fix(codegen): module-unique names for promoted string constants and the null guard (ELF multi-unit link)

changelog.d/8942-elf-split-unit-string-constants.md

@@ -0,0 +1,4 @@
+### Fixed
+
+- **Codegen units: `add_string_constant` globals and the null-guard global are now module-unique, so a multi-module Linux link of split modules no longer fails with `multiple definition of .str.N`** (#8942). Every `LlModule` numbered its anonymous rodata constants from `.str.0`, which is fine while they stay `private`. Codegen-unit splitting (#5391/#7174) promotes them so sibling units can reference them, and on every non-Mach-O target the owning unit's copy is a plain strong definition with default visibility (`make_unique_owner_global` — whose doc said "COFF" but whose branch runs for ELF too). Two modules large enough to split therefore both exported `.str.375` with different contents; GNU ld refused a Next.js App Route bundle's `--output-type dylib` link with 2,188 `multiple definition` errors (`app-page.runtime.prod.js` ↔ `route.js`, `jsonwebtoken/index.js` ↔ `route.js`). macOS was not clean either, only quiet: Mach-O keeps the replicated `linkonce_odr` copies (`weak external automatically hidden`) and ld64 coalesces weak definitions by name, so one module's bytes silently stood in for another's whenever a `.str.N` index was shared — `fn.name`, class names and `Function.prototype.toString` came out wrong, reproduced on macOS with a three-module program and `PERRY_CODEGEN_UNITS=2`. `compile_module` now installs the module symbol prefix on the `LlModule` (`set_symbol_prefix`) and `add_string_constant` mints `@<prefix>_.str.N`, mirroring what `strings.rs` already did for `<prefix>_.str.N.bytes`. The unprefixed `perry_null_guard_zero` (the safe-dereference target of `safe_load_i32_from_ptr`) takes the identical promotion path and is renamed `perry_null_guard_zero_<prefix>`, injected per function through the `RegCounter` cell so no call site changes. Unique names rather than `linkonce_odr hidden` because a COMDAT is folded by name and would reproduce ld64's silent merge on ELF; the #7174 one-definition-per-module layout is unchanged. Fixtures that never set a prefix keep the bare names. Verified on macOS end to end (split output byte-identical to Node after, miscompiled before) and on ELF by retargeting the dumped units to `x86_64-unknown-linux-gnu` under the owner policy and linking with `ld.lld` (10 duplicate symbols before, 0 after); a real Linux build is the remaining proof. `crates/perry-codegen/src/module.rs`, `block.rs`, `function.rs`, `codegen/mod.rs`.
+- **`--output-type dylib` on Linux now links `-lm -lpthread -ldl`, like the executable link always has** (#8942). The `cc -shared` plugin link in `run_pipeline.rs` never carried the system libraries: a plugin resolves every `perry_*`/`js_*` symbol from the host at `dlopen` time, so the omission was invisible until a real-app ELF dylib link — the same Next.js route bundle, right after the string-constant collisions were fixed — failed with `undefined reference to 'floor'` / `'log10'` from `perry_closure_*` functions, where LLVM had lowered `llvm.floor`/`llvm.log10` to libm calls. New `link/linux_dylib_libs.rs::push_unix_dylib_output` appends the libraries AFTER the objects (GNU ld only resolves what precedes a `-l`, and Ubuntu's default `--as-needed` drops an earlier one) and then `-o`; unit tests pin the order and that macOS (`-lSystem` already carries libm) gets no extra flags. `crates/perry/src/commands/compile/run_pipeline.rs`, `crates/perry/src/commands/compile/link/linux_dylib_libs.rs`, `link/mod.rs`.

crates/perry-codegen/src/block.rs

@@ -55,6 +55,10 @@ impl Default for FpFlags {
     }
 }
 
+/// Name of the null-guard global in a module without a symbol prefix. A
+/// prefixed module uses [`crate::module::LlModule::null_guard_global`].
+pub(crate) const DEFAULT_NULL_GUARD_GLOBAL: &str = "perry_null_guard_zero";
+
 /// Function-wide register counter shared between all blocks in a function.
 ///
 /// Registers are `%r1`, `%r2`, … unique across the entire function body —
@@ -92,6 +96,15 @@ pub struct RegCounter {
     /// callee is UB, so the registry, not the emitting code, is the single
     /// source of truth. `None` for functions built outside a module (tests).
     preserve_none_fns: RefCell<Option<Rc<RefCell<HashSet<String>>>>>,
+    /// `@`-prefixed symbol of the module's null-guard global (the zeroed
+    /// `i32` that [`LlBlock::safe_load_i32_from_ptr`] dereferences in place
+    /// of a bad handle). Injected by `LlModule::define_function` so the name
+    /// can carry the module prefix: codegen-unit splitting promotes the
+    /// global to a strong link-visible symbol on ELF/COFF, and an unprefixed
+    /// `perry_null_guard_zero` in two split modules is a GNU ld
+    /// `multiple definition`. Functions built outside a module (tests) keep
+    /// the bare name.
+    null_guard_symbol: RefCell<Option<String>>,
     /// Compiler-private validity bits for nested stable-packed loop proofs.
     ///
     /// A guarded inner receiver may keep its raw address across call-free
@@ -113,10 +126,24 @@ impl RegCounter {
             eh_unwind_labels: RefCell::new(Vec::new()),
             shadow_slot_allocas: RefCell::new(HashSet::new()),
             preserve_none_fns: RefCell::new(None),
+            null_guard_symbol: RefCell::new(None),
             stable_packed_revalidation_slots: RefCell::new(Vec::new()),
         }
     }
 
+    /// Point this function's null-guard loads at `global` (a bare symbol
+    /// name, no `@`). See the `null_guard_symbol` field.
+    pub(crate) fn set_null_guard_global(&self, global: &str) {
+        *self.null_guard_symbol.borrow_mut() = Some(format!("@{global}"));
+    }
+
+    fn null_guard_symbol(&self) -> String {
+        self.null_guard_symbol
+            .borrow()
+            .clone()
+            .unwrap_or_else(|| format!("@{DEFAULT_NULL_GUARD_GLOBAL}"))
+    }
+
     pub(crate) fn push_stable_packed_revalidation_slot(&self, slot: String) {
         self.stable_packed_revalidation_slots
             .borrow_mut()
@@ -1028,8 +1055,10 @@ impl LlBlock {
     /// a small handle), returns 0 instead of dereferencing.
     /// Used for .length reads and bounds checks on arrays/strings.
     ///
-    /// Uses `@perry_null_guard_zero` — a module-global i32 initialized
-    /// to 0 that serves as a safe dereference target.
+    /// Uses the module's null-guard global (`@perry_null_guard_zero`, or
+    /// its module-prefixed spelling under `LlModule::set_symbol_prefix`) — a
+    /// module-global i32 initialized to 0 that serves as a safe dereference
+    /// target.
     ///
     /// (Issue #52) The length load is tagged `!invariant.load` — once
     /// resolved, an Array/Buffer's length field at offset 0 of the
@@ -1054,7 +1083,7 @@ impl LlBlock {
                 cond_ty: "i1",
                 cond: is_bad.clone(),
                 ty: "ptr",
-                a: "@perry_null_guard_zero".to_string(),
+                a: self.counter.null_guard_symbol(),
                 b: handle_ptr.clone(),
             });
             r

crates/perry-codegen/src/codegen/mod.rs

@@ -426,10 +426,6 @@ pub fn compile_module(hir: &HirModule, opts: CompileOptions) -> Result<Vec<u8>>
     let _opt_report_module_scope = crate::opt_report::enter_module(hir);
 
     let mut llmod = LlModule::new_with_fp_flags(&triple, fp_flags);
-    // Null guard global: a zeroed i32 used as a safe dereference target
-    // when a NaN-unboxed pointer is null/invalid. Prevents segfaults from
-    // uninitialized locals or unhandled expressions producing 0.0/TAG_UNDEFINED.
-    llmod.add_internal_global("perry_null_guard_zero", crate::types::I32, "0");
     runtime_decls::declare_phase1(&mut llmod);
 
     // Derive a per-module symbol prefix from the HIR module name:
@@ -443,6 +439,18 @@ pub fn compile_module(hir: &HirModule, opts: CompileOptions) -> Result<Vec<u8>>
     // `main` is the only globally-named symbol — non-entry modules emit
     // `<prefix>__init` instead.
     let module_prefix = sanitize(&hir.name);
+    // Anonymous rodata constants (`add_string_constant`) carry the prefix
+    // too: codegen-unit splitting promotes them to link-visible symbols,
+    // and their per-module counter would otherwise collide across modules
+    // at the final link (GNU ld: `multiple definition of .str.N`).
+    llmod.set_symbol_prefix(&module_prefix);
+    // Null guard global: a zeroed i32 used as a safe dereference target
+    // when a NaN-unboxed pointer is null/invalid. Prevents segfaults from
+    // uninitialized locals or unhandled expressions producing 0.0/TAG_UNDEFINED.
+    // Defined AFTER the prefix is installed so its name is module-unique
+    // (`perry_null_guard_zero_<prefix>`) — split units export it strong on
+    // ELF/COFF, exactly like the string constants above.
+    llmod.add_internal_global(&llmod.null_guard_global(), crate::types::I32, "0");
 
     // Imports are no longer a hard error — Phase F.1 supports multi-
     // module compilation. Cross-module function CALLS via ExternFuncRef

crates/perry-codegen/src/function.rs

@@ -786,6 +786,12 @@ impl LlFunction {
         self.reg_counter.set_preserve_none_fns(fns);
     }
 
+    /// Point this function's null-guard loads at the module's (possibly
+    /// module-prefixed) null-guard global. See `RegCounter::null_guard_symbol`.
+    pub(crate) fn set_null_guard_global(&self, global: &str) {
+        self.reg_counter.set_null_guard_global(global);
+    }
+
     /// Whether this function's define header (and every declare of it) must
     /// carry the `preserve_nonecc` calling convention (#8175). Render-time
     /// lookup against the module registry, so define order never matters.