[ASDAlexander77]

Fixes fuzzer bug R6 (#646): a break, continue or return out of a try, when the finally reads a const of the enclosing block.

for (..) {
    const v = mv(6);
    try { if (c) continue; } finally { s += v.get(); }   // SIGSEGV / 0xC0000374
}

Why

const v = mv(6) is a folded const: the call's result is named directly, with no slot. releaseDiscardedTemporaries releases it where its block ends, and before each break, continue or return that leaves the block early. That release ran before the finally the jump goes through, so the finally read a freed block. #600 fixed this for locals that live in slots (finallyGuardScope + mlirGenScopeExitAfterFinally), but folded consts are released by this pass instead, which knew nothing about finallys.

Fix

When a jump passes through a finally between it and the temporary's block, the release moves to the end of the outermost such finally (the last one the jump runs). It goes inside a ts.If true tagged for that jump (JUMP_ONLY_ATTR_NAME with break:/continue: + label, or RETURN_ONLY_ATTR_NAME). TryOpLowering already keeps such a group only in that jump's copy of the finally, so this reuses MLIRGen's scheme for slot locals. Jumps with the same key share one copy, so each gets one release. A jump that passes through no finally is unchanged.

The release moves even when no finally reads the temporary (follow-up commit 4d07298). A finally that leaves by a jump of its own (try { continue; } finally { break; }) never reaches the end of the finally, and the jump's own release is then the only one. Before, the temporary was released in front of the continue and again in front of the break. The fuzzer found this past its first 1000 programs, and jumpInFinally in the test covers it.

The pass runs in every memory model, so this also fixes the own forms of R6 (R6-minimal, R6-own, R6-call-in-finally crashed under own as well).

Tests

tests/00temporary_read_in_finally.ts covers:

• continue and break through a finally
• two continues through one finally
• a labelled continue through two nested finallys
• a return through a finally
• a call in the finally

It runs compiled, under JIT, and in the rc/none corpus, and it crashes under rc on Linux without the fix. The ownership verifier (--verify-ownership) reports no errors on it.

Verification

• ctest -C Release: Windows 4982/4982, WSL Linux 4964/4964.
• After merging main (rc: a new array given straight to a call is held across it #649, own: compile the ray tracer under -mm=own #655): Windows 5278/5278.
• Replaying the fuzzer's repros on Linux: all five R6 repros now match gc under rc and own. Disagreements went from 22 to 17.
• mm_fuzz.py --jobs 10 run --count 500 --seed 1: only the 3 known own failures (R1, O4).

🤖 Generated with Claude Code