Segfault with readline

[matej21]

How can we reproduce the crash?

I encountered segfaults while using the Plop code generator, which internally relies on CLI tools like inquirer (for user input) or ora (progress). After running a generator, the process would hang, and pressing Enter would cause a segfault.

I've isolated the issue to readline when it's closed immediately after being created.

Minimal Reproduction Code

import readline from 'readline/promises';

const rl1 = readline.createInterface({
  input: process.stdin,
  output: process.stdout,
});

const name = await rl1.question('Enter your name: ');
console.log(`Hello, ${name}!`);
rl1.close();

const rl2 = readline.createInterface({
  input: process.stdin,
  output: process.stdout,
});
rl2.close();

Observations

1. If only rl2 exists (without rl1), the process hangs but does not segfault.
2. When both rl1 and rl2 are used, pressing Enter after the rl1 prompt results in a segfault.
3. Wrapping the rl2.close() call in setTimeout(..., 0) prevents the segfault.

Relevant log output

Stack Trace (bun.report)

Bun v1.1.37-canary (4117af6) on linux x86_64 [AutoCommand]

Segmentation fault at address 0x0000001A

• ld-temp.o:0: llint_op_call_ignore_result
• ld-temp.o:0: llint_op_call_ignore_result
• ld-temp.o:0: llint_op_call_ignore_result
• ld-temp.o:0: llint_op_call_ignore_result
• ld-temp.o:0: llint_op_call_ignore_result
• ld-temp.o:0: llint_op_call_ignore_result
• ld-temp.o:0: llint_op_call_ignore_result

Features: Bun.stdin, Bun.stdout, dotenv, jsc, tsconfig, tsconfig_paths, tsconfig_paths

_{Sentry Issue: BUN-4KP}