Owned<T>: Func<Owned<T>> and nested Owned<T> share one accumulator → disposal leaks & cross-contamination

[ekalchev]

Rather than filing separate bug reports for each behaviour, I think the more useful contribution is a unit-test suite covering the common Owned scenarios. Tests are easier to read than prose, and they keep paying off as regression coverage long after this issue is closed.

The approach is differential testing: I use Autofac's Owned as the reference oracle — an implementation that has provided these semantics for years and is well proven in production — and assert Pure.DI against the same expected values. Where the two agree, we end up with an executable specification of what Owned should do; where they diverge, we get a precise, reproducible failing test. That should make it considerably easier to land a correct Owned implementation in Pure.DI, since every scenario already has a known-good target to code against.

Autofac is wired in only behind an AUTOFAC_REFERENCE compile symbol, so the suite carries no Autofac dependency by default. Happy to open a PR with it whenever that's useful.

Summary

The generated composition allocates a single Owned accumulator per composition-root resolution and reuses it for every Owned<T> created in that block, instead of giving each Owned<T> its own. Two consequences:

• The documented Func<Owned<T>> "unit of work" pattern leaks. When the factory is invoked more than once (e.g. a message pump), only the first Owned<T> is disposed; every later one is silently not disposed.
• Nested Owned<T> are not independent. Disposing either the outer or the inner Owned<T> disposes both graphs.

Reproduced building from current master (da274f04b), .NET 10. The Owned<T> accumulator code is long-standing, so released 2.5.x is very likely affected as well.

Repro 1 — nested Owned<T> are not independent

using System;
using Pure.DI;

var composition = new Composition();
Owned<IOuter> outer = composition.Root;
IInner inner = outer.Value.Inner;

outer.Dispose(); // dispose the OUTER Owned<T> only
Console.WriteLine($"inner disposed: {inner.IsDisposed}");

interface IInner { bool IsDisposed { get; } }

class Inner : IInner, IDisposable
{
    public bool IsDisposed { get; private set; }
    public void Dispose() => IsDisposed = true;
}

interface IOuter { IInner Inner { get; } }

class Outer(Func<Owned<IInner>> innerFactory) : IOuter
{
    private readonly Owned<IInner> owned = innerFactory();
    public IInner Inner => owned.Value;
}

partial class Composition
{
    static void Setup() => DI.Setup(nameof(Composition))
        .Bind().To<Inner>()
        .Bind().To<Outer>()
        .Root<Owned<IOuter>>("Root");
}

• Expected: inner disposed: False — the inner Owned<T> owns an independent lifetime; disposing the outer must not touch it.
• Actual: inner disposed: True.

(The reverse also holds: disposing the inner Owned<T> disposes disposables that belong only to the outer graph.)

Repro 2 — Func<Owned<T>> loop disposes only the first unit, leaks the rest

using System;
using System.Collections.Generic;
using Pure.DI;

var composition = new Composition();
IPump pump = composition.Pump;
pump.Process(3);

foreach (IConnection c in pump.Connections)
    Console.WriteLine($"disposed: {c.IsDisposed}");

interface IConnection { bool IsDisposed { get; } }

class Connection : IConnection, IDisposable
{
    public bool IsDisposed { get; private set; }
    public void Dispose() => IsDisposed = true;
}

interface IPump { IReadOnlyList<IConnection> Connections { get; } void Process(int count); }

class Pump(Func<Owned<IConnection>> factory) : IPump
{
    private readonly List<IConnection> connections = new();
    public IReadOnlyList<IConnection> Connections => connections;

    public void Process(int count)
    {
        for (int i = 0; i < count; i++)
        {
            using Owned<IConnection> owned = factory(); // begin+end a unit of work
            connections.Add(owned.Value);
        }
    }
}

partial class Composition
{
    static void Setup() => DI.Setup(nameof(Composition))
        .Bind().To<Connection>()
        .Bind().To<Pump>()
        .Root<IPump>("Pump");
}

• Expected: True / True / True — each using disposes its own unit of work.
• Actual: True / False / False — only the first is disposed. Connections 2..N are never disposed and stay referenced by the shared accumulator for the pump's lifetime (so it is both a resource leak and a memory leak).

Root cause

The generated root getter creates one perBlockOwned and the Func<Owned<T>> closure captures it; every invocation adds to and wraps that same accumulator (trimmed):

var perBlockOwned = new Pure.DI.Owned();                 // created ONCE
Func<Owned<IConnection>> factory = () =>
{
    // ...
    perBlockOwned.Add(transientConnection);              // every call -> same list
    perBlockOwnedIConnection = new Owned<IConnection>(value, /* IOwned = */ perBlockOwned); // same list
    perBlockOwned.Add(perBlockOwnedIConnection);
    return perBlockOwnedIConnection;
};
return new Pump(factory);

Combined with the Owned.Dispose() guard, which returns before the Clear():

public void Dispose()
{
    if (_isDisposed) return;   // after the first dispose this returns immediately
    _isDisposed = true;
    try { /* dispose items in reverse; nested IOwned are skipped */ }
    finally { Clear(); }
}

the first using disposes the accumulator and sets _isDisposed; every subsequent Owned<T> wraps that same, already-disposed accumulator, so its Dispose() is a no-op. The nested case is the same mechanism — the inner Owned<T> wraps the outer's accumulator.

Expected behaviour

Each Owned<T> should own an independent set of disposables (its own accumulator), so that disposing one Owned<T> never affects another, and a Func<Owned<T>> invoked N times yields N independently-disposable units of work. This is what Autofac's Owned<T> does (each is its own lifetime scope).

Evidence

I put together an Owned<T> behaviour-comparison suite (28 tests) that asserts Pure.DI against Autofac's Owned<T> as a reference implementation — 23 confirm parity and 5 document the divergences above. It's on a branch and drops into tests/Pure.DI.UsageTests (Autofac is behind an AUTOFAC_REFERENCE compile symbol, so the committed suite has no Autofac dependency):

https://github.com/ekalchev/Pure.DI/tree/owned-idisposable-autofac-parity/tests/Pure.DI.UsageTests/Owned

Happy to open a PR with these tests if that's useful.

[NikolayPianikov]

@ekalchev Yes, it would be easier to figure it out if there were tests not only for broken but also for working behavior in order to exclude regression. Thank you in advance

[ekalchev]

Thanks! That's exactly how the suite is built — it covers the working scenarios alongside the broken ones, specifically so the passing ones guard against regressions. I intentionally went wide to pin down what already behaves correctly, not just what's broken.

Of the 28 tests, 23 confirm behaviour that already matches the reference implementation — transient/singleton/scoped disposal, root isolation, diamond (shared) dependencies, disposal order, factory-created disposables, async disposal, and double-dispose idempotency — and 5 capture the divergences from this issue. They're all on the branch already; I'll open a PR so you have the complete set.

[NikolayPianikov]

@ekalchev Thanks a lot, I'll figure it out.

[NikolayPianikov]

As for Owned.Dispose():
The test expected Owned.Dispose() to propagate an exception thrown by a user-provided dependency while continuing to dispose the remaining resources. However, the official .NET dispose pattern recommends that Dispose() should not throw except in critical situations. A dependency that throws from Dispose() therefore violates the expected disposal contract.
For this reason, the current Owned behavior is intentionally not changed. Owned.Dispose() suppresses exceptions thrown by individual dependencies and continues disposing all remaining owned resources. This prioritizes deterministic cleanup and prevents one incorrectly implemented dependency from interrupting disposal of the rest of the object graph.

[NikolayPianikov]

As for the forgotten user Owned.Dispose()
This behavior is intentionally not changed. Creating Owned<T> transfers ownership and disposal responsibility to the caller. Tracking the returned graph in the composition as well would introduce two competing owners and retain already transferred resources until the composition is disposed. The caller must therefore dispose every Owned<T> handle it receives.