[Bug] Bun runtime segmentation fault during long-running interactive session with multiple subagents

Bug Description
Bun runtime segfault killed a 21h48m interactive session. CLI 2.1.235, native installer, Windows 11 Home build 26200, bundled Bun v1.4.0 (939d4325b) win x64. panic(main thread): Segmentation fault at address 0x10 Elapsed: 78465504ms | RSS 0.19 GB | Peak 0.89 GB | Machine 25.50 GB — not OOM. Features: spawn(565) yaml_parse(3795) fetch(122) abort_signal(60) WebSocket(2) 8 subagents were live at the moment of death; the session had accumulated 26 subagent transcripts. No user action to point at, no deterministic repro. bun.report decoded the trace. Most frames are a mis-walked stack (unrelated ICU and BoringSSL symbols); the one coherent run is JSC::JSArray::fastToString -> JSStringJoiner::append -> appendWithoutSideEffects i.e. main thread joining an array into a string, reading off a null base at 0x10. Crash report: https://bun.report/1.4.0/w_1939d432mgggkI+hogCgns7Fw49sEgn+sE6pysDgv99+Cs+si7B_______os567C_____A2AgB Filed publicly as anthropics/claude-code#87862 with the full write-up. Related family: #77579 (JSC GC UAF at 0x...50), #75538 (~25 concurrent subagents), #87616 (0x54, background thread, same Bun build). Upstream same-address report: oven-sh/bun#26843 (macOS arm64). The crashed session is 7e7613d2-d693-438d-ba3e-f3de91d11364 in D:\nahdi\Jake Hall — attach that one if this report is coming from elsewhere.

Environment Info

• Platform: win32
• Terminal: windows-terminal
• Version: 2.1.235
• Feedback ID: ba4dd727-6d37-4fc9-918e-261f5278e8a4

Errors

[]