/* * 937_str_arrfield_store_cap_run — runtime coverage for the G1 fold: STORING a * str into a FIELD of an INDEXED element `arr[i].f = v` must write the full 24B * {ptr,len,cap} header, not just {ptr,len}. str is 24B since Phase 2 (#1); the * write-side mirror of the landed arrfield READ (936) previously stored only 2 * words (AX=ptr@foff+0, BX=len@foff+8) and silently DROPPED cap. * * This is only meaningful now that the arrfield READ is 3-word (936): before * that fix the store+read were 2-word-symmetric and cap was untouched at both * ends, so a dropped store-cap was invisible. Now the read returns the real * +16 word, so a 2-word store is observable. * * Sites: cgen.c's `arr[i].field = v` str branch (N_DOT lhs, N_INDEX lhs.lhs, * N_IDENT idxbase) and the cgenexpr.ww cgassign twin. The composed mechanic: * the rhs str leaves AX=ptr/BX=len/CX=cap, all three spilled across the * index/address computation (the index scale `MOVQ $esz, CX; IMULQ` would * clobber cap), the element address staged in DX off the str AX/BX/CX * convention (mirroring the s.f=v store), then the full triple stored at * foff+0/+8/+16. * * Rows mirror the 936 arrfield READ rows: * A [N]S local array : `arr[i].f = v` (LEAQ base, value element). * B []S local slice : `sl[i].f = v` (MOVQ slice.ptr base, value elem). * D [N]*S pointer-elem : `arr[i].f = v` (LEAQ base, MOVQ deref to the *S). * * RHS cap!=len: each test str is a literal whose .cap is mutated to a value * DISTINCT from its len (NOT a bare literal — literals carry cap==len, which * would hide a dropped cap; #12: global literal .cap reads 0). cap and len are * both nonzero and unequal so a 2-word store that drops cap is detectable. * * PRE-POISON (B != A, both nonzero, != len): before the G1 store under test, * all three slot words are seeded with a DIFFERENT str (ptr='q', len=4, * cap=5=A) via a PROVEN already-3-word store path — never the G1 store itself * (if G1 is broken its own poison write would also drop cap, leaving +16 * uninit rather than a controlled poison). A/B poison via `&arr[i]` + a * *struct field store (`pr.f = q`); D poisons the pointee via the proven * s1local field store (`st.f = q`). The G1 store then writes the test str * (ptr='h', len=2, cap=8=B). A broken 2-word store never touches +16, so the * 3-word read-back observes the poison cap 5, never 8 — deterministic * discrimination with no reliance on a stale register. * * FULL-TRIPLE ASSERT: a register-reallocation slip in the 3-word store could * clobber ptr or len while wiring cap, and a cap-only assert would miss it. So * each row reads the value back (landed 3-word arrfield read) and checks all * three words: ptr (first byte through it — 'h'=104), len (2), cap (8). The * 2-word store writes ptr/len correctly (they ARE the two words it keeps), so * cap is the fail-before discriminator; ptr/len guard the fix. * * Verified fail-before (stashed the store edit on BOTH stages → all rows exit * 1, cap reads the poison 5) / pass-after (exit 0), both the cstage `ww` and * wwstage `ww_ww` drivers. */ #include #include #include #include #include #include static int runwait(const char *cmd) { int rc = system(cmd); if (rc == -1) return -1; if (WIFEXITED(rc)) return WEXITSTATUS(rc); return -1; } struct row { const char *label; const char *src; int want; }; static const struct row rows[] = { /* A — `arr[i].f = v` into a [N]S local array (LEAQ base, value * element). Poison the slot (cap=5,len=4,'q') via &arr[1] + a * *struct field store; then the G1 store lands the test str * (cap=8,len=2,'h'). */ { "arrfield_store_array_value", "type rec = struct { f: str };\n" "export fn main() i32 = {\n" " let q: str = \"qqqq\"; q.cap = 5i32;\n" " let p: str = \"hi\"; p.cap = 8i32;\n" " let arr: [3]rec;\n" " let pr: *rec = &arr[1];\n" " pr.f = q;\n" " arr[1].f = p;\n" " let s: str = arr[1].f;\n" " if (s.cap: i32 != 8) { return 1; };\n" " if (s.len: i32 != 2) { return 2; };\n" " if (s[0] != 104u8) { return 3; };\n" " return 0;\n" "};\n", 0 }, /* B — `sl[i].f = v` into a []S local slice (MOVQ slice.ptr base, * value element). The slice views the same backing array; poison the * element through the array pointer, store the test str through the * slice, read it back through the slice. */ { "arrfield_store_slice_value", "type rec = struct { f: str };\n" "export fn main() i32 = {\n" " let q: str = \"qqqq\"; q.cap = 5i32;\n" " let p: str = \"hi\"; p.cap = 8i32;\n" " let arr: [3]rec;\n" " let pr: *rec = &arr[1];\n" " pr.f = q;\n" " let sl: []rec = arr[0:3];\n" " sl[1].f = p;\n" " let s: str = sl[1].f;\n" " if (s.cap: i32 != 8) { return 1; };\n" " if (s.len: i32 != 2) { return 2; };\n" " if (s[0] != 104u8) { return 3; };\n" " return 0;\n" "};\n", 0 }, /* D — `arr[i].f = v` into a [N]*S pointer element (LEAQ base, MOVQ * deref to the *S, then store at the field). The element points at a * separately-built struct poisoned via the proven s1local field store * (`st.f = q`); the G1 store derefs arr[1] and overwrites st.f. */ { "arrfield_store_ptr_elem", "type rec = struct { f: str };\n" "export fn main() i32 = {\n" " let q: str = \"qqqq\"; q.cap = 5i32;\n" " let p: str = \"hi\"; p.cap = 8i32;\n" " let st: rec;\n" " st.f = q;\n" " let arr: [3]*rec;\n" " arr[1] = &st;\n" " arr[1].f = p;\n" " let s: str = arr[1].f;\n" " if (s.cap: i32 != 8) { return 1; };\n" " if (s.len: i32 != 2) { return 2; };\n" " if (s[0] != 104u8) { return 3; };\n" " return 0;\n" "};\n", 0 }, }; static int run_driver(const char *driver, const struct row *r, int i) { char src[96], tmpdir[96], cmd[1024]; snprintf(src, sizeof src, "/tmp/strarrfieldstore_%d_%d.ww", getpid(), i); snprintf(tmpdir, sizeof tmpdir, "/tmp/strarrfieldstore_%d_d_%d", getpid(), i); FILE *f = fopen(src, "wb"); if (!f) return -1; fputs(r->src, f); fclose(f); mkdir(tmpdir, 0755); snprintf(cmd, sizeof cmd, "cd %s && %s build %s", tmpdir, driver, src); if (runwait(cmd) != 0) { fprintf(stderr, "row[%s]: build via %s failed\n", r->label, driver); unlink(src); rmdir(tmpdir); return -1; } const char *base = strrchr(src, '/'); base = base ? base + 1 : src; char outbin[160]; snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); char *dot = strrchr(outbin, '.'); if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; int got = runwait(outbin); unlink(src); unlink(outbin); rmdir(tmpdir); return got; } int main(void) { const char *bin = getenv("BIN"); if (!bin) bin = "out/bin"; char absbin[512]; if (bin[0] != '/') { char cwd[256]; if (getcwd(cwd, sizeof cwd) == NULL) return 1; snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); bin = absbin; } char cdrv[640]; snprintf(cdrv, sizeof cdrv, "%s/ww", bin); char wdrv[640]; snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); struct { const char *name; const char *path; int gated_on_existence; } drivers[] = { { "cstage", cdrv, 0 }, { "wwstage", wdrv, 1 }, { NULL, NULL, 0 }, }; int n = (int)(sizeof rows / sizeof rows[0]); int total = 0, fail = 0; for (int d = 0; drivers[d].name; d++) { if (drivers[d].gated_on_existence && access(drivers[d].path, X_OK) != 0) { fprintf(stderr, "str_arrfield_store_cap_run: skip %s (no %s)\n", drivers[d].name, drivers[d].path); continue; } for (int i = 0; i < n; i++) { int got = run_driver(drivers[d].path, &rows[i], i); total++; if (got != rows[i].want) { fprintf(stderr, "str_arrfield_store_cap_run[%s][%s]: exit=%d want=%d\n", drivers[d].name, rows[i].label, got, rows[i].want); fail++; } } } if (fail) { fprintf(stderr, "str_arrfield_store_cap_run: %d/%d fixtures failed\n", fail, total); return 1; } printf("str_arrfield_store_cap_run: %d/%d ok\n", total, total); return 0; }