Crash in module loader when cycles exist between ESM & CJS

[pythonmcpi]

What version of Bun is running?

1.0.27+c34bbb2e3 on debian, 1.0.27-canary.2+bc7415453 on win10

What platform is your computer?

Linux 5.10.0-21-amd64 x86_64 unknown | Microsoft Windows NT 10.0.19045.0 x64

What steps can reproduce the bug?

Create the following files:

// 1.ts
import SomeClass from "./3";

import { config } from "./5";

const client = {};

console.log(SomeClass);
client.config = config;

// 3.ts
import somedata = require("./4");

export default class SomeClass {}

// 4.js
const config = require(`./5`);

module.exports = {};

// 5.ts
const config_ = {};

type GeneratedConfigType = typeof config_;
export interface Config extends GeneratedConfigType {}

export const config = config_ as Config;

Then, run bun run 1.ts.

What is the expected behavior?

For bun to not segfault, and exit quietly after logging SomeClass to stdout. Alternatively, for bun to complain that Property 'config' does not exist on type '{}' for the client.config = config line.

What do you see instead?

Segmentation fault, on both linux and windows. Windows stack trace:

Segmentation fault at address 0x18
???:?:?: 0x7ff7e46b7631 in ??? (bun.exe)
???:?:?: 0x7ff7e4646a4c in ??? (bun.exe)
???:?:?: 0x7ff7e46471e1 in ??? (bun.exe)
???:?:?: 0x7ff7e447534d in ??? (bun.exe)
???:?:?: 0x7ff7e442324e in ??? (bun.exe)
???:?:?: 0x7ff7e440228f in ??? (bun.exe)
???:?:?: 0x7ff7e441f86f in ??? (bun.exe)
???:?:?: 0x7ff7e59c3ae5 in ??? (bun.exe)
???:?:?: 0x7ff7e441f77a in ??? (bun.exe)
???:?:?: 0x7ff7e441dae6 in ??? (bun.exe)
???:?:?: 0x1df8000115d in ??? (???)
???:?:?: 0x1dfc4986cff in ??? (???)
???:?:?: 0x1dfc7657467 in ??? (???)
???:?:?: 0x1dfc77c770f in ??? (???)
???:?:?: 0x1dfc76a2c7f in ??? (???)
???:?:?: 0x7002f4670f in ??? (???)
???:?:?: 0x7ff7e5d6d6c8 in ??? (bun.exe)

Additional information

No response

[pythonmcpi]

This issue is potentially related to #6946 - however I'm able to reliably reproduce the crash with the setup reported in this issue, while 6946's setup seems to only segfault ~30% of the time.

[Jarred-Sumner]

Debug logs

ASSERTION FAILED: m_moduleEnvironment
/Users/runner/work/WebKit/WebKit/Source/JavaScriptCore/runtime/AbstractModuleRecord.h(148) : JSModuleEnvironment *JSC::AbstractModuleRecord::moduleEnvironment()
1   0x1036053d0 WTFCrash
2   0x102dd9240 JSC::constructEmptyObject(JSC::JSGlobalObject*)
3   0x1046d0dd4 JSC::JSScope::abstractResolve(JSC::JSGlobalObject*, unsigned long, JSC::JSScope*, JSC::Identifier const&, JSC::GetOrPut, JSC::ResolveType, JSC::InitializationMode)
4   0x1039baf2c JSC::CodeBlock::finishCreation(JSC::VM&, JSC::ScriptExecutable*, JSC::UnlinkedCodeBlock*, JSC::JSScope*)
5   0x10480ce94 JSC::ModuleProgramCodeBlock::create(JSC::VM&, JSC::ModuleProgramExecutable*, JSC::UnlinkedModuleProgramCodeBlock*, JSC::JSScope*)
6   0x10480c28c JSC::ScriptExecutable::newCodeBlockFor(JSC::CodeSpecializationKind, JSC::JSFunction*, JSC::JSScope*)
7   0x10480d99c JSC::ScriptExecutable::prepareForExecutionImpl(JSC::VM&, JSC::JSFunction*, JSC::JSScope*, JSC::CodeSpecializationKind, JSC::CodeBlock*&)
8   0x10423a79c JSC::Interpreter::executeModuleProgram(JSC::JSModuleRecord*, JSC::ModuleProgramExecutable*, JSC::JSGlobalObject*, JSC::JSModuleEnvironment*, JSC::JSValue, JSC::JSValue)
9   0x104690698 JSC::JSModuleRecord::evaluate(JSC::JSGlobalObject*, JSC::JSValue, JSC::JSValue)
10  0x104472e58 JSC::AbstractModuleRecord::evaluate(JSC::JSGlobalObject*, JSC::JSValue, JSC::JSValue)
11  0x102e54a28 Zig::GlobalObject::moduleLoaderEvaluate(JSC::JSGlobalObject*, JSC::JSModuleLoader*, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::JSValue)
12  0x10468adb0 JSC::JSModuleLoader::evaluate(JSC::JSGlobalObject*, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::JSValue)
13  0x117a2c03c 12  ???                                 0x0000000117a2c03c 0x0 + 4691509308
14  0x104e2d3a0 llint_entry
15  0x104e2d3ec llint_entry
16  0x104e2c070 llint_entry
17  0x104e2bffc llint_entry
18  0x104e2bffc llint_entry
19  0x104e2d3a0 llint_entry
20  0x104e05cb4 vmEntryToJavaScript
21  0x104238bbc JSC::Interpreter::executeCallImpl(JSC::VM&, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
22  0x10468490c JSC::runJSMicrotask(JSC::JSGlobalObject*, WTF::ObjectIdentifierGeneric<JSC::MicrotaskIdentifierType, WTF::ObjectIdentifierThreadSafeAccessTraits>, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::JSValue)
23  0x1048ae1f0 JSC::VM::drainMicrotasks()
24  0x102e6a754 Zig::GlobalObject::drainMicrotasks()
25  0x102e6a780 JSC__JSGlobalObject__drainMicrotasks
26  0x1011b6458 src.bun.js.event_loop.EventLoop.drainMicrotasksWithGlobal
27  0x101666f7c src.bun.js.event_loop.EventLoop.tickQueueWithCount__anon_168896
28  0x1011b62f8 src.bun.js.event_loop.EventLoop.tickWithCount
29  0x100dac434 src.bun.js.event_loop.EventLoop.tick
30  0x10177df14 src.bun.js.event_loop.EventLoop.waitForPromise
31  0x1012a17d8 src.bun.js.javascript.VirtualMachine.waitForPromise
fish: Job 1, 'bun-debug 1.ts' terminated by signal SIGSEGV (Address boundary error)