[ASDAlexander77]

Fixes fuzzer repro 40181 (#646), found in a fresh range past the first 1000 programs. It fails on main as well.

Why

Under rc a bound method counts the object it is bound to through that object's type tag at CLOSURE_TYPE_INDEX. Only the bound value's receivers take a count (getBoundObjectTypeTag). There were two holes:

• Bound through an interface (c = ig.get): the object's type isn't known where the bound value is built, so the value got no tag and counted nothing. c() then ran on a freed object once the interface went away.
• A global initialized with a bound method (let c = mk().get, let c = G.v.get): the global took no count. A temporary object was given back at the end of the initializer, and the first c = d released it a second time.

Fix

• InterfaceSymbolRefOpLowering, rc only: the bound value takes the tag the interface already carries for what it points at (INTERFACE_TYPE_INDEX, set by NewInterfaceOpLowering). A missing optional method has a null this, and its tag is null too. The struct is built from LLVM values directly, the way CreateBoundFunctionOpLowering builds it. A first version wrapped a not-yet-converted ts.CreateBoundFunction in an UnrealizedConversionCast. With that version, tslang aborted in malloc under --opt on Linux (36interfaces, 00owned_construct_interface). Building the struct directly, in the second commit, makes both pass. I didn't pin down exactly what corrupted the heap.
• claimGlobalInitializers: a global initialized with a bound method takes a count, as it already does for a field read.

Tests

tests/00bound_method_counts_object.ts covers:

• a local bound through an interface
• a global bound through an interface
• a global bound by its initializer to a temporary
• a global bound by its initializer to a global's field
• the global bound again

It runs compiled, under JIT, and in the rc/none corpus.

Verification

• ctest -C Release: Windows 5278/5278 with main merged at 149646d (rc: a new array given straight to a call is held across it #649). The later merge of rc: a value stored into a local that owns nothing is not freed under it #652 was not rerun on Windows. Its code is in the combined Linux run below, and CI covers the final head.
• WSL Linux with all of the open rc fixes applied: 4994/4994, including the two tests the first version broke.

🤖 Generated with Claude Code