fix: x86_64 SIGSEGV in Contract() with multi-module ethkit — Export linkage for all wrappers, keys_array GcHeader guard (v0.4.48)

Two fixes for x86_64-specific crash in ethkit Contract() with 20 compiled modules:

1. Wrapper functions for FuncRef callbacks (e.g., .map(resolveType)) now use
   Linkage::Export instead of Linkage::Local. The wrapper names are already
   scoped with module prefix (__wrapper_{prefix}__{name}) preventing symbol
   collisions. Export linkage ensures func_addr produces linker-resolved
   absolute addresses, which is more reliable than Cranelift-internal
   resolution for Local symbols on x86_64 ELF.

2. Added cross-platform GcHeader type validation for keys_array pointers in
   js_object_get_field_by_name. Linux lacked the macOS-only ASCII heuristic
   guard, so corrupted keys_array pointers crashed with SIGSEGV instead of
   returning undefined.

Author: proggeramlug

CLAUDE.md

@@ -8,7 +8,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 Perry is a native TypeScript compiler written in Rust that compiles TypeScript source code directly to native executables. It uses SWC for TypeScript parsing and Cranelift for code generation.
 
-**Current Version:** 0.4.47
+**Current Version:** 0.4.48
 
 ## Workflow Requirements
 
@@ -140,6 +140,9 @@ Projects can list npm packages to compile natively instead of routing to V8. Con
 
 ## Recent Changes
 
+### v0.4.48
+- fix: x86_64 SIGSEGV in `Contract()` with 20-module ethkit — wrapper functions for FuncRef callbacks (e.g., `.map(resolveType)`) now use `Linkage::Export` instead of `Linkage::Local`; module-scoped names prevent collisions while Export linkage ensures correct `func_addr` resolution on x86_64 ELF; also added cross-platform GcHeader validation for `keys_array` in `js_object_get_field_by_name` to catch corrupted object pointers (Linux lacked the macOS-only ASCII heuristic guard)
+
 ### v0.4.47
 - fix: module-local function wrappers use `Linkage::Local` — prevents cross-module symbol collisions when two modules share filename + function names (e.g., two `contract.ts` files both with `resolveType`); fixes x86_64 wrong dispatch in large module graphs
 - feat: `Promise.race` implemented — `js_promise_race` runtime function with resolve/reject handlers; settles with first promise that completes

Cargo.lock

@@ -85,7 +85,7 @@ opt-level = "s"       # Optimize for size in stdlib
 opt-level = 3
 
 [workspace.package]
-version = "0.4.47"
+version = "0.4.48"
 edition = "2021"
 license = "MIT"
 repository = "https://github.com/PerryTS/perry"

Cargo.toml

@@ -1983,11 +1983,13 @@ impl crate::codegen::Compiler {
         } else {
             format!("__wrapper_{}__{}", self.module_symbol_prefix, func.name)
         };
-        // Only exported functions need Export linkage for their wrappers (cross-module calls).
-        // Module-local function wrappers use Local linkage to prevent symbol collisions when
-        // two modules have the same filename and function names (e.g., two contract.ts files
-        // each with resolveType). With Export linkage the linker could resolve the wrong one.
-        let linkage = if func.is_exported { Linkage::Export } else { Linkage::Local };
+        // All wrapper functions use Export linkage. The wrapper name is scoped with the
+        // module prefix (__wrapper_{prefix}__{name}), preventing symbol collisions even when
+        // two modules define functions with the same name. Export linkage ensures that
+        // func_addr produces a linker-resolved absolute address, which is more reliable
+        // than Cranelift-internal resolution for Local symbols — particularly on x86_64 ELF
+        // where Local func_addr relocations can produce incorrect addresses in large binaries.
+        let linkage = Linkage::Export;
         let wrapper_id = self.module.declare_function(&wrapper_name, linkage, &sig)?;
         // Track whether we need to NaN-box the return value (always needed since we return f64)
         let needs_return_boxing = original_return_abi == types::I64;

crates/perry-codegen/src/closures.rs

@@ -1060,6 +1060,19 @@ pub extern "C" fn js_object_get_field_by_name(obj: *const ObjectHeader, key: *co
             }
         }
 
+        // Cross-platform safety: validate keys_array has a valid GcHeader.
+        // If the keys_array pointer is corrupt (e.g., due to a stale reference after GC,
+        // or a func_addr relocation issue on x86_64), the GcHeader check catches it
+        // before we dereference the array contents.
+        {
+            let keys_gc = (keys as *const u8).sub(crate::gc::GC_HEADER_SIZE) as *const crate::gc::GcHeader;
+            let keys_gc_type = (*keys_gc).obj_type;
+            // keys_array must be GC_TYPE_ARRAY (arena-allocated array)
+            if keys_gc_type != crate::gc::GC_TYPE_ARRAY {
+                return JSValue::undefined();
+            }
+        }
+
         // Fast path: check field index cache (keys_array_ptr + key_hash → field_index)
         // Objects with the same shape share the same keys_array, so we cache per-shape lookups.
         let key_bytes = std::slice::from_raw_parts(