[mypyc] Fix memory leak when borrowing property getter return values

`is_native_attr_ref()` decides whether an attribute access can safely
use a borrowed reference (skipping DECREF). It used `has_attr(name) and
not get_method(name)` — the idea being: if there's an attribute but no
method, it's a struct field (safe to borrow).

However, `has_attr()` checks both `ir.attributes` (struct fields) and
`ir.property_types` (properties), and is populated during the
preparation phase (always complete). `get_method()` checks `ir.methods`,
which is populated during the compilation phase, one module at a time.

When modules within an SCC are compiled in nondeterministic order (set
iteration of `scc.mod_ids`), `ir.methods` may not be populated for a
cross-module class yet. `get_method()` then returns None for a property
getter that hasn't been compiled, causing `is_native_attr_ref` to
incorrectly return True — treating the property as a plain struct field.

Property getters are method calls that return new owned references (the
getter INCREFs before returning). Marking the result as borrowed skips
the DECREF, leaking one reference per call.

The fix checks `ir.attributes` directly (struct fields only, always
populated during preparation) instead of the unreliable `has_attr()` +
`not get_method()` combination. Properties are never in `ir.attributes`,
so they will always correctly return False.

Note: the underlying issue is that modules within an SCC are compiled in
nondeterministic order, and `ir.methods` is not populated until a
module's function bodies are compiled. Any code that reads `ir.methods`
during compilation of a different module in the same SCC could have
similar order-dependent bugs.

Author: VaggelisD

mypyc/irbuild/builder.py

@@ -1467,8 +1467,7 @@ def is_native_attr_ref(self, expr: MemberExpr) -> bool:
         return (
             isinstance(obj_rtype, RInstance)
             and obj_rtype.class_ir.is_ext_class
-            and obj_rtype.class_ir.has_attr(expr.name)
-            and not obj_rtype.class_ir.get_method(expr.name)
+            and any(expr.name in ir.attributes for ir in obj_rtype.class_ir.mro)
         )
 
     def mark_block_unreachable(self) -> None:

mypyc/test-data/run-classes.test

@@ -6000,3 +6000,47 @@ class InterpGrand(Child):
 ig = InterpGrand(5, 3)
 assert ig.overridden() == -1
 assert ig.calls_overridden() == 0  # -1 + 1
+
+[case testPropertyGetterLeak]
+class Bar:
+    pass
+
+class Foo:
+    def __init__(self) -> None:
+        self.obj: object = Bar()
+
+    @property
+    def val(self) -> object:
+        return self.obj
+
+[file other.py]
+import gc
+from native import Foo, Bar
+
+def check(foo: Foo) -> bool:
+    return isinstance(foo.val, Bar)
+
+def test_property_getter_no_leak() -> None:
+    foo = Foo()
+    gc.collect()
+    before = gc.get_objects()
+    for _ in range(100):
+        check(foo)
+    gc.collect()
+    after = gc.get_objects()
+    diff = len(after) - len(before)
+    assert diff <= 2, diff
+
+test_property_getter_no_leak()
+
+[file driver.py]
+import sys
+from other import check
+from native import Foo
+
+foo = Foo()
+init = sys.getrefcount(foo.obj)
+for _ in range(100):
+    check(foo)
+after = sys.getrefcount(foo.obj)
+assert after - init == 0, f"Leaked {after - init} refs"