-mm=rc: a parameter the body assigns owns what it is assigned

[ASDAlexander77]

Closes #512.

Under -mm=rc, a parameter's slot is borrowed from the caller and takes no reference, so assigning to it neither retained nor released. x = new B(1) stored an instance that the block it was made in then released, and x pointed at freed memory from there on.

• In the issue's while (x instanceof A) { x = new B(1) }, the next condition read it and crashed.
• More generally, any parameter assigned inside a block and read after it got whatever had been allocated over it since. On main under rc, an optional parameter, a method's parameter and a string built in a loop all come back as garbage.
• gc and none are unaffected; -mm=own refuses parameter assignment, unchanged.

Change

mlirGenFunctionOwnAssignedParams (MLIRGenFunctions.cpp) runs before the body is generated, under rc only.

1. It scans the body for assignments to each parameter that holds a heap reference:
   • plain and compound assignments (=, +=, ??=, ...)
   • destructuring targets
   • for (x of ...) / for (x in ...)
2. Each such parameter is copied into a local of the same name. A local owns what it holds (takeOwnershipOfLocal): a reference is taken on the caller's value, each assignment hands the count over, and the function's exit gives it back. The copy is listed with the function's own scope.

The scan over-approximates on purpose: it walks nested functions and counts every name in a destructuring target. A copy that wasn't needed costs one retain/release pair; a missed one is this bug.

Test

00param_assigned_owned.ts reads the parameter after reusing the heap in every case:

• the two instanceof loops from the issue (while and for)
• assignment in an if, in a loop, in a block whose variable a closure captured, and inside a closure
• optional, defaulted and ??= parameters
• returning the assigned parameter
• destructuring and for...of into it
• a method, an arrow function, a generator, an async function and a rest parameter
• a string, and an unassigned parameter

On main the first assertion crashes under rc. With the change it passes under gc, rc and none, with and without --opt, compile and JIT. --verify-ownership is clean.

00for_condition_narrowing.ts (#514) used a local copy because of this bug; its instanceof case reassigns the parameter again, so it now guards #512 too.

Verification

• ctest -C Release: 3882/3882 passed, including the 8 ownership-verifier shards. The generator / async / rest cases were added to the test afterwards; that test's 6 registrations and the verifier shards (14 tests) were rerun and pass. gtest unittests are not built in this tree.
• DefaultLib (origin/main) built for rc with this compiler: release compile and JIT 159/160 passed, with 1 skip (a gc-only test).

🤖 Generated with Claude Code