/* * 936_str_arrfield_cap_run — runtime coverage for the C4.6-arrfield fold: a * str-typed FIELD of an INDEXED element `arr[i].f` (N_INDEX-rooted N_DOT) must * load the full 24B {ptr,len,cap} header, not just {ptr,len}. str is 24B since * Phase 2 (#1); pre-arrfield the `arr[i].f` str arm loaded 2 words (len in BX, * ptr in AX) and dropped cap. * * This is the LAST member of the 3-word-value-read cluster. UNLIKE the other * C4.6 arms there is no adjacent slice-element sibling at this leaf, so the * 3-word triple is authored directly to the canonical slice-header ABI. By the * leaf the element base is in AX, so the order is len->BX(foff+8), * cap->CX(foff+16), ptr->AX(foff+0) LAST — matching the proven in-tree oracle * cgslicehdr(D_AX) and the caseB chained-*struct slice arm. Sites: cgen.c's * "arr[i].field" branch (N_DOT, N_INDEX lhs) and the cgenexpr.ww cgdot twin. * * The byte-id gates (990-997) can't catch a symmetric 2-word miscompile: if * both stages drop cap identically, byte-id passes silently. So this pins the * *runtime* contract — build through both the cstage `ww` and wwstage `ww_ww` * driver and confirm the assertion holds (exit 0). * * Sub-cases (one leaf covers all; the differences — LEAQ vs MOVQ base, the * pointer-element deref — are upstream of the leaf): * A [N]S local array : `arr[i].f` (LEAQ base, value element). * B []S local slice : `sl[i].f` (MOVQ slice.ptr base, value element). * D [N]*S pointer-elem : `arr[i].f` (LEAQ base, MOVQ deref to the *S). * * POISONING: the store side of `arr[i].f = v` and whole-struct `arr[i] = st` * are SEPARATE, still-broken store-side gaps (filed; out of scope for this * read-side fold — they store only 1-2 words and drop cap). So the value * elements (A, B) are poisoned through `&arr[i]` + a *struct field write * (`let pr: *rec = &arr[i]; pr.f = p;` — both the &arr[i] index-address and * the chained pointer-field store are landed/working), which lands a real * cap into the element's +16 word. D points its element at a separately-built * struct (`st.f = p`, the proven s1local 3-word field store). * * DISCRIMINATION (heed the 933/934/935 lesson): a 2-word read leaves CX * holding whatever the index scale-multiply (`MOVQ $esz, CX; IMULQ`) left * there, never the poison. spoil() additionally interposes a CX-clobbering * call between the build and the `arr[i].f` read, so a broken 2-word read * observes spoil's leftover (44), never the poison cap. Verified fail-before * (stashed the +16 cap load: all rows exit 1 on both drivers) / pass-after * (exit 0), both drivers. */ #include #include #include #include #include #include static int runwait(const char *cmd) { int rc = system(cmd); if (rc == -1) return -1; if (WIFEXITED(rc)) return WEXITSTATUS(rc); return -1; } struct row { const char *label; const char *src; int want; }; static const struct row rows[] = { /* A — `arr[i].f` value element of a [N]S local array (LEAQ base). * Poison cap=8 (len=2) via &arr[1] + a *struct field store. spoil() * clobbers CX between the build and the read so a broken 2-word read * cannot coincidentally pass on a stale CX. */ { "arrfield_array_value", "type rec = struct { f: str };\n" "fn spoil() i32 = {\n" " let z: str = \"zzzz\";\n" " z.cap = 44i32;\n" " let w: str = z;\n" " return w.cap: i32;\n" "};\n" "export fn main() i32 = {\n" " let p: str = \"hi\";\n" " p.cap = 8i32;\n" " let arr: [3]rec;\n" " let pr: *rec = &arr[1];\n" " pr.f = p;\n" " let junk: i32 = spoil();\n" " let s: str = arr[1].f;\n" " if (s.cap: i32 != 8) { return 1; };\n" " if (s.len: i32 != 2) { return 2; };\n" " if (junk != 44) { return 3; };\n" " return 0;\n" "};\n", 0 }, /* B — `sl[i].f` value element of a []S local slice (MOVQ slice.ptr * base). The slice views the same poisoned backing array. Poison * cap=9 (len=5). */ { "arrfield_slice_value", "type rec = struct { f: str };\n" "fn spoil() i32 = {\n" " let z: str = \"zzzz\";\n" " z.cap = 44i32;\n" " let w: str = z;\n" " return w.cap: i32;\n" "};\n" "export fn main() i32 = {\n" " let p: str = \"world\";\n" " p.cap = 9i32;\n" " let arr: [3]rec;\n" " let pr: *rec = &arr[1];\n" " pr.f = p;\n" " let sl: []rec = arr[0:3];\n" " let junk: i32 = spoil();\n" " let s: str = sl[1].f;\n" " if (s.cap: i32 != 9) { return 1; };\n" " if (s.len: i32 != 5) { return 2; };\n" " if (junk != 44) { return 3; };\n" " return 0;\n" "};\n", 0 }, /* D — `arr[i].f` pointer element of a [N]*S array (LEAQ base, MOVQ * deref to the *S, then the leaf field load). The element points at * a separately-built struct so the poison rides the proven s1local * 3-word field store, not the broken array-element store. Poison * cap=7 (len=3). */ { "arrfield_ptr_elem", "type rec = struct { f: str };\n" "fn spoil() i32 = {\n" " let z: str = \"zzzz\";\n" " z.cap = 44i32;\n" " let w: str = z;\n" " return w.cap: i32;\n" "};\n" "export fn main() i32 = {\n" " let p: str = \"abc\";\n" " p.cap = 7i32;\n" " let st: rec;\n" " st.f = p;\n" " let arr: [3]*rec;\n" " arr[1] = &st;\n" " let junk: i32 = spoil();\n" " let s: str = arr[1].f;\n" " if (s.cap: i32 != 7) { return 1; };\n" " if (s.len: i32 != 3) { return 2; };\n" " if (junk != 44) { return 3; };\n" " return 0;\n" "};\n", 0 }, }; static int run_driver(const char *driver, const struct row *r, int i) { char src[96], tmpdir[96], cmd[1024]; snprintf(src, sizeof src, "/tmp/strarrfieldcap_%d_%d.ww", getpid(), i); snprintf(tmpdir, sizeof tmpdir, "/tmp/strarrfieldcap_%d_d_%d", getpid(), i); FILE *f = fopen(src, "wb"); if (!f) return -1; fputs(r->src, f); fclose(f); mkdir(tmpdir, 0755); snprintf(cmd, sizeof cmd, "cd %s && %s build %s", tmpdir, driver, src); if (runwait(cmd) != 0) { fprintf(stderr, "row[%s]: build via %s failed\n", r->label, driver); unlink(src); rmdir(tmpdir); return -1; } const char *base = strrchr(src, '/'); base = base ? base + 1 : src; char outbin[160]; snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); char *dot = strrchr(outbin, '.'); if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; int got = runwait(outbin); unlink(src); unlink(outbin); rmdir(tmpdir); return got; } int main(void) { const char *bin = getenv("BIN"); if (!bin) bin = "out/bin"; char absbin[512]; if (bin[0] != '/') { char cwd[256]; if (getcwd(cwd, sizeof cwd) == NULL) return 1; snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); bin = absbin; } char cdrv[640]; snprintf(cdrv, sizeof cdrv, "%s/ww", bin); char wdrv[640]; snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); struct { const char *name; const char *path; int gated_on_existence; } drivers[] = { { "cstage", cdrv, 0 }, { "wwstage", wdrv, 1 }, { NULL, NULL, 0 }, }; int n = (int)(sizeof rows / sizeof rows[0]); int total = 0, fail = 0; for (int d = 0; drivers[d].name; d++) { if (drivers[d].gated_on_existence && access(drivers[d].path, X_OK) != 0) { fprintf(stderr, "str_arrfield_cap_run: skip %s (no %s)\n", drivers[d].name, drivers[d].path); continue; } for (int i = 0; i < n; i++) { int got = run_driver(drivers[d].path, &rows[i], i); total++; if (got != rows[i].want) { fprintf(stderr, "str_arrfield_cap_run[%s][%s]: exit=%d want=%d\n", drivers[d].name, rows[i].label, got, rows[i].want); fail++; } } } if (fail) { fprintf(stderr, "str_arrfield_cap_run: %d/%d fixtures failed\n", fail, total); return 1; } printf("str_arrfield_cap_run: %d/%d ok\n", total, total); return 0; }