Stale-read detectors for the surviving pools: ASan poisoning + make jit-checked (#1665)

[InauguralPhysicist]

Part of #1665: the detector items for the two recycling layers that stay (the NUM freelist and call-env recycling).

What it adds

• ASan whole-object poisoning (compiled only under __SANITIZE_ADDRESS__):
  • Parked NUMs are poisoned whole except the 8-byte freelist link. Under ASan only, the link moves from data+0 to data+8, so a stale read of the number is caught.
  • Parked call envs: values, names, assign_counts and the hash arrays are poisoned, plus the Env struct except parent, which vm_take_call_env reads to match the closure.
  • Poison is lifted on reuse, on take, by the collector walk (and put back afterwards) and in chunk_free.
  • All 29 release objects are byte-identical to the base build, checked with cmp.
• make jit-checked (EIGS_JIT_CHECKED):
  • Emitted GET_LOCAL, SET_LOCAL and LOCAL_DOT_GET/SET check that the cached values base still matches the frame env and that slot < count.
  • The EnvIC hit paths of GET_NAME and SET_NAME check slot < count.
  • A failed check aborts and names the read site.
  • Default emission is unchanged. A CI step runs the JIT-tier sections under this build.
• Section [0fg]: three planted stale reads (a parked num, a parked env slot, a parked env field) and a clean control.

Evidence

• Plants:
  • main's ASan: all three undetected (rc 0);
  • this build: all three reported as use-after-poison at the planted address;
  • the control passes clean.
• Mutation train: eight mutants, each removing one poison or unpoison site (GC unpoison/re-poison, take, pop, park, NUM park, chunk_free, link-word position). Each turns [0fg] red.
• Heap use-after-free: under-arity call leaves an unbound param slot that a GC cull frees (v0.45.0, minimal repro) #1661 revert under jit-checked: EIGS_JIT_CHECKED: local slot out of range (1 vs 1) at GET_LOCAL offset 5 in chunk 'g' line 6, rc 134, on all four reproducers at both JIT tiers. The release build with the same revert prints ok.
• Gates:
  • jit-smoke passes;
  • jit_diff passes on release and on jit-checked (256 programs);
  • JIT sections under jit-checked: 29/29;
  • ASan with leak detection: 448/448 over 34 changed sections plus 31/31 core sections, with no poison report and no leaks;
  • TSan: 57/57;
  • freestanding-check, werror_switch_check, suite labels and the changelog pass.
• CI runs the full release and ASan suites. The builder did not run them; it worked to a long-lane budget.

Caveats

• The ASan half of the Heap use-after-free: under-arity call leaves an unbound param slot that a GC cull frees (v0.45.0, minimal repro) #1661 re-run does not reproduce, by construction. Heap use-after-free: under-arity call leaves an unbound param slot that a GC cull frees (v0.45.0, minimal repro) #1661's stale slot came from the Env freelist, which Remove the Env freelist (#1665 arm C2) #1698 removed. With the fix reverted, the JIT reads a fresh zero-filled env, not a parked object. The call-env pool refuses underfed calls, so the class can only return if that guard is relaxed, and the new poisoning would then catch it.
• Filed from this work:
  • Call env of a one-statement callee (define f(a) as: return a) is never parked #1703: a one-statement callee's call env is never parked;
  • CI jit-checked lane has no positive control that proves it can go red #1704: the jit-checked CI lane has no positive control.
• [0ff] was taken by B0 (Slot-access API, rehearsal build and migration gate (#1665 arm D B0) #1702), so this section is [0fg].

Review

Built by a Claude builder after three Codex Cloud attempts ended in ERROR with no output. The builder's self-check (plants, mutation train and byte-identical objects) is the evidence above.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KC99CmwatKssQYggkBCgwF

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T14:52:42.429589Z	9206f2a	PR opened
🔒 Security Review	✅ Completed 2026-10-10T14:56:28.150748Z	9206f2a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codspeed]

Merging this PR will not alter performance

✅ 13 untouched benchmarks

---

_{Comparing detect-1665 (9206f2a) with main (515b151)}