[ASDAlexander77]

An interface value was { vtable, this, type }: the third word was the runtime type tag of what this points at, which -mm=rc and -mm=own release and retain the object through. Every interface vtable is made for one concrete type (a class's, with a subclass getting its own, or an object literal's), so the tag now lives in the vtable. The value is two pointers again: 16 bytes, not 24.

Layout

• Interface vtable header is { type tag, .instanceOf }, and members follow it as before:
  • INTERFACE_VTABLE_TYPE_SLOT = 0
  • INTERFACE_VTABLE_INSTANCEOF_SLOT = 1
  • INTERFACE_VTABLE_HEADER_SLOTS = 2
• Class vtable: a class's own vtable still starts with its .instanceOf (CLASS_VTABLE_INSTANCEOF_SLOT). instanceof now names the slot of the vtable it reads.
• Tag value: the class, object-literal and null vtable builders write it (mlirGenInterfaceVTableTypeTag). It is the type's descriptor, or null when the type owns no heap memory. It is always null in an interface's null vtable (A null class object, null or undefined given to an interface is a null interface whose methods throw #665).

Example (rc):

@Square.Shape..vtbl = { td_<hash>_class+32, @Square..instanceOf, @Rect.area, <offset of id> }
@Shape.null..vtbl   = { null, @.instanceOf.none, @Shape.null.area, null }

Changes

• Lowering:
  • ts.NewInterface no longer makes a tag.
  • releaseViaInterfaceTag reads the tag through the vtable. A zeroed slot has no vtable and a null interface has a null tag; both release nothing.
  • A method bound through an interface takes its tag from the same vtable.
• Interface-to-interface cast (An interface cast to one it does not extend gets a vtable laid out for it #666): the remap keeps the header, because the tag belongs to the value whatever it is seen through.
• Own passes: the signature, closed-world and resolve passes read interface vtables past the two-slot header.
• -mm=own borrowing records (spec 32):
  • A record box that borrows its fields is released by a routine of its own, so the tag must name that routine.
  • Its vtable is the object literal's, which every record of that shape shares.
  • The signature pass therefore gives such a box a copy of that vtable, <vtable>.r<i>...vtbl, whose descriptor names the borrowing routine (giveBorrowingRecordsTheirVTables).
• Docs: the rc design doc (§9.31) records the move.

DefaultLib

No source change is needed: none of its C++ reads an interface's layout. I rebuilt it locally with this compiler for gc, rc, none and own (release), and ran its tests.ps1 (compile + JIT):

Model	Result
gc	167/167
rc	166/167 (weakref_basic is gc-only, skipped)
none	166/167 (weakref_basic is gc-only, skipped)
own	61/167

All 105 own failures are compile-time refusals ("-mm=own cannot prove..."). The pre-#665 compiler in the main checkout gives the same first error on every one, so the change didn't cause them. There are no run errors.

Tests

• New test: 00interface_type_tag_in_vtable.ts, registered as compile + JIT, plus the rc/none corpus. It covers a class, a subclass, an object literal, a cast to an interface the value's type doesn't extend, a copy whose original is given null, and dropping a null interface. Each object is reached only through interfaces, and churn() reuses freed blocks before the field reads.
• Tooth: with the retain through the tag skipped, the test fails under rc at its first field check (assertion failed: a class object's field).
• Windows ctest -C Release: 5408/5408 passed.
• WSL (Release, ninja -j 4, ctest -j 8): 5396/5396 passed.

Not in this PR

let n: J | null = i where i: I | null and I does not extend J is a plain copy: I's vtable is used as J's with no remap, so n.id reads a method slot as a field offset and crashes. It fails the same way before this change. It is the I | null sibling of #665's C | null → I | null and needs its own fix.

🤖 Generated with Claude Code