Skip to content

rc: a ternary branch yielding a fresh object widened to a union hands its reference out (#465) - #466

Merged
ASDAlexander77 merged 2 commits into
mainfrom
fix-rc-ternary-fresh-null
Oct 3, 2026
Merged

ASDAlexander77 merged 2 commits into
mainfrom
fix-rc-ternary-fresh-null

Conversation

@ASDAlexander77

Copy link
Copy Markdown
Owner

Fixes #465.

Under rc, cond ? new C() : null freed the new object. The then-branch yields new C() cast to C | null. OwnedReturnConsumptionPass decides whether a branch hands an unclaimed reference out by looking at the yielded value itself, and here that value was the cast, not the new. So it saw no branch carrying a reference and left the ts.If alone. The new's reference was then released as a discarded temporary at the end of its branch, before the merge. The result pointed at freed memory, and its receiver released it a second time.

The pass now looks through the casts that only widen a branch's yield: a cast to a union or an optional, OptionalValue, and CreateUnionInstance. The producer's reference goes out with the ts.If result, as it already did when a branch yielded the new itself. A cast that makes a new value, such as a box to any, carries its own reference and is not looked through.

Tests

  • New 00ternary_new_or_null.ts: registered as compile and JIT tests and in the rc/none corpus. It failed under rc before the change. Each case reads the result after allocations of the same size have reused anything freed:
    • a local cond ? new C() : null;
    • the same ternary returned from a function;
    • an optional cond ? n : undefined;
    • the ternary inside a loop.
  • The original repros now print 5 under rc, where before they printed 0 or crashed.
  • The own corpus is unchanged: 453 / 593 plain, 451 / 593 with --opt.
  • Full Release ctest: 3636/3637. The one failure is test-compile-gc-defaultlib-collector, the known local LNK2005 against the stale installed default library; it fails on main the same way.

🤖 Generated with Claude Code

ASDAlexander77 and others added 2 commits October 3, 2026 18:49
… its reference out (#465)

`cond ? new C() : null` freed the new object under rc. The then-branch yields `new C()` cast to
`C | null`; OwnedReturnConsumptionPass looked for a branch that hands an unclaimed reference out
by asking about the yielded value itself, which was the cast, not the `new`. Seeing no branch
that carries one, it left the ts.If alone, and the `new`'s reference was released as a
discarded temporary at the end of its branch, before the merge: the result pointed at freed
memory (and was released a second time by its receiver).

The branch's yield is now seen through the casts that only widen it (to a union or an optional,
OptionalValue, CreateUnionInstance): the producer's reference goes out with the ts.If result, as
it already did when a branch yielded the `new` itself. A cast that makes a new value (a box to
`any`) carries its own reference and is not looked through.

Test: 00ternary_new_or_null (compile and JIT, and in the rc/none corpus): a local and a returned
`cond ? new C() : null`, an optional `cond ? n : undefined`, and a loop, each read after
allocations of the same size have reused anything freed. It failed under rc before the change.
The own corpus is unchanged (453 / 593 plain, 451 / 593 with --opt).

Fixes #465.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…null

# Conflicts:
#	tslang/test/tester/CMakeLists.txt
@ASDAlexander77
ASDAlexander77 merged commit 891426a into main Oct 3, 2026
2 checks passed
@ASDAlexander77
ASDAlexander77 deleted the fix-rc-ternary-fresh-null branch October 3, 2026 18:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

-mm=rc: cond ? new C() : null frees the new object

1 participant