[ARC] SIGSEGV caused by cursor inference with a case object

[ghost]

When run, this program crashes with a SIGSEGV, but not when cursor inference is disabled. Found in combparser Nimble package.

Example

type
  ErrorNodeKind = enum Branch, Leaf
  Error = ref object
    case kind: ErrorNodeKind
      of Branch:
        left: Error
        right: Error
      of Leaf:
        discard
  
  Maybe = object
    errors: Error

proc plus(): Maybe =
  let lresult = Maybe()
  let lerrors = lresult.errors
  var rerrors: Error
  # This block is required
  block:
    let rresult = Maybe(errors: Error(kind: Leaf))
    rerrors = rresult.errors
  result.errors = Error(kind: Branch, left: lerrors, right: rerrors)

let r1 = plus()
doAssert r1.errors.kind == Branch
doAssert r1.errors.right.kind == Leaf

Current Output

/home/dian/Things/Nim/hello.nim(27) hello
/home/dian/Things/Nim/lib/system/assertions.nim(30) failedAssertImpl
/home/dian/Things/Nim/lib/system/assertions.nim(23) raiseAssert
/home/dian/Things/Nim/lib/system/fatal.nim(49) sysFatal
Error: unhandled exception: /home/dian/Things/Nim/hello.nim(27, 10) `r1.errors.right.kind == Leaf`  [AssertionDefect]
Error: execution of an external program failed: '/home/dian/Things/Nim/hello '

Expected Output

No output

Nim Compiler Version 1.3.5 [Linux: amd64]
Compiled at 2020-07-29
Copyright (c) 2006-2020 by Andreas Rumpf

git hash: b2a1944587bd23f87d05ed20cf33dd11c4c86e26
active boot switches: -d:release -d:danger

[ghost]

expandArc output of plus (a bit formatted so it's easier to see stuff):

var
  lresult
  :tmpD
  :tmpD_1
lresult = Maybe()
let lerrors_cursor = lresult.errors
var rerrors_cursor: Error
block :tmp:
  var rresult
  rresult = Maybe(errors: Error(kind: Leaf))
  rerrors_cursor = rresult.errors
  # Doesn't seem right for me, we destroy rresult here
  `=destroy`(rresult)
`=sink`(result.errors, Error(
  kind: Branch, 
  left:
    wasMoved(:tmpD)
    `=`(:tmpD, lerrors_cursor)
    :tmpD,
  # but use rerrors_cursor here
  right:
    wasMoved(:tmpD_1)
    `=`(:tmpD_1, rerrors_cursor)
    :tmpD_1
  )
)
`=destroy`(lresult)