Bun’s New Crash Reporter

368 points by zackoverflow 2 years ago | 80 comments

LiamPowell 2 years ago |

So the argument for using this over a regular stack trace is that they don't have to ship megabytes of debug symbols. However they have seemingly just ignored the better option of only including function names in the debug table, which is obviously a much nicer option than having to use a web service to view you stack trace.

This isn't just a theoretical solution either, it's already implemented in LLVM: https://clang.llvm.org/docs/UsersManual.html#cmdoption-gline...

Jarred 2 years ago | |

> the argument for using this over a regular stack trace is that they don't have to ship megabytes of debug symbols

No, it’s because almost nobody has enough patience to upload a crash report for a GitHub issue. It has to be easy. Making it a URL that autofills the form with almost everything we need makes it easy. The size matters too, we didn’t want it to have downsides for our users, but the important thing is making this whole process really easy for the user so that enough developers actually upload crash reports.

LewisJEllis 2 years ago | |

"they have seemingly just ignored the better option...obviously much nicer"

This comes off a bit presumptuous. I would assume that they are aware this is a possibility.

"having to use a web service to view you stack trace"

This is just not a downside that matters for this usage scenario. It's almost the same story as minifying your frontend JS bundle, uploading source maps to Sentry, then using Sentry to view an unminified stack trace from a user's browser. The user was never going to view that stack trace anyway, and I am not bothered by having to use Sentry to view it - I never would have seen it at all otherwise.

AnthonyMouse 2 years ago | | |

> The user was never going to view that stack trace anyway

Speak for yourself.

The ability to understand and affect what's going on in your own user agent is important not just to users having control over their own devices, it changes the social fabric. You can't get interested in how something works because to you it's an opaque blob whose priests have declared you unworthy. Curiosity suppressed. That's bad for the kids.

LiamPowell 2 years ago | | |

> This comes off a bit presumptuous. I would assume that they are aware this is a possibility.

They don't present it here, they justify their solution by claiming that the existing solution is bad because it includes several megabytes of debug symbols.

hitekker 2 years ago | | |

On the note of awareness of possibilities vs ignorance, I found this thread on HN to be gold: https://news.ycombinator.com/item?id=37592471

The creator of Vue pointed out a new feature for Svelte was a similar feature that Vue had tried and discarded. The creator of Svelte showed up to explain their position; I thought their exchange was illuminating. I was also impressed by Vue's research & experimentation.

tambourine_man 2 years ago | | |

> I am not bothered by having to use Sentry to view it

I am. And by source maps in general.

RicoElectrico 2 years ago | | |

> The user was never going to view that stack trace anyway,

Well akchually, I found stack traces useful as a user. It allowed me to pinpoint an issue (SPICE simulator crashing due to inconsistent quote handling in E-sources vs another simulator which did not crash). IDK how else I'd be able to find this other than file a Jira ticket to the simulator team (and then wait 2 days for various people to pass the ticket, as they almost always do)

dewey 2 years ago | |

If you criticize something where you have no context, were not part of the discussions and aware of the trade offs that were made it comes across a bit arrogant to say they should “obviously” “just” do something else.

There’s other ways to suggest an alternative solution.

LiamPowell 2 years ago | | |

Maybe it comes off that way a bit, but I can only go off what's in the blog post where they begin by calling the existing solution bloated in order to justify their new solution without ever mentioning that the debug table contains much more than just function names and line number mappings.

I do think it should be obvious that displaying text directly in the console is better than relying on a web service to display that same text.

simscitizen 2 years ago | |

Another option on macOS/iOS is to ship just the LC_FUNCTION_STARTS section in the Mach-O binary. This is how symbolication can discover function names from system libraries even without full debug symbols on those platforms.

saagarjha 2 years ago | |

These can still be large. I generally include them unconditionally because I think they bring value but most software does not.

cryptonector 2 years ago |

This is great. Very creative. Many should copy this scheme. The key is the relative-to-executable/shared object base stack trace program counters.

bun is statically linked, yes? In a dynamically linked system one would need to prefix every normalized program counter with a small numeric shared object ID.

andersa 2 years ago | |

It's not really anything new. Very common in environments where you can't ship symbols such as games crashing on player's computers.

For example, the Unreal Engine crash reporter has been capable of sending such a simple format for many years. You can restore a reasonably accurate function/line number from it for each stack frame.

Though minidump is usually preferred as having the stack variables can give additional hints to what happened.

nikita 2 years ago |

Microsoft is really good at this BTW. At SQL Server we had mini dumps they were tiny stripped out of personal info and incredibly useful. And a full dump of a production SQL Server even at that time (15 years ago) would be a huge file - too big to move around.

jallmann 2 years ago | |

Curious - was this for Microsoft internal services or customer deployments? If the latter, how did they know what was PII?

nikita 2 years ago | | |

I believe you had to opt in and it has some legal language before it. All the data pages were stripped and SQL Servers stores all data in the buffer pool. But of course you could find some stuff on the stack and other caches.

malkia 2 years ago | | |

Possibly this was used MiniDumpFilterTriage (from https://learn.microsoft.com/en-us/windows/win32/api/minidump...) and some of other stripping/scrubbing data fields.

This one fills all non-null ptr in the callstack (and other areas?) with 0xAAAAAAAA

I actually had to fix this for us two weeks ago, as our internal tools were crashing on the CI with this, and it wasn't helpful (to us), but at the same time understand how important is for this if shipped to external customers.

Crashdumps are underrated field that needs more eyes to solve the big data problem there.

punkbit 2 years ago |

After years following bun, (seen first tweets about from zig) have recently started using it. Stuff just works without any hassle! Thank you

elliotlarson 2 years ago |

Bun seems really compelling. I tried it out for a couple of small example projects and I like the speed and the fact that it combines package management and a JS runtime. However, I use Dependabot on most of my serious projects. I know work is under way, or at least there is some discussion in a couple of repo issues, for Bun support in Dependabot. I'm kind of holding off on using it until support for it has been rolled out.

nathankleyn 2 years ago | |

We had the same reticence about Dependabot missing before we made the switch, but realised Renovate works with Bun and is a good enough stand in for now until support arrives.

Absolutely zero regrets, the cumulative savings across everything that is faster and the massive step up in DX is worthy of the hype.

elliotlarson 2 years ago | | |

Yeah, I had heard about Renovate supporting Bun. I guess I was reluctant to start working with another 3rd party dependency management system when I already knew how to setup and use Dependabot, and I assumed Bun support was coming soon-ish. But maybe the benefits of moving over to Renovate and getting to use Bun now outweighs the costs. <thinking-about-it>

lelo_tp 2 years ago |

Few people would notice how much attention was put into it. Love it, really tells how much the folks behind bun care about their craft

herpderperator 2 years ago |

Bun is amazing, but I recently tried to make an http/2 server through fastify and was not able to:

     user@host:~/d/temp/server$ bun run index_fastify.js
     14 |   warned.add(feature), console.warn(new NotImplementedError(feature, issue));
     15 | }, $;
     16 |
     17 | class NotImplementedError extends Error {
     18 |   code;
     19 |   constructor(feature, issue) {
                                    ^
     NotImplementedError: node:http2 createServer is not yet implemented in Bun. Track the status & thumbs up the issue: https://github.com/oven-sh/bun/issues/887
      code: "ERR_NOT_IMPLEMENTED"

           at new NotImplementedError (internal:shared:19:27)
           at internal:shared:2:69
           at node:http2:48:53
           at getServerInstance (/Users/user/d/temp/server/node_modules/fastify/lib/server.js:342:16)
           at createServer (/Users/user/d/temp/server/node_modules/fastify/lib/server.js:25:18)
           at fastify (/Users/user/d/temp/server/node_modules/fastify/fastify.js:198:30)
           at /Users/user/d/temp/server/index_fastify.js:4:13

The linked issue is actually about implementing support for http/2 clients, which was already released in v1.0.13 (https://bun.sh/blog/bun-v1.0.13#http2-client-support). The NotImplementedError message should be updated to point to the issue for the server variant: https://github.com/oven-sh/bun/issues/8823

Implementing http/2 server support is in the top few feature requests (https://github.com/oven-sh/bun/issues?q=is%3Aissue+is%3Aopen...). It looks like once they ship this, a lot more people will be able to move over to Bun.

drewbitt 2 years ago | |

That's just the status of Bun. Wait for implementations -> turns out you need more implementations of other APIs once that's done -> wait some more -> it comes out but will crash at various edge cases -> wait some more -> repeat. Bun is just too early in its lifecycle. Very hopeful for the project though!

alimnes 2 years ago | | |

Yes, but http2 is one of the few features Bun is missing. Overall it's pretty complete.

vvpan 2 years ago |

So, anybody using Bun? Does it live up to hype?

toxik 2 years ago |

I feel like this post was a great case study of Zig. Interesting!

tredre3 2 years ago |

Did you know that bun needs to download 37 packages before the repl becomes available? No internet no repl for you.

    PS C:\Users\anon> bun repl
       bun-repl [6/6]
    error: FailedToOpenSocket downloading package manifest bun-repl
    error: bun-repl@latest failed to resolve

Not a big deal, but I was expecting (and frankly excited) to have a single no-install executable to drop in my PATH and have it just work!

Jarred 2 years ago | |

We haven’t prioritized implementing a repl yet. The current repl is a community-implemented bun-repl npm package. `bun repl` internally does the equivalent of `bunx bun-repl`

Kwpolska 2 years ago | | |

Sounds like a security nightmare.

Does `bun foobar` translate to `bunx bun-foobar` as well?

ctoth 2 years ago |

TIL: Bun runs on Windows and can be installed with scoop.

nimish 2 years ago |

Does debug fission not work? Microsoft uses it extensively including having a shared PDB server.

https://gcc.gnu.org/wiki/DebugFission

alkonaut 2 years ago |

Strange that it doesn’t include some random bytes so the same report can’t be submitted many times. Does it just assume the base memory address is random enough?

sgammon 2 years ago |

This is awesome. Great work Bun team

bluelightning2k 2 years ago |

This guy ships

nosefrog 2 years ago |

This is crazy. Amazing work!

tiffanyh 2 years ago |

Unpopular opinion …

Please use the same TLD for all your services.

Don’t do: Bun.sh, and now Bun.report

It’s confusing for users and also a security vector.

Just make it report.bun.sh

inopinatus 2 years ago | |

The obvious long-term solution is to obtain the .bun gTLD in the next round of applications (expected 2026)

Jarred 2 years ago | | |

there have been discussions about this

thanksgiving 2 years ago | |

Another vote for same TLD. I’d dare say this should be the default position for everything (except toy projects).

twelvechairs 2 years ago | |

I don't know if it's unpopular. That's literally how domains are designed to function and have done by and large for decades

thanksgiving 2 years ago | | |

I think marketing folks like to send emails from a different domain so they can send transactional and marketing emails from different domains altogether (not just subdomains). Not sure if this is evidence based or just plain voo doo / monkey-see-monkey-do but I’ve read this in multiple places. But of course, that doesn’t apply here.

Rucadi 2 years ago |

A lot of people trash about bun, but I think that they are highly motivated people bringing a lot to the table.

ComputerGuru 2 years ago | |

Having VCs kind of forces that motivation on you, for better or worse.

dzogchen 2 years ago |

I just cannot get excited for this VC funded experimental piece of technology. 10 years ago, maybe. Node.js is not going anywhere anytime soon.

inopinatus 2 years ago | |

They used to say "perl is not going anywhere", too, and it turns out they were right.

lolinder 2 years ago | | |

Python and PHP weren't VC-funded projects.

pjmlp 2 years ago | | |

Turns out a full rewrite turns people away.

Still plenty of UNIX admins keep using Perl 5.

cryptonector 2 years ago |

> Linux: Use dl_iterate_phdr to iterate over the loaded modules, once you find one that the raw address is contained in, .dlpi_addr on the dl_phdr_info struct will be the base address.

Er, just use `dladdr()`.

AbuAssar 2 years ago |

> That's why in Bun v1.1.5, I wrote a compact new format for Zig and C++ crash reports.

why did the author use the pronoun I instead of we? isn't it a team work and there is no I in team as they say?

Jarred 2 years ago | |

We are a team, but Dave wrote the code for this project so "I" makes sense