[ASDAlexander77]

Summary

Phase 8 of -mm=own (spec §23): a built-in, counted Shared<T> for graphs a tree of single owners cannot express (a node in two lists, a DAG, a parent link).

• Shared<T> is !ts.shared<T>, a handle to a heap block holding the count and one T. Its ops are ts.SharedNew, ts.SharedValueRef (s.value is a ts.Load of it) and ts.SharedCount. Members: new Shared(x), .value read and write, ===/!==, Shared.count(s) (-1 under gc and none). A program's own Shared wins.
• The same program under every model. gc and none never count. rc counts the handle as it counts every block. Own counts this type and no other: the inference pass steps aside for every retain and release of a handle, so a handle's count is exactly rc's.
• A handle, widened during review, is a Shared<T>, an optional of one, or a union of Shared members with members that own no heap (Shared<T> | null | number). Under own, a Shared<T> in a union with an owning member (Shared<T> | string) is rejected with a named error.
• §23.3, reading through a handle. Two handles may reach one block, so a borrow read through a handle ends at any of these:
  • the handle's own release or overwrite;
  • any write through any handle, whatever its element type;
  • a push or unshift through a handle, inline or in a callee;
  • a call that may drop.
• A handle read out of a place is a borrow of the place unless every use of it is one rc counts. Every use is classified and a use not known to count is a borrow (Ruling 9): a counted use is a receiver with rc's retain for that very use (a store, a return, a push or unshift, new Shared, an array literal's element, an any box, or an owning local's slot); a cast or view that is still a handle, a merge or a local that owns nothing passes it on; anything else (a call argument, a tuple's element, an object literal's field, a capture, a yield, any other op) is a borrow. f(p, p.child), with f overwriting p.child, is rejected under own, and so are f(p, q, q.child = p.child), { s: (q.child = p.child) } and [(q.child = p.child), 1], where one use is counted and the other is not. cur = cur.value.next is counted, so walking a graph is not restricted, and Shared.count(q.child = p.child) is legal.
• A handle global takes over its initializer's reference through any view of its type (Shared<T> | null, Shared<T> | undefined, a union), from new Shared(..) or from a call, so it is born holding one count under rc and own. A handle read out of a field or an element (holder.child, new P().child, mkArr()[0]) carries no reference, and the global takes a count of its own.
• any: a handle boxes under its own descriptor (typeof "object"), and unboxes through a checked ___unbox.
• Cycles leak, as under rc.

Spec §23.7 records the results. The plan is docs/superpowers/plans/2026-10-03-own-shared.md.

Measured (AOT, measure.ps1, MB)

program	iterations	gc	rc	none	own
a leaf in two arrays	20000	5.9	4.4	10.6	4.4
a leaf in two arrays	200000	5.9	4.4	65.9	4.4
a two-node cycle	200000	5.9	35.2	35.2	35.2

Corpus and IR

• --emit=llvm -mm=own --no-default-lib over test/tester/tests gives 453 / 593 plain and 451 / 593 with --opt. That is the same set of files, with the same first errors, as main.
• The LLVM IR of the 453 files that compile is identical to main's for 451 of them, after §22.7's normalisations. The other two (00union_null_undefined_nonstrict and 00union_bin_ops2) flip a union's member order between runs of main itself. Each binary gives the same two outputs.
• Rerun after the final review's fix round: the same 453 / 451 files with the same first errors, and all 453 IR files identical to main's (both flipping files came out in main's order in that run).
• Under -mm=rc, 50 files were compared: 49 are identical, and 00union_bin_ops2 flips the same way.
• Rerun after the second fix round: the same 453 / 451 files with the same first errors. Under own, 451 of 453 IR files are identical to main's; 00union_null_undefined_nonstrict and 00funcs (a third flipper of the same kind, ___cast<!ts.union<si32, !ts.boolean>,…>, which flips in main too: 11 and 1 over 12 runs) came out in main's other order. Under rc, 49 of 50, 00union_bin_ops2 again.
• Spot check after the third fix round: 40 corpus files under own and rc against main's binary. All 70 that compile are identical; the other ten fail under own on both binaries with the same first error.
• Spot check after the fourth fix round: another 40 files, the same way. 66 of the 67 that compile are identical; the other is 00union_bin_ops2, main's other output (under rc in one run, under own in the rerun; main gives it 1 run in 10). The 13 that fail fail on both binaries with the same first error.

Tests

• Positives run under gc, none, rc and own, AOT and JIT: own_shared_basic, own_shared_user_named, own_shared_graph, own_shared_containers, own_shared_cycle, own_shared_union, own_shared_global, own_shared_unlink, own_shared_global_init, own_shared_place_two_uses and own_shared_global_field. The last five drop the only other owner, reuse its memory, and then read through the handle that is left. own_shared_global_init covers a Shared<T> | undefined global from new Shared, let and const Shared<T> | null globals from a call, an explicit cast of a call's result, and Shared<T> | undefined and Shared<T> | number from a call, each asserting its count of 1. own_shared_global_field covers globals from holder.child (count 2), new P().child, mkP(..).child and mkArr(..)[0] (count 1).
• own_shared_count runs under rc and own. It asserts every count, including a generator over a handle parameter, handles copied inside a generator, and a generator that reads its handle after the caller has replaced its own and the memory is reused.
• --verify-ownership is quiet on the eleven counted files under own and rc.
• Negatives:

test	message
own_err_shared_borrow_write	'n' borrows 'a.value' but is used here after it may be released or overwritten
own_err_shared_borrow_call	the same, after a call that may drop
own_err_shared_borrow_push	'first' borrows 'a.value.items[]' but is used here after …
own_err_shared_borrow_push_call	… borrows 'a.value' but is used here after … (push in a callee)
own_err_shared_borrow_other_type	the same, for a write through a Shared<Base> alias
own_err_shared_borrow_reassigned	the same, after the handle itself is reassigned
own_err_shared_moved_in	is used here after its value was moved
own_err_shared_union_owned	a Shared<Node> in a union with 'string', which -mm=own does not count, is not supported
own_err_shared_place_arg	'this value' borrows 'p.child' but is used here after … (f(p, p.child), f overwriting p.child)
own_err_shared_place_two_uses	'this value' borrows a field but is used here after … (f(p, q, q.child = p.child), f overwriting both fields)
own_err_shared_place_literal	'this value' borrows a field and cannot be stored, returned or captured ({ s: (q.child = p.child) }, then both fields overwritten)
own_err_shared_place_tuple	'this value' borrows a field and cannot be stored, returned or captured ([(q.child = p.child), 1] in a const tuple, then both fields overwritten)

• Full Windows Release suite: 3630/3631 at d636eb82; the one failure is test-compile-gc-defaultlib-collector, the known local LNK2005 against the stale installed default library (fails on main the same way).
• Windows Release: the Shared set passes 126/126. ctest -R own passes 616/616, and ctest -R "own|rc" passes 1570/1570.
• Linux (GCC, WSL): with the fourth round applied to ceedafa5 as a patch, the build has no errors, and ctest -R "own_shared|own-err|own-no-counting|own-verify|verify-ownership-own_shared" passes 267/267, the same count as on Windows. (Before the fix rounds: 213/213 at bbac9ba8; after the first: 234/234 at fad98c53; after the second: 255/255, its changes applied to 476c4d8f; after the third: 266/266 at 3a86e20d.)
• Teeth: each §23.3 rule has a negative that compiles once that rule is switched off. Without the step-aside, the own positives fail to compile. Without the payload release, own_shared_count fails. Each fix of the final review's four rounds has its own tooth. The full table is in §23.7.

The final review's fix round

The final review found three critical defects and one important one, all fixed here:

• A global handle was born at count 0 under own (moveIntoGlobals erased its retain), and a Shared<T> | null global from new Shared gave back its initializer's reference under rc and own. Test: own_shared_global. This round fixed only a cast of new Shared; the second round fixed the rest (below).
• A const of a union or optional handle was folded, holding no count and getting no check: unlinking a list node read freed memory. Every handle const now has storage. Test: own_shared_unlink.
• A handle read out of a place and given to a call was neither counted nor checked. It is now a borrow unless rc counts it. Test: own_err_shared_place_arg.
• A generator over a handle parameter was falsely rejected under own. It now compiles, and its box owns the handle's count. Test: own_shared_count.

The second fix round

The re-review found the global fix partial and one new important defect, both fixed here:

• A handle global initialised through a view other than a cast of new Shared - Shared<T> | undefined = new Shared(..), Shared<T> | null = mk() (let or const), <Shared<T> | null>mk() - was still born at count 0: own read garbage and crashed, rc printed count 0. OwnedReturnConsumptionPass now claims the reference through any view, once a call's result is known to carry one (MLIRGen cannot see that). Keyed on the global's type. Test: own_shared_global_init.
• One counted use exempted the whole read, so f(p, q, q.child = p.child), with f overwriting both fields, compiled under own and read freed memory. The exemption is now per use (Ruling 7): the counted uses are a copy, the other use is tenure-checked, and the counted store's own release of the old value is not a drop of the read. Tests: own_err_shared_place_two_uses, own_shared_place_two_uses.
• A generator that outlives its caller's handle is now asserted in own_shared_count.

The third fix round

The second re-review found one more important defect and an understated limit, both fixed here:

• Any store of a handle read counted as a counted owner, so in const o = { s: (q.child = p.child) } the object literal's field, which rc makes no retain for, kept the read with no count, and own crashed once both fields were replaced. A store now counts only when rc retained for it (ts.Retain, then the store, with or without the old value's ts.ReleaseSlot between), and one it did not makes the read a borrow. Test: own_err_shared_place_literal.
• A handle global initialised from a field (holder.child, new P().child, mkP().child) was born at count 0 and crashed under rc and own; A global initialized from another global reads garbage (heap-typed globals; crash with a class) #446 hides only the global-from-global case. The global claim now gives a handle read out of a field or an element a retain of its own, right after the read. Keyed on the handle type. Test: own_shared_global_field. The class equivalents read freed memory under rc on main as well and are not changed.

The fourth fix round

The third re-review found one more important defect of the same kind, fixed here:

• A use outside both lists fell through. handleReadUses let a use that was neither a counted receiver nor in isBorrow's list count for nothing either way, so in const t: [Shared<T>, number] = [(q.child = p.child), 1] (and with as const, or a Shared<T> | null element) the counted store exempted the read, the tuple kept it with no count, and own crashed once both fields were replaced. The default is inverted (Ruling 9): every use is classified, a receiver counts only with rc's retain for that very use (push, unshift, new Shared and a return now need theirs too, and an array literal's element is now a receiver with its retain), and anything else is a borrow. A return (a store into the result slot after the scope exit's releases) and an any box are classified before they would be passed on. Test: own_err_shared_place_tuple. Three probes that compiled before are now rejected as conservative (below).

Known limits

Every limit in §23.7's "Outside the rule":

• Covariance. Shared<Derived> can be assigned to Shared<Base>, which is TypeScript's own unsoundness and is not fixed. Under own, any write through any handle ends every borrow.
• Conservative rejections (false errors, never miscompiles):
  • a function that gives back a handle loses __own_no_drops, so a call to it ends its caller's borrows;
  • a getter returning s.value;
  • a write through a handle of an unrelated type ends borrows through every handle;
  • a push or unshift through a handle ends element borrows, inline and in a callee;
  • a handle read out of a place and given straight to a call that may drop, even when the callee retains it first: with p a parameter, keep(k, p.child). Copying it into a local first is accepted;
  • one read with a counted use and a use given to a call that may drop, even when the counted owner keeps the block: f(p, k = p.child), with k an owning local. k = p.child; f(p, k) is accepted;
  • using r = …; return p.child: a scope exit split across blocks hides the return's retain from the check, so it is rejected (it compiled before the fourth round);
  • one read with a counted use whose value also goes into a tuple, whether or not anything drops it: [(q.child = p.child), 1] with no drop after it, and const [a, n] = [(q.child = p.child), 1] (both compiled before the fourth round). const x = p.child; const t = [x, 1] is accepted;
  • a generator over a handle parameter and another parameter that holds a block, that reads the handle;
  • a generator function expression capturing a local handle, as for any local.
• The any unbox checks only the typeof name, so a Shared<B> passes as a Shared<A>. A wrong-type unbox cannot be asserted in a test (A let in try whose initializer throws is not caught (stack overflow / uncaught exception) #456).
• Through null. Shared.count(u) and u.value on an un-narrowed Shared<T> | null read through null.
• Misused names (Shared.foo(s), a bare Shared) report only "failed statement"; another member gets the generic "Can't resolve property"; a program's own Shared leaves one dead op behind.
• A rejected mixed union also reports own's ordinary error after the named one.
• The union check builds its MLIRTypeHelper with a default CompileOptions.
• rc is no oracle for borrows: rc runs the use-after-free shapes own rejects.
• No count is elided under own yet.
• A bare { } block does not end a folded const boxed: any = h.
• A handle returned from an imported function is counted one extra under rc and own (no __owned_result on the importer's call); classes leak the same way. No test.
• A handle global initialised from another global takes no count of its own. Today such an initializer does not read the other global's value in any model (A global initialized from another global reads garbage (heap-typed globals; crash with a class) #446), which hides it. A global object literal holding a handle from a call (let o = { s: mkS(4) }) gives the call's reference back and crashes under rc and own; its class equivalent reads freed memory under rc on main.
• An owning local initialised through a view of its type (let b: Shared<T> | undefined = new Shared(..)) holds two counts until the end of its block, where the initializer's reference is given back: Shared.count reads one high there. Balanced, not a leak.
• Not tested: a generic function f<T>(s: Shared<T>).

Issues filed (pre-existing, every model)

• push onto an array parameter is lost to the caller (stale length/data under gc; crash under rc) #453: a push onto an array parameter is lost to the caller.
• -mm=rc: const b = a (a let of a class) takes no reference; reassigning a frees what b holds #454: under rc, const b = a of a let class value takes no reference.
• Casting a Node | null value to any crashes the compiler (every model) #455: Node | null cast to any crashes the compiler.
• A let in try whose initializer throws is not caught (stack overflow / uncaught exception) #456: a let in try whose initializer throws is not caught.
• A throw in a try that declares a class-typed let is not caught (crash in every model) #457: a throw in a try that declares a local crashes.
• Unbraced else whose body is a for-of over a generator, inside a loop: operand does not dominate this use #458: an unbraced else whose body is a for … of over a generator, inside a loop: "operand does not dominate this use".
• -mm=rc/own: a Node | null global initialised from a call is freed at start #459: a union global of a class (let G: Node | null = mk()) is freed at initialisation (fixed for handle globals only).
• -mm=rc: { s: p.child } takes no reference; overwriting p.child frees what the literal holds #460: under rc, { s: p.child } takes no reference.
• -mm=rc/own: a global object literal { s: mk() } is freed at start #461: under rc and own, a global object literal { s: mk() } is freed at initialisation.
• Global T | null | undefined initialised from a T | undefined call: 'ts.Global' op expects region #0 to have 0 or 1 blocks #462: a global T | null | undefined initialised from a T | undefined call fails to compile (ts.Global region).
• Not filed: <Shared<T> | string>a is a compile error in every model; a global initialised by a conditional (let x = on() ? 1 : 2) is a compile error in every model; a discarded arr.pop() does not give back the element it removes (rc and own alike).

🤖 Generated with Claude Code