GeezerVison

 fn get_varname(&self, var_num: oparg::VarNum) -> &str {
-    self.metadata.varnames[var_num.as_usize()].as_ref()
+    let idx = var_num.as_usize();
+    if let Some(name) = self.metadata.varnames.get_index(idx) {
+        name.as_ref()
+    } else {
+        let cell_idx = idx - self.metadata.varnames.len();
+        self.metadata
+            .cellvars
+            .get_index(cell_idx)
+            .or_else(|| self.metadata.freevars.get_index(cell_idx - self.metadata.cellvars.len()))
+            .map(String::as_ref)
+            .unwrap_or("<invalid var num>")
+    }
 }

Verify each finding against the current code and only fix it if needed.

In `@crates/codegen/src/ir.rs` around lines 1112 - 1113, get_varname currently
indexes only metadata.varnames and will panic for VarNum values that refer into
the "locals-plus" table (cellvars/freevars created for LOAD_CLOSURE); update
get_varname to resolve VarNum against the combined locals-plus layout: if
var_num.as_usize() < self.metadata.varnames.len() return that entry, otherwise
subtract varnames.len() and if the remaining index is <
self.metadata.cellvars.len() return from metadata.cellvars, else subtract
cellvars.len() and return from metadata.freevars; ensure indexes use as_usize()
and do bounds-safe lookups so it never panics when encountering
LOAD_CLOSURE-created slots.

 fn store_variable(&mut self, idx: oparg::VarNum, val: JitValue) -> Result<(), JitCompileError> {
     let builder = &mut self.builder;
     let ty = val.to_jit_type().ok_or(JitCompileError::NotSupported)?;
-    let local = self.variables[idx].get_or_insert_with(|| {
+    let slot = self
+        .variables
+        .get_mut(idx.as_usize())
+        .ok_or(JitCompileError::BadBytecode)?;
+    let local = slot.get_or_insert_with(|| {
         let var = builder.declare_var(ty.to_cranelift());
         Local {
             var,
             ty: ty.clone(),
         }
@@
             Instruction::LoadFast { var_num } | Instruction::LoadFastBorrow { var_num } => {
-                let local = self.variables[var_num.get(arg)]
-                    .as_ref()
+                let local = self
+                    .variables
+                    .get(var_num.get(arg).as_usize())
+                    .and_then(Option::as_ref)
                     .ok_or(JitCompileError::BadBytecode)?;
                 self.stack.push(JitValue::from_type_and_value(
                     local.ty.clone(),
                     self.builder.use_var(local.var),
                 ));

Verify each finding against the current code and only fix it if needed.

In `@crates/jit/src/instructions.rs` around lines 111 - 115, The code directly
indexes self.variables with a VarNum (typed u32) which can panic on malformed
bytecode; change both occurrences (e.g., in store_variable and the other site
where self.variables[idx] is used) to first convert the VarNum to usize and use
checked access (self.variables.get_mut(idx_usize) or
self.variables.get(idx_usize)), returning Err(JitCompileError::BadBytecode) when
None. Inside the Some(slot) branch, keep the existing logic (declare_var via
builder and set the slot) but perform it via the checked slot reference instead
of indexing to avoid panics.