Segfault in Bun 1.3.10 on Linux x64 (AMD Ryzen, baseline) - recurring crashes

[usaloCKLEnTO]

Bug Report

Bun is crashing with a segmentation fault. This has happened 3 times in the past week. Sessions were not particularly long-running.

Crash Output

Bun v1.3.10 (1423d3c8) Linux x64 (baseline)
Linux Kernel v6.8.0 | glibc v2.39
CPU: sse42 popcnt avx avx2
Args: "claude" "--dangerously-skip-permissions"
Features: Bun.stderr(2) Bun.stdin(2) Bun.stdout(2) abort_signal(922) fetch(1425) jsc spawn(1442) standalone_executable process_dlopen(2) yaml_parse(344)
Builtins: "bun:main" "node:assert" "node:async_hooks" "node:buffer" "node:child_process" "node:constants" "node:crypto" "node:events" "node:fs" "node:fs/promises" "node:http" "node:https" "node:module" "node:net" "node:os" "node:path" "node:path/posix" "node:path/win32" "node:perf_hooks" "node:process" "node:stream" "node:timers/promises" "node:tls" "node:tty" "node:url" "node:util" "node:zlib" "node:worker_threads" "undici" "ws"
Elapsed: 15700825ms | User: 632217ms | Sys: 113404ms
RSS: 0.02ZB | Peak: 1.14GB | Commit: 0.02ZB | Faults: 2 | Machine: 16.77GB

panic(main thread): Segmentation fault at address 0x7FFCEDDCF925

Crash Report URL

https://bun.report/1.3.10/B_11423d3cmgkgEuhogC4oi5wE+ypRslpuiEslpuiEslpuiEslpuiE_____________m8q7hEA24//B3tjskS

Environment

• Bun version: 1.3.10 (bundled with Claude Code)
• OS: Ubuntu, Linux 6.8.0-100-generic x86_64
• CPU: AMD Ryzen 5 5600GT (Cezanne), running in a Proxmox VM
• CPU Features: sse42 popcnt avx avx2 (baseline target)
• glibc: 2.39
• RAM: 16.77GB
• Application: Claude Code v2.1.51

Notes

• The RSS value 0.02ZB in the crash output appears to be a display/tracking bug itself
• This is the latest available version of Bun bundled with Claude Code — no newer version available to test
• Crashes are recurring (~3x/week) and not correlated with session length
• Running inside a Proxmox QEMU/KVM virtual machine

[github-actions]

Found 3 possible duplicate issues:

1. Segfault in Bun Canary v1.3.9-canary.51 on Linux x64 (claude-code) #26864
2. Segmentation fault after long-running session (v1.3.9-canary.51) #26984
3. Segmentation fault at address 0x10 when running Claude Code standalone executable #26843

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[robobun]

This was fixed in #17841.

Classification: Known WASM IPInt Bug (Duplicate)

This is a duplicate of the known JSC WASM In-Place Interpreter (IPInt) crash tracked in meta-issue #17841, reported upstream as WebKit Bug #289009.

Evidence

Decoded Crash Trace

The bun.report URL decodes to a stack trace showing:

• Multiple recursive calls to wasm_trampoline_wasm_ipint_call_wide32
• Followed by *13 unknown/js code* entries
• Terminating in llint_call_javascript

This is the exact signature of the known JSC WASM IPInt bug.

Segfault Address

The fault address 0x7FFCEDDCF925 is in the stack memory region (0x7FFx range on Linux x86_64). Combined with the recursive wasm_ipint_call_wide32 frames, this is a stack overflow: the WASM interpreter's recursive call handling exhausted the thread stack.

Existing Fixes (Not Yet Merged)

Multiple fix branches already exist targeting this exact crash:

• claude/fix-wasm-ipint-segfault-27340 - Disables JSC::Options::useWasmIPInt() on Linux x86_64
• claude/fix-wasm-ipint-sigill-27348 - Same fix for SIGILL variant
• claude/fix-wasm-osr-crash-26444 - Disables useWasmOSR on Linux x64

The crash pattern detection script at scripts/handle-crash-patterns.ts line 61 already matches wasm_trampoline_wasm_ipint_call_wide32 to auto-close duplicates.

RSS Display Bug (Secondary)

The "0.02ZB" RSS value is a separate minor bug: the crash handler at src/crash_handler.zig:1006-1036 uses mi_process_info() directly, which returns incorrect RSS values on Linux. Normal code paths work around this via Bun::getRSS() (see src/bun.js/modules/BunJSCModule.h:379), but the crash handler does not apply this fixup.

Workaround

Set environment variable: BUN_JSC_useWasmIPInt=0

Not Reproducible On Demand

This crash is intermittent (~3x/week), requires WASM execution paths, and specifically affects Linux x86_64. It cannot be reliably reproduced with specific steps but is a well-documented known issue.

This is an automated comment.

[Jarred-Sumner]

Fixed in #26922. This will be part of the next Claude Code release.

[Delitants]

Not fixed in 1.3.15. I'm tired of this, getting rid of bun and switching to Node.js.