fix(error): don't capture stack trace on materialized ErrorInstance in appendStackTrace

src/jsc/bindings/FormatStackTraceForJS.cpp

@@ -668,11 +668,11 @@ JSC_DEFINE_HOST_FUNCTION(errorConstructorFuncAppendStackTrace, (JSC::JSGlobalObj
         return {};
     }
 
-    if (!destination->stackTrace()) {
+    if (!destination->stackTrace() && !destination->hasMaterializedErrorInfo()) {
         destination->captureStackTrace(vm, globalObject, 1);
     }
 
-    if (source->stackTrace()) {
+    if (source->stackTrace() && destination->stackTrace() && source != destination) {
         destination->stackTrace()->appendVector(*source->stackTrace());
         source->stackTrace()->clear();
     }

test/js/node/v8/capture-stack-trace.test.js

@@ -1121,3 +1121,37 @@ test("lazy error-info materialization does not store an empty stack value when t
   });
   expect(exitCode).toBe(0);
 });
+
+test("Error.appendStackTrace on an error with materialized info does not crash in GC", async () => {
+  const src = `
+    let keep = [];
+    for (let i = 0; i < 200; i++) {
+      eval(\`(function inner\${i}() {
+        const a = new Error();
+        const b = new Error();
+        a.sourceURL;
+        b.sourceURL;
+        Error.appendStackTrace(a, b);
+        keep.push(b);
+        const c = new Error();
+        const d = new Error();
+        d.sourceURL;
+        Error.appendStackTrace(c, d);
+        keep.push(c, d);
+        const self = new Error();
+        Error.appendStackTrace(self, self);
+        keep.push(self);
+      })();\`);
+    }
+    Bun.gc(true);
+    Bun.gc(true);
+    process.stdout.write("ok");
+  `;
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "-e", src],
+    env: bunEnv,
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect({ stdout, stderr, exitCode }).toEqual({ stdout: "ok", stderr: "", exitCode: 0 });
+});