Fix event-loop hang when dlopen'd Go/cgo lib coexists with WASM on Linux

scripts/build/deps/webkit.ts

@@ -3,7 +3,12 @@
  * for local mode. Override via `--webkit-version=<hash>` to test a branch.
  * From https://github.com/oven-sh/WebKit releases.
  */
-export const WEBKIT_VERSION = "0d85951a31d3d04684e3e598589de065378c2c59";
+// Preview autobuild of oven-sh/WebKit#235 rebased on current main — the
+// ucontext-SP fix for JSC's signalHandlerSuspendResume (so the GC
+// thread-suspend signal works under SA_ONSTACK, e.g. Go cgo's initsig,
+// instead of spinning forever). Swap back to the next merged hash once
+// #235 lands.
+export const WEBKIT_VERSION = "autobuild-preview-pr-235-f9079851";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.
@@ -83,7 +88,13 @@
  * doesn't reuse a wrong-ABI extraction.
  */
 function prebuiltDestDir(cfg: Config): string {
-  const version16 = cfg.webkitVersion.slice(0, 16);
+  // A raw 40-char git SHA is unique in its first 16 chars; a preview tag
+  // like `autobuild-preview-pr-235-a355e3e0` is NOT (every preview tag
+  // starts with `autobuild-previe` → same dir for every PR). Prefer the
+  // trailing hash when we recognise a preview-tag shape, so worktrees
+  // sharing `$BUN_INSTALL/build-cache` across branches don't collide.
+  const v = cfg.webkitVersion;
+  const version16 = v.startsWith("autobuild-") ? v.slice(-16) : v.slice(0, 16);
   // Cross-compiled targets share a host (and cache dir) with native builds,
   // so include os+arch in the key — otherwise a FreeBSD/arm64 extraction
   // collides with a Linux/x64 one at the same WebKit version.

test/regression/issue/31158.test.ts

@@ -0,0 +1,94 @@
+// Regression test for https://github.com/oven-sh/bun/issues/31158.
+//
+// When a shared library (e.g. Go's cgo runtime) force-sets `SA_ONSTACK` on
+// JavaScriptCore's thread-suspend signal (SIGPWR on Linux in Bun's WebKit
+// fork), every delivery of that signal on a thread that has an alternate
+// signal stack (ASAN runtime, Bun's crash handler, libbacktrace) runs the
+// handler on the alt stack. WTF's stack-check in `signalHandlerSuspendResume`
+// used `currentStackPointer()` — the handler's own SP — so the sanity
+// check failed every time, `Thread::suspend()` retried forever, and the
+// event loop stopped advancing on the next WASM compile/install.
+//
+// Fixed upstream (oven-sh/WebKit#235) by reading the interrupted thread's
+// SP from the ucontext instead of the handler's own SP — that SP is stable
+// whether the handler runs on the normal stack or the alt stack, so
+// `SA_ONSTACK` no longer matters.
+//
+// Triggers the exact shape of the bug without needing Go installed in CI:
+// force `SA_ONSTACK` onto SIGPWR via `bun:ffi` (same thing Go's cgo
+// `initsig` does to every handler at load time), then compile+call a WASM
+// function (which triggers `resetInstructionCacheOnAllThreads`, the code
+// path that actually suspends the JS thread). Without the fix,
+// `setTimeout` after the WASM call never fires and the child hangs.
+import { expect, test } from "bun:test";
+import { bunEnv, bunExe, isGlibc } from "harness";
+
+// The bug is only reachable on Linux: SIGPWR is only used as the suspend/
+// resume signal on Linux (see `vendor/WebKit/Source/WTF/wtf/posix/
+// ThreadingPOSIX.cpp` — USE(BUN_JSC_ADDITIONS) branch). The reproduction
+// dlopens `libc.so.6` directly so it needs glibc; musl names its libc
+// differently and static-musl builds of Bun don't even have a dynamic
+// loader in the room.
+test.skipIf(!isGlibc)(
+  "event loop survives SA_ONSTACK on SIGPWR + WASM (oven-sh/bun#31158)",
+  async () => {
+    const script = /* ts */ `
+      import { dlopen, FFIType, ptr } from "bun:ffi";
+
+      // 1. Open libc so we can flip SA_ONSTACK on SIGPWR the same way Go's
+      //    cgo 'initsig' does on every inherited handler.
+      const libc = dlopen("libc.so.6", {
+        sigaction: { args: [FFIType.i32, FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+      });
+
+      // x86_64 glibc layout: sa_handler (8), sa_mask (128), sa_flags (4), sa_restorer (8).
+      // We only touch sa_flags so this layout holds on aarch64 too (same offsets).
+      const SIGACTION_SIZE = 152;
+      const FLAGS_OFFSET = 8 + 128;
+      const SIGPWR = 30;
+      const SA_ONSTACK = 0x08000000;
+
+      const buf = new ArrayBuffer(SIGACTION_SIZE);
+      const view = new DataView(buf);
+
+      libc.symbols.sigaction(SIGPWR, null, ptr(buf));
+      view.setInt32(FLAGS_OFFSET, view.getInt32(FLAGS_OFFSET, true) | SA_ONSTACK, true);
+      libc.symbols.sigaction(SIGPWR, ptr(buf), null);
+
+      // 2. Exercise the WASM path that calls resetInstructionCacheOnAllThreads.
+      //    The bytes below are a minimal WASM module with one exported function
+      //    that loops 10_000 times and returns — enough to trigger compilation.
+      //    SA_ONSTACK is still set at this point; the WTF fix makes the
+      //    handler tolerate it instead of spinning.
+      const bytes = new Uint8Array([
+        0, 97, 115, 109, 1, 0, 0, 0, 1, 5, 1, 96, 0, 1, 127, 3, 2, 1, 0, 7, 5,
+        1, 1, 102, 0, 0, 10, 34, 1, 32, 1, 1, 127, 65, 0, 33, 0, 2, 64, 3, 64,
+        32, 0, 65, 1, 106, 33, 0, 32, 0, 65, 144, 206, 0, 72, 13, 0, 11, 11, 32,
+        0, 11,
+      ]);
+      const inst = new WebAssembly.Instance(new WebAssembly.Module(bytes));
+      (inst.exports.f as () => number)();
+
+      // 3. A setTimeout that must fire — the bug makes this hang forever.
+      await new Promise(r => setTimeout(r, 10));
+      console.log("EVENT_LOOP_ALIVE");
+    `;
+
+    // `await using` scopes the child to this block — if the test-runner
+    // timeout fires because the bug reproduced, `Bun.spawn`'s disposer
+    // kills the child on the way out, no harness-side watchdog needed.
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "-e", script],
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    expect(stderr).toBe("");
+    expect(stdout).toContain("EVENT_LOOP_ALIVE");
+    expect(exitCode).toBe(0);
+  },
+  15_000,
+);