Build reference-count elision: skip the retain and drop for a proved move

When a reference-typed variable's last use hands it to a call, spawn, or aliasing
copy that consumes it, the retain there and the variable's own drop are both
elided: the consumer takes over the single reference. The decision is per site
(a variable used at several places is still retained at the earlier ones) and
per variable for the drop.

Soundness conditions, conservative so it can only under-elide, never over-elide:
the use must be the variable's last real use (loop-aware, since a loop-carried
variable is live across the back-edge), the variable must appear exactly once at
the move site (passing it twice hands the callee several references), and it must
have a single drop that the move dominates (approximated by no control flow
between the move and the drop). When any condition is unmet the reference
counting stays.

Two unsound attempts were caught by the leak and memory-safety tests during
development: skipping the retain per variable rather than per site (freed a value
still used at a later call), and treating a value passed twice in one call as a
single move (under-referenced it). Both are fixed and pinned by the existing
suite. Measured effect on the http hello path: incref 102 to 81 and decref 172 to
151 per request, memory-safe, all suites and goldens green in both fold modes.

Author: Axmouth

solid-snake-compiler/src/bytecode_gen.rs

@@ -577,6 +577,109 @@ fn for_each_stmt_read(stmt: &TypedIRStmt, f: &mut impl FnMut(usize)) {
     }
 }
 
+/// Each variable whose reference is moved into a call, spawn, or aliasing copy that consumes it,
+/// mapped to the instruction index of that move. The retain is elided only at that move site (a
+/// variable used at several sites is still retained at the earlier ones), and the variable's own drop
+/// is elided (it was consumed). Conservative and sound: the move must dominate the drop, approximated
+/// by a single drop with no control flow between the move and it (a straight-line consumed value), and
+/// it is loop-aware (a variable carried into a loop is live across the back-edge, never a move). When
+/// it cannot prove a move it keeps the reference counting. See plans/PROFILING.md.
+fn elidable_moves(ir: &[TypedIRInstruction]) -> HashMap<usize, usize> {
+    let last = last_real_use(ir);
+    let loops = loop_ranges(ir);
+    let mut defs: HashMap<usize, Vec<usize>> = HashMap::new();
+    let mut drops: HashMap<usize, Vec<usize>> = HashMap::new();
+    for (i, instr) in ir.iter().enumerate() {
+        if let Some(v) = stmt_def_var(&instr.kind) {
+            defs.entry(v).or_default().push(i);
+        }
+        if let TypedIRStmt::Drop { target, .. } = &instr.kind {
+            drops.entry(target.id()).or_default().push(i);
+        }
+    }
+    let is_movable = |v: usize, i: usize| -> bool {
+        if last.get(&v) != Some(&i) {
+            return false;
+        }
+        for &(start, end) in &loops {
+            if start <= i && i <= end {
+                let defined_in_loop = defs
+                    .get(&v)
+                    .is_some_and(|ds| ds.iter().any(|&d| start <= d && d <= i));
+                if !defined_in_loop {
+                    return false;
+                }
+            }
+        }
+        true
+    };
+    // A branch or jump between the move and the drop means the move may not dominate the drop (the
+    // drop could be reached on a path that skips the move), so the value stays counted.
+    let control_flow_between = |m: usize, d: usize| -> bool {
+        ir.get(m + 1..=d).is_some_and(|slice| {
+            slice.iter().any(|ins| {
+                matches!(
+                    ins.kind,
+                    TypedIRStmt::Jump { .. }
+                        | TypedIRStmt::JumpIf { .. }
+                        | TypedIRStmt::JumpIfNot { .. }
+                        | TypedIRStmt::Label(_)
+                )
+            })
+        })
+    };
+
+    // Candidate (moved-from variable, is_rc, retain-site index), collected before deciding so the
+    // decision reads the fully-built def/drop maps.
+    let mut candidates: Vec<(usize, bool, usize)> = Vec::new();
+    for (i, instr) in ir.iter().enumerate() {
+        match &instr.kind {
+            TypedIRStmt::Assign {
+                value: TypedIRExpr::Var(src),
+                ..
+            } => candidates.push((src.id(), is_rc(src.typ()), i)),
+            TypedIRStmt::Call { args, .. } => {
+                for a in args {
+                    candidates.push((a.id(), is_rc(a.typ()), i));
+                }
+            }
+            TypedIRStmt::CallBuiltin {
+                builtin: Builtin::CtxNew,
+                args,
+                ..
+            } => {
+                for (idx, a) in args.iter().enumerate() {
+                    if idx > 0 {
+                        candidates.push((a.id(), is_rc(a.typ()), i));
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+
+    // How many times each variable is a retain candidate at a given instruction. A variable passed
+    // more than once in one call (`f(a, a)`) hands the callee several references and is not a single
+    // move, so it must stay counted.
+    let mut occurrences: HashMap<(usize, usize), usize> = HashMap::new();
+    for &(v, _, i) in &candidates {
+        *occurrences.entry((v, i)).or_insert(0) += 1;
+    }
+
+    let mut elidable: HashMap<usize, usize> = HashMap::new();
+    for (v, is_rc_v, i) in candidates {
+        if !is_rc_v || occurrences.get(&(v, i)) != Some(&1) || !is_movable(v, i) {
+            continue;
+        }
+        if let Some(ds) = drops.get(&v) {
+            if ds.len() == 1 && ds[0] > i && !control_flow_between(i, ds[0]) {
+                elidable.insert(v, i);
+            }
+        }
+    }
+    elidable
+}
+
 /// Classify one function body's retains into elision categories. Read-only, mirrors the retain rules
 /// in `lower_body`/`lower_expr_to_bytecode_stage_one`.
 pub fn analyze_rc_elision(ir: &[TypedIRInstruction]) -> RcElisionReport {
@@ -983,21 +1086,30 @@ fn lower_body(
         }
     }
 
+    // Variables whose reference is moved into a consumer, so their retain and drop are both elided.
+    let elidable = elidable_moves(ir);
+
     for (idx, ir_instr) in ir.iter().enumerate() {
         match &ir_instr.kind {
             TypedIRStmt::Assign { target, value } => {
                 let (reg, instrs) = get_var_register(target.id(), reg_alloc)?;
                 instructions.extend_from_slice(&instrs);
                 let instrs = lower_expr_to_bytecode_stage_one(value, reg, reg_alloc, constants)?;
                 instructions.extend_from_slice(&instrs);
-                // Aliasing (`q = p`) creates another reference to the same value.
-                if matches!(value, TypedIRExpr::Var(_)) {
-                    emit_retain(target.typ(), reg, &mut instructions);
+                // Aliasing (`q = p`) creates another reference to the same value, unless the source is
+                // moved here (its last use), in which case `q` takes the reference and no retain is
+                // needed.
+                if let TypedIRExpr::Var(src) = value {
+                    if elidable.get(&src.id()) != Some(&idx) {
+                        emit_retain(target.typ(), reg, &mut instructions);
+                    }
                 }
             }
             TypedIRStmt::Drop { target, .. } => {
-                // Releasing a reference at end of life, freeing the object at zero.
-                if is_rc(target.typ()) {
+                // Releasing a reference at end of life, freeing the object at zero. A moved variable
+                // was consumed at its last use, so its reference is already gone and its drop is elided
+                // (the register is still freed below).
+                if is_rc(target.typ()) && !elidable.contains_key(&target.id()) {
                     let (reg, instrs) = get_var_register(target.id(), reg_alloc)?;
                     instructions.extend_from_slice(&instrs);
                     emit_release(target.typ(), reg, &mut instructions);
@@ -1051,8 +1163,12 @@ fn lower_body(
                     instructions
                         .push(UnprocessedInstruction::MoveU64((arg_reg.into(), reg.into())));
                     // The callee owns its parameters and drops them, so an argument gets an extra
-                    // reference here to balance that drop.
-                    emit_retain(arg.typ(), reg, &mut instructions);
+                    // reference here to balance that drop, unless the argument is moved into the call
+                    // (its last use), in which case the caller hands over its reference and skips both
+                    // this retain and the argument's drop.
+                    if elidable.get(&arg.id()) != Some(&idx) {
+                        emit_retain(arg.typ(), reg, &mut instructions);
+                    }
                 }
                 instructions.push(UnprocessedInstruction::CallFn((func_id,)));
                 // The return value comes back in R0.
@@ -1121,7 +1237,10 @@ fn lower_body(
                         // reference arguments (its own return-path drops release them), so they
                         // get the same extra reference an ordinary call's arguments do. Argument
                         // zero is the function id, never a reference.
-                        if *builtin == Builtin::CtxNew && i > 0 {
+                        if *builtin == Builtin::CtxNew
+                            && i > 0
+                            && elidable.get(&arg.id()) != Some(&idx)
+                        {
                             emit_retain(arg.typ(), reg, &mut instructions);
                         }
                     }