Crash (panic) when combining Array.find with property accessor

[jeroenheijmans]

How can we reproduce the crash?

While doing Advent of Code I ran into a bun crash. I managed to boil it down into a rather small reproducible scenario:

// Run with "bun repro.js" from "/tmp/bun-repro"
const list = [{ myMap: { "A": [] }}];
const idx = "A";
const foo = list.find(_ => true).myMap[idx];

With (full details further down):

panic(main thread): Scope mismatch while visiting...

Some initial observations:

• replacing .find(...) with just [0] will avoid the crash
• replacing myMap[idx] with myMap["A"] will avoid the crash

PS. I tried looking through the existing issues but found it hard to determine if mine would be a duplicate. Sorry if it is!

PS. The "Stack Trace" block was auto-filled when coming from Bash to this URL, complete with all the control characters. I found no way to circumvent this, sorry! The "Relevant log output" part probably contains the exact same data copied from my terminal, in a much better format.

Relevant log output

$ bun repro.js 
============================================================
Bun v1.1.38 (bf2f153f) Linux x64
Linux Kernel v6.8.0 | glibc v2.39
CPU: sse42 popcnt avx avx2
Args: "bun" "repro.js"
Features: jsc 
Builtins: "bun:main" 
Elapsed: 7ms | User: 4ms | Sys: 5ms
RSS: 1.07GB | Peak: 33.03MB | Commit: 1.07GB | Faults: 0

panic(main thread): Scope mismatch while visiting
3 | const foo = list.find(_ => true).baz[idx];
                          ^
debug: Expected this scope (.function_args)
    at /tmp/bun-repro/repro.js:3:23

1 | const list = [{ myMap: { "A": [] }}];
    ^
debug: Found this scope (.entry)
    at /tmp/bun-repro/repro.js:1:1

Crashed while visiting /tmp/bun-repro/repro.js
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

Stack Trace (bun.report)

Bun v1.1.38 (bf2f153) on linux x86_64 [RunCommand]

panic: Scope mismatch while visiting
�[2m4 | �[0m�[0m�[35mconst�[0m foo = bar�[0m�[3m�[1m.find�[0m(b => b.char === target).paths[idx]�[0m�[2m;�[0m
�[2m�[1m�[2m�[1m^�[0m
�[2mdebug�[0m�[2m: �[0m�[2m�[1mExpected this scope (.function_args)�[0m
�[2mat �[0m�[36m/home/jeroen/git/prive/advent-of-code-2024/src/repro.js�[0m�[2m:�[0m�[33m4�[0m�[2m:�[0m�[33m22�[0m

�[2m1 | �[0m�[0m�[35mconst�[0m bar = [{ char: �[0m�[32m"A"�[0m, paths: { A: [] }}]�[0m�[2m;�[0m
�[2m�[1m�[2m�[1m^�[0m
�[2mdebug�[0m�[2m: �[0m�[2m�[1mFound this scope (.entry)�[0m
�[2mat �[0m�[36m/home/jeroen/git/prive/advent-of-code-2024/src/repro.js�[0m�[2m:�[0m�[33m1�[0m�[2m:�[0m�[33m1�[0m

• js_parser.zig:14701: src.js_parser.NewParser_
• js_parser.zig:14677: src.js_parser.NewParser_
• js_parser.zig:7027: src.js_parser.NewParser_
• js_parser.zig:17549: src.js_parser.NewParser_
• js_parser.zig:16041: src.js_parser.NewParser_
• js_parser.zig:16977: src.js_parser.NewParser_
• js_parser.zig:16977: src.js_parser.NewParser_
• js_parser.zig:16718: src.js_parser.NewParser_
• js_parser.zig:20383: src.js_parser.NewParser_

Features: jsc

_{Sentry Issue: BUN-A5M}

[github-actions]

@jeroenheijmans, the latest version of Bun is v1.1.41, but this crash was reported on Bun v1.1.38.

Are you able to reproduce this crash on the latest version of Bun?

bun upgrade

[jeroenheijmans]

Fair point!

Just upgraded (and it went a version higher even, to 1.1.42), the crash still occurs. Here's the output from a retry:

============================================================
Bun v1.1.42 (50eec002) Linux x64
Linux Kernel v6.8.0 | glibc v2.39
CPU: sse42 popcnt avx avx2
Args: "bun" "run" "repro.js"
Features: jsc 
Builtins: "bun:main" 
Elapsed: 6ms | User: 2ms | Sys: 7ms
RSS: 1.07GB | Peak: 33.69MB | Commit: 1.07GB | Faults: 0

panic(main thread): Scope mismatch while visiting
4 | const foo = list.find(_ => true).myMap[idx];
                          ^
debug: Expected this scope (.function_args)
    at /tmp/bun-repro/repro.js:4:23

1 | // Run with "bun repro.js" from "/tmp/bun-repro"
    ^
debug: Found this scope (.entry)
    at /tmp/bun-repro/repro.js:1:1

Crashed while visiting /tmp/bun-repro/repro.js
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

At this time the bun.report servers are giving me 502 errors (from Cloudflare) so I can't seem to add a crash report with the link at this moment.

[b0o]

Regression happened somewhere between 1.1.17 and 1.1.18. Simpler repro:

const k = "A";
(_ => {})[k]