[ASDAlexander77]

Fixes fuzzer bug R9 (#646), plus a broader shape found while reducing it.

let n: N;
if (c) { n = mk(5); } else { n = mk(6); }
churn();
n.v.x;                       // reads a freed block (prints 777, the churn's value)

try {} finally {
    let n10 = mk(5);
    for (..) { p3.v = n10.v; n10 = mk(..); }   // R9: SIGABRT
}

Why

A local declared with no initializer, or inside a catch or finally clause, owns nothing (localTakesOwnership, by design: no retain on store, no release at scope exit). A call's result stored into such a local was still treated as a discarded temporary, so it was released at the end of its own block. When that block is nested inside the local's scope (an if, a loop body), the release came while the local still held the value, and the next read used a freed block. When the store sits in the local's own block, that release happens at the local's scope end and is fine; that's why let n = mk(); n = mk(); in a catch worked.

Fix (rc)

releaseDiscardedTemporaries leaves a value alone when it is stored into an unowned local declared outside the value's block. That value now leaks instead of being freed early, which is the direction this design already takes when it can't tell. Values stored into an unowned local in their own block are still released.

Tests

tests/00unowned_local_store.ts covers:

• a no-initializer let assigned in an if and in a loop
• a local of a finally assigned in a loop (the R9 shape)
• a local of a catch assigned in an if

It fails under rc on Linux without the fix. The ownership verifier reports no errors on it. The test runs compiled, under JIT, and in the rc/none corpus.

Verification

• ctest -C Release: Windows 4982/4982, WSL Linux 4964/4964.
• Replaying the fuzzer's repros on Linux: R9-finally-iface-field-store now matches gc.
• mm_fuzz.py --jobs 10 run --count 500 --seed 1: only the 3 known own failures (R1, O4).

🤖 Generated with Claude Code