Files
ww/test/wcc/946_append_structlit_evalorder_run.c
Hojun-Cho 2c09d13ca3 wcc/cgen: #59 append/insert struct-literal value eval-order — eval-to-scratch pre-grow + precise copy (both-stage)
append/insert of a struct-LITERAL value evaluated the literal's field
exprs AFTER the grow, so a field reading the destination (e.g. len(xs))
saw the grown length. Both stages, #263 gate-blind (cs==ww byte-identical,
both wrong — runtime is the only net). #50 fixed the scalar/boxing value
arm; the struct-lit arm still post-grew.

Fix (mirror #50, both stages): resolve the struct, fill the literal into a
fresh per-site scratch (@appendstructscr, sized esz, survives rt_ensure +
nested-append clobber) BEFORE the grow, then copy scratch -> post-grow slot.

The copy uses the precise descending 8/4/2/1 ladder (the proven N_IDENT
struct arm directly below), NOT a raw 8B-word block copy: a struct's size
rounds to maxalign (check.c:916), so a sub-8B struct packs at a 4/2/1B
slice stride and an 8B copy over-writes past the slot — at a power-of-2
capacity boundary that clobbers the adjacent allocation (heap corruption,
both stages). The ladder never reads past esz (no uninit high bytes) nor
writes past the slot; esz=8 stays a single MOVQ (byte-id preserved).

insert() rides by construction: both stages desugar it to append and
re-dispatch into this arm. The #49 aplace path already uses the precise
ladder (verified, not exposed). #59 closes the last composite-value
eval-order hole in append/insert.

Pin: 946_append_structlit_evalorder_run — append / insert / narrow-neighbor
(i32-field at the cap boundary with an adjacent-allocation survival assert)
rows, each base-fail at 39432f7 and post-pass with cs==ww byte-id.
2026-06-07 12:10:38 +09:00

253 lines
7.8 KiB
C

/*
* 946_append_structlit_evalorder_run — task #59 (#50's eval-order kin):
* an append/insert of a STRUCT-LITERAL value used to fill the literal's
* fields into the destination slot AFTER cg_append_grow had already bumped
* xs.len. So a field expression that reads `len(xs)` saw the POST-grow
* length. Hare evaluates the value BEFORE the grow.
*
* #263 both-wrong-IDENTICAL: cstage and wwstage emitted byte-identical asm
* that was wrong on BOTH (exit 6 vs the correct 3) — the asm-diff and
* byte-id gates are BLIND to it, so a RUNTIME row is the only net.
*
* Fix (both stages, byte-identical per rule 10): fill the struct literal
* into a fresh per-SITE scratch BEFORE the grow (mirror #50's tagged arm),
* then grow, slot, raw-copy scratch->slot. insert() desugars in-place to
* append and re-dispatches into THIS exact arm, so it is fixed by
* construction — R2 proves the desugar twin (both stages).
*
* Rows assert RUNTIME on BOTH drivers AND cs==ww .s byte-identical:
* append_eval `append(xs, rec{f=len(xs):i64})` x3 -> sum == 3 (pre-grow);
* base bug = 6 (post-grow), main returns 1.
* insert_eval `insert(xs[1], rec{f=len(xs):i64})` -> inserted.f == 2
* (pre-grow len at insert time); base bug = 3.
*
* All K_RUN: build+run exit 0 on BOTH drivers AND cs==ww byte-identical.
* NNN<950, self-contained (/tmp, no imports), so rule-14's selfhost-sibling
* race does not apply (903/940/945 precedent).
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
static int
runwait(const char *cmd)
{
int rc = system(cmd);
if (rc == -1) return -1;
if (WIFEXITED(rc)) return WEXITSTATUS(rc);
return -1;
}
static int
slurp_eq(const char *a, const char *b)
{
FILE *fa = fopen(a, "rb");
FILE *fb = fopen(b, "rb");
if (!fa || !fb) { if (fa) fclose(fa); if (fb) fclose(fb); return -1; }
int rc = 0;
for (;;) {
int ca = fgetc(fa), cb = fgetc(fb);
if (ca != cb) { rc = -1; break; }
if (ca == EOF) break;
}
fclose(fa); fclose(fb);
return rc;
}
struct row { const char *label; const char *src; int want; };
static const struct row rows[] = {
{ "append_eval",
"package main;\n"
"type rec = struct { f: i64 };\n"
"export fn main() i32 = {\n"
" let xs: []rec = [];\n"
" append(xs, rec{ f = len(xs): i64 });\n"
" append(xs, rec{ f = len(xs): i64 });\n"
" append(xs, rec{ f = len(xs): i64 });\n"
" let s: i64 = xs[0].f + xs[1].f + xs[2].f;\n"
" if (s != 3) { return 1; };\n"
" return 0;\n"
"};\n", 0 },
{ "insert_eval",
"package main;\n"
"type rec = struct { f: i64 };\n"
"export fn main() i32 = {\n"
" let xs: []rec = [];\n"
" append(xs, rec{ f = 100 });\n"
" append(xs, rec{ f = 200 });\n"
" insert(xs[1], rec{ f = len(xs): i64 });\n"
" if (xs[1].f != 2) { return 1; };\n"
" if (xs[0].f != 100) { return 2; };\n"
" if (xs[2].f != 200) { return 3; };\n"
" return 0;\n"
"};\n", 0 },
/*
* narrow_neighbor — a sub-8B struct (`{a: i32}`, esz=4, packs at
* stride 4) appended to fill the slice exactly to capacity. Catches
* BOTH halves of #59 in one row:
* pre-fix (pristine 39432f7): field exprs eval post-grow → sum
* wrong → returns 1.
* 8B-block-copy fix (the over-copy regression): eval-order is
* correct but the last slot's 8-byte copy writes 4 bytes PAST
* the 32-byte buffer into the adjacent `victim` allocation →
* victim[0] clobbered → returns 2.
* precise 8/4/2/1 ladder: both correct → 0.
* The 8-element fill makes len==cap==8 so the tail over-write lands
* past the buffer; `victim` is alloc'd right after xs's buffer (bump
* allocator) so the clobber is observable.
*/
{ "narrow_neighbor",
"package main;\n"
"type rec = struct { a: i32 };\n"
"export fn main() i32 = {\n"
" let xs: []rec = [];\n"
" append(xs, rec{ a = len(xs): i32 });\n"
" let victim: []i64 = [];\n"
" append(victim, 1234605616436508552i64);\n"
" let i: i32 = 1;\n"
" for (i < 8) {\n"
" append(xs, rec{ a = len(xs): i32 });\n"
" i += 1;\n"
" };\n"
" let s: i32 = 0;\n"
" let j: i32 = 0;\n"
" for (j < 8) { s += xs[j].a; j += 1; };\n"
" if (s != 28) { return 1; };\n"
" if (victim[0] != 1234605616436508552i64) { return 2; };\n"
" return 0;\n"
"};\n", 0 },
};
/* build+run via a driver (ww / ww_ww); returns 0 pass, nonzero fail. */
static int
run_driver(const char *driver, const struct row *r, int i)
{
char src[96], tmpdir[96], errf[96], cmd[1024];
snprintf(src, sizeof src, "/tmp/ase_%d_%d.ww", getpid(), i);
snprintf(tmpdir, sizeof tmpdir, "/tmp/ase_%d_d_%d", getpid(), i);
snprintf(errf, sizeof errf, "/tmp/ase_%d_e_%d", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
mkdir(tmpdir, 0755);
snprintf(cmd, sizeof cmd, "cd %s && %s build %s >/dev/null 2>%s",
tmpdir, driver, src, errf);
int brc = runwait(cmd);
if (brc != 0) {
fprintf(stderr, "row[%s]: build via %s failed\n",
r->label, driver);
unlink(src); unlink(errf); rmdir(tmpdir);
return -1;
}
const char *base = strrchr(src, '/');
base = base ? base + 1 : src;
char outbin[256];
snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
char *dot = strrchr(outbin, '.');
if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
int got = runwait(outbin);
unlink(src); unlink(outbin); unlink(errf); rmdir(tmpdir);
if (got != r->want) {
fprintf(stderr, "row[%s]: %s exit %d, want %d\n",
r->label, driver, got, r->want);
return 1;
}
return 0;
}
/* cs==ww .s byte-id (rule 10). */
static int
byteid(const char *w6c, const char *w6c_ww, const struct row *r, int i)
{
char src[96], cs_s[96], ws_s[96], cmd[1024];
snprintf(src, sizeof src, "/tmp/ase_bi_%d_%d.ww", getpid(), i);
snprintf(cs_s, sizeof cs_s, "/tmp/ase_bi_%d_%d_cs.s", getpid(), i);
snprintf(ws_s, sizeof ws_s, "/tmp/ase_bi_%d_%d_ww.s", getpid(), i);
FILE *f = fopen(src, "wb");
if (!f) return -1;
fputs(r->src, f);
fclose(f);
int rc = 0;
snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null", w6c, cs_s, src);
if (runwait(cmd) != 0) { fprintf(stderr, "row[%s]: w6c failed\n", r->label); rc = 1; }
else {
snprintf(cmd, sizeof cmd, "%s -o %s %s 2>/dev/null", w6c_ww, ws_s, src);
if (runwait(cmd) != 0) { fprintf(stderr, "row[%s]: w6c_ww failed\n", r->label); rc = 1; }
else if (slurp_eq(cs_s, ws_s) != 0) {
fprintf(stderr, "row[%s]: cstage/wwstage .s DIFFER "
"(rule-10 byte-id)\n", r->label);
rc = 1;
}
}
unlink(src); unlink(cs_s); unlink(ws_s);
return rc;
}
int
main(void)
{
const char *bin = getenv("BIN");
if (!bin) bin = "out/bin";
char absbin[512];
if (bin[0] != '/') {
char cwd[256];
if (getcwd(cwd, sizeof cwd) == NULL) return 1;
snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
bin = absbin;
}
char cdrv[640], wdrv[640], w6c[640], w6c_ww[640];
snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
snprintf(w6c, sizeof w6c, "%s/w6c", bin);
snprintf(w6c_ww, sizeof w6c_ww, "%s/w6c_ww", bin);
struct { const char *name; const char *path; int gated; }
drivers[] = {
{ "cstage", cdrv, 0 },
{ "wwstage", wdrv, 1 },
{ NULL, NULL, 0 },
};
int n = (int)(sizeof rows / sizeof rows[0]);
int total = 0, fail = 0;
for (int d = 0; drivers[d].name; d++) {
if (drivers[d].gated && access(drivers[d].path, X_OK) != 0) {
fprintf(stderr, "append_structlit_evalorder: skip %s (no %s)\n",
drivers[d].name, drivers[d].path);
continue;
}
for (int i = 0; i < n; i++) {
total++;
if (run_driver(drivers[d].path, &rows[i], i) != 0) fail++;
}
}
if (access(w6c_ww, X_OK) == 0) {
for (int i = 0; i < n; i++) {
total++;
if (byteid(w6c, w6c_ww, &rows[i], i) != 0) fail++;
}
}
if (fail) {
fprintf(stderr, "append_structlit_evalorder: %d/%d checks failed\n",
fail, total);
return 1;
}
printf("append_structlit_evalorder: %d/%d ok\n", total, total);
return 0;
}