[ASDAlexander77]

Fixes the rc regression the memory-model fuzzer (#646) reported as A2, bisected to #639. Its four repros turned out to be two bugs.

1. The hold was taken after a later argument freed the block (A2-global, A2-field)

holdGlobalArguments (#639/#643/#645) retained a global-read argument right before the call. A later argument of the same call can give that global a new value first:

s += f13(G, (G = mk(1), HG.n));
s += f2(HG.n, (HG.n = mk(8), HG.n));

The ReleaseSlot of that assignment freed the block the first argument had read. The hold then retained and released a freed block, a double free ("malloc(): unaligned tcache chunk detected", 0xC0000374). Now the retain, and #645's unwind-slot store, come right after the argument's read.

2. A const read of a global held no count (A2-callee, A2-callee-try; fuzzer R1)

const n = G was folded into the read itself. Once G got a new value, here or in a callee, n dangled. Before #639 that was a silent use-after-free. #639's hold on run(n.v) (with run assigning G) turned it into a double free. Under rc, a const read out of a global, or an interface or bound method made over one, now gets storage like a const read out of a field or an element (#635, #641, #642, #644). Under own the folded read stays a borrow.

This also fixes R1-own-minimal and R1-const-global under rc. R1 under own still crashes and is not touched here. The cost: under rc, a const of any global, even one that is never reassigned (const h = HG), now pays a retain/release pair, as the field and element cases already do.

Tests

• tests/00global_argument_reassigned.ts: a global and a global's field lent before an argument that assigns them, in a loop, and with a later argument that throws inside a try.
• tests/00const_global_read.ts: a const of a global reassigned here and in a call, a field of it lent to a call that assigns the global (in a loop, read in a finally), and an interface or bound method over a global.

Both run compiled, under JIT, and in the rc/none corpus. Without the hold move, 00global_argument_reassigned fails under rc on Windows too. Both crash under rc on main on Linux.

Verification

• The four A2 repros print what gc prints under rc on Windows and on Linux (MALLOC_PERTURB_). Under own, A2-global runs correctly and the other three are rejected.
• ctest -C Release: Windows 4970/4970, WSL Linux 4952/4952.
• mm_fuzz.py --jobs 10 run --count 500 --seed 1 on Linux found 10 failures. All 10 fail on main as well, and all 7 rc ones also crash on the JIT: find the GC runtime next to tslang, and say so when it is missing #633 base, so none is A2. The rc failures are A1's view variant: a global or a global's field lent through an interface or object-literal view (f({ v: G.v }, (G = mk(), x)), or HG.n as an IX parameter) and reassigned in a later argument. globalOf doesn't see through those views, so nothing is held. The 3 own failures are R1 (own) and O4.

🤖 Generated with Claude Code