A `function ... of object` return value is a 16-byte [Code, Data]
method pointer, ABI-identical to `record Code, Data: Pointer end`. It
was returned as a scalar (only the Code half), so a method captured from
a call (`M := Obj.GetFn()`) and later invoked dropped the Data/Self half
— a call through M then dereferenced a null/garbage Self.
Route the return through the record-return ABI: a canonical 16-byte
[Code, Data] two-pointer record classifies as two integer eightbytes ->
rcInt2 (rax:rdx) on SysV, matching a direct record return. Both the
QBE and native x86-64 backends are fixed.
The native side mirrors the QBE approach via a lazily-built canonical
`_BlaiseMethodPtr` record (distinct GNative* singletons so the two
backends' identically-named globals do not collide when both are linked
into the self-hosting compiler), wired through BuildFrame's return
classification (rcInt2, not sret), the epilogue (loads both halves into
rax:rdx), the Result-slot zero-init (both 16 bytes), and every call-site
capture: variable- and field-destination assignment of a
method-ptr-returning call, and the immediate-invoke path
(`Obj.GetFn()(args)`) which materialises the 16-byte block and dispatches
through it so Data lands in %rdi.
Tests: an IR-level assertion that the return uses the aggregate ABI, plus
e2e cases. The new TestRun_MethodPtrReturn_ReadsSelf returns a method
that READS Self (an instance field) — unlike the X+Y case, which never
touches Self and so could not catch a dropped Data half — and asserts the
right value on every backend.
f6c1cee9fe