[ASDAlexander77]

Fixes fuzzer repro 80037 (#646), found in a fresh range (80001). It fails on main.

const HG = new H();
function g11(p12: H, p13: N) {
    f7((p12.n = mk(7), p12.n), (HG.n = mk(9), p13));   // p12 is HG
}
g11(HG, HG.n);   // malloc(): unaligned tcache chunk detected

Why

The first argument is read out of p12.n. The second argument's HG.n = mk(9) then gives back the block it read, because p12 is HG. #653 holds an argument when something between its read and the call overwrites its place, but samePlace compares places by name, so it treated p12.n and HG.n as different places. HG being const doesn't matter; a let crashes the same way.

Fix (rc only)

overwrittenBeforeCall uses a new helper, mayBeSamePlace, which is samePlace plus two cases:

• one field (same position) of two objects of the same class type;
• an element of two arrays of the same type.

Which object a value is can't be known here, so such a store may be an overwrite, and the argument is held. That costs one extra retain/release pair, and only when an argument list assigns such a place. readFromOtherArgument still uses samePlace.

Tests

tests/00argument_place_aliased.ts covers a field reached through a parameter that is:

• the const global
• the global
• another parameter (the same object)

It also covers an element reached through another parameter that is the same array. Each case crashes on its own under rc on Linux without the fix, and the test passes under gc. It runs compiled, under JIT, and in the rc/none corpus.

Verification

• ctest -C Release: Windows 5316/5316, measured before An element is stored into once the value is ready #658 was merged in (that merge had no conflicts).
• WSL Linux, together with the 80194 fix: 5304/5304.

🤖 Generated with Claude Code