[ASDAlexander77]

Fixes fuzzer bugs A1 (local, parameter and local-field forms) and R8 (#646) under rc.

s += f(n, (n = mk(3), n), ..);           // A1: n is freed before f runs - SIGSEGV
s += f(h.n, (h.n = mk(4), h.n), ..);     // A1, a local's field
f1(n8, n8.items[0]);                     // R8: f1 does `p2.items[0] = mv(4)`, then reads p3

Why

Arguments are borrowed. In both shapes the place an argument was read from is overwritten while the call still uses it:

• A1: a later argument of the same call assigns it. rc: hold a global argument from its read, and give a const read of a global a count #647 covered a global, but a local or a local's field was still released before the call ran.
• R8: the callee is given the object too, and overwrites the field or element through that other parameter.

Fix (rc only)

holdGlobalArguments now also holds:

• an argument read from a slot or a place that something between the read and the call overwrites (a ts.Store or ts.ReleaseSlot to the same place; a new helper samePlace compares one variable, one global, or one field of one value);
• an argument read from a field or an element of a value passed as another argument of the same call.

The overwrite check walks out through the fields and elements the argument was read through (follow-up commit 10b6e91). So f({ v: n.v }, (n = mk(), 0)) and f(n.items[0], (n = mk(), 0)) are held as well: there the later argument gives back the object the argument was read out of. The fuzzer found these past its first 1000 programs, and localsFieldInLiteral and localsElement in the test cover them.

As with the global hold (#647/#648), it is retained where it is read and released after the call.

Tests

tests/00argument_place_overwritten.ts covers:

• a local given before an argument that assigns it, once and in a loop
• a parameter given the same way
• a class field given the same way
• an element, and a field, passed with their object and overwritten through it

On Linux main, the local, field and R8 cases each fail on their own. The parameter case already passes on main and is kept as coverage. The test runs compiled, under JIT, and in the rc/none corpus.

Verification

• ctest -C Release: Windows 4982/4982, WSL Linux 4964/4964.
• After merging main (rc: a new array given straight to a call is held across it #649, own: compile the ray tracer under -mm=own #655): Windows 5278/5278. The conflict with rc: a new array given straight to a call is held across it #649 was in the hold loop: both checks are kept, the new-array check first.
• Replaying the fuzzer's repros on Linux: A1-local and R8 now match gc under rc. A1-local and A1-global-own still crash under own, which is left to own-raytrace.
• mm_fuzz.py run --count 500 --seed 1 and --count 1000 --seed 2: no rc failures. Seed 2 had 5 rc A1 failures before this change. Only the known own failures remain (R1, O4, A1 own).

🤖 Generated with Claude Code