TypeScript: Segmentation fault on Node.js 22
🔎 Search Terms
“segmentation fault”
🕗 Version & Regression Information
- This is a crash
⏯ Playground Link
https://github.com/remarkjs/remark/tree/main/packages/remark-parse
💻 Code
The code is not actually relevant. It still happens if you remove the content of packages/remark-parse/lib/index.js. The existence of the file is important.
🙁 Actual behavior
Using Node.js 22, running tsc --build from the remark-parse workspace, yields:
$ tsc -b
[1] 57135 segmentation fault (core dumped) tsc -b
🙂 Expected behavior
It generates type definitions
Additional information about the issue
It works in Node.js 20, but not Node.js 22.
If the project is built with Node.js 20, then an incremental build with Node.js 22 won’t crash TypeScript.
Neither tsc nor tsc --showConfig not tsc --build --clean causes a crash, only tsc --build.
See https://github.com/remarkjs/remark/pull/1291#issuecomment-2084920007 for some more info where this was first discovered.
About this issue
- Original URL
- State: open
- Created 2 months ago
- Comments: 26 (8 by maintainers)
Not reproing for me on Windows x64 Node 22.0.0 tsc 5.5.0-dev.20240430, potato laptop
The TypeScript compiler is JavaScript code, which should never be able to cause a segfault (as that would likely be a security issue in e.g. browsers). This sound more like a Node and/or V8 bug to me.
I just confirmed using
typescript@nextfixed it for me.After setting up everything again to make a nice reproduction, I see the behaviour @wooorm described: the
👉emoji causes the crash, it’s not random anymore.I have also setup a test matrix in GitHub actions which shows that this errors occurs in Linux. It can’t be reproduced on Windows, because npm shipped with Node.js 22 on Windows appears to be broken.
Fair. I pushed the reproduction repo to https://github.com/remcohaszing/typescript-bug-58369.
Since @wooorm and I have slightly different results, I suspect the hardware plays a role and you have a very beefy development machine.
I use Linux by the way. That may be relevant.
Based on a new project with only the files as described in https://github.com/microsoft/TypeScript/issues/58369#issuecomment-2085192574:
So if I understand correctly the culprit is #53081.
My point stands. tsc is pure JS code; if any version of the compiler can cause a segmentation fault that crashes the Node.js process, that’s a potential security issue and should be brought up to the Node.js team.
The crash does not happen in TS 5.1.0-dev.20230307. But does occur with TS 5.1.0-dev.20230308.
Here’s the diff, which is too big to put in markdown. And I’m not allowed to use
.diffas an extension here.diff.txt
Interesting from what I’m reading: looks like an introduction of
scanJSDocCommentTextToken, and new code relating to positional info? The rest of the diff looks like the renumbering of the enums. And renaming functions fromgetStartPos->getTokenFullStart;setTextPos->resetTokenState. some more interesting code at the end, aroundremoveTrailingWhitespaceandpushCommentin I believe the tokenizer.Idea: could
Debug.assertcause a crash on Node 22?Also repro’d at https://github.com/syntax-tree/mdast-util-to-string/actions/runs/8894134799, https://github.com/syntax-tree/unist-util-visit-parents/actions/runs/8893972759, and https://github.com/syntax-tree/unist-util-visit/actions/runs/8894107813/job/24421655968, which are simpler.
The segment fault goes away by removing
declaration: truein tsconfig.Particularly
mdast-util-to-stringis a simple repo that I recommend looking at.What these repos have in common is that they use(edit:.d.tsfiles.mdast-util-to-stringdoesn’t)