[ASDAlexander77]

Narrowing a field in an else branch was not limited to that branch. Code after the if, and the next method compiled, then read a value from a region that no longer existed. Found in the BrowserLib sources attached to #231, where 7 of 14 files crashed. Event.ts alone reproduces it.

class N { v: number = 1; }
class L {
    head: N | null = null;
    a(): void { if (this.head === null) { print("x"); } else { print("y"); } }
    b(): boolean { return this.head === null; }   // crash, or "saving to constant object" at 1:1
}

Cause

Narrowing a property access registers {object type, "this.head"} → narrowed value in safeTypesMap. The true side of an if, a ?: and an && opens a SafeTypesMapScopeT, so its entry is removed when that side ends. The false side (the else narrowing from ElseSafeCase) opened only a SymbolTableScopeT. Its entry stayed until the module-level scope in MLIRGenModule.cpp, which caused two problems:

• The rest of the function still saw this.head as the else value, even though that value is defined inside the else region.
• Each method is generated twice, once for discovery and once for real. The second pass looked this.head up again and got a value from the discarded discovery body. What happened next depended on how the freed memory was reused: a crash, a bogus "saving to constant object", or nothing visible.

Fix

The false side of if (MLIRGenStatements.cpp), of ?: (MLIRGenExpressions.cpp) and of || (MLIRGenImpl.h) now opens a SafeTypesMapScopeT, the same as the true side.

|| does not narrow its right side yet, so that change only keeps the three places consistent.

Tests

• New 00safe_cast_else_scope.ts (compile, jit, and the rc/none corpus). It covers narrowing in an if/else, in a ?:, a read after an if/else in the same method, and a later method. Each is checked with head null and not null. Before the fix it fails with 0xC0000005.
• Full release suite: 2968/2968 passed.

The other #231 crash, a field of a union compared with null, is fixed in #376.

🤖 Generated with Claude Code