test_gap_json_advanced.ts SIGSEGVs (exit 139) partway through — somewhere between line 70 and 100

[proggeramlug]

Summary

Running the full test-files/test_gap_json_advanced.ts against a perry-compiled binary exits with SIGSEGV (139) after producing 23 lines of output where node produces a different ordering and ~26+ lines. Pre-existing on v0.5.498.

The failure is masked by the test currently being part of the parity sweep — the parity comparison reports it as "output differs" without surfacing the segfault nature.

Bisection

Lines included	Compile	Run exit
1–50	ok	0, 16 lines output
1–70	ok	0, 21 lines output
1–100	ok	139 (SIGSEGV), 23 lines output

So the trigger is somewhere in lines 70–100, which contains:

1. try { JSON.stringify(circular); } catch … (lines 70–76)
2. JSON.stringify(withToJSON) where the object has a toJSON() method (lines 78–86)
3. Nested toJSON() (lines 88–97)

Each of these works in isolation:

• Plain circular-ref JSON.stringify + try/catch → exits 0, prints expected true / true.
• Plain toJSON() (single + nested) → exits 0, prints expected {"wrapped":42} / {"inner":"custom-7"}.

So the SIGSEGV is in the interaction between the earlier statements (replacer / reviver / pretty-print / circular-detect that already executed in lines 1–70) and the subsequent JSON.stringify calls in lines 78+. Likely some state in the JSON machinery (replacer-state? circular-detect set?) isn't reset between calls, and the next stringify dereferences a stale pointer.

Output divergence

Even before the segfault, perry's output ordering differs from node's first 23 lines — perry emits two extra lines ({"name":"Bob","city":"NYC"} and 42) that node doesn't, suggesting the replacer / reviver path also has a correctness bug that's worth investigating in the same area.

Repro

./target/release/perry test-files/test_gap_json_advanced.ts -o /tmp/jsadv && /tmp/jsadv ; echo $? → 139.

[proggeramlug]

Fixed in v0.5.508 (commit beb60ac) — root cause was identical to #448: ABI mismatch in js_object_set_field (declared DOUBLE, runtime takes u64). { raw: 1, toJSON() {...} } forced the open-shape js_object_set_field codepath; the toJSON closure pointer stored as 0 in the GP register the runtime read from, then SIGSEGV on dereference inside JSON.stringify. The single fix in #448 closes both repros — no separate commit needed. Two independent investigation agents (worktree-agent-a20ed4c46c5f86071 for #448, worktree-agent-ac0625ea29de69675 for #451) reached the identical root cause + fix.