compile: fence the LOADNIL merge peephole at jump targets

[wolfy-j]

Defect

local v = t[key] or nil (any … or nil local initializer) inside a generic for body panics the VM with a Go nil pointer dereference whenever the left operand is truthy. or false, numeric for, while, and the same statement outside a loop are unaffected.

Root cause

codeStore.AddLoadNil merges a new LOADNIL into the previous instruction whenever the register spans are adjacent, with no jump-target fence. The nil arm of or nil ends in a LOADNIL that the short-circuit path jumps over; folding the next statement's nil-register init into it moves that init onto the skipped path, so the comparison reads an uninitialized stack slot:

[015] JMP      0, 1          ; truthy lhs skips the nil arm
[016] LOADNIL  7, 8          ; merged: R8 only nil'd on the falsy path
[017] EQ       1, 7, 8       ; reads R8 -> empty LValue on the truthy path

PUC Lua guards exactly this with fs->lasttarget in luaK_nil.

Fix

codeStore records the highest label pc (MarkLabelPc, fed by funcContext.SetLabelPc); AddLoadNil merges only when the previous instruction lies strictly after every label position. Adjacent nil locals with no label between them still fold.

Tests

TestLoadNilMergeStopsAtJumpTarget covers ipairs/pairs hit+miss, scalar or nil, guarded chains, and the still-folding case. Full package suite passes.

https://claude.ai/code/session_01CGwbFUspyUu7dbwdWsXL7J