feb941363a
`(app print x)` under --alloc=rc leaked the heap-Str allocated by
`show x` in print's body: the let-binder `s` in
`(let s (app show x) (do io/print_str s))` was never flagged
trackable, so the drop site at scope-close emitted no
`ailang_rc_dec(s)`. Minimal repro `(body (app print 42))` produced
`allocs=1 frees=0 live=1`.
Root cause is two-layer:
1. examples/prelude.ail.json declared the Show class method `show`
without an explicit `ret_mode` on the return type, so serde
defaulted to ParamMode::Implicit. Fix: add `"ret_mode": "own"`
on the Show.show method, parallel to how the heap-Str-producing
builtins (int_to_str, bool_to_str, float_to_str, str_clone,
str_concat) declare it. examples/prelude.ail regenerated via
`ail render` to stay parse-isomorphic with the JSON.
2. crates/ailang-check/src/lib.rs `substitute_rigids` was silently
stripping `param_modes` and `ret_mode` whenever it rebuilt a
`Type::Fn`, so even after the prelude fix, the mono-synthesised
`show__Int / Bool / Str / Float` lost the `Own` annotation
during rigid substitution. Fix: preserve both fields through
the substitution.
RED pin: crates/ail/tests/print_no_leak_pin.rs (test
`alloc_rc_print_int_does_not_leak_show_result_str`) + fixture
examples/print_int_no_leak_pin.ail asserts allocs == frees and
live == 0 for `(body (app print 42))` under --alloc=rc.
Ten mono-body hash pins re-recorded (eq__Int/Bool/Str,
compare__Int/Bool/Str, show__Int/Bool/Str/Float, eq__IntBox) —
the bodies are semantically identical; the canonical JSON now
carries the previously-stripped mode metadata, so the body hash
moves. Re-pinning is bookkeeping for the intentional drift, not
a workaround.
Surfaced 2026-05-14 during the rpe.1 BLOCKED orchestrator run
(Cat A). Existed in latent form since iter 24.3 (when Show + print
shipped); only became user-observable when `(app print ...)` joined
the corpus. cargo test --workspace: 565 / 0 / 3.
Open follow-up flagged for next /audit: grep for `Type::Fn { ..., .. }`
field-spread sites — any other shape that drops modes during
rebuild is a latent instance of the same bug class. Out of scope
for this minimal fix.
119 lines
4.7 KiB
Rust
119 lines
4.7 KiB
Rust
//! RED-pin for the 2026-05-14 rpe.1 Cat-A heap-Str leak in `print`.
|
|
//!
|
|
//! Property protected: under `--alloc=rc`, evaluating the trivial
|
|
//! program `(body (app print 42))` does NOT leak the heap-Str
|
|
//! allocated inside `print`'s body. `print`'s body is the explicit-
|
|
//! let `let s = show x in do io/print_str s` (see iter 24.3, pinned
|
|
//! structurally by `print_mono_body_shape.rs`); `show` at primitive
|
|
//! type calls `int_to_str` which returns a fresh heap-Str (slab in
|
|
//! `runtime/str.c`). `io/print_str` borrows the Str. At let-scope-
|
|
//! close, the binder `s` is the only owner — codegen must emit
|
|
//! `ailang_rc_dec(s)`. The runtime stats line at exit must report
|
|
//! `live == 0` (equivalently `allocs == frees`).
|
|
//!
|
|
//! As of commit 301cbc3 this test fails: stderr reports
|
|
//! `ailang_rc_stats: allocs=1 frees=0 live=1`. The IR for the post-
|
|
//! mono `ail_prelude_print__Int` body contains a `call ptr
|
|
//! @ail_prelude_show__Int(...)` followed by `getelementptr +8` +
|
|
//! `@puts` + `ret i8 0` — there is no `ailang_rc_dec` on the
|
|
//! show-result before return. Root cause sits at codegen's
|
|
//! `is_rc_heap_allocated` App-arm: it reads the callee's
|
|
//! `Type::Fn.ret_mode` via `synth_callee_ret_mode` and requires
|
|
//! `Own`. The mono'ed `show__Int` inherits its `Type::Fn` from the
|
|
//! `Show` class method declaration in `examples/prelude.ail.json`,
|
|
//! whose `methods[0].type` omits the `ret_mode` key — `serde` defaults
|
|
//! the missing field to `ParamMode::Implicit`. So
|
|
//! `synth_callee_ret_mode(show__Int) == Implicit`, the let-binder is
|
|
//! not flagged trackable, and `drop_symbol_for_binder` is never
|
|
//! called for it.
|
|
//!
|
|
//! Once the underlying issue is fixed (the canonical move is to
|
|
//! recognise that any class-method whose declared `ret` is `Str` /
|
|
//! any pointer-typed user type should round-trip as Own through
|
|
//! mono, OR to install the Show class declaration with explicit
|
|
//! `ret_mode: "own"`, OR to widen `is_rc_heap_allocated`'s App-arm
|
|
//! to also consult the callee's ret type-via-Str-carve-out), this
|
|
//! test must flip GREEN without weakening the assertion.
|
|
|
|
use std::path::Path;
|
|
use std::process::Command;
|
|
|
|
fn ail_bin() -> &'static str {
|
|
env!("CARGO_BIN_EXE_ail")
|
|
}
|
|
|
|
#[test]
|
|
fn alloc_rc_print_int_does_not_leak_show_result_str() {
|
|
let manifest_dir = env!("CARGO_MANIFEST_DIR");
|
|
let workspace = Path::new(manifest_dir).parent().unwrap().parent().unwrap();
|
|
let src = workspace
|
|
.join("examples")
|
|
.join("print_int_no_leak_pin.ail");
|
|
let tmp = std::env::temp_dir().join(format!(
|
|
"ailang_print_no_leak_pin_{}",
|
|
std::process::id()
|
|
));
|
|
std::fs::create_dir_all(&tmp).unwrap();
|
|
let out = tmp.join("bin");
|
|
let status = Command::new(ail_bin())
|
|
.args([
|
|
"build",
|
|
src.to_str().unwrap(),
|
|
"--alloc=rc",
|
|
"-o",
|
|
])
|
|
.arg(&out)
|
|
.status()
|
|
.expect("ail build failed to run");
|
|
assert!(
|
|
status.success(),
|
|
"ail build --alloc=rc failed for print_int_no_leak_pin.ail"
|
|
);
|
|
let output = Command::new(&out)
|
|
.env("AILANG_RC_STATS", "1")
|
|
.output()
|
|
.expect("execute binary");
|
|
assert!(
|
|
output.status.success(),
|
|
"binary exited non-zero: status {:?}",
|
|
output.status
|
|
);
|
|
let stderr = String::from_utf8(output.stderr).expect("stderr utf8");
|
|
let stats_line = stderr
|
|
.lines()
|
|
.find(|l| l.starts_with("ailang_rc_stats:"))
|
|
.unwrap_or_else(|| {
|
|
panic!(
|
|
"missing ailang_rc_stats line in stderr; stderr was:\n{stderr}"
|
|
)
|
|
});
|
|
let mut allocs: Option<u64> = None;
|
|
let mut frees: Option<u64> = None;
|
|
let mut live: Option<i64> = None;
|
|
for tok in stats_line.split_whitespace() {
|
|
if let Some(v) = tok.strip_prefix("allocs=") {
|
|
allocs = v.parse().ok();
|
|
} else if let Some(v) = tok.strip_prefix("frees=") {
|
|
frees = v.parse().ok();
|
|
} else if let Some(v) = tok.strip_prefix("live=") {
|
|
live = v.parse().ok();
|
|
}
|
|
}
|
|
let allocs = allocs.expect("missing allocs= field");
|
|
let frees = frees.expect("missing frees= field");
|
|
let live = live.expect("missing live= field");
|
|
assert_eq!(
|
|
live, 0,
|
|
"`(app print 42)` under --alloc=rc leaks {live} heap-Str cell(s) \
|
|
(allocs={allocs} frees={frees}); print's let-binder for the \
|
|
show-result must drop at let-scope-close. Show class method \
|
|
`show` in prelude.ail.json omits `ret_mode`, so mono-synthesised \
|
|
`show__Int` inherits ret_mode=Implicit and `is_rc_heap_allocated` \
|
|
declines to track the let-binder."
|
|
);
|
|
assert_eq!(
|
|
allocs, frees,
|
|
"alloc/free mismatch (allocs={allocs} frees={frees} live={live})"
|
|
);
|
|
}
|