Neutralize moved-out match scrutinee payloads so enum drops cannot double-free.

Null variant union fields when pattern bindings take ownership, add cgen regression coverage for the test_fs_read shape, and regenerate example C snapshots where output changed.

Author: Cod-e-Codes

.cursor/skills/finding-ion-bugs/references/bug-hotspots.md

@@ -13,6 +13,7 @@ CLI errors use `TypeCheckError` Debug form (`UseAfterMove { ... }`). LSP reforma
 ## Codegen (`src/cgen/`)
 
 - Drop order and `ion_drop_*` for moved fields
+- **Match scrutinee move-out**: pattern payload bindings null `match_val_N.data.variant_*` fields when ownership transfers (`statement_match_payload_move_neutralizes_scrutinee`); whole-enum binding arms clear active variant payloads via `emit_match_scrutinee_whole_enum_moved_out`
 - **Return unwind**: all function exits use `emit_function_return` (`ret_val`, `scope_emit_return_unwind`, `goto epilogue`), including diverging `return` inside rvalue `match` arms (`rvalue_match_divergent_return_unwinds_owned`). Value-producing rvalue arms still assign and `break` from the `switch`.
 - `Box`, `Vec`, `String` layout vs `runtime/ion_runtime.h`
 - Single-file merge (`merge_modules`) vs `--mode multi` divergences

examples/showcase.c

@@ -27,16 +27,16 @@ typedef struct Vec_int {
     size_t elem_size;
 } Vec_int;
 
-typedef struct tuple_int_int {
-    int f0;
-    int f1;
-} tuple_int_int;
-
 typedef struct tuple_ion_sender_t_ion_receiver_t {
     ion_sender_t f0;
     ion_receiver_t f1;
 } tuple_ion_sender_t_ion_receiver_t;
 
+typedef struct tuple_int_int {
+    int f0;
+    int f1;
+} tuple_int_int;
+
 typedef struct Point {
     int x;
     int y;

examples/text_summary/text_summary.c

@@ -40,18 +40,18 @@ static ION_MAYBE_UNUSED ReadResult ReadResult_Err_new(int arg0) {
     return result;
 }
 
-extern int write(int fd, uint8_t* buf, int count);
-
 extern int open(uint8_t* path, int flags);
 extern int read(int fd, uint8_t* buf, int count);
 extern int close(int fd);
 
+extern int write(int fd, uint8_t* buf, int count);
+
 TextCounts summarize_text(ion_string_t* ION_MAYBE_UNUSED text);
 int main(void);
+ReadResult fs_read_to_string_result(ion_string_t* ION_MAYBE_UNUSED path);
 void fmt_print_int(int ION_MAYBE_UNUSED n);
 void fmt_println_int(int ION_MAYBE_UNUSED n);
 ion_string_t* fmt_int_to_string(int ION_MAYBE_UNUSED n);
-ReadResult fs_read_to_string_result(ion_string_t* ION_MAYBE_UNUSED path);
 void io_print(ion_string_t* ION_MAYBE_UNUSED s);
 void io_println(ion_string_t* ION_MAYBE_UNUSED s);
 void io_print_str(uint8_t* ION_MAYBE_UNUSED s, int ION_MAYBE_UNUSED len);
@@ -97,6 +97,7 @@ int main(void) {
     switch (match_val_0.tag) {
         case 0: { // Ok
             ion_string_t* content = match_val_0.data.variant_0.arg0;
+            match_val_0.data.variant_0.arg0 = NULL;
             ion_string_t* text = content;
             int bytes = ((text) ? (int)((text)->len) : 0);
             TextCounts counts = summarize_text(text);
@@ -122,6 +123,46 @@ int main(void) {
         return ret_val;
 }
 
+ReadResult fs_read_to_string_result(ion_string_t* ION_MAYBE_UNUSED path) {
+    ReadResult ret_val = {0};
+    {
+        int fd = open(path->data, 0);
+        if (fd < 0) {
+            ret_val = ReadResult_Err_new((-1));
+            if (path) { ion_string_free(path); }
+            goto epilogue;
+        }
+        ion_string_t* text = ion_string_new();
+        uint8_t buf[256] = {0};
+        int n = read(fd, &buf[0], 256);
+        while (n > 0) {
+            int i = 0;
+            while (i < n) {
+                ion_string_push_byte(text, (unsigned char)(buf[i]));
+                i = (i + 1);
+            }
+            n = read(fd, &buf[0], 256);
+        }
+        if (n < 0) {
+            int _closed = close(fd);
+            (void)_closed;
+            ret_val = ReadResult_Err_new((-2));
+            if (text) { ion_string_free(text); }
+            if (path) { ion_string_free(path); }
+            goto epilogue;
+        }
+        int _closed = close(fd);
+        (void)_closed;
+        ret_val = ReadResult_Ok_new(text);
+        if (path) { ion_string_free(path); }
+        goto epilogue;
+    }
+    if (path) { ion_string_free(path); }
+    goto epilogue;
+epilogue:
+        return ret_val;
+}
+
 void fmt_print_int(int ION_MAYBE_UNUSED n) {
     io_print_int(n);
     goto epilogue;
@@ -189,46 +230,6 @@ ion_string_t* fmt_int_to_string(int ION_MAYBE_UNUSED n) {
         return ret_val;
 }
 
-ReadResult fs_read_to_string_result(ion_string_t* ION_MAYBE_UNUSED path) {
-    ReadResult ret_val = {0};
-    {
-        int fd = open(path->data, 0);
-        if (fd < 0) {
-            ret_val = ReadResult_Err_new((-1));
-            if (path) { ion_string_free(path); }
-            goto epilogue;
-        }
-        ion_string_t* text = ion_string_new();
-        uint8_t buf[256] = {0};
-        int n = read(fd, &buf[0], 256);
-        while (n > 0) {
-            int i = 0;
-            while (i < n) {
-                ion_string_push_byte(text, (unsigned char)(buf[i]));
-                i = (i + 1);
-            }
-            n = read(fd, &buf[0], 256);
-        }
-        if (n < 0) {
-            int _closed = close(fd);
-            (void)_closed;
-            ret_val = ReadResult_Err_new((-2));
-            if (text) { ion_string_free(text); }
-            if (path) { ion_string_free(path); }
-            goto epilogue;
-        }
-        int _closed = close(fd);
-        (void)_closed;
-        ret_val = ReadResult_Ok_new(text);
-        if (path) { ion_string_free(path); }
-        goto epilogue;
-    }
-    if (path) { ion_string_free(path); }
-    goto epilogue;
-epilogue:
-        return ret_val;
-}
-
 void io_print(ion_string_t* ION_MAYBE_UNUSED s) {
     {
         int _result = write(1, s->data, (int)s->len);