/* * 938_str_chainfield_store_cap_run — runtime coverage for the G2 fold: STORING a * str into a FIELD reached through a *struct-VALUED EXPRESSION (`r.sym.f = v`, * the chained-N_DOT store) must write the full 24B {ptr,len,cap} header, not * just {ptr,len}. str is 24B since Phase 2 (#1); the chained-store arm * previously stored only 2 words (AX=ptr@foff+0, BX=len@foff+8) and silently * DROPPED cap — the second STORE-cluster fold, after the arrfield store (937). * * This is the write-side mirror of the landed chained *struct str-field READ * (caseB, #11) and is only meaningful now that read is 3-word: before that the * store+read were 2-word-symmetric and cap was untouched at both ends, so a * dropped store-cap was invisible. Now the read returns the real +16 word, so a * 2-word store is observable. * * Sites: cgen.c's chained-N_DOT `.field = v` str branch (n->lhs is N_DOT, * n->lhs->lhs is N_DOT/non-IDENT evaluating to a *struct) and the cgenexpr.ww * cgassign twin (strict gate: chain root is a LOCAL ident, every dot resolves * through a *struct). The mechanic is a direct transfer of G1 (arrfield store): * the rhs str leaves AX=ptr/BX=len/CX=cap, all three spilled (PUSHQ CX/BX/AX) * across the base-expr eval (which may clobber any register), the resolved * *struct ptr staged in DX off the str AX/BX/CX convention (mirroring the * s.f=v store), then the full triple stored at foff+0/+8/+16. The base here is * a single-word *struct pointer, so it does not contend for the spilled slots. * * Rows exercise the CHAINED arm at two depths (a direct-field `s.f=` probe would * MISS this arm and test the already-3-word IDENT-base path): * A depth-2 `r.sym.f = v` (r: outer, outer.sym: *inner, inner.f: str). * B depth-3 `r.a.b.f = v` (two pointer hops; deeper base eval clobbers * more registers, stressing the spill). * * RHS cap!=len: each test str is a literal whose .cap is mutated to a value * DISTINCT from its len (NOT a bare literal — literals carry cap==len, which * would hide a dropped cap; a str sub-slice was rejected too: ww yields cap==len * for `buf[0:2]`, equally hiding the drop). cap=8 and len=2 are both nonzero and * unequal so a 2-word store that drops cap is detectable. * * PRE-POISON (cap=5 != 8, both nonzero, != len): before the G2 store under test, * all three slot words are seeded with a DIFFERENT str (ptr='q', len=4, cap=5) * via the PROVEN already-3-word DIRECT field store (`st.f = q`, the s.f=v * oracle, N_IDENT base) — never the G2 chained store itself (if G2 is broken its * own poison write would also drop cap, leaving +16 uninit rather than a * controlled poison). The pointee is a local struct; the chain's leaf points at * it, so the G2 store overwrites the poisoned field. The G2 store then writes * the test str (ptr='h', len=2, cap=8). A broken 2-word store never touches +16, * so the 3-word read-back observes the poison cap 5, never 8 — deterministic * discrimination with no reliance on a stale register. * * FULL-TRIPLE ASSERT: a register-reallocation slip in the 3-word store could * clobber ptr or len while wiring cap, and a cap-only assert would miss it. So * each row reads the value back (landed 3-word chained read, caseB) and checks * all three words: ptr (first byte through it — 'h'=104), len (2), cap (8). The * 2-word store writes ptr/len correctly (they ARE the two words it keeps), so * cap is the fail-before discriminator; ptr/len guard the fix. * * Verified fail-before (stashed the store edit on BOTH stages → all rows exit 1, * cap reads the poison 5) / pass-after (exit 0), both the cstage `ww` and * wwstage `ww_ww` drivers. */ #include #include #include #include #include #include static int runwait(const char *cmd) { int rc = system(cmd); if (rc == -1) return -1; if (WIFEXITED(rc)) return WEXITSTATUS(rc); return -1; } struct row { const char *label; const char *src; int want; }; static const struct row rows[] = { /* A — depth-2 `r.sym.f = v`. r is a local outer; r.sym is a *inner * pointing at a local struct st. Poison st.f (cap=5,len=4,'q') via the * DIRECT s.f=v 3-word store; then the G2 chained store lands the test * str (cap=8,len=2,'h') through r.sym. */ { "chainfield_store_depth2", "type inner = struct { f: str };\n" "type outer = struct { sym: *inner };\n" "export fn main() i32 = {\n" " let q: str = \"qqqq\"; q.cap = 5i32;\n" " let p: str = \"hi\"; p.cap = 8i32;\n" " let st: inner;\n" " st.f = q;\n" " let r: outer;\n" " r.sym = &st;\n" " r.sym.f = p;\n" " let s: str = r.sym.f;\n" " if (s.cap: i32 != 8) { return 1; };\n" " if (s.len: i32 != 2) { return 2; };\n" " if (s[0] != 104u8) { return 3; };\n" " return 0;\n" "};\n", 0 }, /* B — depth-3 `r.a.b.f = v`. Two pointer hops (r.a: *mid, mid.b: * *inner). Poison the leaf via the DIRECT store (`leaf.f = q`); the G2 * chained store derefs r.a then .b and overwrites leaf.f. The deeper * base eval clobbers more registers, confirming the spilled triple * survives an arbitrary base-formation. */ { "chainfield_store_depth3", "type inner = struct { f: str };\n" "type mid = struct { b: *inner };\n" "type outer = struct { a: *mid };\n" "export fn main() i32 = {\n" " let q: str = \"qqqq\"; q.cap = 5i32;\n" " let p: str = \"hi\"; p.cap = 8i32;\n" " let leaf: inner;\n" " leaf.f = q;\n" " let m: mid;\n" " m.b = &leaf;\n" " let r: outer;\n" " r.a = &m;\n" " r.a.b.f = p;\n" " let s: str = r.a.b.f;\n" " if (s.cap: i32 != 8) { return 1; };\n" " if (s.len: i32 != 2) { return 2; };\n" " if (s[0] != 104u8) { return 3; };\n" " return 0;\n" "};\n", 0 }, }; static int run_driver(const char *driver, const struct row *r, int i) { char src[96], tmpdir[96], cmd[1024]; snprintf(src, sizeof src, "/tmp/strchainfieldstore_%d_%d.ww", getpid(), i); snprintf(tmpdir, sizeof tmpdir, "/tmp/strchainfieldstore_%d_d_%d", getpid(), i); FILE *f = fopen(src, "wb"); if (!f) return -1; fputs(r->src, f); fclose(f); mkdir(tmpdir, 0755); snprintf(cmd, sizeof cmd, "cd %s && %s build %s", tmpdir, driver, src); if (runwait(cmd) != 0) { fprintf(stderr, "row[%s]: build via %s failed\n", r->label, driver); unlink(src); rmdir(tmpdir); return -1; } const char *base = strrchr(src, '/'); base = base ? base + 1 : src; char outbin[160]; snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base); char *dot = strrchr(outbin, '.'); if (dot && strcmp(dot, ".ww") == 0) *dot = '\0'; int got = runwait(outbin); unlink(src); unlink(outbin); rmdir(tmpdir); return got; } int main(void) { const char *bin = getenv("BIN"); if (!bin) bin = "out/bin"; char absbin[512]; if (bin[0] != '/') { char cwd[256]; if (getcwd(cwd, sizeof cwd) == NULL) return 1; snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin); bin = absbin; } char cdrv[640]; snprintf(cdrv, sizeof cdrv, "%s/ww", bin); char wdrv[640]; snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin); struct { const char *name; const char *path; int gated_on_existence; } drivers[] = { { "cstage", cdrv, 0 }, { "wwstage", wdrv, 1 }, { NULL, NULL, 0 }, }; int n = (int)(sizeof rows / sizeof rows[0]); int total = 0, fail = 0; for (int d = 0; drivers[d].name; d++) { if (drivers[d].gated_on_existence && access(drivers[d].path, X_OK) != 0) { fprintf(stderr, "str_chainfield_store_cap_run: skip %s (no %s)\n", drivers[d].name, drivers[d].path); continue; } for (int i = 0; i < n; i++) { int got = run_driver(drivers[d].path, &rows[i], i); total++; if (got != rows[i].want) { fprintf(stderr, "str_chainfield_store_cap_run[%s][%s]: exit=%d want=%d\n", drivers[d].name, rows[i].label, got, rows[i].want); fail++; } } } if (fail) { fprintf(stderr, "str_chainfield_store_cap_run: %d/%d fixtures failed\n", fail, total); return 1; } printf("str_chainfield_store_cap_run: %d/%d ok\n", total, total); return 0; }