fix: memory-safety audit — container/record ownership + intern ref leak

[lang315]

What

Memory-safety audit of the gotk4 Go↔C marshaling generator and the hand-written pkg/core runtime. Four confirmed reference-counting bugs fixed, each pinned by a failing-first regression test, plus baseline benchmarks for the previously-unmeasured signal-dispatch hot path. GTK4 binding coverage re-verified at 100% (677/677 bindable types).

Every fix was driven adversarially: four parallel review agents (typeconv, pkg/core, girgen, perf), then a second /simplify pass (reuse, simplification, efficiency, altitude). Findings were verified against committed generated output before fixing.

Bugs fixed

1. Callback out-param GHashTable double-free / over-unref (cc72a81b0) — a hash table written to a vfunc out-parameter is created with g_hash_table_new_full(…destroy…), so the table owns its keys and values. The out-param-in-callback path computed ShouldFree()==true for the inners, emitting defer C.free on every key (double-free with the table's key-destroy) and skipping g_object_ref/g_variant_ref on values (over-unref when C destroys the table). New ConversionValue.OwnedByContainer forces ShouldFree false for container-owned inners. Manifested in gio MenuModel get_item_links / get_item_attributes.

2. Transfer-full refcounted records handed to C with no ref (cc72a81b0) — GVariant/GskTransform/PangoAttrList/… passed to C with transfer-full got neither a reference nor a finalizer detach, so the C consumer's unref raced the Go finalizer's unref (use-after-free). The Go→C record path now takes its own reference when C assumes ownership, mirroring the existing Class/Interface behavior.

3. Floating GVariant not sunk (cc72a81b0 + 3f644089f) — taking a reference on a received/passed record now prefers ref_sink over ref when available (both directions, after the /simplify altitude pass caught the Go→C side lagging). Identical to ref on non-floating instances; on a fresh g_variant_new_* result it claims the floating reference instead of leaving the flag set — matching what intern.Get already does for GObjects.

4. intern.Get leaks a ref on transfer-full return of an interned object (f4b4332ea) — Get(take=false) (glib.AssumeOwnership, every transfer-full return) did the reference-transfer unref only on the new-box path. Both already-interned paths returned early without it, permanently leaking one ref per repeated transfer-full get of the same object (e.g. every gio.ListModel.Item(i) on the same item) and pinning it strong forever — never reaching the toggle's is_last state, never finalized.

Plus 3d1ef525d: union CastBlock now imports runtime unconditionally (a field-less union with copy() generated runtime.SetFinalizer without the import — non-manifest in the 4.22 corpus, certain from the path).

Evidence

Regression tests fail on the pre-fix tree and pass after — verified by stashing each fix and re-running:

=== new generator pin tests (in-memory GIR fixtures, no system GIR) ===
--- PASS: TestCallbackOutParamHashTableOwnership   (fails pre-fix: spurious defer C.free)
--- PASS: TestRecordTakeRefPrefersRefSink          (fails pre-fix: plain g_variant_ref)
--- PASS: TestUnionRuntimeImport                   (fails pre-fix: runtime used, not imported)

=== intern refcount regression (reads real GObject ref_count via cgo) ===
--- PASS: TestGetTransferFullAlreadyInterned       (fails pre-fix: refcount 3, want 2)
--- PASS: TestGetTransferNoneAlreadyInterned

=== root module suite ===
ok  github.com/diamondburned/gotk4/gir/girgen
ok  github.com/diamondburned/gotk4/gir/girgen/generators
ok  github.com/diamondburned/gotk4/gir/girgen/strcases
ok  github.com/diamondburned/gotk4/gir/pkgconfig

=== GTK4 coverage guard ===
TOTAL: 677/677 bindable GTK4 types covered (100.00%)
--- PASS: TestGTK4Coverage

Bindings regenerated in the canonical Docker/Nix environment (GTK 4.22.4) and verified:

go generate                     rc=0   (all diff hunks are the intended ref/ref_sink additions)
go build -C pkg ./...           rc=0   (Linux, full tree, in Docker)
goimports -l pkg gir            (empty — clean)
go generate (2nd run)           rc=0, git status clean   (idempotent — passes CI git-dirty gate)
pkg/core + cairo + gota tests   green (macOS, brew GTK)
examples/telegram build         rc=0 (against regenerated bindings)

Also in this branch

• Baseline benchmarks for signal dispatch + GValue marshaling (f30294682) — the previously-unbenchmarked per-frame hot path. Confirms the intern layer is not a bottleneck (~23 ns/op, 0 allocs steady-state) and documents the reflect-path and G_TYPE_OBJECT double-marshal candidates as deferred behind a profile-first bar (repo's no-speculative-opt rule).
• /simplify pass (3f644089f) — deduped the generator-test harness (generateNamespace → delegates to generateNamespaceDeps), mirrored ref_sink to the Go→C direction, and documented the container-ownership rule + the deliberately-unfixed callback flip so the next maintainer doesn't "fix" it and regress the C→Go paths.

Not fixed (noted for follow-up)

Latent items the pinned corpus doesn't exercise, out of scope for this PR: GArray/GByteArray C→Go converters (no *_steal binding today), the toggle-ref resurrection race in intern (needs an atomic finalize/resurrection check — the area has a reverted-fix history), the slab once-path copy, and four girgen hardening items (constant-name sanitization, record field-getter dedup, filter regex anchoring). The InternObject(x).Native() double-compute is a pre-existing ~56-site generator idiom; this branch adds one line following house style rather than diverging.

🤖 Generated with Claude Code