HTMLRewriter crashes when an error is thrown in text

[TomasHubelbauer]

How can we reproduce the crash?

const text = await response.text();
const htmlRewriter = new HTMLRewriter();

htmlRewriter.on('script[id="__NEXT_DATA__"]', {
  async text(text) {
    const data = JSON.parse(text.text);
    …
  },
});

Relevant log output

Bun v1.1.43-canary.11+5e003dccd (macOS arm64)
error: script exited with code 1

|   htmlRewriter.on('script[id="__NEXT_DATA__"]', {
|     async text(text) {
|       const data = JSON.parse(text.text);
                             ^
SyntaxError: JSON Parse error: Unterminated string
============================================================
Bun Canary v1.1.43-canary.11 (5e003dcc) macOS Silicon
macOS v15.1.1
Features: fetch html_rewriter jsc tsconfig 
Builtins: "bun:main" 

panic(main thread): Segmentation fault at address 0x10
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

error: script was terminated by signal SIGTRAP (Trace or breakpoint trap)

Stack Trace (bun.report)

Bun v1.1.43-canary (5e003dc) on macos aarch64 [AutoCommand]

Segmentation fault at address 0x00000010

• 1 unknown/js code
• core::ptr::drop_in_place$LT$lol_html..rewriter..HtmlRewriter$LT$lolhtml..rewriter..ExternOutputSink$GT$$GT$::h16dd3e1853ee585e
• lol_html_rewriter_free
• src.bun.js.api.html_rewriter.HTMLRewriter.BufferOutputSink.deinit
• src.bun.js.api.html_rewriter.HTMLRewriter.beginTransform
• HTMLRewriterPrototype__transform
• WebCore::HTMLRewriterPrototype__transformCallback
• 1 unknown/js code
• jsc_llint_commonCallOp__llintOpWithMetadata__llintOpWithReturn__llintOp__commonOp__fn__fn__makeReturn__fn__fn__fn__666_callHelper__dispatch_LowLevelInterpreter64_asm_2538
• llint_call_javascript

Features: fetch, html_rewriter, jsc, tsconfig, tsconfig

_{Sentry Issue: BUN-B4D}