diff --git a/crates/ail/tests/e2e.rs b/crates/ail/tests/e2e.rs index 2bced03..34f01b6 100644 --- a/crates/ail/tests/e2e.rs +++ b/crates/ail/tests/e2e.rs @@ -2124,3 +2124,40 @@ fn alloc_rc_explicit_mode_tail_sum_does_not_leak_outer_cells() { and no drop site emits the shallow rc_dec for the moved-from outer LCons cell" ); } + +/// Iter 18g.2 regression: a `let`-binder whose value is the result of +/// an Own-returning function call must be dropped at let-scope close. +/// +/// Background: 18c.3's `is_rc_heap_allocated` returns `false` for any +/// `Term::App` shape (the doc-comment explicitly defers the +/// owned-returning-call case to "later iters tied to `(own)` ret-mode +/// contracts"). With Iter 18a's mode contracts in place, that +/// limitation is no longer load-bearing — the call's `ret_mode == Own` +/// is the static signal that a fresh heap allocation has flowed into +/// the binder, and the let-scope close is the right place to dec it. +/// +/// 18f.2's bench surfaced the user-visible cost: in +/// `(let t (app build_tree 19) ...)`, `t` was not trackable and the +/// depth-19 Tree (~1M cells) leaked at every program exit. +/// +/// Pre-fix on this minimal fixture: `live = 3` (one TNode + two TLeaf +/// children). +/// Post-fix: `live = 0`. +#[test] +fn alloc_rc_let_binder_for_owned_returning_app_drops_at_scope_close() { + let (stdout, allocs, frees, live) = + build_and_run_with_rc_stats("rc_let_owned_app_leak.ail.json"); + assert_eq!( + stdout.trim(), + "1", + "pin(TNode) returns 1 regardless of leak status" + ); + assert_eq!( + live, 0, + "let-binder for an Own-returning app leaked {live} cells \ + (allocs={allocs} frees={frees}); is_rc_heap_allocated must \ + recognise Term::App with ret_mode=Own as trackable, and the \ + drop-symbol resolution must derive drop__ from the \ + call's return type" + ); +} diff --git a/crates/ailang-codegen/src/lib.rs b/crates/ailang-codegen/src/lib.rs index e428ad4..c2fef72 100644 --- a/crates/ailang-codegen/src/lib.rs +++ b/crates/ailang-codegen/src/lib.rs @@ -1545,12 +1545,17 @@ impl<'a> Emitter<'a> { /// non-escaping ones become stack `alloca`s and must NOT be /// `dec`'d (they are freed by LLVM at fn return). /// - /// Other value shapes (calls, vars, literals, matches, …) return - /// `false` here. A call's return value may itself be an - /// RC-allocated box, but the caller does not statically know that - /// — proper handling of returned boxes is part of the wider - /// uniqueness story (and tied to `(own)` ret-mode contracts in - /// later iters). + /// Iter 18g.2 widens this to include `Term::App` whose callee's + /// fn-type carries `ret_mode == Own`. The mode contract states that + /// the callee hands the returned cell's ownership to the caller's + /// frame; the let-scope close is the right place for the caller's + /// dec. Calls whose callee is `Borrow`/`Implicit`-returning are + /// still not trackable — they don't carry that signal. + /// + /// Other value shapes (vars, literals, matches, …) return `false` + /// here. A `Term::Var` returning an RC-allocated box would already + /// be tracked by an earlier let-binder; tracking it again here + /// would double-dec. fn is_rc_heap_allocated(&self, value: &Term) -> bool { if !matches!(self.alloc, AllocStrategy::Rc) { return false; @@ -1560,10 +1565,37 @@ impl<'a> Emitter<'a> { let term_ptr = (value as *const Term) as usize; !self.non_escape.contains(&term_ptr) } + Term::App { callee, .. } => { + // Iter 18g.2: a call whose callee carries + // `ret_mode == Own` hands a fresh heap allocation to + // the caller's frame. Trackable. `Borrow` and + // `Implicit` ret-modes do not carry that signal — + // returning by Borrow is a view into the callee's + // owned data (caller does not own it), and Implicit + // is the back-compat lane that 18c.3's debt covers. + self.synth_callee_ret_mode(callee) + .map(|m| matches!(m, ParamMode::Own)) + .unwrap_or(false) + } _ => false, } } + /// Iter 18g.2: lookup helper for a callee's `ret_mode`. Returns + /// `Some(mode)` when the callee resolves to a fn-typed term; + /// `None` for shapes whose type is not a `Type::Fn` (typechecker + /// would already have rejected an App on a non-fn, but the helper + /// is defensive). Used by [`Self::is_rc_heap_allocated`] and the + /// [`Self::drop_symbol_for_binder`] App-arm to decide both + /// trackability and the drop-fn symbol. + fn synth_callee_ret_mode(&self, callee: &Term) -> Option { + let cty = self.synth_arg_type(callee).ok()?; + match cty { + Type::Fn { ret_mode, .. } => Some(ret_mode), + _ => None, + } + } + /// Iter 18c.4: pick the drop-fn symbol to call at the close of a /// trackable `Term::Let` scope. For a `Term::Ctor` binder the /// symbol is `drop__` — derived from the ctor's @@ -1594,6 +1626,31 @@ impl<'a> Emitter<'a> { .get(val_ssa) .cloned() .unwrap_or_else(|| "ailang_rc_dec".to_string()), + // Iter 18g.2: an Own-returning call hands a freshly heap- + // allocated cell whose static type is the callee's + // `ret`. Resolve the per-type drop fn from that ret-type + // so the cascade walks the cell's pointer-typed children + // (e.g. an Own-returned `Tree` fans out via + // `drop__`). Falls back to `ailang_rc_dec` if + // the ret-type is not a `Type::Con` (e.g. a bare type + // var on an as-yet-unmonomorphised polymorphic call — + // the monomorphised copies will resolve correctly). + Term::App { .. } => { + if let Ok(ret_ty) = self.synth_arg_type(value) { + if let Type::Con { name, .. } = ret_ty { + if name.matches('.').count() == 1 { + let (prefix, suffix) = + name.split_once('.').expect("checked"); + if let Some(target) = self.import_map.get(prefix) { + return format!("drop_{target}_{suffix}"); + } + return format!("drop_{prefix}_{suffix}"); + } + return format!("drop_{m}_{name}", m = self.module_name); + } + } + "ailang_rc_dec".to_string() + } _ => "ailang_rc_dec".to_string(), } } @@ -1608,11 +1665,15 @@ impl<'a> Emitter<'a> { /// transferred to a pattern-bound binder that owns the dec /// for them. /// - /// `value` must be a `Term::Ctor` — `is_rc_heap_allocated` only - /// returns true for `Term::Ctor` / `Term::Lam`, and a `Term::Lam` - /// binder cannot accumulate moved slots (closures are not pattern- - /// matched into positional fields). The match-or-error pattern - /// guards that invariant. + /// Iter 18g.2 widens the input set: with `Term::App` (Own- + /// returning call) now also trackable, a let-binder whose value is + /// `Term::App` may accumulate moved slots if its body pattern- + /// matches the binder. The per-field static-ctor emission below + /// is not usable in that case (the runtime tag is dynamic, not + /// statically known from `value`'s shape); fall back to shallow + /// `ailang_rc_dec`. The non-moved field cells leak under that + /// path — same dynamic-tag partial-drop debt that 18d.4's match + /// arm already documents. fn emit_inlined_partial_drop( &mut self, value: &Term, @@ -1622,11 +1683,22 @@ impl<'a> Emitter<'a> { let (type_name, ctor_name) = match value { Term::Ctor { type_name, ctor, .. } => (type_name.as_str(), ctor.as_str()), _ => { - return Err(CodegenError::Internal( - "emit_inlined_partial_drop: binder value is not a Term::Ctor; \ - moved_slots should only accumulate against Ctor binders" - .into(), + // Iter 18g.2 fallback: dynamic-tag partial-drop debt. + // `value` is `Term::App` (Own-returning) or `Term::Lam` + // — `is_rc_heap_allocated` returns true for both, and a + // body that pattern-matches such a binder will populate + // `moved_slots`. We don't know the active ctor + // statically, so we shallow-dec the outer cell. Non- + // moved field cells leak under this path; closing the + // leak requires a tag-conditional partial-drop helper + // (analogous to the per-type drop fn but parameterised + // on the tag). Tracked as future work — same family as + // 18d.4's `(case (LCons h t) ...)` carve-out. + let _ = (val_ssa, moved); // keep compiler quiet about unused + self.body.push_str(&format!( + " call void @ailang_rc_dec(ptr {val_ssa})\n" )); + return Ok(()); } }; let cref = self.lookup_ctor_by_type(type_name, ctor_name)?; diff --git a/examples/rc_let_owned_app_leak.ail.json b/examples/rc_let_owned_app_leak.ail.json new file mode 100644 index 0000000..6ca603f --- /dev/null +++ b/examples/rc_let_owned_app_leak.ail.json @@ -0,0 +1 @@ +{"defs":[{"ctors":[{"fields":[],"name":"TLeaf"},{"fields":[{"k":"con","name":"Int"},{"k":"con","name":"Tree"},{"k":"con","name":"Tree"}],"name":"TNode"}],"kind":"type","name":"Tree"},{"body":{"cond":{"args":[{"name":"d","t":"var"},{"lit":{"kind":"int","value":0},"t":"lit"}],"fn":{"name":"==","t":"var"},"t":"app"},"else":{"args":[{"lit":{"kind":"int","value":1},"t":"lit"},{"args":[{"args":[{"name":"d","t":"var"},{"lit":{"kind":"int","value":1},"t":"lit"}],"fn":{"name":"-","t":"var"},"t":"app"}],"fn":{"name":"build","t":"var"},"t":"app"},{"args":[{"args":[{"name":"d","t":"var"},{"lit":{"kind":"int","value":1},"t":"lit"}],"fn":{"name":"-","t":"var"},"t":"app"}],"fn":{"name":"build","t":"var"},"t":"app"}],"ctor":"TNode","t":"ctor","type":"Tree"},"t":"if","then":{"args":[],"ctor":"TLeaf","t":"ctor","type":"Tree"}},"kind":"fn","name":"build","params":["d"],"type":{"effects":[],"k":"fn","params":[{"k":"con","name":"Int"}],"ret":{"k":"con","name":"Tree"},"ret_mode":"own"}},{"body":{"arms":[{"body":{"lit":{"kind":"int","value":0},"t":"lit"},"pat":{"ctor":"TLeaf","fields":[],"p":"ctor"}},{"body":{"lit":{"kind":"int","value":1},"t":"lit"},"pat":{"ctor":"TNode","fields":[{"name":"v","p":"var"},{"name":"l","p":"var"},{"name":"r","p":"var"}],"p":"ctor"}}],"scrutinee":{"name":"t","t":"var"},"t":"match"},"kind":"fn","name":"pin","params":["t"],"type":{"effects":[],"k":"fn","param_modes":["borrow"],"params":[{"k":"con","name":"Tree"}],"ret":{"k":"con","name":"Int"}}},{"body":{"body":{"args":[{"args":[{"name":"t","t":"var"}],"fn":{"name":"pin","t":"var"},"t":"app"}],"op":"io/print_int","t":"do"},"name":"t","t":"let","value":{"args":[{"lit":{"kind":"int","value":1},"t":"lit"}],"fn":{"name":"build","t":"var"},"t":"app"}},"kind":"fn","name":"main","params":[],"type":{"effects":["IO"],"k":"fn","params":[],"ret":{"k":"con","name":"Unit"}}}],"imports":[],"name":"rc_let_owned_app_leak","schema":"ailang/v0"} diff --git a/examples/rc_let_owned_app_leak.ailx b/examples/rc_let_owned_app_leak.ailx new file mode 100644 index 0000000..1defc60 --- /dev/null +++ b/examples/rc_let_owned_app_leak.ailx @@ -0,0 +1,53 @@ +; Iter 18g.2 RED-test fixture: a let-binder whose value is the +; result of an Own-returning fn call. 18c.3's +; `is_rc_heap_allocated` predicate returns `false` for any +; `Term::App` shape (its doc-comment explicitly defers this case +; to "later iters tied to (own) ret-mode contracts"); we now have +; those contracts (Iter 18a), and the let-scope close should drop +; the binder. +; +; Surfaced by 18f.2 / 18g.1: `bench_latency_explicit`'s +; `(let t (app build_tree 19) ...)` leaks the entire depth-19 +; Tree (~1M cells) because `t` is not trackable. This minimal +; repro uses a 2-cell depth-1 tree. +; +; Pre-fix: live = 3 (TNode + 2 TLeaf children — the depth-1 +; tree). +; Post-fix: live = 0. + +(module rc_let_owned_app_leak + + (data Tree + (ctor TLeaf) + (ctor TNode (con Int) (con Tree) (con Tree))) + + (fn build + (type + (fn-type + (params (con Int)) + (ret (own (con Tree))))) + (params d) + (body + (if (app == d 0) + (term-ctor Tree TLeaf) + (term-ctor Tree TNode 1 + (app build (app - d 1)) + (app build (app - d 1)))))) + + (fn pin + (type + (fn-type + (params (borrow (con Tree))) + (ret (con Int)))) + (params t) + (body + (match t + (case (pat-ctor TLeaf) 0) + (case (pat-ctor TNode v l r) 1)))) + + (fn main + (type (fn-type (params) (ret (con Unit)) (effects IO))) + (params) + (body + (let t (app build 1) + (do io/print_int (app pin t))))))