ai slop

src/bun.js/bindings/webcore/Worker.cpp

@@ -130,18 +130,29 @@
 extern "C" void WebWorker__setRef(
     void* worker,
     bool ref);
 
 void Worker::setKeepAlive(bool keepAlive)
 {
+    Locker locker { m_implLock };
+    if (!impl_)
+        return;
     WebWorker__setRef(impl_, keepAlive);
 }
 
+void Worker::clearZigImpl()
+{
+    Locker locker { m_implLock };
+    impl_ = nullptr;
+}
+
 bool Worker::updatePtr()
 {
+    Locker locker { m_implLock };
     if (!WebWorker__updatePtr(impl_, this)) {
+        impl_ = nullptr;
         m_onlineClosingFlags = ClosingFlag;
         m_terminationFlags.fetch_or(TerminatedFlag);
         return false;
     }
 
     return true;
@@ -216,7 +227,10 @@
         return Exception { TypeError, errorMessage.toWTFString(BunString::ZeroCopy) };
     }
 
-    worker->impl_ = impl;
+    {
+        Locker locker { worker->m_implLock };
+        worker->impl_ = impl;
+    }
     worker->m_workerCreationTime = MonotonicTime::now();
 
     return worker;
@@ -263,6 +277,9 @@
 {
     // m_contextProxy.terminateWorkerGlobalScope();
     m_terminationFlags.fetch_or(TerminateRequestedFlag);
+    Locker locker { m_implLock };
+    if (!impl_)
+        return;
     WebWorker__notifyNeedTermination(impl_);
 }
 
@@ -467,6 +484,10 @@
 
 extern "C" void WebWorker__dispatchExit(Zig::GlobalObject* globalObject, Worker* worker, int32_t exitCode)
 {
+    // The Zig WebWorker struct is about to be freed on this (worker) thread.
+    // Block until any in-flight ref()/unref()/terminate() from the parent
+    // thread is done, then clear the pointer so they become no-ops.
+    worker->clearZigImpl();
     worker->dispatchExit(exitCode);
     // no longer referenced by Zig
     worker->deref();

src/bun.js/bindings/webcore/Worker.h

@@ -76,6 +76,7 @@ class Worker final : public ThreadSafeRefCounted<Worker>, public EventTargetWith
     void dispatchEvent(Event&);
     void dispatchCloseEvent(Event&);
     void setKeepAlive(bool);
+    void clearZigImpl();
 
     void postTaskToWorkerGlobalScope(Function<void(ScriptExecutionContext&)>&&);
 
@@ -119,7 +120,8 @@ class Worker final : public ThreadSafeRefCounted<Worker>, public EventTargetWith
     // Tracks TerminateRequestedFlag and TerminatedFlag
     std::atomic<uint8_t> m_terminationFlags { 0 };
     const ScriptExecutionContextIdentifier m_clientIdentifier;
-    void* impl_ { nullptr };
+    Lock m_implLock;
+    void* impl_ WTF_GUARDED_BY_LOCK(m_implLock) { nullptr };
 };
 
 JSValue createNodeWorkerThreadsBinding(Zig::GlobalObject* globalObject);

test/js/web/workers/worker-terminate-race.test.ts

@@ -0,0 +1,58 @@
+import { expect, test } from "bun:test";
+import { bunEnv, bunExe } from "harness";
+
+// The Zig WebWorker struct is freed on the worker thread once the worker
+// exits. These tests hammer ref()/unref()/terminate() from the parent
+// thread while the worker thread is tearing down, which used to read the
+// freed struct (ASAN use-after-poison in WebWorker__setRef /
+// WebWorker__notifyNeedTermination).
+
+async function run(src: string) {
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "-e", src],
+    env: bunEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect(stdout).toBe("");
+  if (exitCode !== 0) {
+    expect(stderr).toBe("");
+  }
+  expect(exitCode).toBe(0);
+}
+
+test.concurrent("Worker: ref/unref after terminate does not use-after-free", async () => {
+  await run(`
+    const w = new Worker("data:text/javascript,", {});
+    w.terminate();
+    for (let i = 0; i < 100000; i++) {
+      w.unref();
+      w.ref();
+    }
+    w.terminate();
+    w.unref();
+  `);
+});
+
+test.concurrent("Worker: ref/unref racing natural exit does not use-after-free", async () => {
+  await run(`
+    const w = new Worker("data:text/javascript,", {});
+    const end = Date.now() + 2000;
+    while (Date.now() < end) {
+      w.unref();
+      w.ref();
+    }
+    w.unref();
+  `);
+});
+
+test.concurrent("Worker: terminate racing natural exit does not use-after-free", async () => {
+  await run(`
+    const w = new Worker("data:text/javascript,", {});
+    const end = Date.now() + 2000;
+    while (Date.now() < end) {
+      w.terminate();
+    }
+  `);
+});