[ASDAlexander77]

Phase 7a of -mm=own: generators and async (spec §2.7, §7 phase 7). The plan is docs/superpowers/plans/2026-10-02-own-phase-7.md and the results are in spec §18. The PR also fixes two use-after-free holes that already exist on main.

Pre-existing holes, fixed

• An object literal cast to an interface was freed twice. The object-literal interface cast marks its ts.NewInterface __owned_result, and isFresh read that as a block of its own. On main, const o = {...}; use(o); use(o), with use taking an interface, frees o twice and crashes. ts.NewInterface is now a view of its object, the way a union or an optional is, and a view is exactly as fresh as its root:
  • let i = <I>raw borrows raw. rc's ts.Retain of the interface is the reference of the let that consumes it, and a borrow erases it.
  • Two releases of one block, where one can run after the other, are two owners and an error. Regression test: own_err_interface_two_views.
• Async bodies were never checked. The async lowering outlines a for await body into a func.func, and neither own pass looked inside one. A retain there failed in the lowering (00for_await_yield). Worse, a call there to a callee that keeps its argument got no facts: the callee moved the argument while the body still released it. Both passes now run on every function. This one is verified in the IR only, because a run can't show it (see the last section).

Generators

• The state object is an ordinary owned block. Its maker makes it with ts.New and returns it cast to !ts.object, and that cast is a view. In the pass, a ts.New'd value_ref seen as its object owns a block, so it is checked: ownsHeapMemory says no for every value_ref. The store that fills it is a borrow.
• The initial state holds only constants, so rc's retain of it is erased.
• A generator's locals are fields of the state object, and the existing container rules handle them, reassignment included.
• A yield v builds a {value, done} record and returns it. A record built to be returned takes the fresh values stored into it: each store is that value's taker. The same rule covers a plain return { value: new C(), done: false }.
• The caller's next() goes through the state object's field. The signature pass now resolves a function read from a field when that field only ever holds one function, and marks the call's result fresh.
• What a generator captures sits in a box in the state object's .captured field. That box is treated as an escaping closure's box, so the 5b rules apply: a number parameter moves in, and an object parameter is 5b's "its value is the caller's" error. An object literal whose methods capture keeps its box the same way.

For review: fieldFunctions (signature pass) is a closed-world rule over the module. It doesn't consult open or privacy. It requires that every ts.Constant of the tuple type holds the same function in that field, that nothing stores into the field (from a method too, which sees object_storage), and that no other op makes a value of the type. It is safe for a generator's state type because the type of next carries a per-site object_storage symbol that no other module can spell. own_err_field_function_reassigned pins the "nothing stores into it" condition.

Verification

• Release suite: 3383 of 3384 pass. The one failure, test-compile-gc-defaultlib-collector, is the same as on -mm=own phase 5a: a closure that does not escape borrows what it captures #436/-mm=own phase 5b: a closure that escapes owns what it captures; a call in a try body is a call #437: the installed default library at I:\tslang is stale. All 381 own tests pass.

• WSL/GCC: builds, and 380 of 380 own tests pass (Windows has one more, the Windows-only shared-library check).

• Corpus: 325 → 359 of 591.

  • Every newly compiling file passes under test-runner -mm=own, AOT and JIT, and so does every -shared pair whose two halves both compile. Their JIT output matches gc's, except the two async files, which only run under test-runner.
  • Two files that compiled on main are errors now, both correctly. 00object stores one object literal into two tuples, and rc leaks it there. 00interface_object_array reads an object after moving it into an array.

• Memory (AOT, measure.ps1, MB):

  test	gc	rc	none	own
  own_generator	6.1	11.2	1548.6	4.3
  own_record_return	5.9	4.2	224.0	4.2
  own_interface_view	5.9	4.3	551.1	4.3
  own_async	6.1	5.7	334.7	5.8

• Teeth: each new rule was undone with a temporary switch:

  • keeping the frame's ReleaseCell after a cell moves into a generator's box breaks own_generator, AOT (0xC0000374) and JIT;
  • keeping a temporary's release after it moves into a record breaks own_record_return, AOT (0xC0000374) and JIT;
  • skipping the released-twice check makes own_err_interface_two_views compile and crash;
  • resolving a reassigned field makes own_err_field_function_reassigned compile.

Tests

• Positive:
  • own_generator: numbers, a class local, a reassigned local, a generator given up early, fresh objects and strings yielded through for...of and by hand, number parameters, an object literal with a method.
  • own_record_return.
  • own_interface_view.
  • own_async: a heap local across await, a fresh result, a heap parameter, a string, a for await body.
• Negatives: own_err_interface_two_views, own_err_field_function_reassigned, own_err_generator_param_object.
• Removed: own_err_interface, a phase 0 placeholder for an interface over a class instance, which now compiles.
• Changed check: the no-counting test's fail pattern is error: now, because error alone matched the async runtime's message string "Awaited async operand is in error state".

Found, not fixed

• A temporary made just before a yield is never released, under rc as well. OwnedReturnConsumptionPass doesn't release past a resume point, so yield "s" + i leaks the string made from i.
• rc leaks yielded objects. That's why rc is above gc on own_generator.
• await f() returns before f's for await body has run, under every model: after for await (const x of g()) keep.push(1), keep is empty. That's why the async-body facts fix can't get a runtime test.
• Phase 7b: a generator over an object parameter, which needs the result to borrow the argument; .map/.filter; and yielded borrows.

🤖 Generated with Claude Code