Worker / worker_threads: WebCore-shaped lifetimes, joined threads, one ordered VM teardown

packages/bun-usockets/src/loop.c

@@ -208,10 +208,10 @@ int us_loop_close_all_groups(struct us_loop_t *loop) {
     int any = 0;
     while (g) {
         struct us_socket_group_t *next = g->next;
-        /* Only connecting/connected sockets are stranded — listen sockets are
-         * 1:1 owned by a Zig Listener / uWS App that holds a raw pointer and
-         * closes them in finalize(). Closing them here turns that into a UAF
-         * after drainClosedSockets(). */
+        /* Only connecting/connected sockets are stranded here. Listen sockets are
+         * 1:1 owned by a Listener / uWS App that holds a raw pointer to them; the
+         * runtime's stop phase has already stopped those owners before this sweep,
+         * and closing a listen socket from under one that was not would be a UAF. */
         if (g->head_sockets || g->head_connecting_sockets || g->low_prio_count) {
             us_socket_group_close_all_ex(g, /* also_listeners */ 0);
             any = 1;

packages/bun-uws/src/Loop.h

@@ -126,8 +126,11 @@ struct Loop {
         return getLazyLoop().loop;
     }
 
-    static void clearLoopAtThreadExit() {
-        if (getLazyLoop().cleanMe) {
+    /* A thread that ran a loop is exiting: free this thread's loop whether uSockets created the
+     * native loop (cleanMe) or was handed one (Windows: the thread's libuv loop, which the caller
+     * closes afterwards; us_loop_free leaves a borrowed native loop alone). */
+    static void freeLoopAtThreadExit() {
+        if (getLazyLoop().loop) {
             getLazyLoop().loop->free();
         }
     }

scripts/build/codegen.ts

@@ -623,13 +623,12 @@ function emitHostExports({ n, cfg, sources, o, dirStamp }: Ctx): void {
   // the two crates so unrelated edits (e.g. src/bundler) don't re-run the
   // scrape. restat=1 + writeIfNotChanged means a no-marker-change edit
   // produces identical output and the cargo step is pruned.
-  const rsInputs = sources.rust.filter(
-    p =>
-      p.endsWith(".rs") &&
-      (p.includes(`${cfg.cwd}/src/runtime/`.replace(/\//g, "/")) ||
-        p.includes(`${cfg.cwd}/src/jsc/`.replace(/\//g, "/"))) &&
-      !p.endsWith("generated_host_exports.rs"),
-  );
+  const slashed = (p: string) => p.replace(/\\/g, "/");
+  const scrapeDirs = [slashed(`${cfg.cwd}/src/runtime/`), slashed(`${cfg.cwd}/src/jsc/`)];
+  const rsInputs = sources.rust.filter(p => {
+    const q = slashed(p);
+    return q.endsWith(".rs") && scrapeDirs.some(d => q.includes(d)) && !q.endsWith("generated_host_exports.rs");
+  });
 
   n.build({
     outputs: [output],

scripts/build/deps/webkit.ts

@@ -3,7 +3,7 @@
  * for local mode. Override via `--webkit-version=<hash>` to test a branch.
  * From https://github.com/oven-sh/WebKit releases.
  */
-export const WEBKIT_VERSION = "ddea71318fec9b923465c7c45ded8fa713ca3251";
+export const WEBKIT_VERSION = "171babe26c3b330ac0263d1bed3550571908c838";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.

src/bun_core/env_var.rs

@@ -203,7 +203,13 @@ pub mod feature_flag {
     new_feature_flag!(pub BUN_ASSUME_PERFECT_INCREMENTAL, "BUN_ASSUME_PERFECT_INCREMENTAL", { default: None });
     new_feature_flag!(pub BUN_BE_BUN, "BUN_BE_BUN", {});
     new_feature_flag!(pub BUN_DEBUG_NO_DUMP, "BUN_DEBUG_NO_DUMP", {});
+    // Run the full VM teardown when the main thread exits (workers always do).
+    // The CI runner turns it on for LeakSanitizer-validated files on ASAN.
     new_feature_flag!(pub BUN_DESTRUCT_VM_ON_EXIT, "BUN_DESTRUCT_VM_ON_EXIT", {});
+    // Test suite only, builds with debug assertions: a worker VM's handle makes
+    // cross-thread completions wait for its close, so each producer's "refused"
+    // release path runs deterministically (bun_jsc::vm_handle::refusal_gate).
+    new_feature_flag!(pub BUN_DEBUG_TEST_WORKER_REFUSAL_GATE, "BUN_DEBUG_TEST_WORKER_REFUSAL_GATE", {});
 
     // Disable "nativeDependencies"
     new_feature_flag!(pub BUN_FEATURE_FLAG_DISABLE_NATIVE_DEPENDENCY_LINKER, "BUN_FEATURE_FLAG_DISABLE_NATIVE_DEPENDENCY_LINKER", {});

src/bundler/BundleThread.rs

@@ -65,6 +65,10 @@ pub trait CompletionStruct: Node + Send + 'static {
         transpiler: &mut Transpiler<'a>,
         bump: &'a Arena,
     ) -> Result<(), crate::Error>;
+    /// Bundle thread, on dequeue: `false` if the owner released this build
+    /// while it was still queued ([`free_released_unstarted`] then frees it).
+    fn try_start(&mut self) -> bool;
+    fn free_released_unstarted(this: *mut Self);
     fn complete_on_bundle_thread(&mut self);
     fn set_result(&mut self, result: BundleV2Result);
     fn set_log(&mut self, log: bun_ast::Log);
@@ -74,8 +78,8 @@ pub trait CompletionStruct: Node + Send + 'static {
     /// `FileMap` layout stays in T6.
     fn file_map(&mut self) -> Option<NonNull<FileMap>>;
     /// Returns a §Dispatch handle (erased owner + `&'static` vtable) the impl
-    /// provides, so the bundler can read `result == .err` /
-    /// `jsc_event_loop.enqueueTaskConcurrent` without naming the concrete
+    /// provides, so the bundler can read `result == .err` / `is_cancelled`,
+    /// and post plugin hops to the owning VM, without naming the concrete
     /// struct.
     fn as_js_bundle_completion_task(&mut self) -> dispatch::CompletionHandle;
 
@@ -221,7 +225,13 @@ impl<C: CompletionStruct> BundleThread<C> {
                     break;
                 }
                 // SAFETY: queue stores non-null *mut C pushed via enqueue(); owner keeps it alive
-                // until complete_on_bundle_thread() signals completion.
+                // until complete_on_bundle_thread() signals completion — unless it
+                // released the build while it sat here (its VM went away).
+                if !unsafe { (*completion).try_start() } {
+                    C::free_released_unstarted(completion);
+                    continue;
+                }
+                // SAFETY: as above; started ⇒ the owner waits for us.
                 let completion = unsafe { &mut *completion };
                 // SAFETY: `generation` is only read/written on this (bundle) thread.
                 let generation = unsafe { (*instance).generation };

src/bundler/DeferredBatchTask.rs

@@ -17,6 +17,13 @@ pub struct DeferredBatchTask {
     running: bool,
 }
 
+impl bun_event_loop::Taskable for DeferredBatchTask {
+    const TAG: bun_event_loop::TaskTag = task_tag::BundleV2DeferredBatchTask;
+    /// Embedded in its `BundleV2`, which outlives the queue entry and owns
+    /// everything the drain would have touched; nothing to free.
+    unsafe fn release_unrun(_: *mut Self) {}
+}
+
 impl DeferredBatchTask {
     pub(crate) fn init(&mut self) {
         // Kept as `&mut self` (not `-> Self`) — this struct is embedded
@@ -47,12 +54,7 @@ impl DeferredBatchTask {
             debug_assert!(!self.running);
             self.running = false;
         }
-        // PORTING.md §Dispatch: tag+ptr, not TaggedPointer. Tag constant lives in
-        // `bun_event_loop::task_tag::BundleV2DeferredBatchTask`.
-        let task = ConcurrentTask::create(Task::new(
-            task_tag::BundleV2DeferredBatchTask,
-            std::ptr::from_mut::<Self>(self).cast::<()>(),
-        ));
+        let task = ConcurrentTask::create(Task::init(std::ptr::from_mut::<Self>(self)));
 
         self.get_bundle_v2().enqueue_on_js_loop_for_plugins(task);
     }

src/bundler/Graph.rs

@@ -56,6 +56,15 @@ pub struct Graph<'a> {
     /// tasks will be run, and the count is "moved" back to `pending_items`
     pub(crate) deferred_pending: u32,
 
+    /// onResolve / onLoad requests a plugin currently holds (dispatched to its
+    /// VM, not yet answered). Bundle thread only. Failed wholesale when that
+    /// VM shuts down mid-build (`BundleV2::is_done`).
+    pub(crate) outstanding_resolves: OutstandingList<crate::bundle_v2::api::JSBundler::Resolve>,
+    pub(crate) outstanding_loads: OutstandingList<crate::bundle_v2::api::JSBundler::Load>,
+    /// The owning VM cancelled this pass; plugin requests were failed and no
+    /// deferred batch will run.
+    pub(crate) cancelled: bool,
+
     /// A map of build targets to their corresponding module graphs.
     pub build_graphs: EnumMap<options::Target, PathToSourceIndexMap>,
 
@@ -160,6 +169,9 @@ impl<'a> Graph<'a> {
             ast: MultiArrayList::default(),
             pending_items: 0,
             deferred_pending: 0,
+            outstanding_resolves: OutstandingList::default(),
+            outstanding_loads: OutstandingList::default(),
+            cancelled: false,
             build_graphs: EnumMap::default(),
             server_component_boundaries: server_component_boundary::List::default(),
             html_imports: HtmlImports::default(),
@@ -221,6 +233,15 @@ impl<'a> Graph<'a> {
         if self.deferred_pending > 0 {
             self.pending_items += self.deferred_pending;
             self.deferred_pending = 0;
+            // Their units are back in `pending_items`.
+            let mut load = self.outstanding_loads.head;
+            while !load.is_null() {
+                // SAFETY: linked ⇒ arena-live; bundle thread.
+                unsafe {
+                    (*load).deferred = false;
+                    load = (*load).outstanding.next;
+                }
+            }
 
             transpiler.drain_defer_task.init();
             transpiler.drain_defer_task.schedule();
@@ -237,3 +258,82 @@ impl<'a> Graph<'a> {
 // here so `InputFile` and the derived `items_side_effects()` SoA accessor share
 // the same type that `LinkerContext::mark_file_live_for_tree_shaking` expects.
 use bun_ast::SideEffects;
+
+/// Intrusive doubly-linked membership in an [`OutstandingList`].
+pub struct OutstandingLink<T> {
+    prev: *mut T,
+    pub(crate) next: *mut T,
+    linked: bool,
+}
+impl<T> Default for OutstandingLink<T> {
+    fn default() -> Self {
+        Self {
+            prev: core::ptr::null_mut(),
+            next: core::ptr::null_mut(),
+            linked: false,
+        }
+    }
+}
+pub trait OutstandingNode: Sized {
+    fn link(&mut self) -> &mut OutstandingLink<Self>;
+}
+/// A bundle pass's outstanding plugin requests; single-threaded (bundle thread).
+pub struct OutstandingList<T: OutstandingNode> {
+    head: *mut T,
+}
+impl<T: OutstandingNode> Default for OutstandingList<T> {
+    fn default() -> Self {
+        Self {
+            head: core::ptr::null_mut(),
+        }
+    }
+}
+impl<T: OutstandingNode> OutstandingList<T> {
+    pub(crate) fn push(&mut self, node: *mut T) {
+        // SAFETY: `node` is arena-live and unlinked; bundle thread.
+        unsafe {
+            let l = (*node).link();
+            debug_assert!(!l.linked);
+            l.linked = true;
+            l.prev = core::ptr::null_mut();
+            l.next = self.head;
+            if !self.head.is_null() {
+                (*self.head).link().prev = node;
+            }
+        }
+        self.head = node;
+    }
+    /// No-op if `node` is not linked (already answered / never dispatched).
+    pub(crate) fn unlink(&mut self, node: &mut T) {
+        let node_ptr: *mut T = node;
+        let l = node.link();
+        if !l.linked {
+            return;
+        }
+        l.linked = false;
+        let (prev, next) = (l.prev, l.next);
+        l.prev = core::ptr::null_mut();
+        l.next = core::ptr::null_mut();
+        // SAFETY: neighbours are linked ⇒ arena-live; bundle thread.
+        unsafe {
+            if prev.is_null() {
+                debug_assert!(core::ptr::eq(self.head, node_ptr));
+                self.head = next;
+            } else {
+                (*prev).link().next = next;
+            }
+            if !next.is_null() {
+                (*next).link().prev = prev;
+            }
+        }
+    }
+    pub(crate) fn pop(&mut self) -> Option<*mut T> {
+        let head = self.head;
+        if head.is_null() {
+            return None;
+        }
+        // SAFETY: linked ⇒ arena-live.
+        self.unlink(unsafe { &mut *head });
+        Some(head)
+    }
+}

src/bundler/ParseTask.rs

@@ -2841,15 +2841,27 @@ pub mod parse_worker {
             .any_loop_mut()
             .expect("BundleV2.linker.loop must be set before scheduling ParseTask")
         {
-            bun_event_loop::AnyEventLoop::Js { owner } => {
-                owner.enqueue_task_concurrent(
+            bun_event_loop::AnyEventLoop::Js { .. } => {
+                let ct =
                     bun_event_loop::ConcurrentTask::ConcurrentTask::from_callback(result, |p| {
                         // SAFETY: `p` is the `result` Box leaked above; ownership
                         // transfers to `on_complete`, which deallocates it.
                         unsafe { on_complete(p) };
                         Ok(())
-                    }),
-                );
+                    });
+                let poster = worker
+                    .ctx
+                    .js_poster
+                    .as_ref()
+                    .expect("JS-owned bundle has a poster");
+                if let bun_event_loop::Posted::Refused(ct) = poster.post(ct) {
+                    // Owning JS VM torn down mid-bundle: free the hop and the result.
+                    // SAFETY: refused ⇒ we own the task box and the leaked result.
+                    unsafe {
+                        bun_event_loop::ConcurrentTask::ConcurrentTask::release_refused(ct);
+                        drop(bun_core::heap::take(result));
+                    }
+                }
             }
             bun_event_loop::AnyEventLoop::Mini(mini) => {
                 // SAFETY: `result` is a valid heap pointer with `task` at the given offset;

src/bundler/ServerComponentParseTask.rs

@@ -116,15 +116,26 @@ fn task_callback_wrap(thread_pool_task: *mut ThreadPoolTask) {
         .any_loop_mut()
         .expect("BundleV2.linker.loop must be set before scheduling ServerComponentParseTask")
     {
-        bun_event_loop::AnyEventLoop::Js { owner } => {
-            owner.enqueue_task_concurrent(
-                bun_event_loop::ConcurrentTask::ConcurrentTask::from_callback(result, |p| {
-                    // SAFETY: `p` is the `result` Box leaked above; ownership
-                    // transfers to `on_complete`, which deallocates it.
-                    unsafe { on_complete(p) };
-                    Ok(())
-                }),
-            );
+        bun_event_loop::AnyEventLoop::Js { .. } => {
+            let ct = bun_event_loop::ConcurrentTask::ConcurrentTask::from_callback(result, |p| {
+                // SAFETY: `p` is the `result` Box leaked above; ownership
+                // transfers to `on_complete`, which deallocates it.
+                unsafe { on_complete(p) };
+                Ok(())
+            });
+            let poster = worker
+                .ctx
+                .js_poster
+                .as_ref()
+                .expect("JS-owned bundle has a poster");
+            if let bun_event_loop::Posted::Refused(ct) = poster.post(ct) {
+                // Owning JS VM torn down mid-bundle: free the hop and the result.
+                // SAFETY: refused ⇒ we own the task box and the leaked result.
+                unsafe {
+                    bun_event_loop::ConcurrentTask::ConcurrentTask::release_refused(ct);
+                    drop(bun_core::heap::take(result));
+                }
+            }
         }
         bun_event_loop::AnyEventLoop::Mini(mini) => {
             // SAFETY: `result` is a freshly Box-leaked `parse_task::Result` (above) and