# aarch64-win64: WideString constants are addressed 0x4000 bytes too high ## Summary Assigning a string literal to a `WideString` gives an empty string. With the `variants` unit linked in, the same assignment raises an access violation. The constant itself is emitted correctly and ends up in `.rdata` intact. The `adrp`/`add` pair that addresses it resolves 0x4000 bytes above the constant's RVA, so the RTL reads the BSTR length prefix from an unrelated location. `AnsiString` and `UnicodeString` literals, typed `WideString` constants and all variable-to-`WideString` assignments are correct. ## Environment - Target `aarch64-win64`, native compiler (`ppca64.exe` runs on the ARM64 host) - FPC 3.3.1-20681-g416b51be87 \[2026/08/19\], built by fpcupdeluxe from gitlab trunk. The `-dirty` suffix comes from 70 deleted files under `packages/{amunits,cocoaint,palmunits,univint}/namespaced`. No compiler or RTL source is modified. - Windows 11 25H2 ARM64 (10.0.26200), Snapdragon X Elite - Internal assembler, internal linker. The bundled `ld` rejects this target (`ld: file not found: pei-aarch64-little`), so `-Xe` could not be compared. - Same behaviour with `-O-` and `-O2`, in `{$mode objfpc}` and `{$mode delphi}` ## Reproducer 1 ```pascal program bug1_empty; {$apptype console} var w: WideString; begin w := 'toto'; writeln(ErrOutput, 'length=', length(w)); end. ``` `fpc -Twin64 -Paarch64 bug1_empty.pas` prints `length=0`. ## Reproducer 2 ```pascal program bug2_crash; {$apptype console} uses variants; var w: WideString; begin w := 'toto'; end. ``` EAccessViolation inside ucrtbase, exit code 217. With that section layout the bogus address holds a large value instead of zero, so `fpc_WideStr_Assign` passes it to `SysReAllocStringLen` as a length. ## Generated code and data `-al` output for reproducer 1: ```asm // [5] w := 'toto'; adrp x1,.Ld1 add x1,x1,:lo12:.Ld1 adrp x0,U_$P$ASM1_$$_W add x0,x0,:lo12:U_$P$ASM1_$$_W bl fpc_widestr_assign .section .rodata.n_.Ld1,"ar" .balign 8 .Ld1$strlab: .long 8 // BSTR byte length, correct .Ld1: .short 116,111,116,111,0 // 'toto'#0, correct .byte 0,0 ``` Both the length prefix and the characters are present in the linked executable. ## Measured addresses Passing the literal to a `noinline` procedure and printing `pointer(w)` relative to `GetModuleHandle(nil)`, against the constant's RVA taken from the PE section headers: | executable | opt | real RVA | prefix there | RVA at run time | prefix read | delta | |------------|-----|----------|--------------|-----------------|-------------|-------| | evidence_rva.exe | \-O- | 0001A114 | 8 | 0001E114 | 2 | +0x4000 | | evidence_rva.exe | \-O2 | 00019114 | 8 | 0001D114 | 2 | +0x4000 | | three_literals.exe | \-O- | 0001A1F4 | 8 | 0001E1F4 | 41 | +0x4000 | | three_literals.exe | \-O2 | 0001A1FC | 8 | 0001E1FC | 41 | +0x4000 | The prefix found at the wrong address is arbitrary, so `length()` returns 0 or a garbage value. 20 and 85540 have both been observed. ## Comparison with the other literal types Same program, three literals passed to three `noinline` procedures: ```asm // TakeW('toto'); adrp x0,.Ld10 add x0,x0,:lo12:.Ld10 // 0x4000 too high bl P$MIX_$$_TAKEW$WIDESTRING // TakeA('toto'); adrp x0,.Ld11 add x0,x0,:lo12:.Ld11 add x0,x0,#16 // correct bl P$MIX_$$_TAKEA$ANSISTRING // TakeU('toto'); adrp x0,.Ld12 add x0,x0,:lo12:.Ld12 add x0,x0,#16 // correct bl P$MIX_$$_TAKEU$UNICODESTRING ``` For `AnsiString` and `UnicodeString` the referenced label is at section start, and the header is skipped with `add #16`. For `WideString` the section starts with `.Ld1$strlab`, the 4-byte BSTR length, so `.Ld1` sits at section start + 4. The relocation targets a symbol at a non-zero offset within its section. A typed constant takes a different path: `const C: WideString = 'toto'` is initialised through the `WIDEINITS_$P$...` table with a `.quad` relocation, and is correct. ## Test matrix Correct: - `const C: WideString = 'toto'` - `w := u` (UnicodeString), `w := a` (AnsiString), `w := v` (variant) - `w := PWideChar`, `SetLength(w, n)`, `SetString(w, p, n)` - `u := 'toto'`, `a := 'toto'` - `w := u + 'cd'` Wrong: - `w := 'toto'`, global or local destination, any literal length, ASCII and non-ASCII - literal passed as a `const WideString` parameter, where `Length` is taken inside the callee - `w := 'ab' + 'cd'` - `w := WideChar('t') + WideChar('o')` - `v := WideString('toto')`, which raises the access violation ## Impact Affects OLE automation and COM interop code, and any unit that fills a `WideString` from a literal. It is the first crash of the mORMot2 regression suite on Windows ARM64 (synopse/mORMot2 issue 411), where a `varOleStr` variant key carries a BSTR built this way. ## Not checked - `x86_64-win64` from the same revision. This installation only has aarch64-win64 units. - External linker. The bundled `ld` rejects `pei-aarch64-little`. - Bisect against an older trunk revision. ## Attached `fpc-widestring-repro.zip` contains the two reproducers above, the address measurement, a matrix of every way to fill a `WideString`, and the three-literal comparison.[fpc-widestring-repro.zip](/uploads/6c1f472eaebaea8057b71cc2a94ed5af/fpc-widestring-repro.zip)