[netliomax25-code]

Related: #15085, which fixes a different problem in other C++ copy assignment operators and does not touch these four classes.

FuncType, GlobalType, TableType and MemoryType cache a Ref ref next to the owning ptr, and operator-> and operator* hand out that cached ref. Their copy assignment replaces the owned object with ptr.reset(...) but does not update ref, so after b = a the cached pointer still refers to the object reset just freed, and b->params() reads freed memory. This needs nothing more unusual than assigning one existing value to another. __asan_describe_address on the pointer held by ref reports it as freed inside FuncType::operator=, and a debug build aborts in ty():

crates/c-api/src/types/func.rs:115:27:
unsafe precondition(s) violated: hint::unreachable_unchecked must never be reached

Move assignment copies ref along with ptr, and the existing tests assign from temporaries, which is likely why this went unnoticed. func_type.cc does copy-assign, but never reads the result.

The fix adds ref = ptr.get(); to all four operators, which is what TagType and ValType already do. Those two are the only other classes with a cached Ref. Only use through -> or * should be affected, since the other paths read ptr directly. The C++ API is tier 2 and the trigger is in embedder code, so I don't think this falls under the security process.

I added a CopyAssign test for each type. All four abort without the fix and pass with it. The C API job's ninja test (184 tests, Debug, -DBUILD_SHARED_LIBS=ON -DBUILD_TESTS=ON) passes on macOS aarch64 with and without -fsanitize=address, and clang-format 22 is clean. I have not run it on Linux or Windows.

[alexcrichton]

Thanks for the PR, but this is a duplicate of #15098 which fixes another location as well, so I'm going to close this