From 88045a485b79b6039c4914f27f6ccab371521b4f Mon Sep 17 00:00:00 2001 From: Brummel Date: Fri, 8 May 2026 14:25:07 +0200 Subject: [PATCH] =?UTF-8?q?fix:=2018g.2=20=E2=80=94=20let-binder=20drop=20?= =?UTF-8?q?for=20Own-returning=20App?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 18c.3's is_rc_heap_allocated returned false for any Term::App shape; the doc-comment explicitly deferred the owned-returning-call case to 'later iters tied to (own) ret-mode contracts'. We have those contracts (Iter 18a). With this iter the predicate widens to recognise Term::App whose callee carries ret_mode=Own; the let- scope close emits a drop call, routing through the per-type drop fn derived from the call's return type so the cascade walks ptr children correctly. Borrow- and Implicit-returning calls are still not trackable — they don't carry the static caller-owns-the-return signal. drop_symbol_for_binder gains an App arm that synthesises the return type and resolves drop__ from it (same shape as the existing Ctor arm), with cross-module qualification through import_map. emit_inlined_partial_drop now defaults to shallow ailang_rc_dec when value is not Term::Ctor — that path is the dynamic-tag partial-drop debt 18d.4 already documents (the runtime tag of a let-binder whose value is Term::App is not statically known, so per-field partial-drop emission is not usable; closing this remaining leak path requires a tag- conditional helper, queued as future work). Red: alloc_rc_let_binder_for_owned_returning_app_drops_at_scope_close on examples/rc_let_owned_app_leak — pre-fix live=3 (TNode + 2 TLeaf), post-fix live=0. End-to-end: bench_latency_explicit under --alloc=rc now reports allocs=11068575 frees=11068575 live=0. The depth-19 Tree cache + all 10M per-op IntList cells deallocate cleanly. Decision 10's prompt-deallocation property now holds end-to-end on the canonical bench fixture. --- crates/ail/tests/e2e.rs | 37 +++++++++ crates/ailang-codegen/src/lib.rs | 102 ++++++++++++++++++++---- examples/rc_let_owned_app_leak.ail.json | 1 + examples/rc_let_owned_app_leak.ailx | 53 ++++++++++++ 4 files changed, 178 insertions(+), 15 deletions(-) create mode 100644 examples/rc_let_owned_app_leak.ail.json create mode 100644 examples/rc_let_owned_app_leak.ailx diff --git a/crates/ail/tests/e2e.rs b/crates/ail/tests/e2e.rs index 2bced03..34f01b6 100644 --- a/crates/ail/tests/e2e.rs +++ b/crates/ail/tests/e2e.rs @@ -2124,3 +2124,40 @@ fn alloc_rc_explicit_mode_tail_sum_does_not_leak_outer_cells() { and no drop site emits the shallow rc_dec for the moved-from outer LCons cell" ); } + +/// Iter 18g.2 regression: a `let`-binder whose value is the result of +/// an Own-returning function call must be dropped at let-scope close. +/// +/// Background: 18c.3's `is_rc_heap_allocated` returns `false` for any +/// `Term::App` shape (the doc-comment explicitly defers the +/// owned-returning-call case to "later iters tied to `(own)` ret-mode +/// contracts"). With Iter 18a's mode contracts in place, that +/// limitation is no longer load-bearing — the call's `ret_mode == Own` +/// is the static signal that a fresh heap allocation has flowed into +/// the binder, and the let-scope close is the right place to dec it. +/// +/// 18f.2's bench surfaced the user-visible cost: in +/// `(let t (app build_tree 19) ...)`, `t` was not trackable and the +/// depth-19 Tree (~1M cells) leaked at every program exit. +/// +/// Pre-fix on this minimal fixture: `live = 3` (one TNode + two TLeaf +/// children). +/// Post-fix: `live = 0`. +#[test] +fn alloc_rc_let_binder_for_owned_returning_app_drops_at_scope_close() { + let (stdout, allocs, frees, live) = + build_and_run_with_rc_stats("rc_let_owned_app_leak.ail.json"); + assert_eq!( + stdout.trim(), + "1", + "pin(TNode) returns 1 regardless of leak status" + ); + assert_eq!( + live, 0, + "let-binder for an Own-returning app leaked {live} cells \ + (allocs={allocs} frees={frees}); is_rc_heap_allocated must \ + recognise Term::App with ret_mode=Own as trackable, and the \ + drop-symbol resolution must derive drop__ from the \ + call's return type" + ); +} diff --git a/crates/ailang-codegen/src/lib.rs b/crates/ailang-codegen/src/lib.rs index e428ad4..c2fef72 100644 --- a/crates/ailang-codegen/src/lib.rs +++ b/crates/ailang-codegen/src/lib.rs @@ -1545,12 +1545,17 @@ impl<'a> Emitter<'a> { /// non-escaping ones become stack `alloca`s and must NOT be /// `dec`'d (they are freed by LLVM at fn return). /// - /// Other value shapes (calls, vars, literals, matches, …) return - /// `false` here. A call's return value may itself be an - /// RC-allocated box, but the caller does not statically know that - /// — proper handling of returned boxes is part of the wider - /// uniqueness story (and tied to `(own)` ret-mode contracts in - /// later iters). + /// Iter 18g.2 widens this to include `Term::App` whose callee's + /// fn-type carries `ret_mode == Own`. The mode contract states that + /// the callee hands the returned cell's ownership to the caller's + /// frame; the let-scope close is the right place for the caller's + /// dec. Calls whose callee is `Borrow`/`Implicit`-returning are + /// still not trackable — they don't carry that signal. + /// + /// Other value shapes (vars, literals, matches, …) return `false` + /// here. A `Term::Var` returning an RC-allocated box would already + /// be tracked by an earlier let-binder; tracking it again here + /// would double-dec. fn is_rc_heap_allocated(&self, value: &Term) -> bool { if !matches!(self.alloc, AllocStrategy::Rc) { return false; @@ -1560,10 +1565,37 @@ impl<'a> Emitter<'a> { let term_ptr = (value as *const Term) as usize; !self.non_escape.contains(&term_ptr) } + Term::App { callee, .. } => { + // Iter 18g.2: a call whose callee carries + // `ret_mode == Own` hands a fresh heap allocation to + // the caller's frame. Trackable. `Borrow` and + // `Implicit` ret-modes do not carry that signal — + // returning by Borrow is a view into the callee's + // owned data (caller does not own it), and Implicit + // is the back-compat lane that 18c.3's debt covers. + self.synth_callee_ret_mode(callee) + .map(|m| matches!(m, ParamMode::Own)) + .unwrap_or(false) + } _ => false, } } + /// Iter 18g.2: lookup helper for a callee's `ret_mode`. Returns + /// `Some(mode)` when the callee resolves to a fn-typed term; + /// `None` for shapes whose type is not a `Type::Fn` (typechecker + /// would already have rejected an App on a non-fn, but the helper + /// is defensive). Used by [`Self::is_rc_heap_allocated`] and the + /// [`Self::drop_symbol_for_binder`] App-arm to decide both + /// trackability and the drop-fn symbol. + fn synth_callee_ret_mode(&self, callee: &Term) -> Option { + let cty = self.synth_arg_type(callee).ok()?; + match cty { + Type::Fn { ret_mode, .. } => Some(ret_mode), + _ => None, + } + } + /// Iter 18c.4: pick the drop-fn symbol to call at the close of a /// trackable `Term::Let` scope. For a `Term::Ctor` binder the /// symbol is `drop__` — derived from the ctor's @@ -1594,6 +1626,31 @@ impl<'a> Emitter<'a> { .get(val_ssa) .cloned() .unwrap_or_else(|| "ailang_rc_dec".to_string()), + // Iter 18g.2: an Own-returning call hands a freshly heap- + // allocated cell whose static type is the callee's + // `ret`. Resolve the per-type drop fn from that ret-type + // so the cascade walks the cell's pointer-typed children + // (e.g. an Own-returned `Tree` fans out via + // `drop__`). Falls back to `ailang_rc_dec` if + // the ret-type is not a `Type::Con` (e.g. a bare type + // var on an as-yet-unmonomorphised polymorphic call — + // the monomorphised copies will resolve correctly). + Term::App { .. } => { + if let Ok(ret_ty) = self.synth_arg_type(value) { + if let Type::Con { name, .. } = ret_ty { + if name.matches('.').count() == 1 { + let (prefix, suffix) = + name.split_once('.').expect("checked"); + if let Some(target) = self.import_map.get(prefix) { + return format!("drop_{target}_{suffix}"); + } + return format!("drop_{prefix}_{suffix}"); + } + return format!("drop_{m}_{name}", m = self.module_name); + } + } + "ailang_rc_dec".to_string() + } _ => "ailang_rc_dec".to_string(), } } @@ -1608,11 +1665,15 @@ impl<'a> Emitter<'a> { /// transferred to a pattern-bound binder that owns the dec /// for them. /// - /// `value` must be a `Term::Ctor` — `is_rc_heap_allocated` only - /// returns true for `Term::Ctor` / `Term::Lam`, and a `Term::Lam` - /// binder cannot accumulate moved slots (closures are not pattern- - /// matched into positional fields). The match-or-error pattern - /// guards that invariant. + /// Iter 18g.2 widens the input set: with `Term::App` (Own- + /// returning call) now also trackable, a let-binder whose value is + /// `Term::App` may accumulate moved slots if its body pattern- + /// matches the binder. The per-field static-ctor emission below + /// is not usable in that case (the runtime tag is dynamic, not + /// statically known from `value`'s shape); fall back to shallow + /// `ailang_rc_dec`. The non-moved field cells leak under that + /// path — same dynamic-tag partial-drop debt that 18d.4's match + /// arm already documents. fn emit_inlined_partial_drop( &mut self, value: &Term, @@ -1622,11 +1683,22 @@ impl<'a> Emitter<'a> { let (type_name, ctor_name) = match value { Term::Ctor { type_name, ctor, .. } => (type_name.as_str(), ctor.as_str()), _ => { - return Err(CodegenError::Internal( - "emit_inlined_partial_drop: binder value is not a Term::Ctor; \ - moved_slots should only accumulate against Ctor binders" - .into(), + // Iter 18g.2 fallback: dynamic-tag partial-drop debt. + // `value` is `Term::App` (Own-returning) or `Term::Lam` + // — `is_rc_heap_allocated` returns true for both, and a + // body that pattern-matches such a binder will populate + // `moved_slots`. We don't know the active ctor + // statically, so we shallow-dec the outer cell. Non- + // moved field cells leak under this path; closing the + // leak requires a tag-conditional partial-drop helper + // (analogous to the per-type drop fn but parameterised + // on the tag). Tracked as future work — same family as + // 18d.4's `(case (LCons h t) ...)` carve-out. + let _ = (val_ssa, moved); // keep compiler quiet about unused + self.body.push_str(&format!( + " call void @ailang_rc_dec(ptr {val_ssa})\n" )); + return Ok(()); } }; let cref = self.lookup_ctor_by_type(type_name, ctor_name)?; diff --git a/examples/rc_let_owned_app_leak.ail.json b/examples/rc_let_owned_app_leak.ail.json new file mode 100644 index 0000000..6ca603f --- /dev/null +++ b/examples/rc_let_owned_app_leak.ail.json @@ -0,0 +1 @@ +{"defs":[{"ctors":[{"fields":[],"name":"TLeaf"},{"fields":[{"k":"con","name":"Int"},{"k":"con","name":"Tree"},{"k":"con","name":"Tree"}],"name":"TNode"}],"kind":"type","name":"Tree"},{"body":{"cond":{"args":[{"name":"d","t":"var"},{"lit":{"kind":"int","value":0},"t":"lit"}],"fn":{"name":"==","t":"var"},"t":"app"},"else":{"args":[{"lit":{"kind":"int","value":1},"t":"lit"},{"args":[{"args":[{"name":"d","t":"var"},{"lit":{"kind":"int","value":1},"t":"lit"}],"fn":{"name":"-","t":"var"},"t":"app"}],"fn":{"name":"build","t":"var"},"t":"app"},{"args":[{"args":[{"name":"d","t":"var"},{"lit":{"kind":"int","value":1},"t":"lit"}],"fn":{"name":"-","t":"var"},"t":"app"}],"fn":{"name":"build","t":"var"},"t":"app"}],"ctor":"TNode","t":"ctor","type":"Tree"},"t":"if","then":{"args":[],"ctor":"TLeaf","t":"ctor","type":"Tree"}},"kind":"fn","name":"build","params":["d"],"type":{"effects":[],"k":"fn","params":[{"k":"con","name":"Int"}],"ret":{"k":"con","name":"Tree"},"ret_mode":"own"}},{"body":{"arms":[{"body":{"lit":{"kind":"int","value":0},"t":"lit"},"pat":{"ctor":"TLeaf","fields":[],"p":"ctor"}},{"body":{"lit":{"kind":"int","value":1},"t":"lit"},"pat":{"ctor":"TNode","fields":[{"name":"v","p":"var"},{"name":"l","p":"var"},{"name":"r","p":"var"}],"p":"ctor"}}],"scrutinee":{"name":"t","t":"var"},"t":"match"},"kind":"fn","name":"pin","params":["t"],"type":{"effects":[],"k":"fn","param_modes":["borrow"],"params":[{"k":"con","name":"Tree"}],"ret":{"k":"con","name":"Int"}}},{"body":{"body":{"args":[{"args":[{"name":"t","t":"var"}],"fn":{"name":"pin","t":"var"},"t":"app"}],"op":"io/print_int","t":"do"},"name":"t","t":"let","value":{"args":[{"lit":{"kind":"int","value":1},"t":"lit"}],"fn":{"name":"build","t":"var"},"t":"app"}},"kind":"fn","name":"main","params":[],"type":{"effects":["IO"],"k":"fn","params":[],"ret":{"k":"con","name":"Unit"}}}],"imports":[],"name":"rc_let_owned_app_leak","schema":"ailang/v0"} diff --git a/examples/rc_let_owned_app_leak.ailx b/examples/rc_let_owned_app_leak.ailx new file mode 100644 index 0000000..1defc60 --- /dev/null +++ b/examples/rc_let_owned_app_leak.ailx @@ -0,0 +1,53 @@ +; Iter 18g.2 RED-test fixture: a let-binder whose value is the +; result of an Own-returning fn call. 18c.3's +; `is_rc_heap_allocated` predicate returns `false` for any +; `Term::App` shape (its doc-comment explicitly defers this case +; to "later iters tied to (own) ret-mode contracts"); we now have +; those contracts (Iter 18a), and the let-scope close should drop +; the binder. +; +; Surfaced by 18f.2 / 18g.1: `bench_latency_explicit`'s +; `(let t (app build_tree 19) ...)` leaks the entire depth-19 +; Tree (~1M cells) because `t` is not trackable. This minimal +; repro uses a 2-cell depth-1 tree. +; +; Pre-fix: live = 3 (TNode + 2 TLeaf children — the depth-1 +; tree). +; Post-fix: live = 0. + +(module rc_let_owned_app_leak + + (data Tree + (ctor TLeaf) + (ctor TNode (con Int) (con Tree) (con Tree))) + + (fn build + (type + (fn-type + (params (con Int)) + (ret (own (con Tree))))) + (params d) + (body + (if (app == d 0) + (term-ctor Tree TLeaf) + (term-ctor Tree TNode 1 + (app build (app - d 1)) + (app build (app - d 1)))))) + + (fn pin + (type + (fn-type + (params (borrow (con Tree))) + (ret (con Int)))) + (params t) + (body + (match t + (case (pat-ctor TLeaf) 0) + (case (pat-ctor TNode v l r) 1)))) + + (fn main + (type (fn-type (params) (ret (con Unit)) (effects IO))) + (params) + (body + (let t (app build 1) + (do io/print_int (app pin t))))))