From da23160ca6166dbf3c85b81c88154329a671dfaf Mon Sep 17 00:00:00 2001 From: TermiNexus Date: Sun, 9 Aug 2026 04:06:17 +0800 Subject: [PATCH] =?UTF-8?q?fix(handles):=20=E5=8F=98=E5=8F=82=E8=B0=83?= =?UTF-8?q?=E7=94=A8=E6=8C=89=20Win64=208=20=E5=AD=97=E8=8A=82=E6=A7=BD?= =?UTF-8?q?=E4=BD=8D=E6=8F=90=E5=8D=87(=E6=95=B4=E6=95=B0=20sext=20?= =?UTF-8?q?=E5=88=B0=20i64,=20f32=20=E6=8F=90=E5=8D=87=20f64)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 根因: 变参按窄类型(i32)传入, LLVM 只写 4 字节进 8 字节栈槽, 高 4 字节残留旧数据; viperlib %d 强制 va_arg 读 i64 暴露残留高位(如 0x400921FB00001000, 高位是 PI 残留)。 修复: found_func.IsVarArg==1 且参数在变参位时提升, 对齐 TPC/Python-llvmlite ABI 自动提升。 SprintfTest R1-R4 PASS, DefineTest PAGE=4096 验证通过。 --- App/lib/core/Handles/HandlesExprCall.vp | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/App/lib/core/Handles/HandlesExprCall.vp b/App/lib/core/Handles/HandlesExprCall.vp index d23250c..f6b937e 100644 --- a/App/lib/core/Handles/HandlesExprCall.vp +++ b/App/lib/core/Handles/HandlesExprCall.vp @@ -5500,6 +5500,20 @@ def translate_call(pool: memhub.MemBuddy | t.CPtr, if fpty is not None: arg_val = HandlesExpr.coerce_to_type( builder, arg_val, fpty, arg) + elif found_func.IsVarArg == 1: + # Win64 变参 8 字节槽位：<64 位整数按 i64 传（sext 符号扩展）， + # f32 提升为 f64。若按原窄类型传，调用点只写 4 字节进 8 字节槽， + # 高 4 字节残留旧栈数据，va_arg(i64) 读到垃圾（如 DefineTest + # PAGE=%d 读到 0x400921FB00001000，高位是 PI 残留）。 + # 对齐 TPC FuncGen/Python-llvmlite 的 ABI 自动提升。 + ab_va: int = HandlesExpr.get_llvm_type_bits(arg_val.Ty) + af_va: int = HandlesExpr.get_llvm_float_bits(arg_val.Ty) + i64_va: llvmlite.LLVMType | t.CPtr = llvmlite.Int64(pool) + if ab_va != 0 and ab_va < 64: + arg_val = llvmlite.build_sext(builder, arg_val, i64_va) + elif af_va == 32: + arg_val = llvmlite.build_fpext( + builder, arg_val, llvmlite.Double(pool)) arg_val.Next = None if head is None: head = arg_val