A record shape that is an arm of a union of records carries a hidden
shape word at struct index 1, so its fields start at index 2. The new
program keeps such records in frame storage while they own string and
array fields, reads and writes those fields, passes the shapes through
the union, compares identities and serializes them. With the frame
storage's reference-field slots addressed at index + 1 instead of the
shape's field base, the compiled program segfaults in the plain lane
and ASan reports a heap-buffer-overflow in the sanitized one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
