.comm alignment operand is emitted as Mach-O log2 on every target, but ELF reads it as bytes

[nahime0]

Summary

The .comm directive's third operand is emitted as a hardcoded 3 for every target, but
that operand means different things on Mach-O and ELF:

• Mach-O (as/clang): alignment as a power of two — 3 means 8-byte alignment.
• ELF (GNU as): alignment in bytes — 3 means 3-byte alignment, which is not a
  power of two at all.

Where

src/codegen_support/data_section.rs:165:

for (label, size) in &self.comm_entries {
    out.push_str(&format!(".comm {}, {}, 3\n", label, size));
}

emit() takes no target parameter, so there is no way for the value to follow the object
format. Every common symbol in the program goes through this one site — the static-local
slots, the define() seen-flags, IR globals, the function-variant active symbols, the
concat scratch, and the stack-limit slot.

Why it surfaced

Adding _stack_limit as a common symbol for the stack-exhaustion guard made this reachable
on Linux images that had not previously been exercised with a fresh .comm symbol.

Expected

Emit the alignment the way the target's assembler reads it: the log2 exponent for Mach-O,
the byte count for ELF. Both should express the same intended 8-byte alignment.

Note

This is an assembler-syntax portability bug, not a codegen logic bug — the sizes and labels
are correct. It is worth an audit of the other directives emitted from the same section for
the same class of Mach-O/ELF operand divergence.

[nahime0]

Fixed on fix/security-round-0804 (PR #678), commit c525e92d0.

This turned out to be blocking rather than latent: it takes out all 16 linux-aarch64 CI shards, with

relocation truncated to fit: R_AARCH64_LDST64_ABS_LO12_NC
  against symbol `_stack_limit' defined in COMMON section

The misdeclaration predates the branch but was unreachable — no common symbol was read through an alignment-sensitive relocation. The stack-exhaustion guard is the first to do so (ldr x9, [x9, :lo12:_stack_limit] in every prologue), which is what made it fatal.

Two details worth recording beyond the original report:

• It is 172 emission sites, not one. DataSection::emit() was only the most visible; the bulk live in runtime/data/fixed.rs and runtime/data/user.rs. All now render through a single target-aware comm_directive().
• _empty_str and _url_stat_matched are byte-sized symbols whose operand was 1 rather than 3, so they escaped the obvious search. They are harmless in practice — nothing reads them with a 64-bit relocation — but they were included anyway, since leaving exceptions is how this class of bug comes back. A sweep test over the whole runtime data section, rather than a spot check on _stack_limit, is what found them.