[robobun]

Problem

• bun test dies with SIGSEGV (exit code 139, nothing printed) on a file with about 30,000 nested describe() blocks. Describe callbacks run from a queue, so no JS stack limit applies.
• The cause is native recursion per nested scope in three walks over the describe tree: Order::generate_order_describe (src/runtime/test_runner/Order.rs), the implicit Drop of the Box<DescribeScope> tree, and retroactively_report_scope (src/runtime/jsc_hooks.rs).

Fix

• All three walks keep an explicit Vec of open scopes, in safe Rust. enter_describe and exit_describe hold the work before and after a scope's children.
• Correct because groups, sequences and debugger test IDs keep their order, and the PRNG is read at the same points. A 13-level fixture logs byte-identical runs, also with --randomize --seed=N.
• Verified: test/js/bun/test/describe.test.ts and test/cli/inspect/test-reporter.test.ts fail before and pass after on debug, release and release+ASan (Linux x64, 1 MB stack).

Background

• A DescribeScope owns entries: child scopes and ExecutionEntrys (tests and hooks). Order flattens that tree into the run schedule, on the main thread's stack.
• TestReporter is the inspector domain that follows a test run. Enabled after collection, it reports every scope collected so far.

Downsides

• Each test file pays one 224-byte heap allocation for the scope stack, more only when nesting passes 4 levels.
• Each describe() costs about 105 more instructions (a separate pre-merge A/B run, not reproduced here: no perf, no valgrind). CPU time shows no difference above A/A noise.
• The release binary gains 3,584 bytes of text (Linux x64).

Notes

• Provenance: found by construction (fuzzing), not by a user report. No crash banner is printed for this stack overflow, so it could not have reported itself either.
• gdb on main @ 4ff9193, D=50,000: #0 generate_order_describe (Order.rs:89), then generate_order_sub / generate_order_describe alternating, rsp just below the [stack] mapping. Under ulimit -s 65536 the same file passes, so stack depth is the only variable.
• Thresholds on Linux x64 at the default 8 MB: release 1.4.3 crashes from about D=30,000 (D=25,000 passes). The debug ASAN build passes D=20,000 and crashes at D=50,000 in the order pass, and at about 10,700 levels in the inspector walk.
• Thresholds at 1 MB: the order pass overflows from D=4,000 on release, D=3,000 on release+ASan and D=1,000 on debug. The inspector walk alone overflows at about 2,840 levels on release+ASan and between 6,000 and 10,000 on release.
• After the change the debug ASAN build runs D=150,000 under ulimit -s 1024, so no other per-level recursion is left on this path. debug::dump_describe still recurses, but it only runs with debug logging enabled.
• generate_order_describe keeps a stack of slice::IterMut over each open scope's entries plus a borrow of its after_all, so no new unsafe is needed. Drop for DescribeScope moves children onto a Vec<TestScheduleEntry> worklist. The inspector walk keeps (children, parent id) pairs.
• Linux sizes the main thread's stack from ulimit -s, so both tests pin it to 1 MB there. That keeps the trees small and makes the result independent of the machine's limit. macOS and Windows link a fixed 18 MB main-thread stack (scripts/build/flags.ts), where these depths fit with or without the change.
• The inspector test uses 2,000 levels on debug builds and 20,000 on every other build. A debug build has larger frames and spends about 0.5 ms per found event. The 20,000-level version takes about 0.2 s on release and 0.65 s on release+ASan. The first revision also used 2,000 levels on release+ASan. An unfixed release+ASan build survives 2,000 levels, so the test could not fail there.
• Fail-before and pass-after (Linux x64, 1 MB stack, one tree with the three src/ files at main or at this branch): both tests fail before and pass after on debug+ASan, release and release+ASan. With only the inspector walk unfixed, the inspector test dies with SIGSEGV after 1,157 of 2,001 found events on debug, 7,509 of 20,001 on release, and 2,478 of 20,001 on release+ASan.
• The 13-level order fixture has all four hooks, skip, todo, only and a throwing describe. The scope stack doubles at 4, 8, 16 open scopes.
• failure_skip_to indices point a failed beforeAll at the first afterAll of its scope. exit_describe sets them at the same moment the recursive version did: after the last child, before the afterAll groups are pushed.
• The inspector test uses the WebSocket transport (--inspect-wait=127.0.0.1:0). Over the unix-socket transport a multi-MB burst of found events arrives with broken framing on the receiving side. That is a separate bug in the buffered socket write path and is tracked separately.
• Allocation detail: OpenDescribe is 56 bytes and a Vec starts at capacity 4. The drop worklist takes over the root scope's entries buffer and reallocates only when a nested scope has more entries than the spare capacity. The inspector walk allocates its stack only when TestReporter.enable arrives late.
• Instruction detail, from the separate pre-merge A/B run (one core, 15 rounds, order rotating): about +105 per describe(). That is +2.5 to +2.8% on a file that is only nested describes, +0.9% on 20,000 flat describes of one test, and +0.009% (inside its 0.26% spread) on 100 describes of 100 tests with hooks. Not reproduced here: perf is not installed, perf_event_open returns EPERM, and valgrind is not installed.
• CPU time here (user+sys, 15 interleaved rounds of base, a second copy of base, and this branch, release builds): this branch against base gave -2.2%, -18.5% and -1.1% on 20,000 flat describes, 10,000 nested describes, and 100 describes of 100 tests with hooks. The A/A control moved -6.6%, -9.5% and -2.4%, and the run-to-run spread was 20 to 41%. No difference is measurable.
• size on release builds of one tree: text 80,705,363 to 80,708,947 bytes (+3,584). Data and bss are unchanged.
• Suites run on the debug build of the merged tree: describe, test-reporter, jest-hooks, failure-skip, test-randomize, only-inside-only, concurrent. Also run on the first revision: bun_test, test-only, test-test, test/cli/test/bun-test.test.ts, test/cli/test/isolation.test.ts.
• Self-reviewed: 4 concerns raised (new unsafe in Order.rs, the inspector walker, the test being vacuous with an unlimited stack, provenance), 4 addressed.
• The branch is merged with main @ f4d755a. The code in src/ is the same as in the first revision. Only comments were shortened.
• bun:test: remove unsafe from the test runner #40235 rewrites Order.rs around Rc/RefCell and keeps the recursion. Whichever lands second needs a small rebase: the frame would hold an Rc<DescribeScope> and an index instead of an IterMut.

---

no test proof · iteration 0 · platform-specific test(s) that do not run on this machine, deferring to CI, which covers all platforms: test/js/bun/test/describe.test.ts, test/cli/inspect/test-reporter.test.ts

[robobun]

Status

Reproduced on main @ 4ff9193 and on release 1.4.3 (Linux x64, default 8 MB stack):

printf 'import {test,expect,describe} from "bun:test";\nlet d=%s;function f(){if(d--<=0){test("leaf",()=>{expect(1).toBe(1)});return}describe("d"+d,f)}f();\n' 50000 > a.test.js
bun test ./a.test.js   # exit code 139, nothing printed after the file name

With this branch the same file prints 1 pass and exits 0, also with 150,000 levels under ulimit -s 1024.

The inspector walk reproduces with --inspect-wait, a client that sends TestReporter.enable after the leaf test starts, and the same fixture: the process dies with SIGSEGV part way through the found events. The new test in test/cli/inspect/test-reporter.test.ts does this.

PR: #42253

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: oven-sh/bun/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Essentials

Run ID: 6202e586-301c-48e2-9a7f-43234b2b262b

📥 Commits

Reviewing files that changed from the base of the PR and between 62a4d00 and ddb5a15.

📒 Files selected for processing (3)

• src/runtime/jsc_hooks.rs
• src/runtime/test_runner/Order.rs
• src/runtime/test_runner/bun_test.rs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

Walkthrough

Runtime test reporting, describe scheduling, and describe-scope destruction now use iterative traversal. Regression tests exercise deeply nested describes, retroactive debugger reporting, parent IDs, and subprocess completion.

Changes

Deep test traversal

Layer / File(s)	Summary
Iterative debugger reporting src/runtime/jsc_hooks.rs, test/cli/inspect/test-reporter.test.ts	Retroactive reporting walks nested describe scopes with an explicit stack, preserves existing debugger IDs, and assigns missing IDs. The regression test checks reported scope counts and parent IDs.
Iterative describe scheduling src/runtime/test_runner/Order.rs, test/js/bun/test/describe.test.ts	Describe scheduling tracks open scopes iteratively, skips non-only children when required, and handles hooks and failed scopes. The regression test runs 10,000 nested scopes and checks completion and test results.
Iterative scope cleanup src/runtime/test_runner/bun_test.rs	Scope destruction drains nested entries iteratively.

Suggested reviewers: jarred-sumner, dylan-conway

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to ddb5a

The changed traversals preserve the established behavior, so no concrete merge-blocking risk is established.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: replacing native recursion with iterative traversal for deeply nested describe scopes.
Description check	✅ Passed	The description explains the problem, implementation, verification, background, and trade-offs. It does not use the template headings exactly, but it provides the required information in equivalent se…

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

I reviewed this and found no bugs. The three recursion→explicit-stack conversions look behaviorally equivalent and the tests pin ulimit -s 1024 so they fail for the right reason. Deferring to a human because generate_order_describe is the scheduling pass every bun test run goes through, and the PR flags a rebase interaction with #40235 that a maintainer should coordinate.

What was reviewed:

• Order.rs: traced enter_describe/exit_describe against the removed recursive body — beforeAll, shuffle, Only::Contains filter, failure_skip_to, and afterAll fire at the same points; generate_order_sub is dead and removed.
• jsc_hooks.rs: pre-order walk preserves parent-id assignment for both the newly-assigned and already-had-ID branches.
• Drop for DescribeScope: pending.append empties scope.entries before the boxed scope drops, so re-entry into drop is constant-depth, not per-level.

Extended reasoning...

Overview

This PR removes native-stack recursion proportional to describe() nesting depth in three places in the test runner: Order::generate_order_describe (the scheduling flatten pass), retroactively_report_discovered_tests (the inspector's TestReporter catch-up walk), and the implicit Drop of the DescribeScope tree. Each is converted to an explicit Vec worklist. The now-dead mutual-recursion helper generate_order_sub is deleted. Two tests are added to existing files: one nests 10,000 scopes under a 1 MB stack and asserts the leaf passes; the other drives the inspector's retroactive walk over a 2,000/20,000-deep tree and verifies every parent/child link.

Security risks

None. This is internal test-runner scheduling and inspector reporting; no user input parsing, no auth, crypto, or network surface is touched. The change adds no unsafe blocks — soundness of the stacked IterMut borrows is enforced by the borrow checker (each nested scope is Box<DescribeScope>, so the iterators borrow disjoint heap allocations under one lifetime tied to root).

Level of scrutiny

Moderate-to-high. The transformation itself is mechanical and I traced each site line-by-line against the removed recursive bodies: enter_describe runs the pre-order work (failed-scope early-out, beforeAll, shuffle) and captures only/use_hooks/beforeall_order/after_all; the main loop applies the same Only::Contains filter; exit_describe runs set_failure_skip_to then afterAll at the same relative moment (after the last child, before afterAll groups are pushed). The inspector walk keeps the "already-has-ID" branch by reading test_id_for_debugger after the conditional assignment. The custom Drop empties each child's entries before the child's own Drop runs, so recursion depth is bounded at 2. That said, Order.rs is the code path that decides execution order, hook grouping, and skip targets for every bun test invocation — a subtle ordering regression would be high-blast-radius, and the PR itself names a competing rewrite (#40235) that a maintainer needs to sequence.

Other factors

The tests follow REVIEW.md conventions closely: ulimit -s 1024 on Linux pins the failure condition so the test cannot pass vacuously on a machine with a large default stack; depth is branched on isDebug/isASAN; the inspector test races every wait against process exit (orExit) so a SIGSEGV surfaces as a failure with stderr rather than a hang; subprocess pipes are drained concurrently; assertions on output precede the exit-code check. The PR description reports byte-identical execution logs on a 13-level hooks/skip/todo/only/throwing fixture including --randomize --seed=N, and lists the sibling suites run locally — I could not independently verify those runs, which is the residual reason a human sign-off is worthwhile.

[robobun]

^{Updated 10:08 PM PT - Oct 1st, 2026}

✅ @robobun, your commit ddb5a1558f41e420dc56b94be6cce102ded89c6f passed in Build #122683! 🎉

---

🧪   To try this PR locally:

bunx bun-pr 42253

That installs a local version of the PR into your bun-42253 executable, so you can run:

bun-42253 --bun

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[Jarred-Sumner]

This is Claude (an AI assistant) commenting on Jarred's behalf.

This fix went in with #46021, which is merged. Closing.