[ASDAlexander77]

What

A new @record marker, written beside @lends. It says the result is a borrowing record (own spec 32): a box the caller owns that holds a borrow of each argument @lends names. Without it, @lends alone means a plain borrow of an argument. Another module sees only the declaration, so the marker is the only way it can tell the two apart.

@lends("a", "b")
@record
export function pairOf(a: Node, b: Node): Pair {
    return { a: a, b: b };
}

Why

Spec 32 documented a leak: "A declaration's @lends, seen from another module without its body, is a plain borrow: a record's box then leaks at that caller." The importer could not tell, and inferring record-ness from the result type, or from @lends naming several parameters, is not safe. A plain borrow of an interface argument looks the same, and a caller told it owns a record would free that argument, which is a double free rather than a leak.

How

• MLIRGen reads @record on functions and methods into ts.own_declared_record, a unit attribute. The declaration printer emits it after @lends, and the dynamic-import global carries it.
• Signature pass:
  • meetFacts gives a declaration's calls __own_result_record when the declaration says @record.
  • calleesDeclare does the same for a call nothing resolves.
• OwnedReturnConsumptionPass: under own, a call whose callee declares @record gets an owned result (calleeDeclaresRecord). The callee may be named directly, read through a dynamic import's global, or called as a method. This half is what closes the leak. MLIRGen never treats an imported call's result as owned, so before this change the importer emitted no release of the box at all.
• checkDeclared, in the defining module:
  • @record without @lends is an error.
  • @record on a body that returns its argument as it is, is an error.
  • An exported function of a library (a module that is not an executable) whose body returns a record must say @record. A function no other module calls does not need to: its callers go by its body.
  • An override must say the same @record as what it overrides; the pinned message of own_err_marker_override now lists @record.
• Spec 32 is updated.

Tests

• export_own_record / import_own_record run with -shared under gc, rc and own, covering both a function and a method that return records.
• import_own_record_outlives checks that reading the record after an argument it borrows is reassigned is still refused.
• own-shared-record.cmake (Windows) checks that the importer's IR releases each Pair box. Before the consumption-pass change there was no release.
• New negatives: own_err_record_without_lends, own_err_record_not_record, own_err_record_exported_unsaid.
• own_lends.ts exports pairOf, a record function, so it now says @record. The DefaultLib uses no @lends.
• Full suite: Windows 5507/5507, Linux 5485/5485.

Not covered

A call to another module's method that isn't on the library's no-drops list counts as one that may free what the caller borrows. So in the importer, a record still can't be read across such a call. That is unchanged by this PR; import_own_record calls the function and the method in separate loops so the two don't interact.

🤖 Generated with Claude Code