Illegal instruction at address 0x579130D

airbreather commented 1 month ago

How can we reproduce the crash?

This happens intermittently (hooray...) in VS Code (Arch-based, AUR package visual-studio-code-bin version 1.93.0-1). Unfortunately, it seems to involve some of the weird things that happen when it's run in VS Code: if I just do bun run mre.ts >/dev/null in a loop from a command-line, it never hits the panic.

I've cut it down to this and redacted some other people's private information from it (so the "args" from the crash log won't match my log output exactly): mre.zip

To repro:

unzip that somewhere
(optional) bun install in the directory. It doesn't seem to be required for the repro, but IntelliSense is nice...
open VS Code in that directory, specifically opening mre.ts
run the "Debug: Start Without Debugging" command (for me, the shortcut is Ctrl + F5)
if it got to the end without the panic, repeat the previous step

This usually takes a few dozen times to trigger for me, but sometimes I've gotten it after only three re-runs in a row. The reported address is always the same, 0x579130D, but it doesn't always panic at the same place spot in the actual program output. For what it's worth, "Debug: Start Debugging" (shortcut F5 for me) seems to hit it much less frequently, but I have indeed seen two panics in that mode (out of probably a hundred times hitting F5).

Full disclosure, this happens rarely for me, and it's a side project, so I'm not going to watch this issue report too closely. It smells a bit like it could be a "we've seen this before but never had a remotely consistent way to reproduce it" thing, and those always drive me nuts when I see them in my stuff, so I wanted to take a shot at making a MRE for this before moving on.

Relevant log output

============================================================
Bun v1.1.27 (267afa29) Linux x64
Linux Kernel v6.10.8 | glibc v2.40
CPU: sse42 popcnt avx avx2 avx512
Args: "bun" "/home/joe/src/Gracious/ffmpeg-combine.ts"
Features: jsc http_server tsconfig 
Builtins: "bun:main" "node:fs/promises" "node:path" 
Elapsed: 59ms | User: 79ms | Sys: 27ms
RSS: 1.07GB | Peak: 0.17GB | Commit: 1.07GB | Faults: 0

panic: Illegal instruction at address 0x579130D
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

To send a redacted crash report to Bun's team,
please file a GitHub issue using the link below:

 https://bun.report/1.1.27/la1267afa2AigghgC+8oPyoo2uF+ru82Esi/j5E8h0j5Ek5xj5E6thl3D4/y99Dwwh63Dgh2rmDA3A6wpkvF

Stack Trace (bun.report)

Bun v1.1.27 (267afa2) on linux x86_64 [AutoCommand]

Illegal instruction at address 0x0579130D

??
ld-temp.o:0: bmalloc_heap_config_specialized_try_deallocate_not_small_exclusive_segregated
ld-temp.o:0: JSC::IsoInlinedHeapCellType<JSC::JSString>::finishSweep
ld-temp.o:0: JSC::MarkedBlock::Handle::sweep
ld-temp.o:0: JSC::LocalAllocator::tryAllocateIn
ld-temp.o:0: JSC::LocalAllocator::allocateSlowCase
LocalAllocatorInlines.h:41: JSC::JSString::create
JSString.h:947: WTF::Detail::CallableWrapper<Bun::BunInspectorConnection::sendMessageToDebuggerThread(...)::'lambda'(...), void, WebCore::ScriptExecutionContext&>::call
Function.h:82: Bun__performTask
event_loop.zig:300: src.bun.js.event_loop.EventLoop.tickQueueWithCount__anon_123577

airbreather commented 1 month ago

Scanning through some other "Illegal instruction" reports, it looks like this might be useful:

From /proc/cpuinfo, one entry of the 32

``` processor : 0 vendor_id : AuthenticAMD cpu family : 25 model : 97 model name : AMD Ryzen 9 7950X 16-Core Processor stepping : 2 microcode : 0xa601203 cpu MHz : 400.000 cache size : 1024 KB physical id : 0 siblings : 32 core id : 0 cpu cores : 16 apicid : 0 initial apicid : 0 fpu : yes fpu_exception : yes cpuid level : 16 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good amd_lbr_v2 nopl xtopology nonstop_tsc cpuid extd_apicid aperfmperf rapl pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb cat_l3 cdp_l3 hw_pstate ssbd mba perfmon_v2 ibrs ibpb stibp ibrs_enhanced vmmcall fsgsbase bmi1 avx2 smep bmi2 erms invpcid cqm rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local user_shstk avx512_bf16 clzero irperf xsaveerptr rdpru wbnoinvd cppc arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic v_vmsave_vmload vgif x2avic v_spec_ctrl vnmi avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid overflow_recov succor smca fsrm flush_l1d amd_lbr_pmc_freeze bugs : sysret_ss_attrs spectre_v1 spectre_v2 spec_store_bypass srso bogomips : 8986.28 TLB size : 3584 4K pages clflush size : 64 cache_alignment : 64 address sizes : 48 bits physical, 48 bits virtual power management: ts ttp tm hwpstate cpb eff_freq_ro [13] [14] ```

airbreather commented 1 month ago

No repro in 1.1.29 after a hundred attempts or so. I intend to do a bisect to see when this was fixed, so that I can maybe throw together a PR with an automated test for this situation. If you don't want to keep this open while I try that out, then go ahead and close this.

oven-sh / bun