From 47efbdb5c04a2be35eaac655980f5edf923ce8ba Mon Sep 17 00:00:00 2001 From: Brummel Date: Sat, 30 May 2026 10:41:52 +0200 Subject: [PATCH] test: RED owned-RawBuf drop-leak repro (refs #43) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit raw_buf_owned_drop_balances_rc_stats + examples/raw_buf_drop_min.ail: a single owned 1-slot Int RawBuf, written once and read once. Prints 10 correctly but under AILANG_RC_STATS shows allocs=2 frees=1 live=1 — the slab leaks. Asserts stdout=="10" (green) and live==0 (RED until the owned-temp drop call is emitted). Root cause (verified, supersedes #42's disproven diagnosis). The leaked value is the anonymous owned temporary produced by RawBuf.set (own-ret, in-place: intercepts.rs emit_rawbuf_set_int does `ret ptr %b`, same slab as its input), then passed to RawBuf.get whose RawBuf param is `borrow`. After get borrows and returns an i64 the temp is dead, but no one drops it: codegen's only two scope-close drop emitters cover Term::Let binders (lib.rs:1785-1822) and Own fn-params (lib.rs:1426-1502); the general call lowerer emit_call (lib.rs:2552) splices args without inspecting per-arg own/borrow modes and emits no post-call drop for an owned arg landing in a borrow slot. Binder-independent, contra #42: the fully inline form with no `let` at all produces byte-identical leaking IR (no Term::Let exists, so the 1785 gate is never reached). The defect is the drop-CALL-site emission raw-buf.4 deferred to raw-buf.5; uniqueness.rs is not implicated. --- crates/ail/tests/e2e.rs | 28 ++++++++++++++++++++++++++++ examples/raw_buf_drop_min.ail | 9 +++++++++ 2 files changed, 37 insertions(+) create mode 100644 examples/raw_buf_drop_min.ail diff --git a/crates/ail/tests/e2e.rs b/crates/ail/tests/e2e.rs index 3143b89..72f50b6 100644 --- a/crates/ail/tests/e2e.rs +++ b/crates/ail/tests/e2e.rs @@ -2234,6 +2234,34 @@ fn raw_buf_int_e2e() { assert_eq!(out.trim(), "60"); } +/// Property (refs #42): an owned RawBuf that is no longer referenced +/// at the end of `main` must be dropped — every slab alloc is matched +/// by a free, so `live == 0` at exit. The flat drop function +/// `@drop_raw_buf_RawBuf` is emitted (raw-buf.4), but no call to it is +/// emitted in `main`'s body, so the slab leaks (`allocs=2 frees=1`, +/// the lone free being the `int_to_str` string from `print`). RED +/// until the drop call fires. +/// +/// NOTE: the leak is independent of binder names. The fully inline +/// form — `(app RawBuf.get (app RawBuf.set (new RawBuf (con Int) 1) +/// 0 10) 0)`, no `let` at all — produces byte-identical leaking IR, +/// as does a distinct-name (`b0`/`b1`) variant. This contradicts the +/// root-cause stated in issue #42 (uniqueness-table binder-name +/// collapse under shadow-rebind): with no binder there is nothing to +/// collapse, yet the drop call is still absent. The defect is in the +/// owned-RawBuf drop-emission decision, not in name-keyed ownership. +#[test] +fn raw_buf_owned_drop_balances_rc_stats() { + let (stdout, allocs, frees, live) = + build_and_run_with_rc_stats("raw_buf_drop_min.ail"); + assert_eq!(stdout.trim(), "10", "fixture must still read back the stored value"); + assert_eq!( + live, 0, + "owned RawBuf leaks {live} slab(s) (allocs={allocs} frees={frees}); \ + the drop call for the owned buffer must fire at end of main" + ); +} + /// raw-buf.4 Float variant: a 2-slot Float RawBuf (1.5 + 2.5), /// exercising the `double` load/store emits. Prints `4.0` (the `%g` /// whole-double `.0` fallback). diff --git a/examples/raw_buf_drop_min.ail b/examples/raw_buf_drop_min.ail new file mode 100644 index 0000000..716e69e --- /dev/null +++ b/examples/raw_buf_drop_min.ail @@ -0,0 +1,9 @@ +(module raw_buf_drop_min + (fn main + (doc "Minimal RawBuf drop-leak reproducer (refs #42): a single owned 1-slot Int RawBuf, written once and read once, then dropped at the end of main. Prints 10. Under AILANG_RC_STATS the owned buffer's drop call must fire, so allocs are balanced by frees (live == 0). The leak is independent of binder names — the fully inline form (app RawBuf.get (app RawBuf.set (new RawBuf (con Int) 1) 0 10) 0) with no let-binding at all leaks identically.") + (type (fn-type (params) (ret (con Unit)) (effects IO))) + (params) + (body + (app print + (let buf (new RawBuf (con Int) 1) + (app RawBuf.get (app RawBuf.set buf 0 10) 0))))))