Segfault when Worker is spawned from terminated parent Worker

[pedrofracassi]

How can we reproduce the crash?

I'm not sure. It seems to happen sometimes when a Worker exists.

I'm using Elysia on the main thread, and ioredis + axios within the worker. Unfortunately I can't share much due to it being a work project.

JavaScript/TypeScript code that reproduces the crash?

This seems to be the last thing than runs fine before the segfault

(on the main thread)

this.worker.addEventListener("close", () => {
      console.log("Worker exited.");
    });

Within the worker, the function I'm using to exit:

async function exit() {
  clearInterval(interval);
  await redis.quit();
  process.exit(0);
}

Calling it like this inside another function that's called every second with setInterval:

if (gameState === "finished") {
  console.log("Game finished");
  exit();
  return;
}

Relevant log output

Game finished
Worker exited.
============================================================
Bun v1.1.8 (89d25807) macOS Silicon
Args: "bun", "src/index.ts"
Features: jsc dotenv(2) fetch(4) http_server transpiler_cache tsconfig 
Builtins: "bun:jsc" "bun:main" "node:assert" "node:buffer" "node:crypto" "node:dns" "node:events" "node:fs" "node:http" "node:https" "node:net" "node:path" "node:stream" "node:string_decoder" "node:tls" "node:tty" "node:url" "node:util" "node:util/types" "node:zlib" 
Elapsed: 3402ms | User: 1519ms | Sys: 317ms
RSS: 0.86GB | Peak: 0.86GB | Commit: 0.90GB | Faults: 69

panic: Segmentation fault at address 0x11

Stack Trace (bun.report)

Bun v1.1.8 (89d2580) on macos aarch64 [AutoCommand]

Segmentation fault at address 0x00000011

• 2 unknown/js code
• JSC::CodeCacheMap::pruneSlowCase
• JSC__JSValue__fromEntries
• src.comptime_string_map.ComptimeStringMapWithKeyType
• src.comptime_string_map.ComptimeStringMapWithKeyType
• src.bun.js.bindings.bindings.JSGlobalObject.throwInvalidArguments__anon_384460
• TCPSocketPrototype__upgradeTLS
• WebCore::JSTimeout::destroy
• JSC::VM::~VM

[github-actions[bot]]

This issue is stale and may be closed due to inactivity. If you're still running into this, please leave a comment.

[cvng]

@Electroid here is another small reproduction on Bun v1.1.25 - if this can help debug this issue:

// https://bun.sh/docs/api/workers

declare const self: Worker

function main() {
  new Worker(import.meta.url).postMessage({})
}

self.addEventListener('message', () => {
  throw new Error('test')
})

main() // runtime crash

View crash report

```bash ============================================================ Bun Canary v1.1.25-canary.3 (1bac0948) macOS Silicon macOS v14.6.1 Args: "bun" "run" "boom.ts" Features: jsc bunfig dotenv(12) tsconfig_paths tsconfig Builtins: "bun:main" Elapsed: 87ms | User: 43ms | Sys: 48ms RSS: 42.30MB | Peak: 42.30MB | Commit: 1.07GB | Faults: 946 panic: Segmentation fault at address 0xB8 oh no: Bun has crashed. This indicates a bug in Bun, not your code. To send a redacted crash report to Bun's team, please file a GitHub issue using the link below: https://bun.report/1.1.25/Mr21bac094AiqgggD__+moZ_m7strC+v/22B2p867B2vl3D+/6qD2x5qDA2AwL [1] 4702 trace trap bun run boom.ts ```

[Jarred-Sumner]

Confirming it reproduces.