Bun.$ crashes on macOS ARM64 with large array of non-empty strings

[kawaz]

How can we reproduce the crash?

Either of these will crash:

In .ts file

import { $ } from 'bun'
await $`echo ${Array(10000).fill('a')}`

Or using bun -e

bun -e 'await Bun.$`echo ${Array(10000).fill("a")}`'

Note: The array size that causes the crash may vary. On my M1 MacBook Pro, it crashes at 9423 elements.

These work fine:

// Works with empty strings even with larger arrays
await $`echo ${Array(10000000).fill("")}`

// Works on Linux amd64 with both empty and non-empty strings
await $`echo ${Array(1000000).fill("a")}`

Relevant log output

bun run ./bun-shell-9432-args.ts
============================================================
Bun v1.1.34 (5e5e7c60) macOS Silicon
macOS v14.6.1
Args: "bun" "run" "./bun-shell-9432-args.ts"
Features: Bun.stderr Bun.stdout jsc shell(2) tsconfig
Builtins: "bun:main"
Elapsed: 49ms | User: 16ms | Sys: 33ms
RSS: 66.08MB | Peak: 66.08MB | Commit: 1.07GB | Faults: 96

panic(main thread): Segmentation fault at address 0x16C0B7CA8
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

To send a redacted crash report to Bun's team,
please file a GitHub issue using the link below:

 https://bun.report/1.1.34/Mr15e5e7c6AqggkghC__mjgkU2m+8RmjgkU2m+8RmjgkU2m+8RmjgkU2m+8RA2Cwq+thsD

Trace/BPT trap: 5

Stack Trace (bun.report)

Bun v1.1.34 (5e5e7c6) on macos aarch64 [AutoCommand]

Segmentation fault at address 0x00000008

• 2 unknown/js code
• src.shell.interpreter.StatePtrUnion
• src.shell.interpreter.Interpreter.Expansion.next
• src.shell.interpreter.StatePtrUnion
• src.shell.interpreter.Interpreter.Expansion.next
• src.shell.interpreter.StatePtrUnion
• src.shell.interpreter.Interpreter.Expansion.next
• src.shell.interpreter.StatePtrUnion
• src.shell.interpreter.Interpreter.Expansion.next

Features: Bun.stdin, jsc, shell, spawn, tsconfig

_{Sentry Issue: BUN-30Q}