From 13a0dbe5ff017749e32b27d747f70568f5cf2d44 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Thu, 13 Aug 2026 21:07:55 +0000
Subject: [PATCH 1/6] bake: exit a successful bun build --app through the build
 VM

build_command only ran vm.on_exit() and vm.global_exit() when the build
threw. A build that rendered returned Ok instead, so the process exited
without emitting 'exit', without applying process.exitCode, and, under
BUN_DESTRUCT_VM_ON_EXIT, without destroying the JSC VM, which left every
native still owned by a JS wrapper created during prerendering (immediates,
blobs, text decoders) unfreed. Run the same exit sequence on both arms.
---
 src/runtime/bake/production.rs   | 38 ++++++------
 test/bake/dev/production.test.ts | 99 +++++++++++++++++++++++++++++++-
 2 files changed, 119 insertions(+), 18 deletions(-)

diff --git a/src/runtime/bake/production.rs b/src/runtime/bake/production.rs
index 4f8b053a5f0d..d943bb965c5c 100644
--- a/src/runtime/bake/production.rs
+++ b/src/runtime/bake/production.rs
@@ -112,11 +112,13 @@ pub fn build_command(ctx: Context) -> crate::Result<()> {
     // SAFETY: `init_bake` returns a freshly-allocated VM owned by this thread;
     // unique access for the rest of this function.
     let vm = unsafe { &mut *vm_ptr };
-    // defer vm.deinit() — handled by `vm.destroy()` on the unwind path below.
+    // Runs only on the `Err` return below (a bundler or I/O failure). Every
+    // other way out of this function exits the process, and the normal one,
+    // `global_exit()` at the end, tears the VM down itself.
     // Note: pass `vm_ptr` by value into the guard so the drop closure does
     // not borrow the local (`defer!` would capture `&vm_ptr`, which under
     // edition-2024 disjoint-capture rules collides with the `&mut *vm_ptr`
-    // re-borrows on the JSError path).
+    // re-borrows below).
     let _vm_guard = scopeguard::guard(vm_ptr, |p| {
         // SAFETY: p is the unique live VM on this thread; its loop is alive, so
         // queued work is released here rather than by a thread teardown.
@@ -211,28 +213,32 @@ pub fn build_command(ctx: Context) -> crate::Result<()> {
     // LIFO order — under the API lock, before the VM is destroyed.
     let mut pt = PerThread::placeholder(vm_ptr);
 
-    match build_with_vm(ctx, &cwd, &mut pt) {
+    let result = build_with_vm(ctx, &cwd, &mut pt);
+    // SAFETY: the reborrows `build_with_vm` made through `pt.vm` died when it
+    // returned, so this frame has exclusive access again; the VM stays
+    // allocated until `global_exit` (or `_vm_guard`) destroys it.
+    let vm = unsafe { &mut *vm_ptr };
+    match result {
         Ok(()) => {}
         Err(crate::Error::JSError) => {
-            // SAFETY: vm.global is live for VM lifetime.
-            let global = unsafe { &*(*vm_ptr).global };
-            let err_value = global.take_exception(jsc::JsError::Thrown);
-            // SAFETY: see above.
-            unsafe {
-                (*vm_ptr)
-                    .print_error_like_object_to_console(err_value.to_error().unwrap_or(err_value))
-            };
-            // SAFETY: see above.
-            let vm = unsafe { &mut *vm_ptr };
+            let err_value = vm.global().take_exception(jsc::JsError::Thrown);
+            vm.print_error_like_object_to_console(err_value.to_error().unwrap_or(err_value));
             if vm.exit_handler.exit_code == 0 {
                 vm.exit_handler.exit_code = 1;
             }
-            vm.on_exit();
-            vm.global_exit();
         }
         Err(e) => return Err(e),
     }
-    Ok(())
+
+    // A rendered build exits the same way a failed one does: `on_exit` runs the
+    // `process.on("exit")` handlers the config and prerender registered, and
+    // `global_exit` exits with `process.exitCode`, tearing the VM down first
+    // under BUN_DESTRUCT_VM_ON_EXIT. Returning `Ok` instead would free only the
+    // Rust side of the VM (`_vm_guard`); the JSC heap would never be destroyed,
+    // so the natives still owned by the prerender's JS objects (timers, blobs,
+    // decoders, ...) would never be freed.
+    vm.on_exit();
+    vm.global_exit()
 }
 
 /// Ported inline from `bun.bun_js.failWithBuildError` to avoid the
diff --git a/test/bake/dev/production.test.ts b/test/bake/dev/production.test.ts
index 1335e3244c00..a1bad3e21104 100644
--- a/test/bake/dev/production.test.ts
+++ b/test/bake/dev/production.test.ts
@@ -1,8 +1,8 @@
 import { describe, expect, test } from "bun:test";
 import { existsSync } from "fs";
-import { bunEnv, bunExe } from "harness";
+import { bunEnv, bunExe, isASAN } from "harness";
 import path from "path";
-import { tempDirWithBakeDeps } from "../bake-harness";
+import { tempDirWithBakeDeps, WAIT_MULTIPLIER } from "../bake-harness";
 
 const normalizePath = (path: string) => (process.platform === "win32" ? path.replaceAll("\\", "/") : path);
 const platformPath = (path: string) => (process.platform === "win32" ? path.replaceAll("/", "\\") : path);
@@ -594,4 +594,99 @@ export default function IndexPage() {
     // Verify NO JavaScript imports are included in the HTML
     expect(htmlContent).not.toContain('<script type="module"');
   });
+
+  // A build that succeeds has to leave through the build VM's exit sequence
+  // (`on_exit` + `global_exit`), like a build that throws already does: that is
+  // what runs the 'exit' handlers, applies process.exitCode and, under
+  // BUN_DESTRUCT_VM_ON_EXIT, destroys the JSC heap. Before, it returned and
+  // exited the process directly, skipping all three.
+  const onExitConfig = `
+    process.on("exit", code => console.log("exit event: " + code));
+    export default { app: { framework: "react" } };
+  `;
+
+  test.concurrent(
+    "rendered build runs 'exit' handlers and exits with process.exitCode",
+    async () => {
+      const dir = await tempDirWithBakeDeps("bake-production-exit-rendered", {
+        "app.ts": onExitConfig,
+        "pages/index.tsx": `
+          process.exitCode = 3;
+          export default function IndexPage() {
+            return <div>Hello World</div>;
+          }
+        `,
+      });
+
+      const { stdout, exitCode } = await Bun.$`${bunExe()} build --app ./app.ts`
+        .cwd(dir)
+        .env(bunEnv)
+        .quiet()
+        .throws(false);
+
+      expect(await Bun.file(path.join(dir, "dist", "index.html")).text()).toContain("Hello World");
+      expect(stdout.toString()).toBe("done\nexit event: 3\n");
+      expect(exitCode).toBe(3);
+    },
+    30_000 * WAIT_MULTIPLIER,
+  );
+
+  test.concurrent(
+    "build with nothing to render runs 'exit' handlers",
+    async () => {
+      const dir = await tempDirWithBakeDeps("bake-production-exit-no-routes", {
+        "app.ts": onExitConfig,
+      });
+
+      const { stdout, exitCode } = await Bun.$`${bunExe()} build --app ./app.ts`
+        .cwd(dir)
+        .env(bunEnv)
+        .quiet()
+        .throws(false);
+
+      expect(stdout.toString()).toBe("done\nexit event: 0\n");
+      expect(exitCode).toBe(0);
+    },
+    30_000 * WAIT_MULTIPLIER,
+  );
+
+  // The natives behind these wrappers are freed by the wrappers' finalizers, so
+  // they stay allocated until the VM is destroyed; LSan sees them as leaked when
+  // the build exits without destroying it. This checks the report's contents
+  // rather than requiring it to be empty because the build's own transpilers
+  // are still leaked (separate fix), which keeps this file in
+  // test/no-validate-leaksan.txt for now.
+  test.concurrent.skipIf(!isASAN)(
+    "rendered build destroys its VM under BUN_DESTRUCT_VM_ON_EXIT",
+    async () => {
+      const dir = await tempDirWithBakeDeps("bake-production-exit-teardown", {
+        "app.ts": `export default { app: { framework: "react" } };`,
+        "pages/index.tsx": `
+          globalThis.keepUntilExit = [new TextDecoder(), new Blob(["prerender"]), setImmediate(() => {})];
+          export default function IndexPage() {
+            return <div>Hello World</div>;
+          }
+        `,
+      });
+
+      const { stdout, stderr } = await Bun.$`${bunExe()} build --app ./app.ts`
+        .cwd(dir)
+        .env({
+          ...bunEnv,
+          BUN_DESTRUCT_VM_ON_EXIT: "1",
+          ASAN_OPTIONS: [bunEnv.ASAN_OPTIONS, "detect_leaks=1"].filter(Boolean).join(":"),
+          LSAN_OPTIONS: `print_suppressions=0:suppressions=${path.join(import.meta.dirname, "../../leaksan.supp")}`,
+        })
+        .quiet()
+        .throws(false);
+
+      expect(await Bun.file(path.join(dir, "dist", "index.html")).text()).toContain("Hello World");
+      expect(stdout.toString()).toBe("done\n");
+      const leaked = ["TextDecoder", "Blob", "ImmediateObject"].filter(type => stderr.toString().includes(type));
+      expect(leaked).toEqual([]);
+    },
+    // LSan symbolizes every reported stack through llvm-symbolizer, which is
+    // slow against a debug binary.
+    60_000 * WAIT_MULTIPLIER,
+  );
 });

From 5fa5ab09968f2d83c1a7ae137542e8edb5ec9847 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Fri, 14 Aug 2026 00:41:15 +0000
Subject: [PATCH 2/6] test: group the build VM exit cases and share one timeout

---
 test/bake/dev/production.test.ts | 179 ++++++++++++++++---------------
 1 file changed, 92 insertions(+), 87 deletions(-)

diff --git a/test/bake/dev/production.test.ts b/test/bake/dev/production.test.ts
index a1bad3e21104..73e817cef037 100644
--- a/test/bake/dev/production.test.ts
+++ b/test/bake/dev/production.test.ts
@@ -600,93 +600,98 @@ export default function IndexPage() {
   // what runs the 'exit' handlers, applies process.exitCode and, under
   // BUN_DESTRUCT_VM_ON_EXIT, destroys the JSC heap. Before, it returned and
   // exited the process directly, skipping all three.
-  const onExitConfig = `
-    process.on("exit", code => console.log("exit event: " + code));
-    export default { app: { framework: "react" } };
-  `;
-
-  test.concurrent(
-    "rendered build runs 'exit' handlers and exits with process.exitCode",
-    async () => {
-      const dir = await tempDirWithBakeDeps("bake-production-exit-rendered", {
-        "app.ts": onExitConfig,
-        "pages/index.tsx": `
-          process.exitCode = 3;
-          export default function IndexPage() {
-            return <div>Hello World</div>;
-          }
-        `,
-      });
-
-      const { stdout, exitCode } = await Bun.$`${bunExe()} build --app ./app.ts`
-        .cwd(dir)
-        .env(bunEnv)
-        .quiet()
-        .throws(false);
-
-      expect(await Bun.file(path.join(dir, "dist", "index.html")).text()).toContain("Hello World");
-      expect(stdout.toString()).toBe("done\nexit event: 3\n");
-      expect(exitCode).toBe(3);
-    },
-    30_000 * WAIT_MULTIPLIER,
-  );
+  describe.concurrent("exits through the build VM", () => {
+    const onExitConfig = `
+      process.on("exit", code => console.log("exit event: " + code));
+      export default { app: { framework: "react" } };
+    `;
+
+    // Each case is a full react build on a debug (and ASAN) binary, and the
+    // LSan case also symbolizes its report, which the default timeout does not
+    // cover; WAIT_MULTIPLIER is how the bake harness budgets production builds.
+    const timeout = 30_000 * WAIT_MULTIPLIER;
+
+    test(
+      "a rendered build runs 'exit' handlers and exits with process.exitCode",
+      async () => {
+        const dir = await tempDirWithBakeDeps("bake-production-exit-rendered", {
+          "app.ts": onExitConfig,
+          "pages/index.tsx": `
+            process.exitCode = 3;
+            export default function IndexPage() {
+              return <div>Hello World</div>;
+            }
+          `,
+        });
+
+        const { stdout, exitCode } = await Bun.$`${bunExe()} build --app ./app.ts`
+          .cwd(dir)
+          .env(bunEnv)
+          .quiet()
+          .throws(false);
+
+        expect(await Bun.file(path.join(dir, "dist", "index.html")).text()).toContain("Hello World");
+        expect(stdout.toString()).toBe("done\nexit event: 3\n");
+        expect(exitCode).toBe(3);
+      },
+      timeout,
+    );
 
-  test.concurrent(
-    "build with nothing to render runs 'exit' handlers",
-    async () => {
-      const dir = await tempDirWithBakeDeps("bake-production-exit-no-routes", {
-        "app.ts": onExitConfig,
-      });
-
-      const { stdout, exitCode } = await Bun.$`${bunExe()} build --app ./app.ts`
-        .cwd(dir)
-        .env(bunEnv)
-        .quiet()
-        .throws(false);
-
-      expect(stdout.toString()).toBe("done\nexit event: 0\n");
-      expect(exitCode).toBe(0);
-    },
-    30_000 * WAIT_MULTIPLIER,
-  );
+    test(
+      "a build with nothing to render runs 'exit' handlers",
+      async () => {
+        const dir = await tempDirWithBakeDeps("bake-production-exit-no-routes", {
+          "app.ts": onExitConfig,
+        });
+
+        const { stdout, exitCode } = await Bun.$`${bunExe()} build --app ./app.ts`
+          .cwd(dir)
+          .env(bunEnv)
+          .quiet()
+          .throws(false);
+
+        expect(stdout.toString()).toBe("done\nexit event: 0\n");
+        expect(exitCode).toBe(0);
+      },
+      timeout,
+    );
 
-  // The natives behind these wrappers are freed by the wrappers' finalizers, so
-  // they stay allocated until the VM is destroyed; LSan sees them as leaked when
-  // the build exits without destroying it. This checks the report's contents
-  // rather than requiring it to be empty because the build's own transpilers
-  // are still leaked (separate fix), which keeps this file in
-  // test/no-validate-leaksan.txt for now.
-  test.concurrent.skipIf(!isASAN)(
-    "rendered build destroys its VM under BUN_DESTRUCT_VM_ON_EXIT",
-    async () => {
-      const dir = await tempDirWithBakeDeps("bake-production-exit-teardown", {
-        "app.ts": `export default { app: { framework: "react" } };`,
-        "pages/index.tsx": `
-          globalThis.keepUntilExit = [new TextDecoder(), new Blob(["prerender"]), setImmediate(() => {})];
-          export default function IndexPage() {
-            return <div>Hello World</div>;
-          }
-        `,
-      });
-
-      const { stdout, stderr } = await Bun.$`${bunExe()} build --app ./app.ts`
-        .cwd(dir)
-        .env({
-          ...bunEnv,
-          BUN_DESTRUCT_VM_ON_EXIT: "1",
-          ASAN_OPTIONS: [bunEnv.ASAN_OPTIONS, "detect_leaks=1"].filter(Boolean).join(":"),
-          LSAN_OPTIONS: `print_suppressions=0:suppressions=${path.join(import.meta.dirname, "../../leaksan.supp")}`,
-        })
-        .quiet()
-        .throws(false);
-
-      expect(await Bun.file(path.join(dir, "dist", "index.html")).text()).toContain("Hello World");
-      expect(stdout.toString()).toBe("done\n");
-      const leaked = ["TextDecoder", "Blob", "ImmediateObject"].filter(type => stderr.toString().includes(type));
-      expect(leaked).toEqual([]);
-    },
-    // LSan symbolizes every reported stack through llvm-symbolizer, which is
-    // slow against a debug binary.
-    60_000 * WAIT_MULTIPLIER,
-  );
+    // The natives behind these wrappers are freed by the wrappers' finalizers,
+    // so they stay allocated until the VM is destroyed, and LSan reports them
+    // when the build exits without destroying it. This checks the report's
+    // contents instead of requiring an empty report because the build's own
+    // transpilers are still leaked (#38233), which is also what keeps this file
+    // in test/no-validate-leaksan.txt.
+    test.skipIf(!isASAN)(
+      "a rendered build destroys its VM under BUN_DESTRUCT_VM_ON_EXIT",
+      async () => {
+        const dir = await tempDirWithBakeDeps("bake-production-exit-teardown", {
+          "app.ts": `export default { app: { framework: "react" } };`,
+          "pages/index.tsx": `
+            globalThis.keepUntilExit = [new TextDecoder(), new Blob(["prerender"]), setImmediate(() => {})];
+            export default function IndexPage() {
+              return <div>Hello World</div>;
+            }
+          `,
+        });
+
+        const { stdout, stderr } = await Bun.$`${bunExe()} build --app ./app.ts`
+          .cwd(dir)
+          .env({
+            ...bunEnv,
+            BUN_DESTRUCT_VM_ON_EXIT: "1",
+            ASAN_OPTIONS: [bunEnv.ASAN_OPTIONS, "detect_leaks=1"].filter(Boolean).join(":"),
+            LSAN_OPTIONS: `print_suppressions=0:suppressions=${path.join(import.meta.dirname, "../../leaksan.supp")}`,
+          })
+          .quiet()
+          .throws(false);
+
+        expect(await Bun.file(path.join(dir, "dist", "index.html")).text()).toContain("Hello World");
+        expect(stdout.toString()).toBe("done\n");
+        const leaked = ["TextDecoder", "Blob", "ImmediateObject"].filter(type => stderr.toString().includes(type));
+        expect(leaked).toEqual([]);
+      },
+      timeout,
+    );
+  });
 });

From fa59cde56cee04dfc454852a9b0d2913164a5f5b Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Fri, 14 Aug 2026 00:46:37 +0000
Subject: [PATCH 3/6] bake: shorten the build_command exit comments

---
 src/runtime/bake/production.rs | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/src/runtime/bake/production.rs b/src/runtime/bake/production.rs
index d943bb965c5c..04c619d575c6 100644
--- a/src/runtime/bake/production.rs
+++ b/src/runtime/bake/production.rs
@@ -112,9 +112,7 @@ pub fn build_command(ctx: Context) -> crate::Result<()> {
     // SAFETY: `init_bake` returns a freshly-allocated VM owned by this thread;
     // unique access for the rest of this function.
     let vm = unsafe { &mut *vm_ptr };
-    // Runs only on the `Err` return below (a bundler or I/O failure). Every
-    // other way out of this function exits the process, and the normal one,
-    // `global_exit()` at the end, tears the VM down itself.
+    // Only the `Err` return below reaches this; the other exits are process exits.
     // Note: pass `vm_ptr` by value into the guard so the drop closure does
     // not borrow the local (`defer!` would capture `&vm_ptr`, which under
     // edition-2024 disjoint-capture rules collides with the `&mut *vm_ptr`
@@ -214,9 +212,8 @@ pub fn build_command(ctx: Context) -> crate::Result<()> {
     let mut pt = PerThread::placeholder(vm_ptr);
 
     let result = build_with_vm(ctx, &cwd, &mut pt);
-    // SAFETY: the reborrows `build_with_vm` made through `pt.vm` died when it
-    // returned, so this frame has exclusive access again; the VM stays
-    // allocated until `global_exit` (or `_vm_guard`) destroys it.
+    // SAFETY: `build_with_vm` has returned, so its reborrows through `pt.vm` are
+    // dead; the VM is live until `global_exit` (or `_vm_guard`) destroys it.
     let vm = unsafe { &mut *vm_ptr };
     match result {
         Ok(()) => {}
@@ -230,13 +227,9 @@ pub fn build_command(ctx: Context) -> crate::Result<()> {
         Err(e) => return Err(e),
     }
 
-    // A rendered build exits the same way a failed one does: `on_exit` runs the
-    // `process.on("exit")` handlers the config and prerender registered, and
-    // `global_exit` exits with `process.exitCode`, tearing the VM down first
-    // under BUN_DESTRUCT_VM_ON_EXIT. Returning `Ok` instead would free only the
-    // Rust side of the VM (`_vm_guard`); the JSC heap would never be destroyed,
-    // so the natives still owned by the prerender's JS objects (timers, blobs,
-    // decoders, ...) would never be freed.
+    // Success exits through the VM as well: this runs the 'exit' handlers, applies
+    // process.exitCode and, under BUN_DESTRUCT_VM_ON_EXIT, destroys the JSC heap
+    // that owns the prerender's timers, blobs, ...; `_vm_guard` frees only the Rust side.
     vm.on_exit();
     vm.global_exit()
 }

From 07a70d9fee26095394a555f819f57e751f23d966 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Fri, 14 Aug 2026 00:48:24 +0000
Subject: [PATCH 4/6] bake: one-line comment on the build_command exit

---
 src/runtime/bake/production.rs | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/runtime/bake/production.rs b/src/runtime/bake/production.rs
index 04c619d575c6..f412015492c7 100644
--- a/src/runtime/bake/production.rs
+++ b/src/runtime/bake/production.rs
@@ -227,9 +227,7 @@ pub fn build_command(ctx: Context) -> crate::Result<()> {
         Err(e) => return Err(e),
     }
 
-    // Success exits through the VM as well: this runs the 'exit' handlers, applies
-    // process.exitCode and, under BUN_DESTRUCT_VM_ON_EXIT, destroys the JSC heap
-    // that owns the prerender's timers, blobs, ...; `_vm_guard` frees only the Rust side.
+    // Success must exit through the VM too: 'exit' handlers, process.exitCode, VM teardown.
     vm.on_exit();
     vm.global_exit()
 }

From c9b47afe3f25ca20ab54b713429d6f6daef41bac Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Fri, 14 Aug 2026 00:52:34 +0000
Subject: [PATCH 5/6] test: keep inherited LSAN_OPTIONS in the bake teardown
 case

---
 test/bake/dev/production.test.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/test/bake/dev/production.test.ts b/test/bake/dev/production.test.ts
index 73e817cef037..d85765d4e868 100644
--- a/test/bake/dev/production.test.ts
+++ b/test/bake/dev/production.test.ts
@@ -681,7 +681,12 @@ export default function IndexPage() {
             ...bunEnv,
             BUN_DESTRUCT_VM_ON_EXIT: "1",
             ASAN_OPTIONS: [bunEnv.ASAN_OPTIONS, "detect_leaks=1"].filter(Boolean).join(":"),
-            LSAN_OPTIONS: `print_suppressions=0:suppressions=${path.join(import.meta.dirname, "../../leaksan.supp")}`,
+            LSAN_OPTIONS: [
+              bunEnv.LSAN_OPTIONS,
+              `print_suppressions=0:suppressions=${path.join(import.meta.dirname, "../../leaksan.supp")}`,
+            ]
+              .filter(Boolean)
+              .join(":"),
           })
           .quiet()
           .throws(false);

From 4df233892cb8c67b9c37b09b0f2680bb98fc39a8 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Fri, 14 Aug 2026 08:10:18 +0000
Subject: [PATCH 6/6] test: create the bake teardown canaries during render,
 tear down in every exit case

The module-scope canaries were hidden by leaksan.supp's evaluateNonVirtual
entry, so the assertion was only carried by bun-framework-react's own
allocations; creating them inside the page component (plus a CryptoHasher
the framework never creates) makes the planted objects the thing measured.
The two exit-code cases now also set BUN_DESTRUCT_VM_ON_EXIT so the build
VM's teardown is exercised on every platform, and no-validate-leaksan.txt
records what still keeps production.test.ts listed.
---
 test/bake/dev/production.test.ts | 41 ++++++++++++++++++++++----------
 test/no-validate-leaksan.txt     |  3 +++
 2 files changed, 31 insertions(+), 13 deletions(-)

diff --git a/test/bake/dev/production.test.ts b/test/bake/dev/production.test.ts
index d85765d4e868..913c9f746d5b 100644
--- a/test/bake/dev/production.test.ts
+++ b/test/bake/dev/production.test.ts
@@ -601,6 +601,12 @@ export default function IndexPage() {
   // BUN_DESTRUCT_VM_ON_EXIT, destroys the JSC heap. Before, it returned and
   // exited the process directly, skipping all three.
   describe.concurrent("exits through the build VM", () => {
+    // With BUN_DESTRUCT_VM_ON_EXIT set, global_exit tears the VM down before the
+    // process exits, so the exit codes asserted below also show that a build
+    // VM's teardown completes on every platform, not only on the ASAN lane that
+    // looks at what it frees.
+    const env = { ...bunEnv, BUN_DESTRUCT_VM_ON_EXIT: "1" };
+
     const onExitConfig = `
       process.on("exit", code => console.log("exit event: " + code));
       export default { app: { framework: "react" } };
@@ -626,7 +632,7 @@ export default function IndexPage() {
 
         const { stdout, exitCode } = await Bun.$`${bunExe()} build --app ./app.ts`
           .cwd(dir)
-          .env(bunEnv)
+          .env(env)
           .quiet()
           .throws(false);
 
@@ -646,7 +652,7 @@ export default function IndexPage() {
 
         const { stdout, exitCode } = await Bun.$`${bunExe()} build --app ./app.ts`
           .cwd(dir)
-          .env(bunEnv)
+          .env(env)
           .quiet()
           .throws(false);
 
@@ -656,20 +662,28 @@ export default function IndexPage() {
       timeout,
     );
 
-    // The natives behind these wrappers are freed by the wrappers' finalizers,
-    // so they stay allocated until the VM is destroyed, and LSan reports them
-    // when the build exits without destroying it. This checks the report's
-    // contents instead of requiring an empty report because the build's own
-    // transpilers are still leaked (#38233), which is also what keeps this file
-    // in test/no-validate-leaksan.txt.
+    // The natives behind these objects are released by their wrappers'
+    // finalizers, so a build that exits without destroying its VM leaves all of
+    // them for LeakSanitizer to report. The page creates them while it renders:
+    // bun-framework-react's own prerender creates the first three kinds the same
+    // way (that is how the bug was found), and leaksan.supp would hide the same
+    // objects if they were created while the module is evaluated. The report
+    // cannot be required to be empty yet because the build's transpilers still
+    // leak (#38233), which is also what keeps this file in
+    // test/no-validate-leaksan.txt.
     test.skipIf(!isASAN)(
-      "a rendered build destroys its VM under BUN_DESTRUCT_VM_ON_EXIT",
+      "a rendered build frees the natives its JS objects own",
       async () => {
         const dir = await tempDirWithBakeDeps("bake-production-exit-teardown", {
           "app.ts": `export default { app: { framework: "react" } };`,
           "pages/index.tsx": `
-            globalThis.keepUntilExit = [new TextDecoder(), new Blob(["prerender"]), setImmediate(() => {})];
             export default function IndexPage() {
+              globalThis.keepUntilExit = [
+                new TextDecoder(),
+                new Blob(["prerender"]),
+                setImmediate(() => {}),
+                new Bun.CryptoHasher("sha256"),
+              ];
               return <div>Hello World</div>;
             }
           `,
@@ -678,8 +692,7 @@ export default function IndexPage() {
         const { stdout, stderr } = await Bun.$`${bunExe()} build --app ./app.ts`
           .cwd(dir)
           .env({
-            ...bunEnv,
-            BUN_DESTRUCT_VM_ON_EXIT: "1",
+            ...env,
             ASAN_OPTIONS: [bunEnv.ASAN_OPTIONS, "detect_leaks=1"].filter(Boolean).join(":"),
             LSAN_OPTIONS: [
               bunEnv.LSAN_OPTIONS,
@@ -693,7 +706,9 @@ export default function IndexPage() {
 
         expect(await Bun.file(path.join(dir, "dist", "index.html")).text()).toContain("Hello World");
         expect(stdout.toString()).toBe("done\n");
-        const leaked = ["TextDecoder", "Blob", "ImmediateObject"].filter(type => stderr.toString().includes(type));
+        const leaked = ["TextDecoder", "Blob", "ImmediateObject", "CryptoHasher"].filter(type =>
+          stderr.toString().includes(type),
+        );
         expect(leaked).toEqual([]);
       },
       timeout,
diff --git a/test/no-validate-leaksan.txt b/test/no-validate-leaksan.txt
index e4f53b8bfa48..f4058c497cdc 100644
--- a/test/no-validate-leaksan.txt
+++ b/test/no-validate-leaksan.txt
@@ -337,7 +337,10 @@ test/napi/node-napi-tests/test/js-native-api/6_object_wrap/do.test.ts
 # LSAN per-spawn adds no coverage and slows the file significantly.
 test/napi/uv_stub.test.ts
 
+# `bun build --app` still leaks its transpilers (#38233) and, with "use client"
+# components, a ServerComponentParseTask (#38004); remove once both have landed.
 test/bake/dev/production.test.ts
+
 test/js/third_party/pg-gateway/pglite.test.ts
 test/js/bun/test/parallel/test-integration-rspack.ts