panic(main thread): Segmentation fault at address 0x1A

[sacsbrainz]

How can we reproduce the crash?

run this code
bun create elysiajs eli

Relevant log output

No response

Stack Trace (bun.report)

Bun v1.1.20 (ae19489) on linux x86_64 [AutoCommand]

Segmentation fault at address 0x0000001A

• ld-temp.o:0: WTF::Unicode::convertReplacingInvalidSequences
• ??
• 1 unknown/js code
• ld-temp.o:0: llint_relativePCBase
• ld-temp.o:0: JSC::Interpreter::executeCall
• ld-temp.o:0: JSC::JSModuleEnvironment::getOwnPropertySlot
• ld-temp.o:0: JSC::VM::drainMicrotasks
• StringImpl.h:0: Bun::ProcessBindingUV::jsErrname
• unbounded_queue.zig:129: src.bun.js.module_loader.RuntimeTranspilerStore.drain
• event_loop.zig:1211: src.bun.js.event_loop.EventLoop.tickQueueWithCount__anon_117904

[github-actions]

@sacsbrainz, the latest version of Bun is v1.1.21, but this crash was reported on Bun v1.1.20.

Are you able to reproduce this crash on the latest version of Bun?

bun upgrade

[sacsbrainz]

yes same error

[Jarred-Sumner]

Confirming I am able to reproduce this.

ASSERTION FAILED: JS assertion failed at line 1 in:
function (promise, value)
{
    "use strict";

    @assert(@isPromise(promise));
    @assert((@getPromiseInternalField(promise, @promiseFieldFlags) & @promiseStateMask) == @promiseStatePending);

    var flags = @getPromiseInternalField(promise, @promiseFieldFlags);
    var reactions = @getPromiseInternalField(promise, @promiseFieldReactionsOrResult);
    @putPromiseInternalField(promise, @promiseFieldReactionsOrResult, value);
    @putPromiseInternalField(promise, @promiseFieldFlags, flags | @promiseStateFulfilled);

    @triggerPromiseReactions(@promiseStateFulfilled, reactions, value);
}

false
/Users/jarred/Code/bun/src/bun.js/WebKit/Source/JavaScriptCore/runtime/JSGlobalObject.cpp(422) : JSC::EncodedJSValue JSC::assertCall(JSGlobalObject *, CallFrame *)
1   0x107e0051c JSC::assertCall(JSC::JSGlobalObject*, JSC::CallFrame*)
2   0x110fc617c 1   ???                                 0x0000000110fc617c 0x0 + 4579942780
3   0x110fc61a8 2   ???                                 0x0000000110fc61a8 0x0 + 4579942824
4   0x110fe7214 3   ???                                 0x0000000110fe7214 0x0 + 4580078100
5   0x1088cf2b4 vmEntryToJavaScript
6   0x1077b40f0 JSC::Interpreter::executeCallImpl(JSC::VM&, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
7   0x1077b41dc JSC::Interpreter::executeCall(JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
8   0x107b6d230 JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
9   0x107b6d4f4 JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
10  0x107e6d500 JSC::runJSMicrotask(JSC::JSGlobalObject*, WTF::ObjectIdentifierGeneric<JSC::MicrotaskIdentifierType, WTF::ObjectIdentifierThreadSafeAccessTraits<unsigned long long>, unsigned long long>, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::JSValue)
11  0x1081547dc JSC::QueuedTask::run()
12  0x1081545d8 JSC::VM::drainMicrotasks()
13  0x1059a9190 Bun::JSNextTickQueue::drain(JSC::VM&, JSC::JSGlobalObject*)
14  0x105a76d4c Zig::GlobalObject::drainMicrotasks()
15  0x105a76d84 JSC__JSGlobalObject__drainMicrotasks
16  0x103746f0c src.bun.js.event_loop.EventLoop.drainMicrotasksWithGlobal
17  0x103d4e2e4 src.bun.js.event_loop.EventLoop.tickQueueWithCount__anon_128956
18  0x103746e08 src.bun.js.event_loop.EventLoop.tickWithCount
19  0x1032cf730 src.bun.js.event_loop.EventLoop.tick
20  0x103ebf82c src.bun.js.event_loop.EventLoop.waitForPromise
21  0x1038762d0 src.bun.js.javascript.VirtualMachine.waitForPromise
22  0x103be1c04 src.bun.js.javascript.VirtualMachine.loadEntryPoint
23  0x1035d16cc src.bun_js.Run.start
24  0x10306ad20 src.bun.js.javascript.OpaqueWrap__anon_56171__struct_84379.callback
25  0x105adb924 JSC__VM__holdAPILock
26  0x102bfccc0 src.bun.js.bindings.bindings.VM.holdAPILock
27  0x102f89bf0 src.bun_js.Run.boot
28  0x102fa9f70 src.cli.Command.maybeOpenWithBunJS
29  0x102fa16a8 src.cli.Command.start
30  0x102b41e80 src.cli.Cli.start
31  0x102b4041c src.main.main
error: script "dev" was terminated by signal SIGTRAP (Trace or breakpoint trap)
fish: Job 1, 'bun-debug --bun dev' terminated by signal SIGTRAP (Trace or breakpoint trap)

[Jarred-Sumner]

Here's what's happening:

1. A file is importing several ES modules asynchronously
2. One of those files does a synchronous require() of an already-imported ES module that has not finished transpiling yet
3. We start synchronusly transpiling the file
4. An error is thrown (in this case, @prisma/client is missing from package.json dependencies)
5. The asynchronously transpiled file finishes transpiling, but the importer of that file is gone!
6. The dangling Promise from the async transpilation gets garbage collected between clearing the strong reference