search

oven-sh / bun

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one
https://bun.sh
Other
74.14k stars 2.76k forks source link

Segmentation Fault using Nuxt Nitro Server #13001

Closed yschroe closed 2 months ago

yschroe commented 3 months ago

How can we reproduce the crash?

Edit: Managed to reproduce the crash reliably on my system:

Repro repo: https://github.com/yschroe/bun-segfault-nuxt

  1. Start the dev server via bun --bun run dev.
  2. Navigate to server/api/test.ts.
  3. Just hit CTRL+S a few times to save the file over and over again.
  4. Each save should trigger ✔ Nuxt Nitro server built in xx ms in the console (I am using the prettier Plugin for VS Code - not sure if it is a prerequisite to actually trigger a rebuild due to reformatting).
  5. After a few times (10-30) bun crashes on my system.

Relevant log output

✔ Nuxt Nitro server built in 88 ms                                                                                                                                                       nitro 14:42:39
✔ Nuxt Nitro server built in 89 ms                                                                                                                                                       nitro 14:42:39
✔ Nuxt Nitro server built in 96 ms                                                                                                                                                       nitro 14:42:39
============================================================
Bun v1.1.21 (70ca2b76) Windows x64
CPU: sse42 avx avx2
Args: "node" "C:\Users\xxx\Documents\repos\xxx\node_modules\nuxi\bin\nuxi.mjs" "dev"
Features: jsc Bun.stderr(4) Bun.stdin(26) Bun.stdout(3) extracted_packages(853) fetch(836) http_server(13) spawn(4) transpiler_cache(63) tsconfig_paths(40) tsconfig(106) 
Builtins: "bun:jsc" "bun:main" "detect-libc" "node:assert" "node:async_hooks" "node:buffer" "node:child_process" "node:constants" "node:crypto" "node:dns" "node:events" "node:fs" "node:fs/promises" "node:http" "node:https" "node:module" "node:net" "node:os" "node:path" "node:perf_hooks" "node:process" "node:querystring" "node:readline" "node:stream" "node:stream/promises" "node:string_decoder" "node:tls" "node:tty" "node:url" "node:util" "node:util/types" "node:vm" "node:zlib" "node:worker_threads" "ws" "node:v8" 
Elapsed: 4159168ms | User: 28625ms | Sys: 5359ms
RSS: 0.94GB | Peak: 2.11GB | Commit: 7.14GB | Faults: 1350488

panic(thread 22756): Segmentation fault at address 0x474BE410278
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

error: script "dev" exited with code 3

Stack Trace (bun.report)

Bun v1.1.21 (70ca2b7) on windows x86_64 [RunAsNodeCommand]

Segmentation fault at address 0x474BE410278

yschroe commented 3 months ago

Managed to crash bun reliably on my system, added repro.

This way sometimes I get a different stack trace (the uv_ip6_addr crash happens as well, 50/50):

✔ Nuxt Nitro server built in 96 ms                                                                                                                                                                     nitro 14:55:13
✔ Nuxt Nitro server built in 87 ms                                                                                                                                                                     nitro 14:55:14
============================================================
Bun v1.1.21 (70ca2b76) Windows x64
CPU: sse42 avx avx2
Args: "node" "C:\Users\yanni\Documents\repos\bun-segfault-nuxt\node_modules\nuxi\bin\nuxi.mjs" "dev"
Features: jsc Bun.stdin(40) Bun.stdout http_server(20) spawn(4) transpiler_cache(144) tsconfig_paths(15) tsconfig(56) 
Builtins: "bun:jsc" "bun:main" "detect-libc" "node:assert" "node:async_hooks" "node:buffer" "node:child_process" "node:constants" "node:crypto" "node:dns" "node:events" "node:fs" "node:fs/promises" "node:http" "node:https" "node:module" "node:net" "node:os" "node:path" "node:perf_hooks" "node:process" "node:querystring" "node:readline" "node:stream" "node:stream/promises" "node:string_decoder" "node:tls" "node:tty" "node:url" "node:util" "node:util/types" "node:vm" "node:zlib" "node:worker_threads" "ws" "node:v8" 
Elapsed: 11317ms | User: 5890ms | Sys: 1125ms
RSS: 1.58GB | Peak: 1.60GB | Commit: 6.46GB | Faults: 577132

panic(thread 16512): Segmentation fault at address 0x56DAE170130
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

To send a redacted crash report to Bun's team,
please file a GitHub issue using the link below:

 https://bun.report/1.1.21/wn170ca2b7A6ggh0D+i9uCgy0mQm5u4K+t3Mwg1pQqxp6Kyxk6K6h02zCkyr9lB6rg9lBA262Cht/j9xC

error: script "dev" exited with code 3

Bun v1.1.21 (70ca2b7) on windows x86_64 [RunAsNodeCommand]

Segmentation fault at address 0x52924170130

yschroe commented 3 months ago

I can also reproduce this crash on mac os. Different stack trace though:

✔ Nuxt Nitro server built in 82 ms                                                                       nitro 3:25:07 PM
============================================================
Bun Canary v1.1.22-canary.96 (df33f2b2) macOS Silicon
macOS v14.5
Args: "node" "/Users/yannik/Documents/Workspace/xxx/node_modules/.bin/nuxt" "dev"
Features: jsc Bun.stdin(168) Bun.stdout http_server(83) spawn(3) transpiler_cache(468) tsconfig_paths(14) tsconfig(42) 
Builtins: "bun:jsc" "bun:main" "detect-libc" "node:assert" "node:async_hooks" "node:buffer" "node:child_process" "node:constants" "node:crypto" "node:dns" "node:events" "node:fs" "node:fs/promises" "node:http" "node:https" "node:module" "node:net" "node:os" "node:path" "node:perf_hooks" "node:process" "node:querystring" "node:readline" "node:stream" "node:stream/promises" "node:string_decoder" "node:tls" "node:tty" "node:url" "node:util" "node:util/types" "node:vm" "node:zlib" "node:worker_threads" "ws" "node:v8" 
Elapsed: 24472ms | User: 22625ms | Sys: 2530ms
RSS: 0.91GB | Peak: 0.92GB | Commit: 0.02ZB | Faults: 2491

panic: Segmentation fault at address 0x26
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

To send a redacted crash report to Bun's team,
please file a GitHub issue using the link below:

 https://bun.report/1.1.22/Mn2df33f2bA6ggh0D__uxmhTuz04O+jq2Gui5jT+0/5Omn85Oml0pCu28o+BA2AsC

error: script "dev" was terminated by signal SIGTRAP (Trace or breakpoint trap)
zsh: trace trap  bun --bun run dev

Bun v1.1.22 (df33f2b) on macos aarch64 [AutoCommand]

Segmentation fault at address 0x2505921A388

Jarred-Sumner commented 2 months ago

Looks like it's a crash when terminating a Worker.

Debug logs:

$ nuxt dev
Nuxt 3.12.4 with Nitro 2.9.7                                                                     3:23:19 PM
                                                                                                 3:23:19 PM
  ➜ Local:    http://localhost:3000/
  ➜ Network:  use --host to expose

  ➜ DevTools: press Shift + Option + D in the browser (v1.3.9)                                   3:23:24 PM

✔ Vite client built in 52ms                                                                     3:23:25 PM
✔ Vite server built in 1097ms                                                                   3:23:26 PM
✔ Nuxt Nitro server built in 628 ms                                                       nitro 3:23:27 PM
ℹ Vite client warmed up in 0ms                                                                  3:23:27 PM
ℹ Vite server warmed up in 893ms                                                                3:23:28 PM
✔ Nuxt Nitro server built in 327 ms                                                       nitro 3:23:28 PM
ASSERTION FAILED: decontaminate()
src/bun.js/WebKit/Source/JavaScriptCore/runtime/StructureID.h(132) : Structure *JSC::StructureID::decode() const
1   0x1091da490 JSC::slowValidateCell(JSC::JSCell*)
2   0x109407f64 JSC::JSObject::globalObject() const
3   0x1074c3538 Bun::NapiExternal::~NapiExternal()
4   0x1074c35d0 Bun::NapiExternal::~NapiExternal()
5   0x1074c362c Bun::NapiExternal::destroy(JSC::JSCell*)
6   0x108d104d0 JSC::PreciseAllocation::lastChanceToFinalize()
7   0x108d04020 JSC::MarkedSpace::lastChanceToFinalize()
8   0x108ca1a2c JSC::Heap::lastChanceToFinalize()
9   0x1094d9b80 JSC::VM::~VM()
10  0x1073f87d0 WTF::ThreadSafeRefCounted<JSC::VM, (WTF::DestructionThread)0>::deref() const::'lambda'()::operator()() const
11  0x1073f8740 WTF::ThreadSafeRefCounted<JSC::VM, (WTF::DestructionThread)0>::deref() const
12  0x10787d240 WebWorker__dispatchExit
13  0x10662bad0 src.bun.js.web_worker.WebWorker.exitAndDeinit
14  0x106b5e4f4 src.bun.js.web_worker.WebWorker.spin
15  0x10694e728 src.bun.js.javascript.OpaqueWrap__anon_171168__struct_182372.callback
16  0x10745d17c JSC__VM__holdAPILock
17  0x10437b78c src.bun.js.bindings.bindings.VM.holdAPILock
18  0x1061a1ba0 src.bun.js.web_worker.WebWorker.start
19  0x105cc8894 src.bun.js.web_worker.WebWorker.startWithErrorHandling
20  0x10567f9c0 Thread.callFn__anon_134142
21  0x105058704 Thread.PosixThreadImpl.spawn__anon_112453.Instance.entryFn
22  0x19de22f94 _pthread_start
23  0x19de1dd34 thread_start
error: script "dev" was terminated by signal SIGTRAP (Trace or breakpoint trap)
fish: Job 1, 'bun-debug --bun run dev' terminated by signal SIGTRAP (Trace or breakpoint trap)
yschroe commented 2 months ago

Unfortunately does still crash for me on v1.1.25 (windows) in the same situation:

============================================================
Bun v1.1.25 (fe62a614) Windows x64
Windows v.win10_fe
CPU: sse42 avx avx2
Args: "node" "C:\Users\yanni\Documents\repos\xxx\node_modules\nuxi\bin\nuxi.mjs" "dev"
Features: jsc Bun.stderr Bun.stdin(60) Bun.stdout http_server(30) spawn(4) transpiler_cache(200) tsconfig_paths(16) tsconfig(58) 
Builtins: "bun:jsc" "bun:main" "detect-libc" "node:assert" "node:async_hooks" "node:buffer" "node:child_process" "node:constants" "node:crypto" "node:dns" "node:events" "node:fs" "node:fs/promises" "node:http" "node:https" "node:module" "node:net" "node:os" "node:path" "node:perf_hooks" "node:process" "node:querystring" "node:readline" "node:stream" "node:stream/promises" "node:string_decoder" "node:tls" "node:tty" "node:url" "node:util" "node:util/types" "node:vm" "node:zlib" "node:worker_threads" "ws" "node:v8" 
Elapsed: 28775ms | User: 15781ms | Sys: 2562ms
RSS: 1.78GB | Peak: 1.80GB | Commit: 6.73GB | Faults: 799553

panic(thread 2588): Segmentation fault at address 0x3B3103902D8
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

To send a redacted crash report to Bun's team,
please file a GitHub issue using the link below:

 https://bun.report/1.1.25/wn1fe62a61A+ggh0DskwmekvvmeyygvH40zuIqr6oUm83la23xw1CgkwzNCYKERNEL32.DLL63yECSntdll.dllwy3WA2m7BwthknQ

error: script "dev" exited with code 3

Bun v1.1.25 (fe62a61) on windows x86_64 [RunAsNodeCommand]

Segmentation fault at address 0x3B3103902D8