FA-90372 / Garbage collector invariants / Member archive

Reference counting: destroying an object leaks its children · case 02

Objects reachable only from a destroyed object keep positive counts forever.

Member previewVariant 2 · 3 implementations · 7 checks per implementation

Case contract

Objects carry a strong count and a weak count. new id k: strong 1 (the creating reference), k null fields. drop id: release one strong reference. store src i dst: retain dst, then write, then release the old value. When the strong count reaches 0 the object is destroyed (recorded in freed, its fields released recursively in field order) and, if no weak references remain, its control block is deallocated too; unweak deallocates a destroyed object's block when the last weak reference goes. upgrade id succeeds (and adds a strong reference) only while the strong count is positive. Touching a deallocated block reports "use-after-free".

Why this case matters

Reference-counting collectors must order retains and releases and separate destruction from deallocation.

One recorded failure

Sample boundary fixture

This sample comes from the broken implementation of a controlled reproducer.

Boundary fixture	Actual	Expected	Outcome
regression: overwrite with a child of the old value	`{"dealloc": [22], "freed": [22], "out": [], "rc": {"21": [1, 0], "23": [2, 0]}}`	`{"dealloc": [22], "freed": [22], "out": [], "rc": {"21": [1, 0], "23": [1, 0]}}`	Failed

MEMBER ARCHIVE

The complete case is available to members.

This record includes three runnable implementations, regression fixtures, execution results, and source hashes.

Member access is invitation-based. Sign in with your invited account to inspect the sources.