Bun test crash in mocked http2 with no-op timeout #19049
Description
How can we reproduce the crash?
https://github.com/wafflecopters/bun-crash-http2-timeout-mock
Relevant log output
bad.test.ts:
============================================================
Bun v1.2.9 (9a329c04) macOS Silicon
macOS v15.3.2
CPU: neon fp aes crc32 atomics
Args: "bun" "test" "--preload" "./preload.ts"
Features: jsc tsconfig
Elapsed: 144ms | User: 101ms | Sys: 8ms
RSS: 28.41MB | Peak: 28.41MB | Commit: 1.07GB | Faults: 58
panic(main thread): Segmentation fault at address 0x30
oh no: Bun has crashed. This indicates a bug in Bun, not your code.
To send a redacted crash report to Bun's team,
please file a GitHub issue using the link below:
https://bun.report/1.2.9/Mt19a329c0EgggQ__uj0j6B2vu85B+8t85Bmwin6Bm1/k6Bmn/k6B++t/jC22s/jCA2AgD
error: script "test" was terminated by signal SIGTRAP (Trace or breakpoint trap)
fish: Job 1, 'bun run test' terminated by signal SIGTRAP (Trace or breakpoint trap)Stack Trace (bun.report)
Bun v1.2.9 (9a329c0) on macos aarch64 [TestCommand]
Segmentation fault at address 0x00000030
- 2 unknown/js code
bool std::__1::__insertion_sort_incomplete[abi:sn190107]<std::__1::_ClassicAlgPolicy, JSC::Heap::runFixpointPhase(...)::$_1&, char const**>JSC::GCClient::Heap::~HeapJSC::GCClient::Heap::~HeapJSC::MarkStackArray::stealSomeCellsFromvoid JSC::MarkedBlock::Handle::specializedSweep<false, (...)0, (...)0, (...)0, (...)0, (...)0, (...)0, JSC::DefaultDestroyFunc>void JSC::MarkedBlock::Handle::specializedSweep<false, (...)0, (...)0, (...)0, (...)0, (...)0, (...)0, JSC::DefaultDestroyFunc>bool JSC::FastStringifier<char16_t, (...)1>::append(...)::'lambda'(...)::operator()<JSC::CompactPropertyTableEntry>bool JSC::FastStringifier<char16_t, (...)1>::append(...)::'lambda'(...)::operator()<JSC::CompactPropertyTableEntry>
Features: tsconfig, jsc
Sentry Issue: BUN-GCE