feat(tvix/eval): always emit OpForce as the last instruction

Change-Id: Id70c987f654dc5d9b47db74e395281309762b468
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6353
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>

tvix/eval/src/compiler/mod.rs

@@ -1256,6 +1256,12 @@ pub fn compile(
 
     c.compile(None, expr);
 
+    // The final operation of any top-level Nix program must always be
+    // `OpForce`. A thunk should not be returned to the user in an
+    // unevaluated state (though in practice, a value *containing* a
+    // thunk might be returned).
+    c.chunk().push_op(OpCode::OpForce);
+
     Ok(CompilationOutput {
         lambda: c.contexts.pop().unwrap().lambda,
         warnings: c.warnings,

tvix/eval/src/tests/tvix_tests/eval-okay-nested-thunks.exp

@@ -0,0 +1 @@
+42

tvix/eval/src/tests/tvix_tests/eval-okay-nested-thunks.nix

@@ -0,0 +1,7 @@
+# If a thunk yields another thunk, OpForce should keep forcing until
+# there is a value.
+let
+  a = b;
+  b = c;
+  c = 42;
+in a