/* * 702_dot_explicit_deref — silent miscompile of `(*p).f` (task #16). * * Pre-existing landmine surfaced by worker-cgnassign during #5 * (whole-struct N_ASSIGN). Both cstage cgen.c N_ASSIGN N_DOT and * wwstage cgenexpr.ww cgassign single-dot dispatch gated on * `n->lhs->lhs->kind == N_IDENT`. The parser produces N_UN(STAR, * IDENT(p)) for `(*p).f`, so the store fell off the dispatch and * silently emitted nothing. Read-side N_DOT had the same gap — * the pointer-auto-deref load branch required N_IDENT and fell * through to cgexpr on the N_UN, which derefs the pointer as a * scalar (load 8B from p into AX, then the field part is dropped). * * Not exercised by current selfhost source (auto-deref `p.f` was * used throughout) so 995_self_rebuild didn't catch it. Latent for * any future user code that types out the explicit deref. * * The fix in both stages is a base/lhs retarget: when the parser * shape is N_UN(STAR, IDENT(p)), substitute the inner IDENT so * the existing via_ptr / pointer-auto-deref branch fires the same * as `p.f`. v1 scope is bare-IDENT inner only; `(*expr).f` with a * non-IDENT pointer expression (`(*arr[i]).f`, `(*g.p).f`) still * drops silently, tracked as a follow-up — needs cgexpr(inner) → * reg + RHS-spill scheduling, which is a different design. * * Each row pins: * - cstage value correctness (process exit code). * - wwstage value correctness (when ww_ww exists). * - cstage vs wwstage byte-identical .s output (catches drift). */ #include #include #include #include #include #include static int runwait(const char *cmd) { int rc = system(cmd); if (rc == -1) return -1; if (WIFEXITED(rc)) return WEXITSTATUS(rc); return -1; } struct row { const char *label; const char *src; int want; }; static const struct row rows[] = { /* Write side, scalar i64 field via explicit deref. * Pre-fix: cgassign single-dot dispatch fell off (base.kind * was N_UN, not N_IDENT) and emitted no store. f stayed 0. */ { "write_i64", "type pt = struct { x: i64, y: i64 };\n" "fn main() i32 = {\n" " let s: pt = pt { x = 0i64, y = 0i64 };\n" " let p: *pt = &s;\n" " (*p).x = 7i64;\n" " (*p).y = 35i64;\n" " return (s.x + s.y): i32;\n" "};\n", 42 }, /* Write side, narrow i32 field. Pins fldstoreop sizing on * the via_ptr path — MOVL not MOVQ (which would stomp 4 bytes * past the field). */ { "write_i32", "type box = struct { a: i32, b: i32, c: i32 };\n" "fn main() i32 = {\n" " let s: box = box { a = 0, b = 0, c = 0 };\n" " let p: *box = &s;\n" " (*p).a = 5;\n" " (*p).b = 11;\n" " (*p).c = 19;\n" " return s.a + s.b + s.c;\n" "};\n", 35 }, /* Write side, str field. Pins the str-typed field branch in * the via_ptr path (cgexpr → AX=ptr/BX=len, store both halves * at +0/+8 — not just AX). Initialiser uses `let v: box;` * (zero-fill) instead of a struct literal because N_LET * N_STRUCTLIT silently drops the .len half of a str-typed * field — a separate pre-existing bug, out of scope here. */ { "write_str", "type box = struct { s: str, n: i64 };\n" "fn main() i32 = {\n" " let v: box;\n" " let p: *box = &v;\n" " (*p).s = \"hi\";\n" " (*p).n = 40i64;\n" " return (v.s.len: i64 + v.n): i32;\n" "};\n", 42 }, /* Read side, scalar i64 field via explicit deref. * Pre-fix: case N_DOT's pointer-auto-deref branch required * N_IDENT and fell through to `cgexpr(c, n->lhs, ...)` — * derefed the pointer as if loading a scalar, so AX held the * first qword of the struct (s.x = 50). Field offset for .y * (+8) was dropped → returned 50 instead of 80. */ { "read_i64", "type pt = struct { x: i64, y: i64 };\n" "fn main() i32 = {\n" " let s: pt = pt { x = 50i64, y = 80i64 };\n" " let p: *pt = &s;\n" " return (*p).y: i32;\n" "};\n", 80 }, /* Read side, narrow i32 field. Pins fldloadop sizing — MOVL * with sign-extend, not raw MOVQ. */ { "read_i32", "type box = struct { a: i32, b: i32, c: i32 };\n" "fn main() i32 = {\n" " let s: box = box { a = 1, b = 2, c = 3 };\n" " let p: *box = &s;\n" " return (*p).a + (*p).b + (*p).c;\n" "};\n", 6 }, /* Read side, str field. Pins the str-typed field load path — * AX=ptr, BX=len. .len is the receive-side check. Initialiser * uses write-by-field (same str-in-structlit-init bug avoided * as in write_str). */ { "read_str_len", "type box = struct { s: str };\n" "fn main() i32 = {\n" " let v: box;\n" " v.s = \"hello\";\n" " let p: *box = &v;\n" " return (*p).s.len: i32;\n" "};\n", 5 }, /* Mixed: write via (*p).f then read via (*p).f. End-to-end * round-trip pins both sides agreeing on the same offset and * width. */ { "roundtrip", "type pt = struct { x: i32, y: i32, z: i32 };\n" "fn main() i32 = {\n" " let s: pt = pt { x = 0, y = 0, z = 0 };\n" " let p: *pt = &s;\n" " (*p).x = 4;\n" " (*p).y = 7;\n" " (*p).z = 13;\n" " return (*p).x + (*p).y + (*p).z;\n" "};\n", 24 }, }; /* run_driver — compile r->src via the given driver and exec; return * the process exit code. Mirror of 701's helper. */ static int run_driver(const char *driver, const struct row *r, int i) { char src[64], tmpdir[64], cmd[1024]; snprintf(src, sizeof src, "/tmp/wded_%d_%d.ww", getpid(), i); snprintf(tmpdir, sizeof tmpdir, "/tmp/wded_%d_d_%d", getpid(), i); FILE *f = fopen(src, "wb"); if (!f) return -1; fputs(r->src, f); fclose(f); mkdir(tmpdir, 0755); snprintf(cmd, sizeof cmd, "cd %s && %s build %s", tmpdir, driver, src); if (runwait(cmd) != 0) { fprintf(stderr, "row[%s]: build via %s failed\n", r->label, driver); unlink(src); rmdir(tmpdir); return -1; } const char *base = strrchr(src, '/'); base = base ? base + 1 : src; char outbin[128]; snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); char *dot = strrchr(outbin, '.'); if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; int got = runwait(outbin); unlink(src); unlink(outbin); rmdir(tmpdir); return got; } /* asm_byte_identical — generate .s via cstage's w6c and wwstage's * w6c_ww and diff. Mirror of 701. */ static int asm_byte_identical(const char *bin, const struct row *r, int i) { char src[64], cs[64], ws[64], cmd[1024]; snprintf(src, sizeof src, "/tmp/wded_asm_%d_%d.ww", getpid(), i); snprintf(cs, sizeof cs, "/tmp/wded_asm_%d_%d_c.s", getpid(), i); snprintf(ws, sizeof ws, "/tmp/wded_asm_%d_%d_w.s", getpid(), i); FILE *f = fopen(src, "wb"); if (!f) return -1; fputs(r->src, f); fclose(f); snprintf(cmd, sizeof cmd, "%s/w6c -o %s %s 2>/dev/null", bin, cs, src); if (runwait(cmd) != 0) { fprintf(stderr, "row[%s]: w6c errored\n", r->label); unlink(src); return -1; } snprintf(cmd, sizeof cmd, "%s/w6c_ww -o %s %s 2>/dev/null", bin, ws, src); if (runwait(cmd) != 0) { fprintf(stderr, "row[%s]: w6c_ww errored\n", r->label); unlink(src); unlink(cs); return -1; } FILE *fc = fopen(cs, "rb"); FILE *fw = fopen(ws, "rb"); int rc = 0; if (!fc || !fw) { rc = -1; } else { for (;;) { int a = fgetc(fc); int b = fgetc(fw); if (a != b) { rc = -1; break; } if (a == EOF) break; } } if (fc) fclose(fc); if (fw) fclose(fw); if (rc != 0) fprintf(stderr, "row[%s]: cstage vs wwstage asm differs\n", r->label); unlink(src); unlink(cs); unlink(ws); return rc; } int main(void) { const char *bin = getenv("BIN"); if (!bin) bin = "out/bin"; char absbin[1024]; if (bin[0] != '/') { char cwd[1024]; if (getcwd(cwd, sizeof cwd) == NULL) return 1; snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); bin = absbin; } char cdrv[1024]; snprintf(cdrv, sizeof cdrv, "%s/ww", bin); char wdrv[1024]; snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); struct { const char *name; const char *path; int gated_on_existence; } drivers[] = { { "cstage", cdrv, 0 }, { "wwstage", wdrv, 1 }, { NULL, NULL, 0 }, }; int n = (int)(sizeof rows / sizeof rows[0]); int total = 0, fail = 0; for (int d = 0; drivers[d].name; d++) { if (drivers[d].gated_on_existence && access(drivers[d].path, X_OK) != 0) { fprintf(stderr, "dot_explicit_deref: skip %s (no %s)\n", drivers[d].name, drivers[d].path); continue; } for (int i = 0; i < n; i++) { int got = run_driver(drivers[d].path, &rows[i], i); total++; if (got != rows[i].want) { fprintf(stderr, "dot_explicit_deref[%s][%s]: exit=%d want=%d\n", drivers[d].name, rows[i].label, got, rows[i].want); fail++; } } } if (access(wdrv, X_OK) == 0) { for (int i = 0; i < n; i++) { total++; if (asm_byte_identical(bin, &rows[i], i) != 0) fail++; } } if (fail) { fprintf(stderr, "dot_explicit_deref: %d/%d fixtures failed\n", fail, total); return 1; } printf("dot_explicit_deref: %d/%d ok\n", total, total); return 0; }