[ASDAlexander77]

Phase 7b of -mm=own: generators that borrow. The plan is docs/superpowers/plans/2026-10-02-own-phase-7b.md and the results are in spec §19.

A generator over a parameter that holds a block now compiles: function* each(a: number[]) { for (const v of a) yield v; }. In Rust terms that's fn each<'a>(a: &'a [f64]) -> impl Iterator + 'a. The caller owns the generator's state object, but the state object borrows the argument and may not outlive it. .map and .filter, which MLIRGen builds as such a generator over the source array, compile too.

How it works

• The signature pass decides which fields of a state object borrow. The release routine is built once per type, while the inference runs per function and in parallel, so the decision has to be module-level. A state type is unique to its generator: the type of its next names a per-site object_storage.
  • The .captured box borrows when every fill is a parameter's cell, or a copy read out of a parameter's field.
  • A state field borrows when everything stored into it, anywhere in the module, is a read of a borrowing cell or field (computed as a least fixpoint). The for...of copy of the array is such a field.
  • Outputs: the module attribute ts.own_borrowing_fields, and __own_result_bounded (the parameters whose blocks the state borrows) on the maker and on each call to it.
• The lowering skips a borrowing field in the state object's release routine. A borrowing box gets tsrelcbc_, which frees each cell but none of what the cells or the by-value fields hold.
• Inside the generator: a store into a borrowing field takes nothing. What is read out of a borrowing cell, field or box field is the caller's, and may only be borrowed: yielding it is an error, because it would give the caller's value a second owner and rc retains nothing there for any other check to see.
• At the caller, the generator is owned like any fresh value, and bounded:
  • no use of it may come after an end of a bounding argument (its release, its assignment, or the overwrite of the field it was read from);
  • it may not be stored, returned or captured;
  • for .map, the bound is the closure box: it ends where the closures on it are released, and where what it holds ends.
• .map and .filter:
  • The caller's box holding a copy of the array borrows it when nothing in the box is fresh. So two .maps of one array no longer move it twice.
  • A callback that captures is a fresh closure made for that box. In that case the box owns its copies and the array moves in.
  • rc reads the array twice for one copy and retains the first read. The second read is now taken as the same value.

For review

• calledOnlyDirectly is a second closed-world test, which disagrees with findOpen by design. findOpen marks .map's maker (..iter) open, because a ts.SymbolRef names it in a ts.CreateBoundFunction. The bounded fact is pinned anyway. The argument is that the maker is private, it is the only ts.New of its state type, and every closure over it is dead: only retained and released, with the real call made directly through the box.
• New coupling: the lowering now reads a pass output (ts.own_borrowing_fields) to pick a release routine. It's own-only: borrowingFieldsOf is empty under rc, gc and none, and whenever the attribute is absent.
• The twin-read rule is general, not generator-only: it changes takerOf and retainBefore for every move out of a slot. The evidence that it's safe is that the corpus didn't move (364 before and after it, none lost). Its barrier stops at any op given the place, and at any call.

Verification

• Release suite: 3389 of 3390 pass. The one failure, test-compile-gc-defaultlib-collector, is the same stale installed default library as on -mm=own phase 5a: a closure that does not escape borrows what it captures #436, -mm=own phase 5b: a closure that escapes owns what it captures; a call in a try body is a call #437 and -mm=own phase 7a: generators and async; an interface is a view of its object #439. All 388 own tests pass.

• WSL/GCC: builds, and 387 of 387 own tests pass (Windows has one more, the Windows-only shared-library check).

• Corpus: 359 → 364 of 591, none lost: 00funcs_generic_iterator, 01disposable, 02disposable (an object literal whose methods capture a parameter is the same shape), 00filter, 00class_iterator_super. Each passes under test-runner -mm=own, AOT and JIT.

• Memory: own_generator_borrow measures flat, the same as rc, at both sizes:

  iterations	gc	rc	none	own
  20000	6.1	4.3	1441.5	4.3
  200000	6.1	4.3	14376.5	4.3

  The ten-times run caught a leak in this PR's first form of the copies rule (a borrowed capturing callback, which nothing then freed). It's fixed in 12a7bd2.

• Teeth: each new rule was undone with a temporary switch:

  • the owning box routine for a borrowing box breaks own_generator_borrow, AOT (0xC0000374) and JIT;
  • releasing a borrowing field does the same;
  • skipping the bounded check makes the three bounded negatives compile;
  • skipping the borrowed-read check makes the yield negative compile.

Tests

• Positive: own_generator_borrow: an array, a class and a string parameter; a generator given up early; two generators over one argument; an argument read out of a field; map; filter; and a capturing filter as the array's last use.
• Negatives: own_err_generator_outlives_arg, own_err_generator_bounded_escapes, own_err_generator_yields_borrow, own_err_generator_map_outlives, own_err_generator_place_overwritten.
• Removed: own_err_generator_param_object, which now compiles.

Found, not fixed (every model)

a.map(f).map(g) fails to compile with "the condition has no value": #442. Without the default library, the built-in .map returns a generator, and the real error is lost in a condition.

Known limits (spec §19.5)

• A yielded borrow is an error: the result record type is shared between generators, so a fact per type can't say that a record borrows.
• A capturing .map/.filter callback moves the array into the closure's box.
• A bounded generator can't be returned past its argument, even when that argument is the returning function's own parameter.

🤖 Generated with Claude Code