FA-90373 / Garbage collector invariants / Member archive

Reference counting: destroying an object leaks its children · case 03

Objects reachable only from a destroyed object keep positive counts forever.

Member previewVariant 3 · 3 implementations · 7 checks per implementation

Case contract

Objects carry a strong count and a weak count. new id k: strong 1 (the creating reference), k null fields. drop id: release one strong reference. store src i dst: retain dst, then write, then release the old value. When the strong count reaches 0 the object is destroyed (recorded in freed, its fields released recursively in field order) and, if no weak references remain, its control block is deallocated too; unweak deallocates a destroyed object's block when the last weak reference goes. upgrade id succeeds (and adds a strong reference) only while the strong count is positive. Touching a deallocated block reports "use-after-free".

Why this case matters

Reference-counting collectors must order retains and releases and separate destruction from deallocation.

One recorded failure

Sample boundary fixture

This sample comes from the broken implementation of a controlled reproducer.

Boundary fixture	Actual	Expected	Outcome
regression: overwrite with a child of the old value	`{"dealloc": [32], "freed": [32], "out": [], "rc": {"31": [1, 0], "33": [2, 0]}}`	`{"dealloc": [32], "freed": [32], "out": [], "rc": {"31": [1, 0], "33": [1, 0]}}`	Failed

MEMBER ARCHIVE

The complete case is available to members.

This record includes three runnable implementations, regression fixtures, execution results, and source hashes.

Member access is invitation-based. Sign in with your invited account to inspect the sources.