Fix #322: a throw out of a called function halts the caller's remaining statements

[InauguralPhysicist]

A throw that propagated out of a called function did not stop the calling function from running its subsequent statements — execution (including side-effecting builtin calls) continued until the nearest enclosing try, or the function returned. Any function that called a throwing helper kept doing work after the error, which could corrupt state, double-apply effects, or mask the failure point.

Surfaced while fixing #306: the meta-interpreter's print of <unbound> printed null then raised, because return fn of arg ran after arg-eval threw. Pure-host reproduction:

define ev() as:
    throw of "boom"
define caller() as:
    ev of []
    print of "SHOULD-NOT-PRINT"   # ran (bug) — now doesn't
try:
    caller of []
catch e:
    print of "caught"

Before: prints SHOULD-NOT-PRINT then caught. After: just caught. (Throw directly in a try body already halted correctly — that control case is unchanged.)

Root cause

CHECK_ERROR (the per-instruction hook DISPATCH runs before every opcode) handled only two cases — catch in the throwing frame, or halt when no handler exists anywhere in this vm_run — with no branch for "error set, no handler in THIS frame, but a handler exists in an OUTER frame." That case fell through and kept executing the current frame.

Fix

Make CHECK_ERROR a loop. For the missing case it unwinds the current frame (drains its stack window, frees an owned env, restores its loop-stall globals, drops its chunk ref — mirroring vm_error_halt's per-frame drain), restores the caller as the current frame, and re-checks — repeating until it reaches the handler frame (catch) or runs out (halt).

• The unwind branch only runs when frame->try_count == 0, so g_try_depth needs no adjustment.
• It sets chunk alongside frame/ip, so the eventual catch runs with a consistent chunk.
• vm_handler_in_range scans only [base_frame, top), so a re-entrant vm_run (sandbox_run) boundary is respected — host handlers below base_frame stay invisible.
• A callee that catches its own error does not over-unwind.

Since DISPATCH runs CHECK_ERROR before every instruction, this covers the whole interpreter; JIT-hot throwing chains bail to the interpreter and propagate too.

Validation

• Regression: section [109] (test_throw_unwind) — multi-level nesting, throw-in-a-loop-in-a-function (loop-fresh env unwind), inner-catch (no over-unwind), and a 20k-iteration JIT-hot throwing chain.
• Release + ASan suites 2348/2348, leak floor 0; the frame-unwind path (heap locals through 20 frames × 5000) is ASan-clean.

Closes #322.

🤖 Generated with Claude Code