fix: let-alias-aware mode propagation through Term::Let

Closes the carve-out shared by 18d.4 Iter A and 18g.1's pre-tail-
call seam: a let-binder whose value is Term::Var aliasing a non-
Own fn-param now inherits the param's mode in current_param_modes
for the duration of the let body. Without this, (let a t (match
a ...)) where t is Implicit / Borrow defeated scrutinee_is_owned
(default for non-fn-param scrutinees was 'owned'), and the arm-
close drop fired on pattern-binders whose underlying memory
belongs to the caller — refcount underflow / SIGSEGV on the next
recursion.

Implementation: Term::Let lowering checks if value is Term::Var
referencing a name in current_param_modes; if so, inserts that
mode under the let-binder's name for the body and restores on
let-close (push/pop pattern, symmetric with locals).

Red:
alloc_rc_let_alias_of_implicit_param_does_not_dec_borrowed_children
on examples/rc_let_alias_implicit_param. Pre-fix: SIGSEGV / RC
underflow on the second iteration of loop. Post-fix: matches
alloc=gc ('0').

The Borrow-ret-mode case is already covered by the language-design
rule (typechecker rejects 'consume-while-borrowed' on the
borrow-aliasing shape); the Implicit-mode case is what the carve-
out actually surfaces. Both are now closed at codegen-time.

Two of the three known debts from the 18g tidy now resolved
(stat-of-N earlier in the session, let-alias here). The remaining
debt — tag-conditional partial-drop helper for the dynamic-tag
carve-outs in lower_match and emit_inlined_partial_drop — is the
substantively larger piece and stays queued.
This commit is contained in:
2026-05-08 15:21:40 +02:00
parent c2af5ad3da
commit 2e0006029b
4 changed files with 153 additions and 0 deletions
+38
View File
@@ -2201,3 +2201,41 @@ fn alloc_rc_let_binder_for_implicit_returning_app_does_not_drop() {
means the unjustified dec triggered the underflow guard."
);
}
/// Iter 18g tidy follow-up: let-alias-aware mode propagation.
///
/// 18d.4 Iter A's fix gated arm-close pattern-binder dec on the
/// scrutinee's `current_param_modes` lookup, but only fn-params
/// register there. A let-binder whose value is `Term::Var` aliasing
/// a non-Own fn-param defeats the gate: the lookup misses, the
/// default treats it as owned, and the arm-close drop fires on
/// pattern-binders whose underlying memory is still owned by the
/// caller. The fixture's shape:
///
/// (fn pin_aliased (params t) ; t: Implicit-mode (default)
/// (let a t ; a aliases t
/// (match a ; matched-on alias
/// (case (TLeaf) 0)
/// (case (TNode v l r) 1))))
///
/// Pre-fix on a recursive caller passing the same heap value: the
/// arm-close drop fragments the caller's tree, the recursive call
/// re-loads now-freed cells, and the binary aborts (SIGSEGV / RC
/// underflow).
///
/// Post-fix: `current_param_modes` propagates through `Term::Let
/// { value: Term::Var(p), ... }` for the duration of the let body,
/// so a let-aliased Implicit / Borrow scrutinee correctly skips
/// the arm-close drop. Output matches `--alloc=gc` (`0`).
#[test]
fn alloc_rc_let_alias_of_implicit_param_does_not_dec_borrowed_children() {
let example = "rc_let_alias_implicit_param.ail.json";
let stdout_gc = build_and_run_with_alloc(example, "gc");
let stdout_rc = build_and_run_with_alloc(example, "rc");
assert_eq!(stdout_gc.trim(), "0");
assert_eq!(stdout_rc.trim(), "0");
assert_eq!(
stdout_gc, stdout_rc,
"alloc=rc must match alloc=gc on rc_let_alias_implicit_param"
);
}
+35
View File
@@ -1822,7 +1822,42 @@ impl<'a> Emitter<'a> {
let (val_ssa, val_ty) = self.lower_term(value)?;
self.locals
.push((name.clone(), val_ssa.clone(), val_ty.clone(), val_ail));
// Iter 18g.tidy.fu: let-alias-aware mode propagation.
// If `value` is a `Term::Var` referencing a name in
// `current_param_modes`, the let-binder inherits that
// mode for the duration of the body. Without this,
// `(let a t (match a ...))` where `t` is an Implicit
// / Borrow-mode param defeats the
// `scrutinee_is_owned` gate in `lower_match` (the
// gate looks up `a` in `current_param_modes`, misses,
// and defaults to "owned" — Iter A then dec's
// pattern-binders whose underlying memory belongs to
// the caller).
//
// Restored on let-body-close (push/pop pattern).
let inherited_mode: Option<ParamMode> = match value.as_ref() {
Term::Var { name: src } => {
self.current_param_modes.get(src).copied()
}
_ => None,
};
let prior_mode = if let Some(m) = inherited_mode {
let prior = self.current_param_modes.insert(name.clone(), m);
Some(prior)
} else {
None
};
let r = self.lower_term(body);
if let Some(prior) = prior_mode {
match prior {
Some(m) => {
self.current_param_modes.insert(name.clone(), m);
}
None => {
self.current_param_modes.remove(name);
}
}
}
self.locals.pop();
// Iter 18d.3: lift the binder's move set out of the
// side table. The binder is leaving scope here; we
@@ -0,0 +1 @@
{"defs":[{"ctors":[{"fields":[],"name":"TLeaf"},{"fields":[{"k":"con","name":"Int"},{"k":"con","name":"Tree"},{"k":"con","name":"Tree"}],"name":"TNode"}],"kind":"type","name":"Tree"},{"body":{"cond":{"args":[{"name":"d","t":"var"},{"lit":{"kind":"int","value":0},"t":"lit"}],"fn":{"name":"==","t":"var"},"t":"app"},"else":{"args":[{"lit":{"kind":"int","value":1},"t":"lit"},{"args":[{"args":[{"name":"d","t":"var"},{"lit":{"kind":"int","value":1},"t":"lit"}],"fn":{"name":"-","t":"var"},"t":"app"}],"fn":{"name":"build","t":"var"},"t":"app"},{"args":[{"args":[{"name":"d","t":"var"},{"lit":{"kind":"int","value":1},"t":"lit"}],"fn":{"name":"-","t":"var"},"t":"app"}],"fn":{"name":"build","t":"var"},"t":"app"}],"ctor":"TNode","t":"ctor","type":"Tree"},"t":"if","then":{"args":[],"ctor":"TLeaf","t":"ctor","type":"Tree"}},"kind":"fn","name":"build","params":["d"],"type":{"effects":[],"k":"fn","params":[{"k":"con","name":"Int"}],"ret":{"k":"con","name":"Tree"},"ret_mode":"own"}},{"body":{"body":{"arms":[{"body":{"lit":{"kind":"int","value":0},"t":"lit"},"pat":{"ctor":"TLeaf","fields":[],"p":"ctor"}},{"body":{"lit":{"kind":"int","value":1},"t":"lit"},"pat":{"ctor":"TNode","fields":[{"name":"v","p":"var"},{"name":"l","p":"var"},{"name":"r","p":"var"}],"p":"ctor"}}],"scrutinee":{"name":"a","t":"var"},"t":"match"},"name":"a","t":"let","value":{"name":"t","t":"var"}},"kind":"fn","name":"pin_aliased","params":["t"],"type":{"effects":[],"k":"fn","params":[{"k":"con","name":"Tree"}],"ret":{"k":"con","name":"Int"}}},{"body":{"cond":{"args":[{"name":"n","t":"var"},{"lit":{"kind":"int","value":0},"t":"lit"}],"fn":{"name":"==","t":"var"},"t":"app"},"else":{"body":{"args":[{"args":[{"name":"n","t":"var"},{"lit":{"kind":"int","value":1},"t":"lit"}],"fn":{"name":"-","t":"var"},"t":"app"},{"name":"t","t":"var"}],"fn":{"name":"loop","t":"var"},"t":"app"},"name":"_v","t":"let","value":{"args":[{"name":"t","t":"var"}],"fn":{"name":"pin_aliased","t":"var"},"t":"app"}},"t":"if","then":{"lit":{"kind":"int","value":0},"t":"lit"}},"kind":"fn","name":"loop","params":["n","t"],"type":{"effects":[],"k":"fn","params":[{"k":"con","name":"Int"},{"k":"con","name":"Tree"}],"ret":{"k":"con","name":"Int"}}},{"body":{"body":{"args":[{"args":[{"lit":{"kind":"int","value":3},"t":"lit"},{"name":"t","t":"var"}],"fn":{"name":"loop","t":"var"},"t":"app"}],"op":"io/print_int","t":"do"},"name":"t","t":"let","value":{"args":[{"lit":{"kind":"int","value":2},"t":"lit"}],"fn":{"name":"build","t":"var"},"t":"app"}},"kind":"fn","name":"main","params":[],"type":{"effects":["IO"],"k":"fn","params":[],"ret":{"k":"con","name":"Unit"}}}],"imports":[],"name":"rc_let_alias_implicit_param","schema":"ailang/v0"}
+79
View File
@@ -0,0 +1,79 @@
; Iter 18g tidy follow-up RED-test fixture: a let-binder whose
; value is a Term::Var referencing a non-Own fn-param must
; inherit the param's mode for codegen's drop-emission gates.
;
; The carve-out documented in 18d.4's Iter A fix: the gate
; checks `scrutinee_is_owned` against `current_param_modes`,
; but only fn-params are recorded there. A let-binder aliasing
; an Implicit-mode fn-param passes the gate (its lookup
; misses, default = owned), so the arm-close drop fires on
; memory the caller still references.
;
; Pattern: `pin_aliased` takes `t` as Implicit-mode (default,
; no annotation); aliases it via `(let a t ...)`; matches `a`.
; In the TNode arm the pattern-bindings `l` / `r` would be
; dec'd at arm close because `a` looks owned to the gate —
; corrupting the caller's tree.
;
; Pre-fix under --alloc=rc: refcount underflow at the second
; iteration of `loop`, where the recursive call into
; `pin_aliased(t)` re-loads cells the previous iteration
; freed.
; Post-fix: clean exit, output `0`. Stats are not the focus
; here (the caller's tree leaks under the Implicit-mode
; back-compat lane); the test asserts only correctness.
(module rc_let_alias_implicit_param
(data Tree
(ctor TLeaf)
(ctor TNode (con Int) (con Tree) (con Tree)))
(fn build
(type
(fn-type
(params (con Int))
(ret (own (con Tree)))))
(params d)
(body
(if (app == d 0)
(term-ctor Tree TLeaf)
(term-ctor Tree TNode 1
(app build (app - d 1))
(app build (app - d 1))))))
; Pin via let-alias: the alias `a` is a Var-binding on the
; Implicit-mode (default) param `t`. Codegen's gate must
; recognise that `a` inherits `t`'s mode and skip the arm-
; close drop that would otherwise fragment the caller's
; tree.
(fn pin_aliased
(type
(fn-type
(params (con Tree))
(ret (con Int))))
(params t)
(body
(let a t
(match a
(case (pat-ctor TLeaf) 0)
(case (pat-ctor TNode v l r) 1)))))
(fn loop
(type
(fn-type
(params (con Int) (con Tree))
(ret (con Int))))
(params n t)
(body
(if (app == n 0)
0
(let _v (app pin_aliased t)
(app loop (app - n 1) t)))))
(fn main
(type (fn-type (params) (ret (con Unit)) (effects IO)))
(params)
(body
(let t (app build 2)
(do io/print_int (app loop 3 t))))))