SEGV after upgrading to 1.3.13

[theimpostor]

What version of Bun is running?

1.3.13+bf2e2cecf

What platform is your computer?

Darwin 24.6.0 x86_64 i386

What steps can reproduce the bug?

❯ bunx --bun jscpd *.tsx
============================================================
Bun v1.3.13 (bf2e2cec) macOS x64
macOS v15.7.5
CPU: sse42 popcnt avx avx2
Args: "node" "/var/folders/ct/x2gct7yn2bxfqs891n8h1dxr0000gn/T/bunx-501-jscpd@latest/node_modules/.bin/jscpd" "ComponentOne.tsx" "ComponentTwo.tsx"
Features: Bun.stderr(2) Bun.stdout(2) jsc transpiler_cache(5) tsconfig(16)
Builtins: "bun:main" "node:assert" "node:buffer" "node:child_process" "node:constants" "node:crypto" "node:events" "node:fs" "node:os" "node:path" "node:process" "node:stream" "node:util"
Elapsed: 816ms | User: 448ms | Sys: 200ms
RSS: 99.39MB | Peak: 99.39MB | Commit: 44.37MB | Faults: 296 | Machine: 34.36GB

panic(main thread): Segmentation fault at address 0x0
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

To send a redacted crash report to Bun's team,
please file a GitHub issue using the link below:

 https://bun.report/1.3.13/mn1bf2e2cegDqgggC__ksvliDi717rC8vx7rCmv/iiD_8snitD_0xwitD_0xwitD0xwitD8snitD8snitD8snitD8snitD8snitD8snitD8snitDA2AA

Illegal instruction: 4     bunx --bun jscpd *.tsx

ComponentOne.tsx:

import type { ExampleStatus } from "@sample/shared/example-status-schema.ts";
import { StatusIcon } from "@/components/example/StatusIcon.tsx";

interface ComponentOneProps {
  status: ExampleStatus | null;
}

export function ComponentOne({ status }: ComponentOneProps) {
  return (
    <div className="bg-white">
      {status ? (
        <div className="flex items-start gap-2">
          <StatusIcon
            severity={status.level}
            className="mt-0.5 h-5 w-5 shrink-0"
          />
          <p className="text-base text-slate-700">{status.summary}</p>
        </div>
      ) : (
        <p className="text-base text-slate-500">Awaiting result</p>
      )}
    </div>
  );
}

ComponentTwo.tsx:

import type { ItemCount } from "@sample/shared/example-list-schema.ts";

interface ComponentTwoProps {
  items: ItemCount[];
}

/** Borderless bar list — reusable inside any container. */
export function ComponentTwo({ items }: ComponentTwoProps) {
  const max = items[0]?.count ?? 1;

  if (items.length === 0) {
    return <p className="text-xs text-slate-400">No data</p>;
  }

  return (
    <div
      className="flex flex-col gap-1.5 overflow-y-auto"
      style={{ maxHeight: items.length > 8 ? "14rem" : undefined }}
    >
      {items.map((item) => {
        const barPct = max > 0 ? (item.count / max) * 100 : 0;
        return (
          <div key={item.label} className="flex items-center gap-2 text-xs">
            <span
              className="w-28 shrink-0 truncate text-slate-700"
              title={item.label}
            >
              {item.label}
            </span>
            <div className="flex-1 h-1.5 rounded-full bg-slate-100 overflow-hidden">
              <div
                className="h-full rounded-full bg-blue-400"
                style={{ width: `${barPct}%` }}
              />
            </div>
            <span className="w-8 text-right font-medium text-slate-700">
              {item.count}
            </span>
          </div>
        );
      })}
    </div>
  );
}

Crashes in Docker (docker desktop 4.70.0) as well:

❯ docker run --rm -v $PWD:/app -w /app oven/bun:1.3.13 x --bun jscpd
Resolving dependencies
Resolved, downloaded and extracted [476]
Saved lockfile
============================================================
Bun v1.3.13 (bf2e2cec) Linux x64 (baseline)
Linux Kernel v6.12.76 | glibc v2.41
CPU: sse42 popcnt avx avx2
Args: "node" "/tmp/bunx-0-jscpd@latest/node_modules/.bin/jscpd"
Features: Bun.stderr(2) Bun.stdout(2) jsc tsconfig(16)
Builtins: "bun:main" "node:assert" "node:buffer" "node:child_process" "node:constants" "node:crypto" "node:events" "node:fs" "node:os" "node:path" "node:process" "node:stream" "node:util"
Elapsed: 395ms | User: 404ms | Sys: 74ms
RSS: 71.11MB | Peak: 133.75MB | Commit: 71.11MB | Faults: 0 | Machine: 16.77GB

panic(main thread): Segmentation fault at address 0x0
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

To send a redacted crash report to Bun's team,
please file a GitHub issue using the link below:

 https://bun.report/1.3.13/Bn1bf2e2cegCqgggC4vyi7E+++Po7khiFsy9giF2u7giF_2377jE_suk8jE_suk8jEsuk8jE2377jE2377jE2377jE2377jE2377jE2377jE2377jE2377jEA2AA

What is the expected behavior?

No response

What do you see instead?

No response

Additional information

Does not crash with bun 1.3.12.

Stack trace from bun bug report link:

Bun v1.3.13 ([`bf2e2ce`](<https://github.com/oven-sh/bun/tree/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79>)) on linux x86_64_baseline [RunAsNodeCommand]

Segmentation fault at address 0x00000000

- [`RegExpInlines.h:0`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79//webkitbuild/.JavaScriptCore/PrivateHeaders/JavaScriptCore/RegExpInlines.h#L0>): `int JSC::RegExp::matchInline<(...)0>`
- [`RegExpMatchesArray.h:70`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79//webkitbuild/.JavaScriptCore/PrivateHeaders/JavaScriptCore/RegExpMatchesArray.h#L70>): `JSC::createRegExpMatchesArray`
- [`RegExpObjectInlines.h:113`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79//webkitbuild/.JavaScriptCore/PrivateHeaders/JavaScriptCore/RegExpObjectInlines.h#L113>): `JSC::RegExpObject::execInline`
- *1 unknown/js code*
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79/ld-temp.o#L0>): `llint_op_call`
- *1 unknown/js code*
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79/ld-temp.o#L0>): `llint_op_call_ignore_result`
- *1 unknown/js code*
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79/ld-temp.o#L0>): `llint_op_call_ignore_result`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79/ld-temp.o#L0>): `llint_op_call_ignore_result`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79/ld-temp.o#L0>): `llint_op_call`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79/ld-temp.o#L0>): `llint_op_call`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79/ld-temp.o#L0>): `llint_op_call`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79/ld-temp.o#L0>): `llint_op_call`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79/ld-temp.o#L0>): `llint_op_call`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79/ld-temp.o#L0>): `llint_op_call`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79/ld-temp.o#L0>): `llint_op_call`
- [`ld-temp.o:0`](<https://github.com/oven-sh/bun/blob/bf2e2cecf27e800962b1e7f03d66278f9d5d2e79/ld-temp.o#L0>): `llint_op_call`

Features: tsconfig, Bun.stderr, Bun.stdout, jsc

[robobun]

✅ Reproduced on Linux x64. Minimal repro (one exec call):

/(?:[abc]+(?:.|b)|(?:a)*)*>/.exec(" x=\"c\" ");   // RIP=0 → SIGSEGV

Root cause: YARR JIT clearInnerParenContextHeadSlots (introduced by the c2010c4 → 4d5e75e WebKit bump in #29294) nulls a frame slot that aliases with a different subpattern's returnAddress in a sibling alternative. The next NestedAlternativeEnd backtrack does loadFromFrameAndJump on the zeroed slot → RIP=0.

Fix is in oven-sh/WebKit#189 (cherry-picks upstream 311137@main + adds sibling-alias guard). Ships to users via a WEBKIT_VERSION bump in this repo once that PR is merged and autobuilt.

Workaround until then: BUN_JSC_useRegExpJIT=0.