Detect circular references when inspecting JSX elements

[robobun]

Bun.inspect() crashes with a segfault when formatting a React element that contains a circular reference back to itself via key, a prop value, or children.

The .JSX format tag was not included in canHaveCircularReferences(), so the formatter recursed into the element without the stack-safety check or the visited-object map that normally prints [Circular].

Repro

const el = {
  $$typeof: Symbol.for("react.element"),
  type: "div",
  key: null,
  ref: null,
  props: {},
};
el.key = el;
Bun.inspect(el); // segfault

After

<div key=[Circular] />

Found by Fuzzilli (fingerprint bb8715595a137556).

[robobun]

^{Updated 8:50 AM PT - May 1st, 2026}

❌ @robobun, your commit b1520bf has 1 failures in Build #49753 (All Failures):

• scripts/build/ci.ts - build failed on 🐧 x64-musl-baseline - build-zig
• scripts/build/ci.ts - build failed on 🐧 aarch64 - build-zig
• scripts/build/ci.ts - build failed on 🐧 x64 - build-zig
• scripts/build/ci.ts - build failed on 🐧 x64-musl-baseline - build-cpp
• scripts/build/ci.ts - build failed on 🍎 aarch64 - build-zig
• scripts/build/ci.ts - build failed on 🐧 x64-baseline - build-zig
• scripts/build/ci.ts - build failed on 🍎 x64 - build-zig
• scripts/build/ci.ts - build failed on 🐧 aarch64-android - build-zig
• scripts/build/ci.ts - build failed on 🐧 aarch64-musl - build-zig
• scripts/build/ci.ts - build failed on 🐧 x64-android - build-zig
• scripts/build/ci.ts - build failed on :freebsd: aarch64 - build-zig
• scripts/build/ci.ts - build failed on 🐧 x64-musl - build-zig
• scripts/build/ci.ts - build failed on :freebsd: x64 - build-zig

---

🧪   To try this PR locally:

bunx bun-pr 30043

That installs a local version of the PR into your bun-30043 executable, so you can run:

bun-30043 --bun

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: b37f2aef-fe30-4474-ace7-ddf91d9ecbfd

📥 Commits

Reviewing files that changed from the base of the PR and between df946dc and b1520bf.

📒 Files selected for processing (3)

• src/bun.js/ConsoleObject.zig
• src/bun.js/test/pretty_format.zig
• test/js/bun/util/inspect.test.js

---

Walkthrough

The changes extend circular reference detection to JSX values in the pretty-printing and inspection logic. Two core files are updated to include .JSX in circular reference eligibility checks, and test coverage is added to verify [Circular] detection in self-referential JSX structures.

Changes

Cohort / File(s)	Summary
JSX Circular Reference Detection src/bun.js/ConsoleObject.zig, src/bun.js/test/pretty_format.zig	Updates circular reference eligibility checks to include .JSX values alongside existing types, enabling [Circular] detection and recursion prevention for self-referential JSX structures.
JSX Circular Reference Inspection Tests test/js/bun/util/inspect.test.js	Adds test coverage for Bun.inspect with React-element-shaped objects containing circular references on element fields and nested props, including multiline output verification.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and directly summarizes the main change: adding circular reference detection for JSX elements in the inspector.
Description check	✅ Passed	The description includes the problem statement, root cause, reproduction case, and expected output, but lacks explicit 'What does this PR do?' and 'How did you verify?' sections from the template.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Review rate limit: 4/5 reviews remaining, refill in 12 minutes.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

This PR may be a duplicate of:

1. Fix stack overflow in Bun.inspect() on circular JSX elements #29709 - Also fixes circular JSX element handling in Bun.inspect() by adding .JSX to canHaveCircularReferences() in both ConsoleObject.zig and pretty_format.zig

🤖 Generated with Claude Code

[robobun]

Duplicate of #29709, which already contains this fix plus additional handling for non-object props.

[claude]

LGTM — minimal fix that extends the existing circular-reference guard to the JSX format tag, with tests covering key/prop/children cycles.

Extended reasoning...

Overview

This PR adds .JSX to the canHaveCircularReferences() predicate in both src/bun.js/ConsoleObject.zig and src/bun.js/test/pretty_format.zig. Each is a one-token addition to an existing switch/or-chain. A new test in test/js/bun/util/inspect.test.js exercises three circular shapes (self-referential key, prop value, and children) and asserts the [Circular] rendering.

Security risks

None. The change only flips a comptime predicate so that the formatter's pre-existing visited-map + stack-safety guard runs for the .JSX tag, exactly as it already does for .Object, .Array, .Map, etc. No new parsing, allocation, or input handling is introduced.

Level of scrutiny

Low. This is a mechanical, pattern-following crash fix in inspect/pretty-print output code (not on a hot correctness path like the bundler or runtime semantics). The guarded code path (getOrPut on the visited map, print [Circular] on hit, remove on exit) is identical to what every other recursive tag already uses, so there's no novel logic to review.

Other factors

The PR was generated from a Fuzzilli crash fingerprint and includes regression tests that would have segfaulted before. The bug-hunting system found no issues. There are no outstanding reviewer comments and no prior reviews on the timeline.