react-reconciler 0.33 init crashes under Perry — SIGBUS on import (standalone) / 'undefined is not iterable' in createReconciler (in-ink); blocks all custom React renderers

[proggeramlug]

Summary

Importing react-reconciler crashes at module load under Perry. The next ink wall after the regex fixes (#4889): with MessageChannel/Segmenter/\p{Surrogate}/\p{RGI_Emoji} all fixed, every leaf dep and react itself now initialize cleanly — but the React reconciler does not.

Two symptoms, same area (react-reconciler 0.33.0 + react 19.2.7):

1. Standalone — native crash (SIGBUS, exit 138) at import, before any user statement runs:

   // rr.ts
   import createReconciler from 'react-reconciler';
   console.log('reached');   // never prints

   $ perry compile rr.ts -o rr && ./rr ; echo $?
   138              # 128 + SIGBUS(10), no stdout/stderr
   

   (perry.define NODE_ENV=production; both react-reconciler.{production,development}.js get compiled in, but the dev build is runtime-guarded by "production" !== process.env.NODE_ENV && (…), so the prod path is what loads. The prod file's top level is only module.exports = function($$$config){…} — so the crash is in how Perry loads/links that cjs module, not in JS logic.)

2. Inside ink — TypeError: undefined is not iterable at init: ink/build/reconciler.js:85 runs createReconciler(hostConfig) at module top level, and that throws (clean JS error, not SIGBUS) when ink is compiled with tree-shaking. So in the fuller graph react-reconciler loads far enough to call the factory, then dies iterating something undefined during reconciler construction.

The differing symptom (native SIGBUS standalone vs. JS undefined is not iterable in-ink) suggests build/graph-dependent codegen — possibly more than one bug — but both block any react-reconciler-based renderer.

Repro environment

• react-reconciler@0.33.0, react@19.2.7, peerDep react: ^19.2.0.
• Perry @ origin/main (post-regex: \p{RGI_Emoji} (property of strings, /v flag) rejected — Rust regex crate has no string-properties; blocks string-width/ink #4889 / fix(runtime): for-of over a dynamically-typed string drives the String iterator (#4892) #4893).
• Flags: PERRY_TREE_SHAKE=1, allow.compilePackages: ["*"], perry.define NODE_ENV=production/DEV=false. No correctness escape hatches.

Why it matters

• react-reconciler is the substrate for every custom React renderer — ink, react-three-fiber, react-pdf, react-nil, etc. This is the gate for all of them, not just ink (Compile ink (React-based TUI framework) end-to-end via perry.compilePackages #348).
• It's the wall Compile ink (React-based TUI framework) end-to-end via perry.compilePackages #348's own deprioritization comment predicted: "React 18's CJS + reconciler + scheduler surface keeps surfacing compiler edges."
• After this, ink's next gate is yoga-layout's WASM runtime (the documented out-of-scope rock).

Asks / triage pointers

• A native SIGBUS at cjs-module load with a trivial module.exports = function(){} body points at the cjs require/interop or module-init codegen for this specific large minified file — worth a --trace llvm on the react-reconciler.production module init.
• Likely related: Captured Object.assign alias causes react-reconciler HostRoot render hang #2564 (captured Object.assign alias → react-reconciler HostRoot render hang) — same package, possibly same alias/codegen family.

Related

• Compile ink (React-based TUI framework) end-to-end via perry.compilePackages #348 (ink end-to-end smoke test — where this surfaced)
• Captured Object.assign alias causes react-reconciler HostRoot render hang #2564 (react-reconciler Object.assign-alias render hang — likely adjacent)
• regex: \p{RGI_Emoji} (property of strings, /v flag) rejected — Rust regex crate has no string-properties; blocks string-width/ink #4889/regex: \p{Surrogate} Unicode property rejected ('invalid pattern') — Rust regex crate has no surrogate scalar values; blocks string-width/ink #4884/globals/Intl: implement Intl.Segmenter (grapheme segmentation) — new Intl.Segmenter() throws, blocks string-width/wrap-ansi/ink #4877/Codegen: new MessageChannel() global constructor unlinked/non-constructible — routes to stdlib symbol, breaks React scheduler init #4873 (the four walls cleared to reach this one)

[proggeramlug]

Deep-triage: the standalone SIGBUS is typed-feedback (#854) writing into a read-only guard-name constant

Minimal repro (no ink, no tree-shake needed):

import createReconciler from 'react-reconciler';
console.log('reached');   // never prints

→ exit 138 (SIGBUS) at module init, before any user statement.

Native backtrace (release build, lldb)

stop reason = EXC_BAD_ACCESS (code=2 /* write */, address=0x100ce15e0)
  frame #0  rr_min`<unnamed_1009066d0> + 44     ; str d0, [x0]   ← faulting store
  frame #1  rr_min`<unnamed_10059323c> + 3104
  frame #2  rr_min`<unnamed_100590a74> + 7216
  frame #3  rr_min`<unnamed_10059b2cc> + 1776
  frame #4  rr_min`<unnamed_1005b3778> + 92
  frame #5  dyld`start

Registers at the fault:

x0 = 0x0000000100ce15e0   →  __TEXT.__cstring + 150160  =  "object_get_by_name_guard"
d0 = NaN

x0 is the address of the read-only string constant "object_get_by_name_guard" — i.e. the value of a typed-feedback guard global. The faulting function stores a NaN-boxed value (d0) straight into it:

<+16>  str  x0, [sp, #0x8]
<+20>  cmp  x0, #0x1000           ; reject small ints / handles
<+24>  b.lo slow
<+28>  lsr  x8, x0, #48           ; reject NaN-boxed (tagged) values
<+32>  cbnz x8, slow
<+36>  and  x8, x0, #0x7          ; require 8-byte alignment
<+40>  cbnz x8, slow
<+44>  str  d0, [x0]              ; *x0 = value   ← x0 is a __cstring addr → write fault

So this helper treats any "untagged, aligned, ≥0x1000" value as a writable heap slot and stores into it — but a guard-name constant pointer passes all three checks and lands here, writing into read-only memory.

Where it comes from

• "object_get_by_name_guard" is the PropertyGet contract guard name: crates/perry-codegen/src/expr/typed_feedback.rs:36 (TypedFeedbackContract::object_get_by_name).
• It's emitted as a private read-only constant and handed to js_typed_feedback_register_site as the guard_ptr diagnostic arg (typed_feedback.rs:227-228, runtime crates/perry-runtime/src/typed_feedback.rs:347). That call path is fine (read-only).
• In the react-reconciler production module IR, every _guard global use (8292 of them) is a legit register_site arg — none is a store target in the IR. So the guard-name pointer is leaking into a store at runtime, inside the typed-feedback observe/guard machinery (the frame #0 store helper above), not in module codegen.

Net: a PropertyGet typed-feedback site, fired densely inside react-reconciler's single giant minified module.exports = function($$$config){…}, ends up with a guard-name constant pointer flowing into the "store value to heap slot" path → SIGBUS. The guard at <+20..+40> is insufficient: an untagged, aligned, ≥0x1000 pointer into .cstring/.rodata is not a writable cell.

In-ink manifestation

In the full ink build (tree-shake on) the same area instead throws a clean TypeError: undefined is not iterable from ink/build/reconciler.js:85's top-level createReconciler(hostConfig) — likely the same typed-feedback corruption surfacing as a JS-level error rather than a raw write fault, depending on optimization/layout.

Suggested next step for the fix

• Audit the PropertyGet typed-feedback observe/guard emit + its runtime store helper (frame #0): a guard-name/metadata pointer is being used as a value/slot. Either it's miscategorized as the observed value, or the "store to slot" helper needs to reject pointers that aren't GC-owned heap objects (is_valid_obj_ptr) before str d0,[x0], not just the tag/alignment checks.
• A --trace llvm on node_modules_react_reconciler_cjs_react_reconciler_production_js.ll reproduces the site density; the crash needs the runtime observe path, so a runtime assert in the store helper (reject non-heap pointers) would localize the first offending site immediately.

Likely same root family as #2564 (captured Object.assign alias → react-reconciler HostRoot hang).