[ASDAlexander77]

Update: #669 merged the same fix into main (and also covers J | null given to I). Merging main took its MLIRGenCast.cpp as it is, so this PR now only adds the test 00nullable_interface_to_interface.ts. With main merged: Windows ctest -C Release 5426/5426 passed, the new test included. The description below is the original one.

Problem

Giving an I | null value to a J | null variable, where I does not extend J, compiled to a plain cast. The value kept I's vtable, and J read it by its own slot numbers. A field read through J took one of I's method slots as the field's offset, so the program crashed (0xC0000005) under gc, rc and none:

interface Shape { id: number; area(): number; }
interface HasId { id: number; }
const b: Shape | null = mkSquare(7, 3);
let n: HasId | null = mkNull();
n = b;
assert(n.id == 7);   // 0xC0000005

Fix

castToNullableUnionType (MLIRGenCast.cpp): both unions are stored as their one member, so I | null → J | null is now the interface-to-interface cast of I to J (castInterfaceToInterface, with the #666 vtable remap). This is how #665 already handles C | null → I | null. A null value stays null. Its vtable, I's null vtable, is remapped like any other, so its methods still throw. 00null_interface_to_interface.ts (#665) settled the same rule for I → J. I | null → I | null (the same interface) is left as it was.

Tests

• New tests/00nullable_interface_to_interface.ts, registered as compile + jit and in TSLANG_CORPUS (rc, none). It reads a field before any method call or allocation, so a regression fails at a few MB instead of running into random code. It covers assignment, a declaration, a value returned from a call, an interface whose members come in another order, and null (stays null, its method throws).
• Not under -mm=own: own refuses this program's interface-returning calls ("'this value' takes a second reference") with or without the fix.
• Tooth: with the MLIRGenCast.cpp change reverted, the test crashes with 0xC0000005 under gc, rc and none (JIT, run one process at a time under a memory watchdog; peak 9–114 MB, no runaway).
• Windows ctest -C Release: 5420/5420 passed (2 disabled/skipped as on main).
• WSL (Linux, Release): 5402/5402 passed (disabled/skipped as on main: defaultlib-collector tests need DEFAULT_LIB_PATH)

Based on main after #668 (type tag in the vtable): the only overlap was adjacent lines in tslang/test/tester/CMakeLists.txt.

🤖 Generated with Claude Code