SIGSEGV in renderSidebar: NaN-boxed pointer dereferenced as raw address #13

Bug Description

Crash (SIGSEGV) when clicking Disconnect button in Mango. The crash occurs in renderSidebar which is called after clearing sidebar state arrays.

Crash Details

Exception Type:    EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x7ffd00059c405610

The faulting address 0x7ffd... has tag 0x7FFD which is POINTER_TAG — a NaN-boxed pointer value. The codegen is using this NaN-boxed f64 as a raw memory address instead of extracting the lower 48 bits first.

Stack Trace

0   Mango    renderSidebar + 3736
1   Mango    __closure_60 + 1568   (Disconnect button handler)
2   Mango    perry_ui_macos::catch_callback_panic

Reproduction

1. Connect to a MongoDB server in Mango
2. Click "Disconnect"
3. App crashes with SIGSEGV

Analysis

The Disconnect handler clears sidebar arrays (sidebarDbNames = []) then calls renderSidebar(). The function accesses widget handles or string values from module-level variables. The codegen generates code that treats NaN-boxed pointer values (f64 with tag 0x7FFD) as raw memory addresses, causing an access to 0x7ffd00059c405610 which is in unmapped memory.

This is related to #10 — the codegen's is_string / is_pointer optimization strips NaN-boxing tags from local variables, but when those values are later used in contexts that expect raw pointers, the full NaN-boxed bits (including the tag) are used as the address.