Crash due to non-threadsafe sourcemap access

LeulAria commented 1 month ago

How can we reproduce the crash?

No response

Relevant log output

$ bun run --env-file=.env --hot src/app.ts
10 | // import { createBunServeHandler } from 'trpc-bun-adapter'
11 | 
12 | import {initTRPC} from '@trpc/server';
============================================================
Bun v1.1.8 (89d25807) macOS Silicon
Args: "bun", "run", "--env-file=.env", "--hot", "src/app.ts"
Features: jsc dotenv http_server transpiler_cache(6) tsconfig_paths tsconfig(2) 
Builtins: "bun:main" "node:async_hooks" "node:buffer" "node:constants" "node:crypto" "node:events" "node:fs" "node:http" "node:https" "node:module" "node:os" "node:path" "node:stream" "node:string_decoder" "node:url" "node:util" "node:util/types" 
Elapsed: 58348ms | User: 205ms | Sys: 145ms
RSS: 72.37MB | Peak: 72.37MB | Commit: 0.80GB | Faults: 1223

panic(main thread): Segmentation fault at address 0x1A
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

To send a redacted crash report to Bun's team,
please file a GitHub issue using the link below:

 https://bun.report/1.1.8/Mr189d2580AioghgH___mro7oC+9r0zBmvo67Bmh6z/Burijbui/8Mm8m7MA2A0B

error: script "dev" was terminated by signal SIGTRAP (Trace or breakpoint trap)
[1]    50611 trace trap  bun dev

Stack Trace (bun.report)

Bun v1.1.8-debug-canary (89d2580) on macos aarch64 [RunCommand]

Segmentation fault at address 0x0000001A

3 unknown/js code
llint_entry
JSC::Interpreter::prepareForCachedCall
JSC::JSModuleEnvironment::create
JSC::VM::visitAggregate
WebCore::jsReadable_resume
src.bun.js.api.BunObject.Timer.Timeout.TimerReference.runFromJSThread
src.bun.js.webcore.response.Fetch.FetchTasklet.onProgressUpdate

Features: jsc, dotenv, http_server, transpiler_cache, tsconfig_paths, tsconfig

macOS v12.6.3
Args: "bun" "run" "--env-file=.env" "--hot" "src/app.ts"
Features: jsc dotenv transpiler_cache(17) tsconfig_paths tsconfig(5) 
Builtins: "bun:main" "node:assert" "node:async_hooks" "node:buffer" "node:child_process" "node:constants" "node:crypto" "node:dns" "node:events" "node:fs" "node:http" "node:https" "node:module" "node:net" "node:os" "node:path" "node:stream" "node:string_decoder" "node:timers" "node:tty" "node:url" "node:util" "node:util/types" "node:http2" 
Elapsed: 19081ms | User: 540ms | Sys: 323ms
RSS: 95.57MB | Peak: 99.58MB | Commit: 0.85GB | Faults: 1311

panic(main thread): Segmentation fault at address 0x1A
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

============================================================
Bun v1.1.20 (ae194892) macOS Silicon
macOS v12.6.3
Args: "bun" "run" "--env-file=.env" "--hot" "src/app.ts"
Features: jsc dotenv http_server transpiler_cache(21) tsconfig_paths tsconfig(5) 
Builtins: "bun:main" "node:assert" "node:async_hooks" "node:buffer" "node:child_process" "node:constants" "node:crypto" "node:dns" "node:events" "node:fs" "node:http" "node:https" "node:module" "node:net" "node:os" "node:path" "node:stream" "node:string_decoder" "node:timers" "node:tty" "node:url" "node:util" "node:util/types" "node:http2" 
Elapsed: 7129ms | User: 501ms | Sys: 268ms
RSS: 117.03MB | Peak: 0.14GB | Commit: 0.71GB | Faults: 1558

panic(main thread): Segmentation fault at address 0x1A
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

To send a redacted crash report to Bun's team,
please file a GitHub issue using the link below:

 https://bun.report/1.1.20/Mr1ae19489AioghwD___mr/7rC2yos2Bmi9/+B+lp6iC+4/kc__A2A0B

error: script "dev" was terminated by signal SIGTRAP (Trace or breakpoint trap)
[1]    53550 trace trap  bun dev

phenax commented 3 weeks ago

Same issue using oven/bun:1.1 docker image on linux. Haven't found a way to reproduce it, it just happened after a bit.

============================================================
Bun v1.1.17 (bb66bba1) Linux x64 (baseline)
Linux Kernel v6.8.10 | glibc v2.31
Args: "bun" "run" "--hot" "src/index.ts"
Features: jsc dotenv http_server tsconfig(4)
Builtins: "bun:main" "node:buffer" "node:crypto" "node:fs" "node:net" "node:os" "node:perf_hooks" "node:stream" "node:string_decoder" "node:tls" "node:util/types"
Elapsed: 2728100ms | User: 1348ms | Sys: 342ms
RSS: 0.02ZB | Peak: 0.18GB | Commit: 0.02ZB | Faults: 272

panic(main thread): Segmentation fault at address 0x1A
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

phenax commented 3 weeks ago

Now it happens all the time. Here's the source code where it happens. Might help with debugging -> https://github.com/notical-run/notical-run

Running bun api dev should bring the error up or docker compose up. This seems to be happening right away without running any of the code. It was working fine up until today. My guess is typescript. @LeulAria are you using drizzle? If not, it could be that trpc and drizzle share some type magic that breaks bun.

Edit: More info. After messing around with it. I have narrowed it down in my project to anytime I access any table imported from schema.ts. Even a console.log(Workspace) in any module other than schema.ts breaks bun.

dylan-conway commented 3 weeks ago

Debug stack trace. It appears to be saving/freeing invalid sourcemap data

❯ bun-debug src/api.ts
============================================================
Bun v1.1.18 (03ea72f0) macOS Silicon
macOS v14.4.1
Args: "bun-debug" "src/api.ts"
Features: jsc dotenv tsconfig 
Builtins: "bun:main" 
Elapsed: 139ms | User: 94ms | Sys: 83ms
RSS: 1.00GB | Peak: 1.00GB | Commit: 1.07GB | Faults: 51

panic(main thread): Segmentation fault at address 0x20040000000
???:?:?: 0x197567583 in ??? (libsystem_platform.dylib)
???:?:?: 0x4f0f00010488fc53 in ??? (???)
/Users/dylan/code/bun/src/bun.js/javascript.zig:145:35: 0x10521907f in deinit (bun-debug)
            default_allocator.free(this.data[0..this.len()]);
                                  ^
/Users/dylan/code/bun/src/bun.js/javascript.zig:278:29: 0x105218c23 in putValue (bun-debug)
                saved.deinit();
                            ^
/Users/dylan/code/bun/src/bun.js/javascript.zig:264:26: 0x10521919f in putMappings (bun-debug)
        try this.putValue(source.path.text, Value.init(bun.cast(*SavedMappings, mappings.list.items.ptr)));
                         ^
/Users/dylan/code/bun/src/bun.js/javascript.zig:235:29: 0x10615e36f in onSourceMapChunk (bun-debug)
        try this.putMappings(source, chunk.buffer);
                            ^
/Users/dylan/code/bun/src/js_printer.zig:503:28: 0x105ba6253 in onChunk (bun-debug)
                try handler(@as(*Type, @ptrCast(@alignCast(self))), chunk, source);
                           ^
/Users/dylan/code/bun/src/js_printer.zig:497:26: 0x10523514b in onSourceMapChunk (bun-debug)
        try self.callback(self.ctx, chunk, source);
                         ^
/Users/dylan/code/bun/src/js_printer.zig:6055:41: 0x105233f53 in printAst__anon_94920 (bun-debug)
            try handler.onSourceMapChunk(source_maps_chunk, source.*);
                                        ^
/Users/dylan/code/bun/src/bundler.zig:1175:64: 0x10524f6bb in printWithSourceMapMaybe__anon_94919 (bun-debug)
                inline else => |is_bun| try js_printer.printAst(
                                                               ^

fish: Job 1, 'bun-debug src/api.ts' terminated by signal SIGTRAP (Trace or breakpoint trap)

ohroy commented 3 weeks ago

+1

LeulAria commented 3 weeks ago

Now it happens all the time. Here's the source code where it happens. Might help with debugging -> https://github.com/notical-run/notical-run

Running bun api dev should bring the error up or docker compose up. This seems to be happening right away without running any of the code. It was working fine up until today. My guess is typescript. @LeulAria are you using drizzle? If not, it could be that trpc and drizzle share some type magic that breaks bun.

Edit: More info. After messing around with it. I have narrowed it down in my project to anytime I access any table imported from schema.ts. Even a console.log(Workspace) in any module other than schema.ts breaks bun.

Im not using drizzel, but im using MikroORM not sure but MokroORM requires ts-node thats in dependency aswell if that help and it happen when ever i do some db quey codechange or some chang in code then i need to restart.

Jarred-Sumner commented 3 weeks ago

@paperdave the stack trace above points to a race condition in the sourcemap changes from last month

cholasimmons commented 3 weeks ago

I've had this issue since version 1.1.13 for over a month or two (#11931 ). It's really frustrating I've been unable to present to shareholders, i really don't want to move away from Bun

I'm on Windows 11, using PrismaORM with this repo.

oven-sh / bun