test_gap_eval_as_value segfaults on Linux, and is the only remaining gap regression on main (sweep 32422185436 on 8d1cca158, parity rate 98.4%):
CRASH test_gap_eval_as_value (SIGSEGV (exit 139))
Perry died after printing 4 line(s); Node exited 0.
The fixture only reads eval as a value — it never calls it (this is the get-intrinsic pattern, '%eval%': eval):
const intrinsics: Record<string, unknown> = { "%Array%": Array, "%eval%": eval, "%Math%": Math };
console.log("has eval key:", "%eval%" in intrinsics);
const e = eval;
console.log("got eval value without throwing:", e !== Symbol.for("unreachable"));Not in gap_snapshot.json, so this is a regression rather than accepted debt.
Distinct from #8479's unwind class. That family aborted with SIGABRT and panic in a function that cannot unwind; this is a genuine SIGSEGV, so it is a wild/null dereference rather than an abort guard. It is also unaffected by the extern "C-unwind" removals in #8488 — it still crashes on 8d1cca158, which contains them.
Does not reproduce on macOS: compiled and run locally against a current perry-dev build, it exits 0 and its output matches the Node oracle byte-for-byte. So Linux CI is the only place it can be diagnosed, as with the rest of this crash family.
Suggested starting point: eval is classified as a global function (typeof === "function") in perry-codegen/src/expr/helpers.rs, but reading it as a value has to materialise something callable. A plausible shape — and it matches a pattern already seen this week in #8465, where net.connect reached a null JS_NATIVE_HTTP_DISPATCH and silently returned undefined — is that the eval value resolves to a function pointer that is null in the Linux build and gets dereferenced rather than checked. Worth dumping what the %eval% slot actually holds before the crash point.
test_gap_eval_as_valuesegfaults on Linux, and is the only remaining gap regression onmain(sweep 32422185436 on8d1cca158, parity rate 98.4%):The fixture only reads
evalas a value — it never calls it (this is theget-intrinsicpattern,'%eval%': eval):Not in
gap_snapshot.json, so this is a regression rather than accepted debt.Distinct from #8479's unwind class. That family aborted with
SIGABRTandpanic in a function that cannot unwind; this is a genuineSIGSEGV, so it is a wild/null dereference rather than an abort guard. It is also unaffected by theextern "C-unwind"removals in #8488 — it still crashes on8d1cca158, which contains them.Does not reproduce on macOS: compiled and run locally against a current
perry-devbuild, it exits 0 and its output matches the Node oracle byte-for-byte. So Linux CI is the only place it can be diagnosed, as with the rest of this crash family.Suggested starting point:
evalis classified as a global function (typeof === "function") inperry-codegen/src/expr/helpers.rs, but reading it as a value has to materialise something callable. A plausible shape — and it matches a pattern already seen this week in #8465, wherenet.connectreached a nullJS_NATIVE_HTTP_DISPATCHand silently returnedundefined— is that the eval value resolves to a function pointer that is null in the Linux build and gets dereferenced rather than checked. Worth dumping what the%eval%slot actually holds before the crash point.