Hojun-Cho
8fa59f9d45
cg_structlit_fill/cgstructlitfill dispatched scalar field stores as {1->MOVB, 4->MOVL, else->MOVQ} with no fsz==2 case, so a 2-byte field was stored with an 8-byte MOVQ. Interior over-stores were harmlessly overwritten by the next field, but the LAST field at the frame edge corrupted the saved base pointer: an (S|e) union success variant places the struct payload after the 8B tag, landing the last field at -4(BP), so MOVQ AX,-4(BP) wrote into saved [BP] and POPQ BP restored garbage — a silent both-stage caller-frame clobber. Route the scalar store through the existing fldstoreop/fieldstoreop helper ({1->MOVB,2->MOVW,4->MOVL,else->MOVQ}), both stages; the #13 graduation comments already pre-documented this resolution. Pure width fix, no loud-stop (scalar widths are always {1,2,4,8} and narrowing is always correct). Value-asserting pin: an i64 sentinel live across the union-maker call (detects the clobber directly) + all members, with a non-union control.
55 lines
2.5 KiB
Plaintext
55 lines
2.5 KiB
Plaintext
// union_subtail_bp_test — #15: a union-return struct-lit fill stored every
|
|
// scalar field with MOVQ except the explicit {1→MOVB, 4→MOVL} arms, so a
|
|
// 2-byte (i16/u16) field fell through to an 8-byte MOVQ. For the LAST field at
|
|
// the frame edge this over-store ran past the slot into saved [BP]: a
|
|
// `(s14|e)` success variant places the s14 payload at -16(BP) after the 8B
|
|
// tag, so the tail field g (off 12) lands at -4(BP) and `MOVQ AX,-4(BP)` writes
|
|
// bytes -4..+3 — clobbering the low 4 bytes of saved BP. POPQ BP then restores
|
|
// a corrupted BP and the CALLER runs on a garbage frame. SILENT both-stage and
|
|
// byte-id-BLIND (both stages emit the same wrong MOVQ), so these VALUE asserts
|
|
// are the sole tooth. Fix: route the scalar store through fldstoreop /
|
|
// fieldstoreop (adds the missing MOVW for fsz==2). Reverting either stage to
|
|
// the MOVQ-default reverts the clobber and reddens.
|
|
//
|
|
// Two teeth: (1) a sentinel i64 live ACROSS the maker call detects the BP
|
|
// clobber directly — on the buggy build the corrupted POPQ BP moves the
|
|
// caller frame so the sentinel read mismatches. (2) assert all s14 members.
|
|
// union_maker (the bug) + plain_maker control (same struct, NON-union maker:
|
|
// g lands at -12(BP), in-frame dead space, no live neighbour — passes even on
|
|
// master). The control isolates the union-return path as the buggy one.
|
|
|
|
package union_subtail_bp_test;
|
|
|
|
type e = !i32;
|
|
type s14 = struct { a: i16, b: i16, c: i16, d: i16, e: i16, f: i16, g: i16 };
|
|
|
|
fn mk14() (s14 | e) = {
|
|
return s14 { a = 1i16, b = 2i16, c = 3i16, d = 4i16, e = 5i16, f = 6i16, g = 7i16 };
|
|
};
|
|
fn mk14p() s14 = {
|
|
return s14 { a = 1i16, b = 2i16, c = 3i16, d = 4i16, e = 5i16, f = 6i16, g = 7i16 };
|
|
};
|
|
|
|
@test fn union_maker() void = {
|
|
let sentinel: i64 = 0x5151515151515151i64; // lives across the mk14 call
|
|
let arr: [2]s14;
|
|
arr[1] = mk14()!; // maker over-stores g past its slot into saved BP
|
|
assert(arr[1].a == 1i16);
|
|
assert(arr[1].b == 2i16);
|
|
assert(arr[1].c == 3i16);
|
|
assert(arr[1].d == 4i16);
|
|
assert(arr[1].e == 5i16);
|
|
assert(arr[1].f == 6i16);
|
|
assert(arr[1].g == 7i16); // the over-stored tail field
|
|
assert(sentinel == 0x5151515151515151i64); // BP-clobber tooth
|
|
};
|
|
|
|
@test fn plain_maker() void = { // CONTROL: same struct, NON-union maker
|
|
let sentinel: i64 = 0x5252525252525252i64;
|
|
let arr: [2]s14;
|
|
arr[1] = mk14p();
|
|
assert(arr[1].a == 1i16);
|
|
assert(arr[1].g == 7i16);
|
|
assert(sentinel == 0x5252525252525252i64);
|
|
};
|