process: skip uncaught-exception dispatch on a terminating worker

src/jsc/VirtualMachine.rs

@@ -1074,7 +1074,7 @@ impl VirtualMachine {
     }
 
     pub fn handled_promise(&self, global_object: &JSGlobalObject, promise: JSValue) -> bool {
-        if self.is_shutting_down() {
+        if self.script_execution_status() != crate::ScriptExecutionStatus::Running {
             return true;
         }
         Bun__emitHandledPromiseEvent(global_object, promise)
@@ -1348,7 +1348,7 @@ impl VirtualMachine {
         err: JSValue,
         is_rejection: bool,
     ) -> bool {
-        if self.is_shutting_down() {
+        if self.script_execution_status() != crate::ScriptExecutionStatus::Running {
             return true;
         }
 
@@ -3287,7 +3287,7 @@ impl VirtualMachine {
     ) {
         use bun_options_types::schema::api::UnhandledRejections as Mode;
 
-        if self.is_shutting_down() {
+        if self.script_execution_status() != crate::ScriptExecutionStatus::Running {
             bun_core::debug_warn!("unhandledRejection during shutdown.");
             return;
         }

src/jsc/bindings/BunProcess.cpp

@@ -1212,9 +1212,14 @@ extern "C" int Bun__handleUncaughtException(JSC::JSGlobalObject* lexicalGlobalOb
     if (!lexicalGlobalObject->inherits(Zig::GlobalObject::info()))
         return false;
     auto* globalObject = uncheckedDowncast<Zig::GlobalObject>(lexicalGlobalObject);
+    auto& vm = JSC::getVM(globalObject);
+
+    // Stopped == a worker with has_requested_terminate(); the process->get / emit / call walk below asserts under a terminate() race.
+    if (Zig::GlobalObject::scriptExecutionStatus(globalObject, globalObject) != JSC::ScriptExecutionStatus::Running) [[unlikely]]
+        return true;
+
     auto* process = globalObject->processObject();
     auto& wrapped = process->wrapped();
-    auto& vm = JSC::getVM(globalObject);
 
     // node parity (exitWithUndefinedFatalException): the internal fatal-exception
     // handler is monkey-patchable as process._fatalException. If user code
@@ -1346,6 +1351,8 @@ extern "C" int Bun__handleUnhandledRejection(JSC::JSGlobalObject* lexicalGlobalO
     if (!lexicalGlobalObject->inherits(Zig::GlobalObject::info()))
         return false;
     auto* globalObject = uncheckedDowncast<Zig::GlobalObject>(lexicalGlobalObject);
+    if (Zig::GlobalObject::scriptExecutionStatus(globalObject, globalObject) != JSC::ScriptExecutionStatus::Running) [[unlikely]]
+        return false;
     auto* process = globalObject->processObject();
 
     auto eventType = Identifier::fromString(JSC::getVM(globalObject), "unhandledRejection"_s);
@@ -1369,6 +1376,8 @@ extern "C" bool Bun__emitHandledPromiseEvent(JSC::JSGlobalObject* lexicalGlobalO
     if (!lexicalGlobalObject->inherits(Zig::GlobalObject::info()))
         return false;
     auto* globalObject = uncheckedDowncast<Zig::GlobalObject>(lexicalGlobalObject);
+    if (Zig::GlobalObject::scriptExecutionStatus(globalObject, globalObject) != JSC::ScriptExecutionStatus::Running) [[unlikely]]
+        return false;
     auto* process = globalObject->processObject();
 
     auto eventType = Identifier::fromString(JSC::getVM(globalObject), "rejectionHandled"_s);

src/jsc/web_worker.rs

@@ -1135,6 +1135,12 @@
             }
         }
 
+        // terminate() may have landed during entrySettled / the status block above; skip dispatchOnline/tick().
+        if self.has_requested_terminate() && !self.exit_called.load(Ordering::Relaxed) {
+            self.flush_logs(vm);
+            return self.shutdown();
+        }
+
         self.flush_logs(vm);
         log!("[{}] event loop start", self.execution_context_id);
         // dispatchOnline fires the parent-side 'open' event and flips the C++
@@ -1459,6 +1465,9 @@
         if vm_log.msgs.is_empty() {
             return;
         }
+        if self.has_requested_terminate() {
+            return;
+        }
         let global = vm.global();
         let result: jsc::JsResult<(JSValue, BunString)> = (|| {
             let err = vm_log.to_js(global, "Error in worker")?;
@@ -1468,14 +1477,32 @@
         let (err, str) = match result {
             Ok(pair) => pair,
             Err(JsError::OutOfMemory) => bun_core::out_of_memory(),
-            Err(JsError::Thrown | JsError::Terminated) => panic!("unhandled exception"),
+            Err(JsError::Terminated) => return,
+            Err(e @ JsError::Thrown) => {
+                if self.has_requested_terminate() {
+                    return;
+                }
+                if let Some(exc) = global
+                    .take_exception(e)
+                    .as_exception(global.vm().as_mut_ptr())
+                {
+                    let _ = jsc::js_global_object::report_uncaught_exception(
+                        global,
+                        jsc::Exception::opaque_ref(exc),
+                    );
+                }
+                return;
+            }
         };
         let mut str = bun_core::OwnedString::new(str);
         let dispatch = jsc::host_fn::from_js_host_call_generic(global, || {
             // `cpp_worker` is the opaque C++-owned handle; `str` reffed for the call.
             WebWorker__dispatchError(global, self.cpp_worker, &mut str, err)
         });
         if let Err(e) = dispatch {
+            if self.has_requested_terminate() {
+                return;
+            }
             // `take_exception` on a `JsError` always returns an Exception
             // cell; None is unreachable. Do not silently drop the error.
             let exc = global

test/js/web/workers/worker-terminate-lifetime.test.ts

@@ -121,6 +121,66 @@ test(
   timeout,
 );
 
+// Regression: a nested worker whose grandchild's module fails to load reports
+// its uncaught MODULE_NOT_FOUND via flush_logs → report_uncaught_exception →
+// Bun__handleUncaughtException. When worker.terminate() and process.exit()
+// land mid-dispatch, that handler would still lazily create `process` and do
+// `process->get("_fatalException")` on a VM already asked to terminate, which
+// tripped ASSERT(object->structure() == this) in Structure::storedPrototype.
+// Debug-assert-only; the race is non-deterministic (~2/14 on
+// release-asan-cov), so loop it.
+test.skipIf(!isASAN)(
+  "terminating a worker while its grandchildren are reporting load errors does not assert",
+  async () => {
+    // Each subprocess run spawns a middle worker that creates grandchildren
+    // whose module load fails, then main terminates the middle worker and
+    // exits. The race window is between the grandchild's error dispatch and
+    // terminate_all_and_wait arming TerminationException. The grandchild path
+    // is an absolute nonexistent file so MODULE_NOT_FOUND is independent of
+    // import.meta.url's value inside the data-URL middle worker.
+    const code = `
+      const { Worker } = require("node:worker_threads");
+      const bad = require("node:path").join(process.cwd(), "does-not-exist-xyzzy.mjs");
+      const middleSrc = \`
+        const { Worker, parentPort } = require("node:worker_threads");
+        for (let j = 0; j < 4; j++) {
+          const w = new Worker(\${JSON.stringify(bad)});
+          w.on("error", () => {});
+        }
+        parentPort.postMessage("spawned");
+        setInterval(() => {}, 1000);
+      \`;
+      const middle = new Worker(new URL(
+        "data:text/javascript;base64," + Buffer.from(middleSrc).toString("base64"),
+      ));
+      middle.on("error", e => { console.error("middle error:", e.message); process.exit(1); });
+      middle.on("message", () => {
+        middle.terminate();
+        console.log("ok");
+        process.exit(0);
+      });
+      setTimeout(() => { console.error("timeout"); process.exit(1); }, 5000);
+    `;
+
+    for (let i = 0; i < 20; i++) {
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), "-e", code],
+        env: bunEnv,
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      expect({ stderr, stdout, exitCode, signalCode: proc.signalCode }).toEqual({
+        stderr: "",
+        stdout: "ok\n",
+        exitCode: 0,
+        signalCode: null,
+      });
+    }
+  },
+  timeout * 2,
+);
+
 // Regression: the per-VM c-ares channel was destroyed in deinit_runtime_state
 // (RuntimeState drop) AFTER JSC teardown and RareData.file_polls drop.
 // ares_destroy() synchronously fires EDESTRUCTION query callbacks and socket-