v1.1.20 segmentation fault crash

[d-kja]

How can we reproduce the crash?

Snippet

// just for definition's sake, I'm using pure JS in this case
type Word = {
    value: string,
    maxX: number,
    minX: number,
    maxY: number,
    minY: number,
}

const words: Word[] = [
  {
    value: "Some string",
    maxX: 1.5463,
    minX: 0.4918,
    maxY: 5.3941,
    minY: 5.4753,
  },
  ...
]

export function identifyWithRegex(words, regex) {
  return words.filter((item)=> new RegExp(regex).test(item?.value);
}

const captureYellowFlagCoordinates = identifyWithRegex(
  words,
  /some regex?/i,
)

const captureInjectedValueCoordinates = identifyWithRegex(
  words,
  /another regex? yep\.?/i,
)

Relevant log output

Bun v1.1.18 (5a0b9352) Linux x64
WSL Kernel v5.15.153 | glibc v2.35
Args: "bun" "example.ts"
Features: jsc transpiler_cache(3) tsconfig
Builtins: "bun:main" "node:async_hooks" "node:child_process" "node:events" "node:fs" "node:fs/promises" "node:os" "node:path" "node:string_decoder" "node:tty" "node:util" "node:util/types"
Elapsed: 62ms | User: 30ms | Sys: 30ms
RSS: 1.05GB | Peak: 94.92MB | Commit: 1.05GB | Faults: 2

---

panic(main thread): Segmentation fault at address 0x1A
...some boiler plate to create the issue...
fish: Job 1, 'bun example.ts' terminated by signal SIGILL (Illegal instruction)

### Stack Trace (bun.report)

Bun v1.1.18 ([`5a0b935`](<https://github.com/oven-sh/bun/tree/5a0b93523134ca0043ee7ae84f01003aa4b7ff69>)) on linux x86_64 [TestCommand]

Segmentation fault at address 0x0000001A

- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/5a0b93523134ca0043ee7ae84f01003aa4b7ff69/ld-temp.o#L0>): `WTF::jscSignalHandler`
- `??`
- *1 unknown/js code*
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/5a0b93523134ca0043ee7ae84f01003aa4b7ff69/ld-temp.o#L0>): `llint_call_javascript`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/5a0b93523134ca0043ee7ae84f01003aa4b7ff69/ld-temp.o#L0>): `JSC::Interpreter::executeCall`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/5a0b93523134ca0043ee7ae84f01003aa4b7ff69/ld-temp.o#L0>): `JSC::runJSMicrotask`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/5a0b93523134ca0043ee7ae84f01003aa4b7ff69/ld-temp.o#L0>): `JSC::VM::drainMicrotasks`
- [`BunProcess.cpp:2558`](<https://github.com/oven-sh/bun/blob/5a0b93523134ca0043ee7ae84f01003aa4b7ff69/src/bun.js/bindings/BunProcess.cpp#L2558>): `Bun::jsFunctionDrainMicrotaskQueue`
- *1 unknown/js code*
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/5a0b93523134ca0043ee7ae84f01003aa4b7ff69/ld-temp.o#L0>): `llint_op_call_ignore_result`

<!-- from bun.report: TthLldy7ku9Fd1_ukTVW -->

[github-actions[bot]]

@d-kja, the latest version of Bun is v1.1.20, but this crash was reported on Bun v1.1.18.

Are you able to reproduce this crash on the latest version of Bun?

bun upgrade

[d-kja]

Well, I'm not really sure what happened as it was running the code just fine and then it crashed once, and I couldn't quite reproduce the issue again. Don't have a whole lot of information, but if I can help with something just let me know

[d-kja]

oh nvm, I managed to reproduce it again with the latest version

Bun v1.1.20 (ae194892) Linux x64
WSL Kernel v5.15.153 | glibc v2.35
CPU: sse42 popcnt avx avx2
Args: "bun" "example.ts"
Features: jsc transpiler_cache tsconfig
Builtins: "bun:main" "node:fs/promises"
Elapsed: 22ms | User: 0ms | Sys: 22ms
RSS: 1.07GB | Peak: 73.47MB | Commit: 1.07GB | Faults: 0

panic(main thread): Segmentation fault at address 0x1A
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

Bun v1.1.20 ([`ae19489`](<https://github.com/oven-sh/bun/tree/ae19489250ab74ee3ea7d5b50fca5d7d2b4e6d66>)) on linux x86_64 [AutoCommand]

Segmentation fault at address 0x0000001A

- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/ae19489250ab74ee3ea7d5b50fca5d7d2b4e6d66/ld-temp.o#L0>): `WTF::Unicode::convertReplacingInvalidSequences`
- `??`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/ae19489250ab74ee3ea7d5b50fca5d7d2b4e6d66/ld-temp.o#L0>): `llint_op_construct_wide16`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/ae19489250ab74ee3ea7d5b50fca5d7d2b4e6d66/ld-temp.o#L0>): `llint_relativePCBase`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/ae19489250ab74ee3ea7d5b50fca5d7d2b4e6d66/ld-temp.o#L0>): `JSC::Interpreter::executeCall`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/ae19489250ab74ee3ea7d5b50fca5d7d2b4e6d66/ld-temp.o#L0>): `JSC::JSModuleEnvironment::getOwnPropertySlot`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/ae19489250ab74ee3ea7d5b50fca5d7d2b4e6d66/ld-temp.o#L0>): `JSC::VM::drainMicrotasks`
- [`unbounded_queue.zig:129`](<https://github.com/oven-sh/bun/blob/ae19489250ab74ee3ea7d5b50fca5d7d2b4e6d66/src/bun.js/unbounded_queue.zig#L129>): `src.bun.js.module_loader.RuntimeTranspilerStore.drain`
- [`event_loop.zig:1211`](<https://github.com/oven-sh/bun/blob/ae19489250ab74ee3ea7d5b50fca5d7d2b4e6d66/src/bun.js/event_loop.zig#L1211>): `src.bun.js.event_loop.EventLoop.tickQueueWithCount__anon_117904`
- [`fifo.zig:245`](<https://github.com/oven-sh/bun/blob/ae19489250ab74ee3ea7d5b50fca5d7d2b4e6d66/src/deps/zig/lib/std/fifo.zig#L245>): `src.bun.js.event_loop.EventLoop.tick`

<!-- from bun.report: 9IuPt4In3qn0yZ_FrIzX -->

[Jarred-Sumner]

Please paste the entire file so that we can reproduce this. Just a segment of it won’t be enough unfortunately

[github-actions[bot]]

Hello @d-kja. Please provide a minimal reproduction using a GitHub repository, Replit, or CodeSandbox. Issues marked with needs repro will be closed if they have no activity within 3 days.

[d-kja]

Sorry for the delay, that day I was in a rush to finish some stuff so I didn't have time to send the code. I tossed the code and a small file containing the shape of the input, because I can't share the actual data. Sandbox

I didn't make it reproducible in the sandbox, I just tossed the code there. I was running the index.ts file directly with bun, if something is missing or you guys need something else, just lemme know and I will update the code