Fix Bun.generateHeapSnapshot("v8") aborting on heaps past ~15M objects (WebKit#529)

scripts/build/deps/webkit.ts

@@ -3,7 +3,7 @@
  * for local mode. Override via `--webkit-version=<hash>` to test a branch.
  * From https://github.com/oven-sh/WebKit releases.
  */
-export const WEBKIT_VERSION = "ceb9f90fb774fdb1ebf1275ae1aaf136ec66c754";
+export const WEBKIT_VERSION = "autobuild-preview-pr-529-d199c1f1";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.

src/jsc/BunHeapProfiler.rs

@@ -33,7 +33,13 @@ pub(crate) fn generate_and_write_profile(
     };
 
     if profile_string.is_empty() {
-        // No profile data generated
+        // The V8 builder returns an empty string when the snapshot was too
+        // large to serialize. Say so instead of silently writing nothing.
+        // The text profiler reports its own errors inline, so leave it alone.
+        if !config.text_format {
+            bun_core::pretty_errorln!("<red>error<r>: heap snapshot is too large to serialize");
+            Output::flush();
+        }
         return Ok(());
     }
 

src/jsc/bindings/BunObject.cpp

@@ -815,6 +815,10 @@ JSC_DEFINE_HOST_FUNCTION(functionGenerateHeapSnapshot, (JSC::JSGlobalObject * gl
             JSC::BunV8HeapSnapshotBuilder builder(heapProfiler);
             auto bytes = builder.jsonBytes();
             RETURN_IF_EXCEPTION(throwScope, {});
+            if (builder.hasOverflowed()) {
+                throwException(globalObject, throwScope, createError(globalObject, "Heap snapshot is too large to serialize"_s));
+                return {};
+            }
             auto released = bytes.releaseBuffer();
             auto span = released.leakSpan();
             auto buffer = ArrayBuffer::createFromBytes(std::span<const uint8_t> { span.data(), span.size() }, createSharedTask<void(void*)>([](void* p) {
@@ -826,6 +830,10 @@ JSC_DEFINE_HOST_FUNCTION(functionGenerateHeapSnapshot, (JSC::JSGlobalObject * gl
         JSC::BunV8HeapSnapshotBuilder builder(heapProfiler);
         auto json = builder.json();
         RETURN_IF_EXCEPTION(throwScope, {});
+        if (json.isNull()) {
+            throwException(globalObject, throwScope, createError(globalObject, "Heap snapshot is too large to serialize"_s));
+            return {};
+        }
         return JSC::JSValue::encode(jsString(vm, json));
     }
 

src/jsc/bindings/webcore/JSWorker.cpp

@@ -760,9 +760,20 @@ static inline JSC::EncodedJSValue jsWorkerPrototypeFunction_getHeapSnapshotBody(
         JSC::BunV8HeapSnapshotBuilder builder(heapProfiler);
         String snapshot = builder.json();
 
+        // json() returns a null String when the snapshot was too large to
+        // serialize; reject instead of resolving with an empty string.
         ScriptExecutionContext::postTaskTo(parentId, parentLoopKind,
             [reqId, protectedProxy = WTF::move(protectedProxy), snapshot = snapshot.isolatedCopy()](ScriptExecutionContext& parentCtx) {
-                resolveCrossVMRequest(protectedProxy.get(), reqId, parentCtx, [&](VM& vm, JSGlobalObject*) -> JSValue { return jsString(vm, snapshot); });
+                auto handle = protectedProxy->takeCrossVMRequest(reqId);
+                if (!handle || parentCtx.isJSExecutionForbidden())
+                    return;
+                auto& parentVM = parentCtx.vm();
+                auto* parentGlobalObject = parentCtx.globalObject();
+                if (snapshot.isNull()) {
+                    handle->reject(parentVM, JSC::createError(parentGlobalObject, "Heap snapshot is too large to serialize"_s));
+                    return;
+                }
+                handle->resolve(parentGlobalObject, parentVM, jsString(parentVM, snapshot));
             });
     });
     if (!accepted) {

test/js/bun/util/v8-heap-snapshot.test.ts

@@ -1,5 +1,5 @@
 import { expect, test } from "bun:test";
-import { bunEnv, bunExe, tempDir } from "harness";
+import { bunEnv, bunExe, isASAN, isDebug, tempDir } from "harness";
 import { join } from "node:path";
 
 const fixture = join(import.meta.dir, "v8-heap-snapshot-fixture.ts");
@@ -89,6 +89,36 @@ test("v8.writeHeapSnapshot() with path", async () => {
   expect(await runFixture("write-path", { args: [path] })).toEqual({ returnedPath: path, ...structure });
 });
 
+// #40686: the builder stored one 96-byte Node per heap cell in a contiguous
+// WTF::Vector, whose single-allocation cap is ~2GiB. Past ~15M live cells the
+// vector growth tripped that cap and aborted the process (SIGABRT) inside the
+// marking walk. 16M small objects reproduce it. The walk visits every live
+// cell, so the heap has to actually be this large; ~30s and ~4GB RSS in a
+// release build, but 10-100x slower under debug/ASAN, hence the skip there.
+test.skipIf(isDebug || isASAN)(
+  "v8 heap snapshot of a 16M-object heap does not crash",
+  async () => {
+    await using proc = Bun.spawn({
+      cmd: [
+        bunExe(),
+        "-e",
+        `const items = Array.from({ length: 16_000_000 }, (_, i) => ({ i }));
+         const snapshot = Bun.generateHeapSnapshot("v8");
+         console.log(items.length, snapshot.length > 100_000_000);`,
+      ],
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(stderr).toBe("");
+    expect(stdout).toBe("16000000 true\n");
+    expect(exitCode).toBe(0);
+  },
+  240_000,
+);
+
 test("v8 heap snapshot labels Web Streams internal edges", async () => {
   const edges = await runFixture("stream-edges");
   // Every WriteBarrier member reported by analyzeHeap shows up as a named