[ASDAlexander77]

let opt: I | null = flag ? mk(5) : null (a C | null given to an I | null) was a plain ts.Cast. The class pointer was read as an interface, which the lowering couldn't build (invalid cast from '!llvm.ptr' to '!llvm.struct<(ptr, ptr, ptr)>'). This affected every memory model, gc included: the program crashed, or called through a wrong vtable into code that allocated without end. Found while fixing memory-model follow-up item 9 (#656).

What an I | null is now

I | null is stored as I, as C | null is stored as C, so giving one to the other is the ordinary class-to-interface cast. A null interface is an interface over a null this, seen through the interface's null vtable.

• Methods: each slot is a stub that throws, as a call of an abstract method would: new Error("method is abstract"), or the message itself without the default library, which has no Error.
• Fields: a slot holds offset 0, so reading a field reads through the null this and faults, as a null class object's field does.
• Optional members: absent (-1).
• .instanceOf: answers false.

These values are null interfaces:

• a null class object cast to an interface. That cast was wrong without any union: under non-strict null a null C gave I a non-null vtable, so === null was false, and for a class that implements I the cast read the vtable through the null pointer and crashed;
• null and undefined given to I or I | null.

An interface is tested for null, and compared, by its this: in ===/==, in its truth value, and therefore in ?., ?? and instanceof. Two interfaces over the same object are now equal. Before, interfaces were compared by vtable, so any two objects of one class were "equal".

Not covered: zeroed interface storage (an uninitialized field, say) is still null by this, but has no vtable, so a method call on it faults instead of throwing.

How it's built

• castToInterfaceSpecialCases (the class branch) picks the vtable with a test for null; mlirGenClassInterfaceVTable is now shared with the plain cast. The interface is built over the object outside that test, so it stays a view for the ownership passes.
• A null object's vtable, and a null/undefined cast, stay a cast of null in the IR the ownership passes see. The cast names the null vtable (__null_interface_vtable), and the lowering puts it in (CastLogicHelper::nullInterfaceVTable).
• mlirGenNullInterfaceVTable makes one null vtable per interface and module (<I>.null..vtbl) with its stubs (<I>.null.<method>). A discovery run makes none.

Ownership passes

• OwnedReturnConsumptionPass: claimGlobalInitializers and viewedValue look through the class read out of the union. Without that, let g: I | null = maybe() was born pointing at freed memory (rc, own), and const o: I | null = c held no count, so c = null freed what o read.
• Signature pass: reads the class vtable through the null-test branch (17 own tests failed without this). It leaves null vtables out and doesn't let a stub's symbol open anything.
• rc pass: leaves null vtables and stubs out of what calls can reach. A stub never returns, so it doesn't turn off the whole-module "every heap result is retained" rule that reduce callbacks depend on.
• throw no longer disables -mm=own's "a C function of numbers destroys nothing" rule (spec 31). The exception tables name the C++ runtime's type_info vtable, a foreign global, which counted as a way to hand C a function. It is marked (__eh_type_info) and left out. Any module with a throw hit this.
• Existing bug in mlirGenFunctionBody, fixed: a function returning nothing that is made while another function is being generated used to pick up that function's return variable. A stub's throw also no longer walks out into the scopes of the function whose cast made it.

Tests

• tests/00nullable_class_to_interface.ts: C | null → I | null in every position (conditional, const, argument, return, assignment, global, held after the local lets go, an implements class). Runs under gc, plus rc and none (corpus).
• own/own_nullable_class_interface.ts: the global-initializer shape, under own, rc, none and gc.
• tests/00class_to_interface_null.ts (non-strict, own too): plain C → I with a null object, null and undefined given to I. Checks === null, ==, !, methods throwing, and identity compare.
• tests/00null_interface_to_interface.ts: a null interface remapped by An interface cast to one it does not extend gets a vtable laid out for it #666 to an interface it doesn't extend stays null, and its methods throw. Not under own, which doesn't take interface→interface casts of an existing value yet.
• Safe failure: every test reads a field before any method call or allocation, so a regression fails an assert instead of running away. The tooth, run one process at a time under a memory/time watchdog, failed at the first assert using 2-4 MB (AOT) or crashed early (JIT).

Verification

• Windows ctest -C Release: 5408/5408 passed (merged with main at 144528a).
• Linux (WSL): 5390/5390 passed.
• Leaks: an rc loop of 2M iterations, four conversions each, stays at 4.5 MB.

Not in this PR (existing bugs)

• Narrowing an interface to null in the right side of a === null && ... makes an invalid cast (struct -> ptr) and, on main, evaluates wrong.
• -mm=own still rejects most I | null values made from a class, and interface→interface casts of an existing value.

🤖 Generated with Claude Code