ww/test/wcc/936_str_arrfield_cap_run.c

/*
 * 936_str_arrfield_cap_run — runtime coverage for the C4.6-arrfield fold: a
 * str-typed FIELD of an INDEXED element `arr[i].f` (N_INDEX-rooted N_DOT) must
 * load the full 24B {ptr,len,cap} header, not just {ptr,len}. str is 24B since
 * Phase 2 (#1); pre-arrfield the `arr[i].f` str arm loaded 2 words (len in BX,
 * ptr in AX) and dropped cap.
 *
 * This is the LAST member of the 3-word-value-read cluster. UNLIKE the other
 * C4.6 arms there is no adjacent slice-element sibling at this leaf, so the
 * 3-word triple is authored directly to the canonical slice-header ABI. By the
 * leaf the element base is in AX, so the order is len->BX(foff+8),
 * cap->CX(foff+16), ptr->AX(foff+0) LAST — matching the proven in-tree oracle
 * cgslicehdr(D_AX) and the caseB chained-*struct slice arm. Sites: cgen.c's
 * "arr[i].field" branch (N_DOT, N_INDEX lhs) and the cgenexpr.ww cgdot twin.
 *
 * The byte-id gates (990-997) can't catch a symmetric 2-word miscompile: if
 * both stages drop cap identically, byte-id passes silently. So this pins the
 * *runtime* contract — build through both the cstage `ww` and wwstage `ww_ww`
 * driver and confirm the assertion holds (exit 0).
 *
 * Sub-cases (one leaf covers all; the differences — LEAQ vs MOVQ base, the
 * pointer-element deref — are upstream of the leaf):
 *   A  [N]S  local array  : `arr[i].f`  (LEAQ base, value element).
 *   B  []S   local slice  : `sl[i].f`   (MOVQ slice.ptr base, value element).
 *   D  [N]*S pointer-elem : `arr[i].f`  (LEAQ base, MOVQ deref to the *S).
 *
 * POISONING: the store side of `arr[i].f = v` and whole-struct `arr[i] = st`
 * are SEPARATE, still-broken store-side gaps (filed; out of scope for this
 * read-side fold — they store only 1-2 words and drop cap). So the value
 * elements (A, B) are poisoned through `&arr[i]` + a *struct field write
 * (`let pr: *rec = &arr[i]; pr.f = p;` — both the &arr[i] index-address and
 * the chained pointer-field store are landed/working), which lands a real
 * cap into the element's +16 word. D points its element at a separately-built
 * struct (`st.f = p`, the proven s1local 3-word field store).
 *
 * DISCRIMINATION (heed the 933/934/935 lesson): a 2-word read leaves CX
 * holding whatever the index scale-multiply (`MOVQ $esz, CX; IMULQ`) left
 * there, never the poison. spoil() additionally interposes a CX-clobbering
 * call between the build and the `arr[i].f` read, so a broken 2-word read
 * observes spoil's leftover (44), never the poison cap. Verified fail-before
 * (stashed the +16 cap load: all rows exit 1 on both drivers) / pass-after
 * (exit 0), both drivers.
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>

static int
runwait(const char *cmd)
{
	int rc = system(cmd);
	if (rc == -1) return -1;
	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
	return -1;
}

struct row { const char *label; const char *src; int want; };

static const struct row rows[] = {
	/* A — `arr[i].f` value element of a [N]S local array (LEAQ base).
	 * Poison cap=8 (len=2) via &arr[1] + a *struct field store. spoil()
	 * clobbers CX between the build and the read so a broken 2-word read
	 * cannot coincidentally pass on a stale CX. */
	{ "arrfield_array_value",
	  "type rec = struct { f: str };\n"
	  "fn spoil() i32 = {\n"
	  "    let z: str = \"zzzz\";\n"
	  "    z.cap = 44i32;\n"
	  "    let w: str = z;\n"
	  "    return w.cap: i32;\n"
	  "};\n"
	  "export fn main() i32 = {\n"
	  "    let p: str = \"hi\";\n"
	  "    p.cap = 8i32;\n"
	  "    let arr: [3]rec;\n"
	  "    let pr: *rec = &arr[1];\n"
	  "    pr.f = p;\n"
	  "    let junk: i32 = spoil();\n"
	  "    let s: str = arr[1].f;\n"
	  "    if (s.cap: i32 != 8) { return 1; };\n"
	  "    if (s.len: i32 != 2) { return 2; };\n"
	  "    if (junk != 44) { return 3; };\n"
	  "    return 0;\n"
	  "};\n",
	  0 },
	/* B — `sl[i].f` value element of a []S local slice (MOVQ slice.ptr
	 * base). The slice views the same poisoned backing array. Poison
	 * cap=9 (len=5). */
	{ "arrfield_slice_value",
	  "type rec = struct { f: str };\n"
	  "fn spoil() i32 = {\n"
	  "    let z: str = \"zzzz\";\n"
	  "    z.cap = 44i32;\n"
	  "    let w: str = z;\n"
	  "    return w.cap: i32;\n"
	  "};\n"
	  "export fn main() i32 = {\n"
	  "    let p: str = \"world\";\n"
	  "    p.cap = 9i32;\n"
	  "    let arr: [3]rec;\n"
	  "    let pr: *rec = &arr[1];\n"
	  "    pr.f = p;\n"
	  "    let sl: []rec = arr[0:3];\n"
	  "    let junk: i32 = spoil();\n"
	  "    let s: str = sl[1].f;\n"
	  "    if (s.cap: i32 != 9) { return 1; };\n"
	  "    if (s.len: i32 != 5) { return 2; };\n"
	  "    if (junk != 44) { return 3; };\n"
	  "    return 0;\n"
	  "};\n",
	  0 },
	/* D — `arr[i].f` pointer element of a [N]*S array (LEAQ base, MOVQ
	 * deref to the *S, then the leaf field load). The element points at
	 * a separately-built struct so the poison rides the proven s1local
	 * 3-word field store, not the broken array-element store. Poison
	 * cap=7 (len=3). */
	{ "arrfield_ptr_elem",
	  "type rec = struct { f: str };\n"
	  "fn spoil() i32 = {\n"
	  "    let z: str = \"zzzz\";\n"
	  "    z.cap = 44i32;\n"
	  "    let w: str = z;\n"
	  "    return w.cap: i32;\n"
	  "};\n"
	  "export fn main() i32 = {\n"
	  "    let p: str = \"abc\";\n"
	  "    p.cap = 7i32;\n"
	  "    let st: rec;\n"
	  "    st.f = p;\n"
	  "    let arr: [3]*rec;\n"
	  "    arr[1] = &st;\n"
	  "    let junk: i32 = spoil();\n"
	  "    let s: str = arr[1].f;\n"
	  "    if (s.cap: i32 != 7) { return 1; };\n"
	  "    if (s.len: i32 != 3) { return 2; };\n"
	  "    if (junk != 44) { return 3; };\n"
	  "    return 0;\n"
	  "};\n",
	  0 },
};

static int
run_driver(const char *driver, const struct row *r, int i)
{
	char src[96], tmpdir[96], cmd[1024];
	snprintf(src, sizeof src, "/tmp/strarrfieldcap_%d_%d.ww", getpid(), i);
	snprintf(tmpdir, sizeof tmpdir, "/tmp/strarrfieldcap_%d_d_%d", getpid(), i);

	FILE *f = fopen(src, "wb");
	if (!f) return -1;
	fputs(r->src, f);
	fclose(f);

	mkdir(tmpdir, 0755);
	snprintf(cmd, sizeof cmd, "cd %s && %s build %s",
	    tmpdir, driver, src);
	if (runwait(cmd) != 0) {
		fprintf(stderr, "row[%s]: build via %s failed\n",
		    r->label, driver);
		unlink(src); rmdir(tmpdir);
		return -1;
	}

	const char *base = strrchr(src, '/');
	base = base ? base + 1 : src;
	char outbin[160];
	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
	char *dot = strrchr(outbin, '.');
	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
	int got = runwait(outbin);

	unlink(src); unlink(outbin); rmdir(tmpdir);
	return got;
}

int
main(void)
{
	const char *bin = getenv("BIN");
	if (!bin) bin = "out/bin";
	char absbin[512];
	if (bin[0] != '/') {
		char cwd[256];
		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
		bin = absbin;
	}

	char cdrv[640];
	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
	char wdrv[640];
	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);

	struct { const char *name; const char *path; int gated_on_existence; }
	drivers[] = {
		{ "cstage",  cdrv, 0 },
		{ "wwstage", wdrv, 1 },
		{ NULL, NULL, 0 },
	};

	int n = (int)(sizeof rows / sizeof rows[0]);
	int total = 0, fail = 0;
	for (int d = 0; drivers[d].name; d++) {
		if (drivers[d].gated_on_existence
		    && access(drivers[d].path, X_OK) != 0) {
			fprintf(stderr,
			    "str_arrfield_cap_run: skip %s (no %s)\n",
			    drivers[d].name, drivers[d].path);
			continue;
		}
		for (int i = 0; i < n; i++) {
			int got = run_driver(drivers[d].path, &rows[i], i);
			total++;
			if (got != rows[i].want) {
				fprintf(stderr,
				    "str_arrfield_cap_run[%s][%s]: exit=%d want=%d\n",
				    drivers[d].name, rows[i].label,
				    got, rows[i].want);
				fail++;
			}
		}
	}

	if (fail) {
		fprintf(stderr, "str_arrfield_cap_run: %d/%d fixtures failed\n",
		    fail, total);
		return 1;
	}
	printf("str_arrfield_cap_run: %d/%d ok\n", total, total);
	return 0;
}