrors via indexvaluetnode, which #24 (aa8ca47)
introduced for the N_INDEX-base case; #28/#30 graduate it for
N_DOT base via the existing dotfieldtnode helper.
Bundle graduates N_DOT base for the entire N_INDEX-lhs cgassign
chain: (a) indexvaluetnode in cgenutil.ww handles N_DOT base via
dotfieldtnode; (b) cgassign N_DOT-base arm in cgenexpr.ww calls
indexvaluetnode for elemtn; (c) scanlocals N_DOT-base arm in
cgendecl.ww parallels the existing N_IDENT arm for tagscr-bump.
Splits are bisect-incoherent: (b)-alone clobbers locals via
under-sized frame, (a)-alone leaves the write path with wrong
elemtn, (c)-alone has no consumer. Only the triple delivers a
complete N_DOT-base graduation matching #24's N_INDEX-base
pattern.
Cstage's first-use+fail-loud strategy for @tagscr (#26 commit
069548d) handles the N_DOT-base shape naturally; the scanlocals
N_DOT arm is wwstage-specific. Long-term rule-10 convergence
(wwstage DOWN from scanlocals to first-use+fail-loud on BOTH
stages) is filed as task #15.
Class A wwstage cgen UNDER. No in-tree consumer; sister latents
filed during #24 + #27 reviews. Test 741_dotbase_chained pins
the dispatch + cstage-byte-identical asm for both rows.
Sister latent (filed): indexbaseesz has no N_TARRAY arm for
scalar struct-field array writes — `s.arr: [N]i32` scalar write
falls through to esz=8 on wwstage. No in-tree exerciser; tight
scope kept here.
115/115 ok. ww2 == ww3 == ww4 byte-id.
Wwstage cgassign's N_INDEX-lhs base-inspection (cgenexpr.ww) only
computed esz/elemtn when base.kind == N_IDENT or N_DOT. For a
chained `names[i][k] = v` (names: **u8) the outer N_INDEX has
base.kind == N_INDEX; esz fell through to the default 8 so the
outer store emitted `MOVQ AX, (BX)` into a 1-byte u8 slot (8 bytes
written — adjacent memory corrupted) plus a stray
`MOVQ $8, CX; IMULQ CX, AX` scaling on the outer index that cstage
doesn't emit. Wrong-width-store: the byte slot was written as 8
bytes and the outer offset multiplied by sizeof *u8 instead of
sizeof u8.
Cstage walks `n->lhs->type` directly via the typed AST at the
N_ASSIGN N_INDEX-lhs branch (cmd/w6c/cgen.c eff->sub->size = 1).
Wwstage now mirrors via indexvaluetnode (already graduated for
cgindex in #24, commit aa8ca47) — the cgassign N_INDEX-lhs branch
gains the parallel base-N_INDEX arm: call indexvaluetnode, then
elemsizeofc for esz and one-layer-strip for elemtn (so the tagged-
element gate keys honestly on the element type, matching the
N_IDENT branch's pattern).
Class A wwstage cgen UNDER. Sister latent of #24's surfaced read-
path bug; filed during the #24 graduation with selfhost + lib grep
empty for chained-write. No in-tree consumer surfaced this before
the fix, so test 740_chained_write is the sole exerciser — pins
cstage-byte-identical asm for **u8 (MOVB store, 1 inner-stride-8
IMULQ pair, no outer scale) + **i32 (MOVL store, inner $8 + outer
$4 IMULQ pairs). Anti-check on the u8 row guards against the pre-
fix stray `MOVQ AX, (BX)` regression.
Sister latents filed (no in-tree consumer):
cgassign N_DOT-base elemtn drop (sister of cgindex N_DOT-base
in #24 review): tagged-element store via obj.arr[i] over a
struct-field array falls through to scalar store.
114/114 ok. ww2 == ww3 == ww4 byte-id.
Wwstage cgindex's base-inspection (cgenexpr.ww) only computed esz/
signed_elem when base.kind == N_IDENT or N_DOT. For a chained
`names[i][k]` (names: **u8) the outer N_INDEX has base.kind ==
N_INDEX; esz fell through to the default 8 so the outer load
emitted `MOVQ (AX), AX` over a 1-byte u8 plus a stray
`MOVQ $8, CX; IMULQ CX, AX` scaling on the outer index that cstage
doesn't emit. Wrong-width-narrow-load: the byte was read as 8 bytes
(reaching into adjacent memory) and the outer offset multiplied by
sizeof *u8 instead of sizeof u8.
Cstage walks n->lhs->type directly via the typed AST
(cmd/w6c/cgen.c idx_eff → eff->sub->size at N_INDEX). Wwstage
needed the parallel via indexvaluetnode — return the value-type
of an N_INDEX expression by stripping one element layer off base's
type, recursing for chained inner. cgindex's else-if chain now
adds the N_INDEX arm: call indexvaluetnode + elemsizeofc/
elemissignedc.
Class A wwstage cgen UNDER. Surfaced first time the codebase
exercised the **T[i][k] shape — through expanddir in
selfhost/cmd/ww/main.ww (post-#22 dir-enum, commit 9e0816e). The
workaround there split names[i][k] into `let nm: *u8 = names[i];
nm[k]` to route through the bare-pointer index path. Retired in
this commit: expanddir uses the natural chained form since the
read path is now byte-identical across stages.
Bundling justification (rule 11): the workaround retirement is
the in-tree verification this fix works — without retiring,
neither bootstrap byte-id nor 995_self_rebuild exercises the
chained read shape. Test 739_chained_index pins cstage-byte-
identical asm for **u8 (MOVZBQ load, 1 inner-stride-8 IMULQ pair,
no outer scale) + **i32 (MOVSXD load, inner $8 + outer $4 IMULQ
pairs).
Sister latents filed (no in-tree consumer, no probe):
Task #27 — cgassign chained-write N_INDEX: write path
`names[i][k] = v` for **u8 has the same dispatch gap. Selfhost +
lib grep is empty.
New latent (filed during review) — cgindex N_DOT base on chained
index: `obj.mat[i][k]` over a struct-field base falls back to
esz=8. indexvaluetnode currently handles N_IDENT + N_INDEX bases
only.
113/113 ok. ww2 == ww3 == ww4 byte-id.
User-mandated language redesign: source files declare their own
namespace via the new `package <name>;` keyword and pull dependencies
via `import <path>;`. Both keywords use Plan-9 `.` separator (user
override on Hare's `::` — `import encoding.utf8;`). Internal token-
kind enum values TK_MODULE=86 and TK_USE=17 kept stable for 990
wwdump byte-diff symmetry; only kwtab strings + tokname spellings
rotated. Executables (selfhost/cmd/{ww,w6c,w6a,w6l,wwdump}/main.ww)
declare `package main;` per Go convention; lib/ + selfhost/cmd/wcc/
files declare their parent-dir basename.
One-commit bundle per the brief's all-at-once directive: a per-stage
split breaks bootstrap byte-id mid-rewrite (cstage with new keyword
can't parse old `module`/`use` files and vice-versa). Body documents
the bundle per rule 11.
Two retained divergences from the user's stated ask, both filed per
rule 7 / rule 8 with inline task pointers at the deferred sites:
Task #22 — Directory-as-module enumeration in the driver. User
asked: "module is combination of files in directory" (golang/hare
shape). After this commit lib/ww/{ast,sym,typ}.ww all declare
`package ww;` but are still pulled into the compilation unit via
explicit sibling `import` chains (sym.ww does `import ast;` etc.),
not via dir enumeration. The cstage scaffold for true dir
enumeration was drafted and reverted because the symmetric wwstage
port requires a ww-side opendir/readdir wrapper around getdents64
(~150-200 lines new ww). Inline citation at locate_import_in /
locatein in both stages points to task #22.
Task #23 — Parser strict missing-`package` error. The original
brief mandated: parser errors when a .ww source omits `package
<name>;` as its first non-comment item. Softened here to silent-
default because 63 test wrappers (200_parse, 100_lex, 300_check,
400_w6c, ..., the inline-source-fragment family) build ad-hoc ww
source strings that lack `package` and the strict error cascaded
into 60+ test failures. Migration is mechanical-sed but deferred
so this commit ships green. Inline citation at parsefile in both
stages points to task #23.
Node.module renamed to Node.nmod and modent.module to modent.nmod
in wwstage source — the field name `module` would collide with the
freshly-reserved TK_MODULE token. The rename is left in place as
clean separator between AST-field-name and reserved-keyword
namespaces. Cstage's n->module retained — C has no `package` or
`module` keyword.
rt/ensure.ww deliberately ships WITHOUT a package declaration so
its `export fn rt_ensure` keeps the bare linker symbol; adding
`package rt;` would mangle to `rt.rt_ensure` and break libwwrt.a
linkage. Documented at the file head.
111/111 ok (110 + new 738_module_decl sentinel). 995_self_rebuild
byte-id holds (ww2 == ww3 == ww4). All 5 frozen
selfhost/cmd/*/main.combined.ww regenerated under the new driver.
CLAUDE.md rule 5 amended with the language-layer divergence note.
Class A silent miscompile, latent until two modules export the same
enum leaf name. Wwstage's enumlookup (selfhost/cmd/wcc/cgen.ww)
walked c.enums head-first by ename; cgdot handed it the bare leaf
from N_DOT.lhs.str for both `Color.MEMBER` (lhs N_IDENT) and
`pkg.Color.MEMBER` (lhs N_DOT) shapes, silently dropping the
explicit qualifier on the second. Cstage's enum-member fold
(cmd/wcc/check.c cexpr N_DOT) was carrying the same head-pick on
the lhs-ident lookup — pre-fix the mismatch surfaced as a
"not assignable to <same-leaf>" checker error rather than a silent
wrong-constant because resolve_typename for the fn return spec
already used scope_lookup_prefer correctly, so the rhs's wrong-
module-Color clashed with the return type's right-module-Color.
No in-tree corpus currently declares two same-leaf enums, so
995_self_rebuild stayed green and the latent miscompile only
surfaces once a stdlib port introduces the collision (same shape
as #27 surfacing when lib/strings dragged utf8's invalid alias
into the chain alongside strconv's invalid).
Fourth leaf of the trio leaf-name lookup graduation (after #27
aliaslookup, #28 fnparamslookupmod, #31 fnretlookupmod): wwstage
enumlookup grows a same-module-first walk before the head-walk
fallback, mirroring aliaslookup's two-pass shape (cgen.ww:75).
The N_DOT consumer surface — `pkg.Enum.MEMBER`, already used
in-corpus by os.flag.RDONLY, temp.mode.RDWR, os.whence.SET etc.
— routes through a new enumlookupmod variant with the explicit
N_DOT.lhs.lhs.str as the mod qualifier (mirror of fnret/
fnparamslookupmod). Cstage's check.c cexpr N_DOT lhs lookup
graduates from scope_lookup to scope_lookup_prefer to align
symmetrically (rule 10: both stages pick same-module-first on
the bare-leaf shape).
733_enum_modshadow pins both surfaces with 3 rows: row 1 bare-leaf
in module M must fold against M's own Color even with another
module's same-leaf Color at the head of c.enums; row 2 same-module
`mod.Color.MEMBER` from inside that mod pins the API surface; row 3
cross-module `othermod.Color.MEMBER` from a third module with no
local Color sentinel-flips the cgdot etmod tracking + enumlookupmod
path independently of row 1's same-module-first fallback. Asserts
the matching \$N, immediate inside the right TEXT sym + bad_imm
NOT-presence anti-check on both stages plus byte-id between stages
per row.
Wwstage cgcall now mirrors cstage's typed-AST callee-params
lookup for module-qualified mod.fn(...) calls, restoring tagged-
union widening on cross-module slice args. Class A runtime
miscompile — masked from 995_self_rebuild because wwstage tools
don't call bytes.index directly; surfaced by lib/strings landing
dragging utf8 + bytes into the wwstage-tool dep chain via
strings.byteindex's `bytes.X(toutf8(...), n)` call sites.
Pre-fix: wwstage's cgcall (cgenexpr.ww) looked up calleeparams
only when callee.kind == N_IDENT. For N_DOT callees (the
module-qualified mod.fn() form), calleeparams stayed nil →
pushargsrev's widening detection gated on param != nil never
fired → wwstage fell through to the N_IDENT-slice fast path
pushing only 3 slot words (cap, len, ptr) WITHOUT the variant
tag. Receiving fn's `match (needle)` then dispatched on
(needle.ptr in CX) instead of needle.tag, with R8/R9 carrying
.len/.cap instead of .ptr/.len. Wrong arm + wrong payload.
Cstage handles N_DOT natively via the checker-set type on
n->lhs->type (cmd/w6c/cgen.c:4156-4165), so cg_widen_tagged_push
slice path pushes 4 words including tag.
Polarity catalog: wwstage UNDER — calleeparams lookup missing
N_DOT dispatch arm. Sister to #19 (N_TSLICE variantindex arm),
#21 (N_CALL pushargsrev arm), #24 (N_CALL nodeisslice arm), #27
(aliaslookup same-mod-first). The pattern: wwstage dispatchers
keep missing arms cstage has natively via typed-AST resolution.
Convergence wwstage → cstage (rule 10's spirit overrides letter
when correctness is at stake — Path 2 of aligning cstage DOWN
would create a runtime miscompile in both stages).
Fix: cgcall N_DOT branch pulls module from callee.lhs.str and
function name from callee.str, calls new fnparamslookupmod
helper. Helper does same-module-first walk then existing
first-match fallback (mirrors #27's aliaslookup fix shape). New
fnret.fmod field carries module identity; collectfnrets sets
f.fmod = d.module at registration. Module-qualified pkg.fn path
unchanged.
Tests:
- 727_modcall_widen_slice pins MOVQ $1 + PUSHQ AX (tag-synth)
before the receiving fn's CALL on canonical mod.fn(slice, ...)
shape with the callee param widened to a tagged union. Three
assertions per row: cstage tag-synth presence, wwstage
tag-synth presence, cstage↔wwstage cmp -s byte-id. Sentinel-
flip-verified: comment out fnparamslookupmod call →
wwstage tag-synth absent + cmp diverges.
99/99 ok. 995_self_rebuild stays green (ww2==ww3==ww4 byte-id).
Class A wwstage cgen miscompile, silent until wwstage path engaged.
Pre-fix wwstage's name-keyed flatvariantidx returned -1 for `[]T`
variants (pat.str empty on N_TSLICE), so cgmatch and
cgtagvariantidx collapsed every `(scalar | []T)` arm to tag 0.
Internally consistent within wwstage; cstage's structural
`type_eq` (cmd/w6c/cgen.c:466 cg_tag_for_variant) matched
correctly. Bootstrap stayed green because no selfhost-corpus path
exercises `(scalar | []T)` until lib/bytes / lib/strings landing
pulls bytes.index through wwstage compilation — 967_bytes_run
uses `ww run` (cstage only), so the wwstage path was never
exercised.
Polarity catalog entry: wwstage UNDER (missing N_TSLICE dispatch
arm in variantindex lookup), not REVERSE — worker's deeper read
corrected rob's initial diagnosis. cstage's structural type-eq is
the leaner-correct side; wwstage converges to it per rule 10.
Fix: new `flatslicevariantidx` helper in cgenutil.ww keyed on
N_TSLICE shape walking pat.lhs against vt.lhs alongside the existing
name-keyed flatvariantidx; extend `taggedvariantindex` shape-fallback
with a `wantslice == ivisslice` axis alongside the existing str
axis; route N_TSLICE in cgenexpr.ww's cgtagvariantidx (is/as)
and cgmatch (case) through the helper. No edits to cgenmatch's
dispatch codegen (CMPQ/JNE/spill) — that's symptom, the bug is
in the variantindex lookup.
Surfaced the 7th corpus-coverage-blind unmask of session 5 (sister
shape to STATUS-4 #11 / #14 / #21 wwstage UNDER family). Latent
within lib/bytes (a6abac2) since landing today; 967_bytes_run's
cstage-only `ww run` driver kept it dormant.
Tests:
- 722_match_slice_variant pins cmp -s byte-id between stages
for the canonical (u8|[]u8), reverse-order ([]u8|u8), and
three-arm (u8|[]u8|str) shapes.
- 926_match_slice_variant_run runtime-pins 7 rows × 2 stages
(cstage + wwstage drivers): canonical, reverse-order, and
other scalar-vs-slice-of-same-primitive matrices (i8|[]i8,
i32|[]i32, u64|[]u64, rune|[]rune), three-arm with str.
Verifies both arms reachable and payload survives.
Filed follow-ups (latent, NOT in this commit's scope):
- flatslicevariantidx falls back to first slice slot when no
element-name matches; `([]u8 | []i32)` would mis-route. No
in-tree consumer.
- 926 missing nested ((u8|[]u8) | i32) row per rob's spec.
- 3-arm 32B tagged sequential-push payload corruption (both
stages, asm byte-id passes, only 9xx runtime catches).
- Chained inline pick() over 32B 3-arm slot (both stages,
bind-to-let workaround documented at 926 row).
93/93 ok. 995_self_rebuild stays green (ww2==ww3==ww4 byte-id).
Class A compile-time fatal retirement — `return f()` from an sret
callee bailed both stages with "sret return-forwarding for >24B
struct not wired (task #23)" at every site, forcing every caller
into a `let r = f(); return r;` workaround that materialised an
intermediate >24B copy in outer's frame. Forwarding now elides the
copy: outer reloads its own @sretarg into RDI for the inner CALL
via `MOVQ @sretarg(BP), DI` (NOT `LEAQ <local>, DI`), inner writes
directly into outer's caller-prealloc dest, RAX (inner's returned
dest pointer per the sret discipline) is already outer's return
value.
Wires 2 sites × 2 stages (same triangle as #23): caller arg-shift
in cgcall/pushargsrev gains an RDI-source switch via
cg_sret_forward / c.sretforward; callee return-arm in cgreturn
replaces the fail-loud abort with cgexpr-into-cgcall + epilogue.
The @sretscr scratch slot is still pre-allocated on the forwarding
branch (unused) — eliding would need AST-walk awareness in
scanlocals; symmetric-allocate is the simpler path and keeps
byte-id with non-forwarding callers.
Latent surfaced and filed during probe (NOT in this commit's
scope): multi-sret-receive in a single fn diverges between stages
— cstage always allocates @sretscr on first sret CALL, wwstage
only when sretdestoff == 0. Bootstrap stays green because the
selfhost corpus has zero >1-sret-receive call sites.
Tests:
- 721_sret_struct_return gains 2 forwarding rows + a 4th asm-
presence sentinel: at the inner CALL site inside outer fn, the
RDI source must be `MOVQ -K(BP), DI` (reload of outer's saved
@sretarg) NOT `LEAQ -K(BP), DI` (a temporary local would write
inner's payload into outer's frame, not caller's dest).
- 925_sret_struct_return_run gains 3 forwarding rows: simple
quad forward, multi-arg inner (pair-by-value + scalar args
alongside the hidden RDI), and slice-payload (decoder
{ i64, []u8 } — the utf8 iterator shape, asserts ptr/len/cap
survive the @sretarg chain).
90/90 ok. 995_self_rebuild stays green (ww2==ww3==ww4 byte-id).
Class B shared miscompile pre-fix: cstage skipped the CALL emit at the
receive site (frame collapsed, exit 11); wwstage emitted CALL but
truncated 32B return to AX only (slice payload garbage, segfault on
g.b[0]). Both stages now lower plain TY_STRUCT > 24B through the SysV
sret discipline: caller pre-allocates dest, passes &dest in RDI as a
hidden first-arg (user args shift to SI/DX/CX/R8/R9/+stack), callee
saves RDI to @sretarg at the prologue and writes through it, returns
RDI in RAX. Surfaced by lib/encoding/utf8 pre-flight when the
Hoehrmann decoder (32B) hit 698_cgreturn_struct.c's OUT-OF-SCOPE
marker.
Scope: plain TY_STRUCT > 24B only — tagged unions, tuples, str, slice
keep their existing register-return ABIs. `return f()` forwarding
from a sret callee is fail-loud-not-wired (compile-time error in
both stages, follow-up filed); the workaround `let r = f(); return
r;` is wired and byte-identical. Discard-context calls (`f();` of an
sret-returning function) share a per-fn single-slot @sretscr;
consecutive discards reuse the same slot.
698_cgreturn_struct.c's OUT-OF-SCOPE marker retired in the same
commit; three positive rows (32B quad, 32B decoder, 40B five) now
assert the sret discipline across both stages via byte-id diff.
Tests:
- 721_sret_struct_return pins three asm-presence sentinels per
row: (a) LEAQ -K(BP), DI immediately before CALL at the receive
site, (b) MOVQ -K(BP), AX before RET in the callee (sret return-
the-pointer), (c) negative-assert no MOVQ AX, -K(BP) capture for
return type >8B. Three rows × both stages × cmp -s byte-id.
- 925_sret_struct_return_run runtime-pins 7 rows × 2 stages
including the collision row (25B+ struct BOTH returned AND passed
by-value as arg — catches arg-shift, sister site to #11), nested
struct payload, slice payload, reassign-receive, N_IDENT return
rhs.
89/89 ok. 995_self_rebuild stays green (ww2==ww3==ww4 byte-id).
Wwstage call-arg-emit recognized tagged args only when the source
was an IDENT (already-materialized var). For N_CALL returning a
tagged-union, the natural-push path mis-routed: AX (tag) pushed
twice, AX clobbered with widentag(=0) between pushes, DX (payload)
dropped entirely. After POP, DI ← 0, SI ← tag — both reversed and
the payload word lost. Class A runtime miscompile, masked by zero
in-tree call sites of the shape until lib/encoding/utf8's iterator
API surfaced it via pre-flight A probe.
Fix aligns wwstage DOWN to cstage (rule 10). cgenutil.ww:pushargsrev
aistagged guard now fires for N_CALL whose callee returns a tagged
whose slot matches the param's tagged slot (mirrors cmd/w6c/cgen.c:
4216-4221's type_eq guard), and the natural-push fallthrough adds a
tagged-CALL arm pushing R8/CX/DX/AX high→low by slot size (mirrors
cmd/w6c/cgen.c:4373-4387). cgenexpr.ww:cgcall's per-arg pop-count
picks up the same taggedcallslot helper so the next arg's POPQ
doesn't land on residual tag/payload words.
Sister-family to #11/#14 in the variant-widen ABI chain — call-site/
caller-side surface, distinct from callee-side #11 (param decompose)
and scratch-side #14 (return slot). Fifth corpus-coverage-blind
unmask this session (catalog: i64 div/mod CQO #16; wwstage IDENT-
local /= no-op #16-B2; cstage signed-DATA module-scope #19; wwstage
silent-zero arrays #19 mirror; #21 call-arg DX drop).
Test: 720_tagged_call_arg asm-presence row (PUSHQ DX appears
between CALL and next CALL, before PUSHQ AX) + 924_tagged_call_arg_
run 9xx semantic row (5 rows: 4-variant CALL-source, 4-variant
IDENT-source regression guard, 2-variant ptr/err, multi-arg tagged
+ scalar). Bootstrap byte-id (ww2 == ww3 == ww4) holds.
B1 (63332fe) landed CQO in both stages' assemblers and switched the
binary `/` and `%` paths to it. The compound-assign sisters (`/=`,
`%=`) were six explicit workarounds across both stages, all calling
out either "fallback for TK_SLASHEQ" or just falling through with no
case at all. With CQO available, every site mechanically ports to the
same "park rhs in CX, slot value into AX, CQO/IDIVQ CX, ferry result
back" sequence.
wwstage cgenexpr.ww:5381-5403 silently no-op'd IDENT-local signed
compound div/mod — `x /= y` and `x %= y` produced no IDIV emit at
all, just a load-bearing `MOVQ BX, off(BP)` that wrote the freshly
loaded slot value back unchanged. Bootstrap byte-id passed because
no selfhost-corpus path exercises signed compound. Latent miscompile
retired alongside the workaround revert.
cstage cgen.c:3735 (top-level-let global compound) was NOT in the
initial five-site bundle and surfaced via worker probing the
wwstage:5147 fix — `let gs: i32 = 100; gs /= 7;` returned 7 (divisor)
on cstage but 14 (correct quotient) on wwstage. Rule 10 caught the
would-be Class A divergence; the sixth site bundles in.
Six sites, one family:
cmd/w6c/cgen.c:3549 deref-compound `*p OP= v`
cmd/w6c/cgen.c:3735 top-level-let `gs OP= v`
cmd/w6c/cgen.c:3765 IDENT-local `x OP= v`
selfhost/cmd/wcc/cgenexpr.ww:3338 deref-compound
selfhost/cmd/wcc/cgenexpr.ww:5147 top-level-let
selfhost/cmd/wcc/cgenexpr.ww:5381 IDENT-local (silent-no-op)
test/wcc/978_intdiv_signed.c adds 7 compound rows × 2 drivers = 14
fixtures (now 68/68): IDENT-local /= /=- /=u, deref *p /= *p %= *p
/=u, with negative-dividend, negative-divisor, and unsigned-high-
bit-set coverage. Top-level-let compound coverage is deferred per
task #18 — single-file inline drivers hit a pre-existing linker
`undefined reference to '<file>.gs'` for LEAQ name(SB) targets.
cstage:3735 and wwstage:5147 are code-review-verified for rule-10
symmetry until #18 lands.
Grep-sweep (`if (n < 0) { neg = true; n = -n; }`) returned two sites
in lib/fmt/fmt.ww i64dec and lib/strconv/strconv.ww — both mirror
ref/hare/strconv/itos.ha's pre-negate idiom for INT64_MIN safety.
Per the Hare-faithful filter, both stay.
Shared miscompile in both stages — not a divergence. Bootstrap byte-id
passed throughout because both stages emitted the same wrong asm. Both
the C cgen (cmd/w6c/cgen.c TK_SLASH/TK_PERCENT) and the ww cgen
(selfhost/cmd/wcc/cgenexpr.ww) prepped IDIVQ with `MOVQ $0, DX`, which
is the unsigned 128-bit dividend shape. For a negative RAX, the CPU
then divides 2^64 + (-RAX) by the divisor — unsigned wraparound, not
signed division. Surfaced via lib/time/add() needing the verbatim Hare
signed-%-normalisation in ref/hare/time/arithm.ha.
Fix: emit CQO (sign-extend RAX into RDX:RAX, REX.W 99) on the signed
arm; keep MOVQ $0, DX on the unsigned arm where the DIVQ-vs-IDIVQ
dispatch was already correct. Since both stages always emit 64-bit
IDIVQ regardless of source width, a single CQO suffices for
i64/i32/i16/i8 — the dividend already lives in RAX sign-extended. No
CDQ/CWTL/CBTW needed.
Symmetric stages (rule 10): both stages were broken identically; both
get the same surgical fix. Adds A_CQO to each assembler's opcode set:
cstage in cmd/w6c/6.out.h + cmd/w6c/txt.c + cmd/w6a/{parse,asm}.c;
wwstage in selfhost/cmd/w6a/{types,parse,asm}.ww.
Class B (shared miscompile) — new in the session's polarity catalog.
Bootstrap byte-id is useless for catching it; semantic 9xx runtime
tests are the right shape. test/wcc/978_intdiv_signed.c covers 27 rows
× 2 drivers = 54 fixtures across {i8,i16,i32,i64,u8,u16,u32,u64} ×
{/, %} with width-boundary minima (INT8_MIN, INT16_MIN, INT32_MIN,
INT64_MIN/2) and high-bit-set unsigned anchors. INT64_MIN is spelled
(-INT64_MAX) - 1 per task #17 (wwstage NEGQ-over-imm drops digits on
-9223372036854775808i64); that literal-cgen bug is unrelated to this
fix.
Two known compound-assign workarounds at cmd/w6c/cgen.c:3765
(TK_SLASHEQ IDENT-local) and :3549 (TK_SLASHEQ/TK_PERCENTEQ
deref-compound) remain in tree; both depend on the assembler having
CQO, so they revert in a follow-up commit citing this one.
Closes STATUS latent #1: @tagscr shared 24B reservation across the
four tagged-scratch sites (cgreturn, pushargsrev, cgindex
tagged-elem, pointer-rooted struct-field tagged write). Any fn that
needed >24B (e.g. slice-in-tagged-field 32B) silently overflowed
into the neighbor frame slot. Surfaced concretely as getopttest's
errortable wwstage exit 16 after #37 fixed the upstream gaps.
c.tagscrsz: i32 on the cgen struct is the single source of truth.
tagscrbump(c, need) in scanlocals raises the max across all 4
reservation sites and returns the frame delta. All emit sites
(cgreturn / pushargsrev / cgindex / cgwidentaggedstore pointer-
rooted) read c.tagscrsz instead of hardcoded 24. Mirrors the existing
cgwidentaggedstore precedent; @tagbase keeps its 8B scanseenmark
dedup (always 8B, correct).
Unmasked latent bug (now fixed): scanlocals's pointer-rooted struct-
field tagged-write detection uses localfindnode(c, base.str) to
resolve the *struct base. For `fn fill(h: *holder)`, h's scan-time
stub from scanseenmark had tnode=nil, so the @tagscr reservation
never fired. Pre-#38 the hardcoded 24B masked this; #38's correctly-
sized slot exposed it. cgfn's param scan loop now sets
c.locals.tnode = scanp.lhs after scanseenmark so localfindnode
resolves param types at scan time.
Test 714 (tagged_return_scratch): 4 rows × 2 stages = 8 fixtures.
Direct adjacency repro; match-arm field-by-field read; **mixed-
sizes-one-fn** (16B pushargsrev widen + 32B cgreturn widen in the
same body — pins the lockstep invariant that a sibling site can't
undersize the shared slot); call-site struct-payload widen. Row 3
specifically would regress if a future refactor ever forgets to
route an emit site through c.tagscrsz.
982 getopt_run green through both stages (was the original surface);
995 self_rebuild byte-id holds.
The original #37 symptom (worker-34's `..findflag` mangle) cannot
reproduce on master — was a runtime miscompile misattributed to a
link-time issue. Investigation surfaced three real wwstage cgen
gaps in the N_INDEX-through-struct-field family, sister bugs to
#34 (N_INDEX N_IDENT-base) and #36 (primsize-default-to-8).
1. `indexbaseesz` slice-element stride defaulted to 8 for named-
struct elements. `&opts.ptr[i]` for `opts: *[]option` computed
MOVQ $8 instead of $24. Fix: route slice case through
`elemsizeofc(c, innert)`; ptr-to-named-struct via structlookup.
2. `cgun TK_AMP N_INDEX` ignored N_DOT base. `&p.ptr[i]` left
esz=8 because only N_IDENT base was handled. Mirror cgindex's
existing N_DOT arm.
3. `nodeisstr` N_INDEX arm only walked N_IDENT bases. `cmd.argsptr[i]`
for `argsptr: *str` returned false; pushargsrev dropped the
.len half at call sites. Add N_DOT-base arm that walks the
struct field's pointee.
Test 713 (struct_field_index): 3 rows × 2 stages = 6 fixtures, one
per fix shape. Runtime-only; bootstrap byte-id (995_self_rebuild)
covers cross-stage drift.
Residual: getopttest's errortable still fails through wwstage with
a slice-of-str-via-&arr[expr] miscompile. Filed as task #38.
cmd/wcc/check.c silently accepted `let a; let a;` in the same block
and similar redecls. Pre-#27 the localoff dedup masked it; post-#27
last-write-wins via head-first localfind. Surfaced by worker-27
during the #27 review.
Cstage: 5 guard sites (check_scope_define-NULL → err) covering
N_LET block-bind, N_MLET tuple binders (incl. same-tuple
`let (a,a)`), N_FORRANGE tuple binders, top-level let, fn param.
Voice: "<kind> '<name>' redeclared in same scope" for inner;
"duplicate let %s" for top-let, matching the existing
"duplicate <kind>" idiom at 1812/1851/1872.
Wwstage: TODO(#11) comments at the 4 mirror sites (installdecl,
N_FORRANGE, N_LET, installparams). Full enforcement waits on the
checkfile pass per rob.
**Unmasked by #32 (worth flagging):** selfhost/cmd/wcc/cgenexpr.ww
cgcall had `let callee: *node = n.lhs;` twice at fn-body scope
(copy-paste, identical value). Pre-fix silent-redecl absorbed it;
post-fix the new guard rejects. Removed the second decl — outer
`callee` stays visible across the intermediate block.
Test 712 (redecl): 10 rows (6 neg + 4 pos), cstage-only per rob.
Negative rows cover all 5 guard sites + same-tuple-dup. Positive
rows pin the legal counter-shapes (cross-block, name-only bucket,
forrange body, mcase-per-arm).
Test 300 row 34 ("shadowing in inner scope; same scope flagged")
was incorrectly asserting the bug; flipped to expect "redeclared"
and added a sibling row pinning cross-block shadow stays ok. Test
709's `same_block_redecl_pin` canary (explicitly documented as
flipping under #32) removed; pointer to 712 left in its place.
wwstage cgdot lacked a TY_FN branch for module-qualified N_DOT
rvalues. `let p = mod1.ping` fell through to the MOVQ/LEAQ-narrow
fallback, loading 8 prologue bytes from the fn's first instruction
instead of taking its address. Cstage cgdot already handled this
case (wired during #9, f1440bf).
Mirror cstage: gate on fnretlookup(c, fld) before the localloadop
fallback; emit `LEAQ <module>.<name>(SB), AX` via emitfnname with
the hint from lhs.str.
Extend 706_fnlabel_mangle: pos.ww now stores mod1.ping/mod2.ping
into local fn-pointer slots and dispatches through them in addition
to the existing direct calls. Expected exit 56 → 112. Regression
shape: without the new branch, MOVQ leaf(SB) loads the prologue
bytes; indirect call jumps into garbage → SIGSEGV.
ww2 == ww3 == ww4 byte-identical at the new emit.
Both stages emitted fn TEXT labels by leaf only; lib/os and lib/io
exporting the same leaves (read, write, close) collided at link.
lib/fmt + lib/log worked around with @symbol("rt_syscall") stubs.
Drop d->export from the fn skip rule in mod_collect (both stages) so
exported fns mangle as <module>.<name>. Let/def/type keep current
behavior. Skip retained for {@symbol, main, empty-module}.
Add cur_mod thread through cgfn + mod_lookup_for_fn(name, hint) at
all 4 label-emit sites (TEXT def, LEAQ N_IDENT, CALL N_IDENT, CALL
N_DOT). Wwstage mirror: emitfnname + modlookupforfn + curmod.
Invariant comment pinned in both stages.
ww2 == ww3 == ww4 byte-identical at the new label format.
706_fnlabel_mangle covers same-leaf cross-module CALL + private-leaf
cur_mod disambiguation through a fn-pointer rvalue.
Wwstage LEAQ-of-fn N_DOT (`let p = mod.fn` rvalue) is a pre-existing
gap; deferred to a follow-up. fmt/log rt_syscall stubs untouched
here; cleanup follows.
Sister fix to #17. The BP-rel helper from #17 covered N_LET /
N_ASSIGN N_IDENT-lhs / N_RETURN; the four N_ASSIGN N_DOT-lhs
structlit walks still went through the inline `cgexpr(field.lhs);
store-AX-sized` shape and silently dropped trailing bytes when a
struct-typed field's value was itself an N_STRUCTLIT. Affected dot
flavors: single-dot via_ptr / global / BP-rel and the chained-dot
walker (depth >= 2, all three root flavors).
Extend `cg_structlit_fill_bp` / `cgstructlitfillbp` into
`cg_structlit_fill` / `cgstructlitfill` taking a destination mode
(DST_BP / DST_PTR_LOCAL / DST_GLOBAL = 0/1/2), srcoff (PTR_LOCAL),
srcname (GLOBAL), and disp accumulator. `disp` grows by foff on
descent; srcoff/srcname stay constant across the call tree. The
pre-#17 wrappers are preserved byte-identically by delegating with
mode=DST_BP — 995_self_rebuild byte-identity holds for the no-
nested-STRUCTLIT case that selfhost source actually uses.
The non-BP modes reload BX before the ELLIPSIS zero-fill loop AND
before every field store (tagged, scalar, and the cgexpr leaf).
This is correctness-by-construction — cgexpr clobbers BX between
fields, and the redundant reload only fires on shapes that didn't
compile before. The four dot-flavor sites in each stage now compute
their dst mode + disp and call the shared helper (reducing each
from ~80-130 inline lines to ~5-12 lines of dispatch).
Stage signature asymmetry: cstage threads Local** for cgexpr; ww-
stage takes explicit totsize because #15 (split totsize into
naturalsize + slotsize) is still pending and the dot sites need
structnaturalsize while the BP-rel sites need si.totsize. Both
asymmetries are documented in the helper docstrings.
704 covers 8 rows (24 checks: 8 cstage exits, 8 wwstage exits, 8
cstage-vs-wwstage .s byte-identity diffs): 6 dst-flavors (single-
dot local/ptr/global, chained-dot local/ptr/global) plus single-
local 3-deep and single-ptr 3-deep to pin disp threading through
the helper's recursion and through DST_PTR_LOCAL BX reloads.
The nested struct-typed CALL rhs in field-walks has the same shape
as the STRUCTLIT bug fixed here but the helper only handles
STRUCTLIT — tracked as task #20.
Pre-existing landmine surfaced by #5. For a struct literal whose
field value is itself an N_STRUCTLIT of a struct-typed field, the
inline field-walk did `cgexpr(field.lhs); store-AX-sized`. cgexpr
has no whole-struct-in-register convention, so the nested literal
landed AX = first qword and the trailing bytes silently stayed zero
(or stack garbage). Three BP-relative sites in each stage hit it:
N_LET, N_ASSIGN N_IDENT-lhs, and N_RETURN N_STRUCTLIT.
Fix: shared cg_structlit_fill_bp (cstage) / cgstructlitfillbp
(wwstage) helper handles TK_ELLIPSIS autofill, tagged-field
widening, float vs scalar store dispatch, AND recurses on
struct-typed N_STRUCTLIT field values at bp_off + field_off. All 3
sites in each stage now call the helper instead of the inline walk.
Scalar store dispatch is the explicit {1->MOVB, 4->MOVL, else MOVQ}
shape (not fieldstoreop, which would emit MOVW for fsz==2) to stay
byte-identical with cstage pending task #13. Sister N_ASSIGN N_DOT
structlit walks (via_ptr / global / BP-relative-through-N_DOT) keep
their inline walk and still drop nested-STRUCTLIT silently — tracked
as task #18.
703 covers 6 rows: let_nested_i64, let_nested_3deep, let_nested_i32,
let_nested_middle (i64; switch to i32 once #15 lands),
assign_ident_nested, return_nested. 995_self_rebuild byte-identity
preserved.
Pre-existing landmine surfaced by #5 (whole-STRUCT N_ASSIGN). Both
stages' N_DOT dispatch gated on `lhs->lhs->kind == N_IDENT`; the
parser produces N_UN(STAR, IDENT(p)) for `(*p).f`, so both sides fell
off:
- Write side (cgassign N_DOT base): emitted nothing, store dropped.
- Read side (case N_DOT pointer-auto-deref): cgexpr derefed the
pointer as a scalar, AX = first qword of struct, field offset
dropped.
Fix: retarget base / dot_lhs to the inner IDENT when shape is
N_UN(STAR, IDENT). The existing via_ptr branch fires identically to
`p.f`. v1 scope is bare-IDENT inner only; `(*expr).f` (non-IDENT
pointer expression) is tracked separately as task #19.
702 covers 7 rows: write_i64/i32/str, read_i64/i32/str_len, roundtrip
Receive side of #4's cgreturn ABI (aee8149) for TY_STRUCT lvalues of
size <=24B. Producer materialises rhs into AX=bytes[0..7], DX=[8..15],
CX=[16..23], zero-padded to 24B; receive sites here read the regs and
write only `declared sz` bytes — MOVQ for full 8B chunks plus a sized
tail (MOVL/MOVW/MOVB) by the *declared* struct size. ASYMMETRY: do NOT
mirror the sender's three uniform MOVQs, else trailing 1..7B chunks
overrun the next local slot. Tail chunks in {3,5,6,7} are unreachable
under WW struct align rules (size%align==0) and fall through.
Five sites wired in each stage (cstage cgen.c, wwstage cgenexpr.ww +
cgenstmt.ww), call-result + structlit rhs at each:
- N_LET `let s: T = bar()` / `= T{...}` cgenstmt cglet
- N_ASSIGN N_IDENT-lhs `s = bar()` / `= T{...}` cgenexpr cgassign
- N_ASSIGN single-DOT local-base `o.f = ...`
- N_ASSIGN single-DOT ptr-base auto-deref `p.f = ...`
- N_ASSIGN single-DOT global-base `g.f = ...`
- N_ASSIGN chained-DOT depth>=2 `o.m.in = ...`
(The four dot-flavors share one shape pattern, hence "5 sites".) Where
the dst addr needs scratch (ptr-base/global-base/via_cx), it is loaded
into BX after the call so CX stays as the third value word; for
structlit field-walks BX is reloaded before each store since cgexpr
clobbers AX/BX between fields.
wwstage needed a new `structnaturalsize(si)` helper (cgenutil.ww):
si.totsize is mis-named — it's slot-padded to 8 by registerstruct for
stack-slot use, while the receive ABI wants the type's natural size
(max(foff+fsz)). Splitting si.totsize into naturalsize + slotsize is
tracked as the wwstage struct sizing follow-up (task #15); until that
lands, the helper recovers the natural size at receive sites.
Test 701_cgassign_struct.c (18 rows, 3 checks each — cstage value,
wwstage value, asm byte-identity), wired in Makefile after 698. The
headline ASYMMETRY case is the 20B `{i32×5}` row: sender pads to 24B
via three MOVQs, receiver writes MOVQ AX +0, MOVQ DX +8, MOVL CX +16.
A regression to a MOVQ tail there overruns 4B past the slot and
flips the exit-code check.
smoke.combined.ww is the auto-regen ride-along of strings.freeall
landing in 714d089 (worker-shlex).
Pre-existing gaps surfaced and tracked separately (not fixed here,
out of scope):
- task #16: silent drop of `(*p).f = ...` explicit-deref dot lhs.
- task #17: silent zero of nested STRUCTLIT field in N_LET / N_ASSIGN
initializer — the field_chain and field_global test rows use
explicit field writes (`o.m.t = 10i64;`) rather than nested
literals as a fixture-level workaround.
- task #9: module-name-mangle for fn labels avoided in the
field_global_call fixture by `let g: outer;` (no init).
make test: 59/59. 994_w6c_ww + 995_self_rebuild PASS — bootstrap
byte-identity is the load-bearing proof for this commit's scope.
Match-arm bind size in wwstage hardcoded str=16, []T=24, else=8 in
both cgmatch (emit) and scanlocals (frame pre-scan). A TY_STRUCT
variant fell into the 8B fallback: only the first quadword reached
the bind, and the prologue SUBQ underbooked the frame so the
emit-time localalloc(bsz=24+) wrote past SP.
Replace the hand-rolled table with slotsize(c, pat) at both sites.
slotsize already covers N_TNAME named structs (returns si.totsize),
str (16), []T (24), tuples, aliases, and primitives (8). Mirrors
cstage cgen.c cgmatch which falls through to bu->size for TY_STRUCT.
Cstage is correct; no mirror needed.
Test 695 covers seven shapes: the 3xi64 headline repro, a 4xi64
struct via let-init scrut (exercises >24B bind), a mixed-quadword
struct (i32+i32+i64+i64), str/slice/i32 negative controls, and a
direct let-init scrutinee variant. The wider 4xi64 row uses the
let-init shape because the N_DOT spill path in cgmatch tops out at
AX/DX/CX/R8 — a separate, unrelated gap from the bind size.
cgdot of a tagged-union struct field previously dropped the AX/DX/CX/R8
payload-register convention used by tagged-union returns: cstage's
direct-struct branch stopped at CX (size > 16) and never loaded R8
(slice-payload variants, slot 32B); the via_ptr branch had no TY_TAGGED
handler at all, falling through to fldloadop and yielding only the tag
in AX. The N_DOT scrutinee fallback in N_MATCH similarly stored only AX
into the spill slot. Wwstage cgdot had no TY_TAGGED branch in any of
the direct, *struct, or top-level-global field-load paths, and cgmatch's
non-ident scrutinee branch didn't recognise N_DOT — dispatch always
computed want = 0 and the spill scratch was hardcoded 24B. The combined
effect: any code reading `s.taggedfield` and consuming more than one
quadword of the payload saw garbage in the upper halves.
Cstage: extended the direct-struct TY_TAGGED branch with an R8 load for
size > 24 (CX still loaded last so global LEAQ-into-CX rooting
survives), added a parallel TY_TAGGED handler to the via_ptr (TY_PTR
inner TY_STRUCT) field branch, and extended the N_DOT scrutinee spill
fallback in N_MATCH to write DX/CX/R8 alongside AX.
Wwstage: new cgloadtaggedfield helper emits the four-register load with
CX-last ordering, and dotfieldtnode resolves a field's declared type
node for a local-ident or *struct base. cgdot grew three TY_TAGGED
branches (direct local, *struct deref staging in BX, top-level global
through CX). cgmatch's non-ident-scrutinee branch grew an N_DOT type-
extraction path mirroring the N_CALL / N_INDEX shapes and now sizes the
@match_spill slot from slotsize(scrutt) so slice-payload variants don't
overflow the historical 24B alloc. rhstaggedabicall accepts N_DOT so
`let copy: ev = h.e;` and tagged-arg call sites pass through the
tagged-source spill branch of cgwidentaggedstore.
Out of scope for #28 and left as separate latents: wwstage's match-arm
bind for a TY_STRUCT-typed variant copies only 8B (cstage falls back
to bu->size; wwstage's bsz=8 default), and the variant-index lookup
for an i64 literal in (i32 | i64) picks the wrong tag on the write
side. Both surface in struct-payload tagged unions and merit their
own tasks; the new test rows steer clear so #28's fix verifies
end-to-end on scalar / str / slice payloads.
Test 693_dot_tagged_source — three variant shapes (16B i64, 24B str,
32B slice) read from direct local, *struct param, top-level global,
and let-init round-trip. The 32B-slice rows verify v.cap (R8 / +24)
so dropping the upper-word load isn't masked by len-only checks; the
top-level-global row routes the write through *p because the direct
global-LHS tagged store is a separate wwstage gap (followup). Three
negative controls (untagged i32 / str / slice fields) keep the new
TY_TAGGED guard from shadowing the existing field-load paths. Wired
into make test; 37 tests total. Bootstrap ww2 == ww3 == ww4
byte-identical.
Extended cg_widen_tagged_store (cstage) / cgwidentaggedstore (wwstage)
to take a base_reg/basereg parameter so the primitive supports non-BP
destinations. Cstage extends body in-place via via_outer gate +
spill+scratch+copy-out; wwstage splits into wrapper (non-BP) +
cgwidentaggedstorebp (BP-only) to dodge the no-goto constraint. New
N_ASSIGN field TY_TAGGED branch routes through the primitive for all
rhs shapes.
Scope-adjacent: fieldsize recurses through N_TTAGGED via slotsize and
TNAME-aliased-to-tagged via aliaslookup. Needed for the test fixtures.
Wwstage read-side N_DOT-of-tagged-field source is filed as task #28;
test rows use mark-canary verification until that lands.
Parallel to TY_STR/TY_SLICE branches at cgen.c:1939/1962. Word-copy
from src slot to field+k*8 via AX, MOVL/MOVB ragged tail. N_IDENT
rhs only — struct-call-result and struct-literal rhs are different
code paths, filed as task #27. Symmetric in N_ASSIGN field case AND
spine-walker terminal; mirrored in wwstage cgassign four sub-shapes
(*struct base, direct local, global, spine terminal).
Parallel to the existing TY_STR branch at cgen.c:1939. Stores AX/BX/CX
at field+0/+8/+16 across three sub-shapes (via_ptr, is_global, direct
local) — DX as addr scratch where needed so CX (cap) survives.
Symmetric in wwstage cgassign. Surfaces tasks #25 (whole-struct rhs)
and #26 (whole-tagged rhs) in the same locus class.
Read-side fix dual to fldloadop: signed-narrow local/global ident loads
now MOVSXD/MOVSWQ/MOVSBQ from the slot instead of raw MOVQ. Deref-stores
(MOVL/MOVW/MOVB) no longer corrupt downstream i64 widens. Compound RMW
restructured to gate direct-mem ADDQ/SUBQ on load_op == MOVQ. Top-level
lets use LEAQ+indirect (w6a doesn't expose MOVSXD/MOVSWQ/MOVSBQ for
D_EXTERN).
dotchainresolve out-params restored to natural *i32 (workaround retired).
selfhost/CLAUDE.md graduated.
Symmetric write-side counterpart of #8, bundled across both stages.
cstage [N]Struct write was broken (1986 gated on TY_PTR); wwstage had
no N_DOT(N_INDEX) write branch at all. New branch covers both
[N]*Struct and [N]Struct via viaptr flag, uses fldstoreop for
scalar/sub-word, MOVSS/MOVSD for float, two-MOVQ for str rhs.
Compound (PLUSEQ etc.) wired for integer scalar.
cstage cmd/w6c/cgen.c gained the missing N_DOT N_INDEX-lhs branch.
Covers both [N]*Struct and [N]Struct via fldloadop. wwstage already
handled [N]*Struct since 7c75dd2; refactored to mirror cstage exactly
and added [N]Struct. The spill workaround in dotchainresolve stays
(Pike rule); task #14 retires it as a follow-up.
Wwstage cgassign N_DOT(N_INDEX,...) silent store-drop discovered in
scope, filed as task #16.
type_isunsigned recurses TY_ENUM and includes TY_RUNE on both stages.
13 LOAD + 6 STORE ladder sites (cstage) plus 4 more wwstage stragglers
in cgindex/cgforrange collapsed to fldloadop/fldstoreop helpers. N_CAST
narrow gate symmetrised; task #1's literal-kind workaround retired.
bool kept out of type_isunsigned, special-cased in field helpers.
Retroactively fixes a u32 mis-sign-extend in deref-compound (sz=4
hardcoded MOVSXD), pinned by new 660_field_signed row.
Loop-shaped spine walker for value-struct chains (o.i.a) and slice/str
pseudo-fields (s.buf.len), read+write, both stages. SB-fallback at the
catch-all preserved for unresolved module-qualified idents.
Follow-ups filed: tasks #7-#10 (wwstage >6-arg frame over-alloc, chained
array-elem field BX loss, & through chained DOT, signed sub-word field
loads zero-extend).
Both stages were eagerly evaluating RHS regardless of LHS (eager
ANDQ/ORQ on the two results). Now: eval LHS into AX, CMPQ $0 +
JE/JNE to a per-call-site label, eval RHS into AX, fall through.
AX holds the LHS sentinel on the skipped path — typechecker
already enforces bool operands.
Surfaced by lib/getopt's nil-argv guard segfault. Six new rows in
test/wcc/700_e2e.c, three of which segfault pre-fix. lib/getopt
test comment relaxed; nested-if kept as regression marker.
Two cgen/check bugs surfaced by new lib modules, plus the modules
themselves (crc64, siphash, random, base64, base32).
1. `(big_u64): u32` (and `: u16`, `: u8`, `: bool`) didn't truncate.
N_CAST emitted nothing for int↔int; the value stayed in AX with
its upper bits intact and downstream CMPQ/DIVQ misread the slot.
The TK_TILDE path already had clamp logic for the same reason —
N_CAST was the missing case. Both stages now MOVL r,r for u32 and
ANDQ $mask for u8/u16/bool. Signed-narrow (i8/i16/i32) stays
no-op until w6a grows reg-reg MOVSBQ/MOVSWQ/MOVSXD. selfhost
cgcast walks alias chains via aliaslookup before checking
primsize/typenameisunsigned so `(u: random)` where
`type random = u64` still bypasses the clamp.
See cmd/w6c/cgen.c N_CAST and selfhost/cmd/wcc/cgenexpr.ww cgcast.
2. `mod.mod` type refs (`random.random` when the imported module
declares `export type random = u64;`) failed with "unknown type".
The driver concatenates imports into one flat scope, so SK_USE
`random` collided with SK_TYPE `random` and scope_define silently
dropped the use. resolve_typename's leaf lookup required
`kind == SK_USE` and gave up. Adds a `use_alias` flag to Sym; the
pass-1 decl scan now marks colliding syms in both directions
(use-after-type and type-after-use). resolve_typename and the
N_DOT cexpr branch treat `use_alias` like SK_USE for qualified
lookup. selfhost check.ww was already lenient on this path so no
ww-side change was needed; bootstrap fixed point (990-995) holds.
See cmd/wcc/check.c installdecl pass + N_DOT/resolve_typename and
cmd/wcc/ww.h Sym.use_alias.
New modules under lib/, each with @test vectors in *_test.ww and wired
into test/wcc/900_stdlib.c (26 modules → all compile):
- lib/hash/crc64 ECMA, ISO (mirror of crc32 shape)
- lib/hash/siphash SipHash-2-4, buffer-based sum/sum24
- lib/math/random SplitMix64 (init, next, u32n, u64n)
- lib/encoding/base64 RFC 4648 std + url-safe encode/decode + sizes
- lib/encoding/base32 RFC 4648 std + base32hex encode/decode + sizes
Seven fixes across the toolchain, plus three new lib/hash modules
(adler32, crc16, crc32) that surfaced them.
1. `~x` on u8/u16/u32 left the upper bits set: NOTQ inverts the
whole 64-bit register and nothing trimmed it back to type
width, so a returned `u16` would compare 64-bit against a
typed literal and disagree. Both stages now mask after NOTQ
for narrow unsigned: AND $0xFF/0xFFFF for u8/u16, MOVL r,r for
u32 (ANDQ $0xFFFFFFFF sign-extends imm32 and is a no-op).
Signed narrows stay sign-extended and need no fix-up. See
cmd/w6c/cgen.c N_UN TK_TILDE and selfhost cgenexpr.ww cgun
TK_TILDE with new nodeprimwidth helper.
2. w6a had no D_CONST immediate path for ANDQ / ORQ. cgen would
emit `ANDQ $65535, AX` and the rr encoder silently wrote
`21 /r` with garbage reg fields — the mask never happened.
Added `81 /4` (AND) and `81 /1` (OR) imm32 paths in both
cstage and selfhost w6a. The ~width fix above depends on this.
3. `s: []u8` cast as a direct fn argument produced a 0-length
slice. cgexpr for N_CAST left (AX=ptr, BX=len) from the str
source but never set CX (cap), and the arg-push fallback only
pushed AX. cgcast now synthesises CX=BX when target is slice
and source is str; node_isslice / arg-push recognise
cast-to-slice and emit the full (cap, len, ptr) triple. Both
stages.
4. `*[N]T` element-store used 8-byte stride + MOVQ regardless of
T's width. Indexing `buf: *[4]u16` would step 8 bytes and
write 8 bytes per element. Added idx_eff (drills *[N]T → T)
in cstage and the matching pointer-array drill in selfhost
elemsizeof. Also added MOVW / MOVZWQ / MOVSWQ to w6c, w6a,
and selfhost mirrors so 2-byte element stores/loads use the
right opcode (was falling through to MOVQ and trailing 6 bytes
into the next slot).
5. Slicing a top-level fixed array (`g[0:n]` where `g: [N]T` is
a global) computed the base from BP instead of the symbol —
localfind returned 0 and the cgen treated it as a local at
offset 0. Both N_SLICE-as-expression (cgslice) and N_SLICE-
as-call-arg paths now check let_islet / letvartnode and emit
LEAQ name(SB) when the base is a global array (or MOVQ
name(SB) for a global slice/pointer base). Both stages.
6. Top-level `let arr: [N]T = [v0, v1, ...]` link-failed on
cstage — emit_lets bailed when it saw N_ARRLIT init on an
array type, and the sz==8 scalar path then misemitted any
8-byte-sized array (e.g. [4]u16, [8]u8) as a single quad.
emit_lets now walks N_ARRLIT, evaluates each element as an
int/rune/bool/nil literal, packs per-element bytes
little-endian, and honours the trailing `...` repeat marker.
Selfhost already handled the literal-init path; fixed the
parallel sz==8 duplicate-DATAW emit on its side (the array
and the scalar paths both fired, last write winning at link
but the duplicate broke cross-stage byte-identicality on user
code with this shape).
7. w6a's per-line input buffer was a 1KB stack `char buf[1024]`.
A `DATAW` for a [256]u16 emits ~2080 bytes on one line, which
truncated mid-escape; the assembler then re-parsed the
remaining tail as garbage opcodes ("unknown opcode"). Bumped
cstage w6a to a 32K static buffer (selfhost w6a already
allocated per-line via amalloc).
lib: lib/hash/adler32, lib/hash/crc16, lib/hash/crc32 — pure
buffer-subset shape (matching lib/hash/fnv), with per-module
*_test.ww runnable via `ww test lib/hash/<name>`. Adler-32 plus
CRC-16 (CCITT/CMDA2000/DECT/ANSI) and CRC-32 (IEEE/Castagnoli/
Koopman) cover Hare's reference vectors bit-for-bit. Wired into
test/wcc/900_stdlib.c. .gitignore: lib/**/*.s,*.o so `ww test`
droppings stay untracked.
`make test` (26/26), `make bootstrap` (ww2≡ww3≡ww4), and per-module
`ww test` all pass. cgen output is byte-identical across cstage and
selfhost for every repro that previously diverged.
`*p += 1` and the rest of the compound-deref family (-= *= |= &= ^=
<<= >>=) fell through the N_ASSIGN switch in both stages and emitted
nothing. The `*p = v` block was gated on TK_ASSIGN, the IDENT-compound
block required N_IDENT, and there was no N_UN/TK_STAR compound branch
between them. Test 994/995/997 byte-identity hid it: both stages
mis-compiled identically, so the diffs were clean.
Surfaced via fmt.println("hello") segfaulting in wwstage builds.
findvariadicparam in cgenutil.ww does `*nfixed_out += 1`; the drop
left nfixed at 0, so `fprint(fd, args...)` mis-counted variadic args,
gathered fd as a formattable element, and segfaulted on tagged
dispatch.
Adds the missing branch in cmd/w6c/cgen.c N_ASSIGN and
selfhost/cmd/wcc/cgenexpr.ww cgassign: eval rhs → push, eval ptr →
BX, sized+extended load (BX) → AX (MOVZBQ for 1B, MOVSXD/MOVL for 4B
by signedness, MOVQ for 8B), pop rhs → CX, combine via
ADDQ/SUBQ/IMULQ/ANDQ/ORQ/XORQ/SHLQ/SHRQ on CX,AX, sized store back.
TK_SLASHEQ stays the rhs-only fallback, matching the IDENT path.
Float and aggregate deref compounds still fall through — uncommon.
Param-decl `name: T...` (Tparam.variadic=1, type []T), call-site
gather of N args into a fresh `[N]T`, forward via `xs...`, full
selfhost mirror, and lib/fmt graduated to the Hare shape.
Frontend:
- parse: `T...` after a param's type stamps Node.op=TK_ELLIPSIS
and breaks out (variadic must be last).
- check: resolve_type N_TFN / build_fn_type wrap the param type
as []T and set tp->variadic. N_CALL accepts either a tail of
args assignable to T (gather) or a single `xs...` spread of
[]T (forward); both bypass the "too many args" check on the
variadic slot.
- type: type_eq compares Tparam.variadic.
Cgen (cstage):
- call site: when the callee has a variadic last param,
materialise the tail args into a frame-resident `[N]T` via
localoff, write a 24B slice descriptor (ptr,len,cap), and
splice a synthesised N_IDENT into args[] so the downstream
widen/eval/pop loops see one slice slot. Tagged-element types
route each store through cg_widen_tagged_store. Forwarding
skips gather: the N_SPREAD wrapper is replaced with its inner
slice expression. Empty form writes {nil,0,0}. args[] / widen[]
bump from 16 to 64 to accommodate Hare's mixed-arg printers.
Selfhost mirror:
- lib/ww/parse: `T...` mark on N_PARAM.op.
- cgen: varargseq counter on Cg; scanlocals reserves
@vararg_d_N + @vararg_sl_N per variadic call (seq recorded on
N_CALL.uval so cgcall picks the same names). cgcall does the
same gather/forward and N_IDENT splice. cgfnparams treats
variadic params as 24B slice slots via a synthesised TSLICE
tnode. pushargsrev skips the tagged-widen detection for
variadic params (effective type is []T, not tagged).
- rhstargetname now recognises N_TRUE/N_FALSE/N_RUNELIT and
typed N_INTLIT so the variant-tag lookup finds bool/rune/iN
variants instead of falling through to "first non-str" (which
misassigned tag 0 to bool in tagged unions like formattable).
lib/fmt graduated: print/println/fprint/fprintln/errorln/fatal
take `args: formattable...`. Bare `error` (no -ln) is skipped —
the leaf name collides with strconv's `type error = !(invalid |
overflow)` under the driver's flat namespace.
Tests: 5 new e2e rows (plain gather, zero-arg, tagged element,
forwarding, fmt.println end-to-end). lib/CLAUDE.md workaround
paragraph replaced with the Hare-shape description.
Six fixes across the toolchain, surfaced by lib/lisp porting work.
1. f64 compound assigns (`acc += d`, `-=`, `*=`, `/=`). Both stages
load slot → X1, OP X0 into X1, store back (ADDSD/SUBSD/MULSD/
DIVSD are reg-reg only). Previous MOVSD-overwrite dropped the
OP. Locals and top-level lets.
2. Top-level `[N]u8` arrays + `&arr[i]`. let_emit_size grows a
TY_ARRAY branch so zero-init DATAW lands; cgindex / N_INDEX
store / `&base[i]` all detect a global array base and use
LEAQ name(SB) instead of LEAQ (BP). TK_AMP no longer pre-
evaluates the operand as a value-load — `&base[i]` computes
base + i*esz directly. Unblocks Hare's static-buffer pattern:
strconv.{u64,i64,f64}tos graduate to module-level `*_buf`
arrays and return owned views.
3. Cross-module `pkg.Enum.MEMBER`. Nested N_DOT chains that
don't fold to a known shape now emit `MOVQ <leaf>(SB), AX`
(mirrors the bare-IDENT unresolved fallback), so isolation
probes — and the test 990 cgen-match floor — stay consistent
across stages. strconv exposes `base` as a real `enum i32`;
callers updated. The `main` exemption (linker entry-point
keeps bare name even when not exported) mirrors C-side
collectmods into selfhost cgendecl.
4. Sum-typed parameter ABI. lib/bytes.{index,rindex} take
`(u8 | []u8)` needle; lib/strings.byteindex / rbyteindex take
`(str | rune)` needle (Hare-shaped; the byte-wise misnomer
`index` is dropped). tagged_arg_size cap bumps to 48 (6 int
regs), with a new partial-fit branch on the callee: when an
N-word tagged arg overflows remaining regs, fill what fits and
stitch the rest from positive BP offsets. scanlocals MCASE
handles slice binds (24B) and walks each arm with a saved /
restored seenmark set so two arms naming the same local each
get their own slot — matches cstage's per-arm scope reset.
5. 4-reg tagged-return ABI (AX=tag, DX=word0, CX=word1, R8=word2),
up from 3 regs. Slice-payload variants (`([]T | E)`, slot 32B)
round-trip ptr/len/cap end-to-end. Every receive site updates:
let-init via cgwidentaggedstore, match scrutinee spill, cgindex
tagged-element load (both N_IDENT and fallback bases),
pushargsrev tagged-ident arg (reads word count from slot size),
cgreturn slice variant in the shuffle path.
6. `expr: TaggedAlias` is a widening, not a re-interpret. C cgen +
selfhost cgwidentaggedstore peel an N_CAST whose destination IS
the union — so cgexpr's natural shape (str: AX=ptr, BX=len;
slice: AX=ptr, BX=len, CX=cap) is consumed by the matching
concrete-variant branch instead of being misread as a tagged
AX/DX/CX triple. Inner casts to a concrete variant (`7: i32`)
keep their type for proper tag lookup. `[N]Alias` arrays
resolve element size via slotsize + aliaslookup, and aliaslookup
strips a `pkg.` prefix so cross-module references work.
lib/fmt grows `formattable = (i64 | str | bool | rune)` plus
`printv` / `printlnv` taking an explicit `[]formattable` slice (the
receive side of Hare's `args: formattable...`). Call-site variadic
gather isn't wired — callers either hand-build the slice or compose
strconv.i64tos + strings.concat.
700_e2e: 114 → 123 rows (f64 compound, top-level u8 arrays + `&buf[i]`,
pkg.Enum.MEMBER, sum-typed (str|rune) and (u8|[]u8) params, 4-reg
slice-return ABI, formattable array). 26/26 tests, bootstrap stable
through ww4.
Closes the remaining tagged-union gaps after the prior two commits:
1. Tagged element in an array/slice (cstage). N_INDEX load now reads
slot words into AX/DX/CX, matching the tagged-return ABI so match
/ call-arg / let-init paths consume `arr[i]` uniformly. N_INDEX
store routes through a scratch slot + cg_widen_tagged_store +
byte-copy to &arr[i], so the full widening machinery (scalar /
str / struct payload / tagged subset / nullable fold) lights up
for element writes too.
2. Selfhost mirror — the cgen widen helpers (struct payload,
tagged-subset, spread-flatten) C cgen has had for two commits
finally land in selfhost:
cgwidentaggedstore — single writer for nullable / tagged ident /
tagged via AX:DX:CX / struct (lit + ident) /
str / scalar source shapes.
cgwidentagremap — CMPQ-chain tag remap for variant-subset.
rhsstructpayload — struct-name predicate; filters `!void` /
`!i32` aliases that share N_STRUCTLIT shape
but aren't structs.
rhstaggedident,
rhstaggedabicall — source-shape predicates.
flatvariantidx — spread-aware variant index lookup. Walks
`(...inner | T)` entries by resolving the
alias and inlining the inner's variants so
wwstage's tag order matches the check.c
flattening cstage does at type resolution.
cglet tagged init, cgassign tagged-ident reassign, cgreturn struct
/ subset payload, pushargsrev struct payload, cgindex tagged
element load, cgassign N_INDEX tagged element store all delegate
to these. cgmatch picks up scrutt from N_INDEX bases (element
type) and uses flatvariantidx for case dispatch.
3. Selfhost frame accounting: scanlocals reserves a 24B @tagscr slot
when the body contains a tagged-arr store, a struct-payload
tagged return, or a struct-payload call arg — dedup'd via
scanseenmark so multiple sites share one slot. N_LET stubs now
carry tnode so walk-time type checks see the array element type.
slotsize TARRAY learned to size tagged / struct / ptr / aliased
elements (was 8B-default for anything not N_TNAME-primitive,
undersizing tagged-element arrays).
Scalar / str call-arg widening keeps its direct-push fast path
(no scratch), so wwstage's asm on selfhost source remains
byte-identical to cstage's — 993/995 still pass.
700_e2e: 9 new rows — scalar/str/struct/subset/nullable variants in
arrays and slices, plus pass-arg / let-init / return / match shapes.
Tagged-union widening already fired for `let r: (str|rune) = "...";`,
`r = "...";`, and `return "..."` from a tagged-returning fn — but not
at call sites, so `fn f(x: (str|rune))` couldn't be called with a bare
str or rune. The arg was pushed as its own static type (2 words for
str, 1 for rune) while the callee's slot expected 3 (tag + payload).
C cgen: at the call boundary, look up the callee's declared param
type per arg. When the param is TY_TAGGED and the arg is a concrete
variant, materialise (tag, value-words, padding) sized to the param's
tagged_arg_size — then the existing pop-into-arg-regs logic picks it
up. Nullable `(*T | void)` collapses to a single 8B push.
selfhost: fnret now carries the params head alongside rtype (amalloc
bumped to 48); pushargsrev takes the matching param node and runs the
same widening sequence per arg. The pop drain in cgcall already
handled extra slot words, so no change needed on that side.
Verified with a smoke covering str/rune literals, typed locals,
pre-existing tagged-local pass-through, and nullable widening from a
raw pointer. Selfhost emits byte-identical asm to C cgen on the test.
`type error = !(invalid | overflow)` miscompiled — istaggedtype
only matched N_TTAGGED directly, so an `e: error` param spilled
as 8B scalar and the match's slot+8 read trailed into saved BP.
Mirror isstrtype's alias+bang unwrap; add resolvetagged() for
is/as/match sites that need the inner N_TTAGGED. Frame scan
counts via slotsize so wwstage stays byte-identical to cstage.
Unblocks lib/strconv.strerror.
Surfaced via examples/lisp, which had to work around the following in
source. Each lowering now matches cstage on the same shape.
- cgassign / cgdot: two-level field through a non-pointer sub-struct.
`(*L).cur.kind = k` (cur a struct-by-value field of L) silently
dropped the store; the corresponding read fell into the SB-symbol
fallback and the linker reported `undefined reference to kind`. The
two new branches resolve outer-field offset + inner-field offset
and emit a single direct store/load at the combined slot, both for
T-by-value and *T-base shapes.
- cgdot: `xs[i].field` chains the trailing field load through the
N_INDEX result for [N]T / []T / *T element-of-struct-ptr. The
cgforrange loop variable now carries the elem tnode so the same
fast path covers `for (let x .. xs) { x.field }`.
- cgindex / cgassign: top-level `[N]T` array and `*T` pointer used
as an index base. cgindex now emits LEAQ name(SB) (array) or
MOVQ name(SB) (pointer) with the correct element scaling; without
this the fallback emitted neither base and walked off the saved
BP slot. Adds letvartnode() helper, an N_TARRAY branch to
letemitsize so the array shows up in c.lets, and an N_TARRAY
initialiser path in emitletdataw that lays the literal bytes into
DATAW.
- cglet / scanlocals: infer the local's tnode for an unannotated
`let x = f()` / `let x = f()?`. inferletcalltype() reads the
callee's declared return; `?` and `!` strip to the success variant
so a tagged-union let allocates the full 24B slot and the
struct-field dispatch in cgdot/cgassign sees the right type.
letslotsize now defers to slotsize on the inferred type.
- slotsize: follow type aliases for tagged-union variants. With
`type parserr = !str;`, the variant slot was 8B instead of the
required 16B; the tagged let stomped on the next slot at the
AX/DX/CX spill.
- cgreturn: tagged-union return forwarding. `return f();` where f
also returns a tagged union now passes the (tag, payload1,
payload2) triple through unchanged instead of re-wrapping it.
- cgreturn / cglet / taggedvariantindex: dispatch by variant name
with module-qualified-vs-bare matching, and recognise N_STRUCTLIT
as the variant tag for `return eof{};`. cgexpr default emits
`MOVQ $0, AX` so the surrounding return shuffle isn't left with
a stale AX.
- isstrtype / nodeisstr: resolve through `!T` aliases. `parserr =
!str` was not propagating the str-shape to the rhs check and the
MOVQ BX,CX shuffle was being dropped from str-typed local
returns.
- exprfloatkind: recognise `p.field` as f64/f32 when the struct
field is so declared, so `v.fval: i64` lowers to CVTTSD2SI on X0.
- cgassign: str field on a direct struct local writes both halves.
`L.src = s;` previously dropped s.len.
- cgcall: pop into the int reg window only up to 6 (DI..R9); rest
stays on the stack and the caller emits ADDQ to clean up.
cgfnparams accepts >6-arg signatures by registering the overflow
params at positive BP offsets (16+8*k(BP)), no spill instruction
emitted.
All 26 harness tests pass; bootstrap reaches a byte-stable fixed
point at ww3 == ww4.
cgexpr leaves float results in X0, not AX, but the struct-field paths
emitted MOVQ AX,off(BX) and MOVQ off(BX),AX — so every store wrote
garbage and every load read garbage, except by accidental register
survival across an unrelated call. examples/lisp only worked because
parsef's X0 happened to live across the broken MOVQ shuffle into
vfloat; any inserted f64 op between them would silently corrupt.
Wire MOVSD/MOVSS X0,… (and the matching loads) into eight field
sites on both compilers: alloc(T{...}), p.x = v through local/ptr/
global, chained r.sub.x = v, *p = v for *f64, let v: T = T{...},
base.x reads, *T.x reads, and chained a.b.c.x reads.
83/83 lisp_test probes still pass; bootstrap reaches a byte-stable
fixed point at ww3 == ww4.
Three gaps in the wwstage cgen relative to C w6c, plus a matching
C-side bug surfaced along the way.
cgmatch (selfhost) handles non-ident scrutinees: `match (foo())` now
spills the AX:DX:CX return triple into a 24B `@match_spill` slot
rather than reading garbage off BP+0. scanlocals counts the slot so
the prologue SUBQ stays in sync. For N_CALL we recover the return
type via fnretlookup so nullable dispatch picks the pointer-vs-null
discriminator. Mirrors @match_spill in cmd/w6c/cgen.c N_MATCH.
cgcall (selfhost) special-cases `alloc(structlit{...})`: lower to
rt_alloc(totsize) + per-field MOV* at the struct's field offsets,
mirroring cmd/w6c/cgen.c's existing path. Previously the structlit
fell into pushargsrev and produced wrong code.
check.ww's N_MCASE branch now pushes a fresh scope around each arm
body. Without this, `case let e: str` inside a fn with an outer
`let e: *T` collided with scopedefine's same-scope dedup, the inner
binding silently dropped, and references to `e` inside the arm
resolved through the outer type.
Both cgens save/restore the locals head around case bodies so arm
binds (and nested arm-body lets) don't leak past the arm — code
after the match resolves names back through the outer scope.
w6c gains `local_alloc`: same as `localoff` minus the dedup. N_MATCH
case-bind allocation switches to it. Previously `let e: *T` (8B)
shadowed by `case let e: str` (16B) reused the outer 8B slot and the
inner str.len store overflowed into the saved BP, segfaulting on
return.
Tests 26/26.
