SIGSEGV in renderSidebar: NaN-boxed pointer dereferenced as raw address

[proggeramlug]

Bug Description

Crash (SIGSEGV) when clicking Disconnect button in Mango. The crash occurs in renderSidebar which is called after clearing sidebar state arrays.

Crash Details

Exception Type:    EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x7ffd00059c405610

The faulting address 0x7ffd... has tag 0x7FFD which is POINTER_TAG — a NaN-boxed pointer value. The codegen is using this NaN-boxed f64 as a raw memory address instead of extracting the lower 48 bits first.

Stack Trace

0   Mango    renderSidebar + 3736
1   Mango    __closure_60 + 1568   (Disconnect button handler)
2   Mango    perry_ui_macos::catch_callback_panic

Reproduction

1. Connect to a MongoDB server in Mango
2. Click "Disconnect"
3. App crashes with SIGSEGV

Analysis

The Disconnect handler clears sidebar arrays (sidebarDbNames = []) then calls renderSidebar(). The function accesses widget handles or string values from module-level variables. The codegen generates code that treats NaN-boxed pointer values (f64 with tag 0x7FFD) as raw memory addresses, causing an access to 0x7ffd00059c405610 which is in unmapped memory.

This is related to #10 — the codegen's is_string / is_pointer optimization strips NaN-boxing tags from local variables, but when those values are later used in contexts that expect raw pointers, the full NaN-boxed bits (including the tag) are used as the address.

[proggeramlug]

This appears to be fixed by the NaN-boxing corrections in v0.4.37 (GH-10/GH-12) and the earlier module-level variable type fixes in v0.4.28.

Verified with test cases that reproduce the exact pattern described:

• Module-level arrays cleared via reassignment (arr = [])
• Function called after clearing that accesses those arrays
• Nested connect/disconnect/renderSidebar cycling

All scenarios work correctly — no SIGSEGV, no pointer corruption. The original bug was likely caused by the same is_string/is_pointer NaN-boxing issue where I64 pointers were being stored/loaded with POINTER_TAG bits still present.