Fix Bug 14: break and continue release the iteration's references

Both statements jumped past the loop body's scope-end drops, leaking every
reference created earlier in the iteration on the jump path (a finalizer-bearing
resource never finalized on a continued or broken iteration). Track the innermost
loop's body scope alongside the loop labels, and have break and continue walk the
scope chain up to and including it, releasing reference-typed variables declared
before the statement, then jump. This mirrors the early-return drop machinery and
is disjoint from the fall-through path, so nothing releases twice.

The added jump-path drop also gives affected variables a second drop, which the
move-elision single-drop guard already treats as not provably movable, so the fix
and the elision compose conservatively. Pinned with finalizer-oracle tests for
both statements. Found pre-existing by the elision adversarial review.

Author: Axmouth

plans/KNOWN_BUGS.md

@@ -71,16 +71,23 @@ declared without a return-type annotation (its inferred return is indeterminate)
 loose typing the dedicated paths had, narrowed here rather than fully closed. Found by the arc 1a
 adversarial review, reconfirmed as the residual channel by the arc 1b and Bug 12 reviews.
 
-## Bug 14 (OPEN, moderate): `continue` skips drops of references created earlier in the loop body
+## Bug 14 (FIXED): `continue` and `break` skipped drops of references created in the loop body
 
-A `continue` inside a `while` jumps to the next iteration without releasing reference-typed values
-created earlier in that iteration's body, so each continued iteration leaks them (a finalizer-bearing
-resource created before the `continue` never runs its finalizer on the continued path). The normal
-fall-through end of the body drops them correctly, so this is drop placement on the `continue` jump
-path, the same family as the early-return drops that `emit_return_param_drops` handles for `return`.
+A `continue` inside a `while` jumped to the next iteration without releasing reference-typed values
+created earlier in that iteration's body, so each continued iteration leaked them (a finalizer-bearing
+resource created before the `continue` never ran its finalizer on the continued path). `break` had
+the same defect on the loop-exit path. The normal fall-through end of the body dropped them
+correctly, so this was drop placement on the jump paths, the same family as the early-return drops.
 Pre-existing, found by the reference-count elision adversarial review by differential comparison
-against the pre-elision build (both leak identically, so the elision is unrelated). Fix direction:
-emit the current iteration's scope-end drops before the `continue` jump, mirroring the return path.
+against the pre-elision build (both leaked identically, so the elision was unrelated).
+
+Fixed by `loop_exit_drops`: the loop lowering tracks the innermost loop's body scope alongside its
+labels, and `break` and `continue` walk the scope chain from the statement's scope up to and
+including that body scope, releasing every reference-typed variable declared before the statement,
+then jump. Disjoint from the fall-through path, whose scope-end drops the jump never reaches, so no
+double release. Pinned by finalizer-oracle tests for both statements, and the extra drop on the jump
+path also disqualifies affected variables from move elision through the existing single-drop guard,
+so the two features compose conservatively.
 
 ## Bug 13 (FIXED): a block match-arm in value position yielded the wrong value
 

solid-snake-compiler/src/bytecode_gen.rs

@@ -2066,6 +2066,25 @@ mod codegen_tests {
         );
     }
 
+    #[test]
+    fn continue_releases_the_iterations_references() {
+        // `continue` jumps past the body's scope-end drops, so it must release the iteration's live
+        // references itself. The continued iteration's resource finalizes at the continue, in order.
+        let (_, out) = run_src(&format!(
+            "{RES_TYPE}let i = 0\nwhile i < 4:\n    let r = Res(i)\n    i = i + 1\n    if i == 2:\n        continue\n    print(\"use\", r.id)\n"
+        ));
+        assert_eq!(out, "use 0\nD 0\nD 1\nuse 2\nD 2\nuse 3\nD 3\n");
+    }
+
+    #[test]
+    fn break_releases_the_iterations_references() {
+        // Same for `break`: the final iteration's references release before leaving the loop.
+        let (_, out) = run_src(&format!(
+            "{RES_TYPE}let i = 0\nwhile i < 5:\n    let r = Res(i)\n    i = i + 1\n    if i == 3:\n        break\nprint(\"done\")\n"
+        ));
+        assert_eq!(out, "D 0\nD 1\nD 2\ndone\n");
+    }
+
     #[test]
     fn rc_aliasing_last_use_is_movable() {
         // `let b = a` with `a` dead afterward is a move of the reference into `b`. `a` is a parameter

solid-snake-compiler/src/intermediate_pass1.rs

@@ -1457,6 +1457,10 @@ pub struct AnalysisContext {
     label_allocator: LabelAllocator,
     loop_break_labels: Vec<Label>,
     loop_continue_labels: Vec<Label>,
+    /// The innermost enclosing loop's body scope, pushed with the loop labels. `break` and
+    /// `continue` walk the scope chain up to it (inclusive) to release the iteration's live
+    /// references before jumping, the loop-exit counterpart of the early-return drops.
+    loop_body_scopes: Vec<usize>,
     var_reads: HashSet<usize>,
     var_assigns: HashMap<usize, usize>,
     /// Signatures of all functions, keyed by name, populated before lowering so calls can
@@ -1587,6 +1591,7 @@ impl AnalysisContext {
             label_allocator: LabelAllocator::new(),
             loop_break_labels: Vec::new(),
             loop_continue_labels: Vec::new(),
+            loop_body_scopes: Vec::new(),
             var_reads: HashSet::new(),
             var_assigns: HashMap::new(),
             function_table: HashMap::new(),
@@ -5725,6 +5730,50 @@ fn return_param_drops(
     drops
 }
 
+/// The drops a `break` or `continue` must emit before its jump: every reference-typed variable
+/// declared before the statement in the scopes from the current one up to and including the
+/// innermost loop's body scope. Without these the jump skips the body's scope-end drops, leaking
+/// each continued or broken iteration's references. The loop-exit counterpart of
+/// `return_param_drops`, and disjoint from the fall-through path, whose own scope-end drops the
+/// jump never reaches.
+fn loop_exit_drops(ctx: &AnalysisContext, span: Span, stmt_id: usize) -> Vec<IRInstruction> {
+    let Some(&body_scope) = ctx.loop_body_scopes.last() else {
+        return Vec::new();
+    };
+    let mut drops = Vec::new();
+    let mut scope = ctx.current_scope;
+    loop {
+        for v in ctx.scopes.scopes[scope]
+            .vars
+            .values()
+            .filter(|v| !v.moved && v.declared_at < stmt_id)
+        {
+            let typ = ctx.get_type(v.id);
+            if matches!(typ, IntermediateType::Custom { .. }
+                    | IntermediateType::String
+                    | IntermediateType::Array { .. }
+                    | IntermediateType::List { .. }
+                    | IntermediateType::Map { .. }
+                    | IntermediateType::StrBuf) {
+                let var = IRVar::Var {
+                    metadata: v.metadata(typ, span),
+                };
+                drops.push(IRInstruction::drop_scope_end(var, span, scope));
+            }
+        }
+        if scope == body_scope {
+            break;
+        }
+        match ctx.scopes.scopes[scope].parent_index {
+            Some(parent) => scope = parent,
+            // The statement sits outside the loop's scope chain, which the label stack should
+            // preclude, so there is nothing further to release.
+            None => break,
+        }
+    }
+    drops
+}
+
 /// Lower one function definition into an IR function unit: bind its parameters as locals of a fresh
 /// scope, lower its body, and record the unit. Shared by ordinary function lowering and by
 /// monomorphized generic instances.
@@ -6681,13 +6730,15 @@ pub fn create_scopes_map_ast(
                                 // Push labels
                                 ctx.loop_break_labels.push(end_label.clone());
                                 ctx.loop_continue_labels.push(start_label.clone());
+                                ctx.loop_body_scopes.push(loop_scope);
 
                                 // Lower loop body
                                 create_scopes_map_ast(body, ctx, Some(repeated.unwrap_or(node_c.statement_id)));
 
                                 // Pop labels
                                 ctx.loop_break_labels.pop();
                                 ctx.loop_continue_labels.pop();
+                                ctx.loop_body_scopes.pop();
                                 ctx.current_scope = saved_scope;
 
                                 // Unconditional jump back to start
@@ -6708,9 +6759,13 @@ pub fn create_scopes_map_ast(
                             }
             ASTNode::Break => {
                                 let span = node_c.span;
-                                if let Some(label) = ctx.loop_break_labels.last() {
+                                if let Some(label) = ctx.loop_break_labels.last().cloned() {
+                                    // Release this iteration's live references before leaving the
+                                    // loop, since the jump skips the body's scope-end drops.
+                                    let drops = loop_exit_drops(ctx, span, node_c.statement_id);
+                                    ctx.ir_output.extend(drops);
                                     ctx.ir_output.push(IRInstruction::jump(
-                                        label.clone(),
+                                        label,
                                         span,
                                         node_c.statement_id,
                                         ctx.current_scope,
@@ -6722,9 +6777,13 @@ pub fn create_scopes_map_ast(
                             }
             ASTNode::Continue => {
                                 let span = node_c.span;
-                                if let Some(label) = ctx.loop_continue_labels.last() {
+                                if let Some(label) = ctx.loop_continue_labels.last().cloned() {
+                                    // Release this iteration's live references before jumping to the
+                                    // next, since the jump skips the body's scope-end drops.
+                                    let drops = loop_exit_drops(ctx, span, node_c.statement_id);
+                                    ctx.ir_output.extend(drops);
                                     ctx.ir_output.push(IRInstruction::jump(
-                                        label.clone(),
+                                        label,
                                         span,
                                         node_c.statement_id,
                                         ctx.current_scope,