Skip to content

bundler: post Bun.build completions by ScriptExecutionContext id to survive worker.terminate() - #35158

Closed
robobun wants to merge 7 commits into
mainfrom
farm/7993167a/bundle-worker-uaf
Closed

bundler: post Bun.build completions by ScriptExecutionContext id to survive worker.terminate()#35158
robobun wants to merge 7 commits into
mainfrom
farm/7993167a/bundle-worker-uaf

address review nits: did_load_process, plugin cleanup on clone OOM, w…

17be429
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed Jul 22, 2026 in 42m 50s

Code review found 1 potential issue

Found 1 candidates, confirmed 1. See review comments for details.

Details

Severity Count
🔴 Important 0
🟡 Nit 1
🟣 Pre-existing 0
Severity File:Line Issue
🟡 Nit src/runtime/api/js_bundle_completion_task.rs:151-156 OOM error arm blanket-destroys a Plugin the HTMLBundle caller only borrows

Annotations

Check warning on line 156 in src/runtime/api/js_bundle_completion_task.rs

See this annotation in the file changed.

@claude claude / Claude Code Review

OOM error arm blanket-destroys a Plugin the HTMLBundle caller only borrows

The `Plugin::destroy` on the `clone_with_allocator()` OOM error arm is correct for the `Bun.build` caller but wrong for the `HTMLBundle::Route` caller, which passes a *borrowed* plugin (owned by the server's `ServePluginsState::Loaded(Box<Plugin>)` — see server_body.rs:870/983, and the `this.plugins = None` in `on_complete_anytask` that skips `deinit`'s destroy for exactly this reason). On the OOM path this tombstones + `unprotect()`s the server's live plugin while the server retains it for subs