One door out of a VM's thread: tickets + a teardown that waits

src/bun_core/env_var.rs

@@ -206,10 +206,10 @@ pub mod feature_flag {
     // Run the full VM teardown when the main thread exits (workers always do).
     // The CI runner turns it on for LeakSanitizer-validated files on ASAN.
     new_feature_flag!(pub BUN_DESTRUCT_VM_ON_EXIT, "BUN_DESTRUCT_VM_ON_EXIT", {});
-    // Test suite only, builds with debug assertions: a worker VM's handle makes
-    // cross-thread completions wait for its close, so each producer's "refused"
-    // release path runs deterministically (bun_jsc::vm_handle::refusal_gate).
-    new_feature_flag!(pub BUN_DEBUG_TEST_WORKER_REFUSAL_GATE, "BUN_DEBUG_TEST_WORKER_REFUSAL_GATE", {});
+    // Test suite only, builds with debug assertions: a worker VM holds every
+    // cross-thread completion until its teardown is waiting, so the "arrived
+    // during teardown" paths run deterministically (bun_jsc::vm_handle::test_gate).
+    new_feature_flag!(pub BUN_DEBUG_TEST_WORKER_TEARDOWN_GATE, "BUN_DEBUG_TEST_WORKER_TEARDOWN_GATE", {});
 
     // Disable "nativeDependencies"
     new_feature_flag!(pub BUN_FEATURE_FLAG_DISABLE_NATIVE_DEPENDENCY_LINKER, "BUN_FEATURE_FLAG_DISABLE_NATIVE_DEPENDENCY_LINKER", {});

src/bundler/bundle_v2.rs

@@ -1531,7 +1531,7 @@ pub mod bv2_impl {
         ) {
             debug_assert!(self.plugins.is_some());
             if let Some(completion) = self.completion {
-                // From Bun.build — the completion posts it to its VM (`loop_handle.post_task` via the vtable).
+                // From Bun.build — the completion posts it to its VM (through its ticket, via the vtable).
                 completion.enqueue_task_concurrent(task);
                 return;
             }

src/event_loop/AnyEventLoop.rs

@@ -67,15 +67,25 @@ impl Default for AnyEventLoop {
 }
 
 impl AnyEventLoop {
-    /// Owning thread: the poster other threads use to deliver JS-loop tasks
-    /// to this loop's VM; `None` for a mini loop.
+    /// Owning thread: the weak poster other threads use to deliver JS-loop
+    /// tasks to this loop's VM; `None` for a mini loop.
     pub fn js_poster(&self) -> Option<JsPoster> {
         match self {
             AnyEventLoop::Js { owner } => Some(owner.js_poster()),
             AnyEventLoop::Mini(_) => None,
         }
     }
 
+    /// Owning thread: a ticket on this loop's VM for work about to leave the
+    /// thread; `None` for a mini loop (owned by, and outliving the work of,
+    /// its thread).
+    pub fn js_ticket(&self) -> Option<JsTicket> {
+        match self {
+            AnyEventLoop::Js { owner } => Some(owner.js_ticket()),
+            AnyEventLoop::Mini(_) => None,
+        }
+    }
+
     pub fn iteration_number(&self) -> u64 {
         match self {
             AnyEventLoop::Js { owner } => owner.iteration_number(),
@@ -433,16 +443,24 @@ impl EventLoopHandle {
         EnteredEventLoop(self)
     }
 
-    /// Owning thread: the poster other threads use to deliver JS-loop tasks to
-    /// this handle's VM; `None` for a mini loop (post to it directly — it is
-    /// owned by, and outlives the work of, its thread).
+    /// Owning thread: the weak poster other threads use to deliver JS-loop
+    /// tasks to this handle's VM; `None` for a mini loop (post to it directly —
+    /// it is owned by, and outlives the work of, its thread).
     pub fn js_poster(&self) -> Option<JsPoster> {
         match self {
             EventLoopHandle::Js { owner } => Some(owner.js_poster()),
             EventLoopHandle::Mini(_) => None,
         }
     }
 
+    /// Owning thread: a ticket on this handle's VM; `None` for a mini loop.
+    pub fn js_ticket(&self) -> Option<JsTicket> {
+        match self {
+            EventLoopHandle::Js { owner } => Some(owner.js_ticket()),
+            EventLoopHandle::Mini(_) => None,
+        }
+    }
+
     pub fn r#loop(self) -> *mut UwsLoop {
         match self {
             EventLoopHandle::Js { owner } => owner.uws_loop(),
@@ -523,17 +541,23 @@ impl EventLoopHandle {
     }
 }
 
-// ─────────────────────────── JsPoster ──────────────────────────────────────
+// ─────────────────────── JsPoster / JsTicket ─────────────────────────────────
+//
+// How code below `bun_jsc` reaches a JS VM from another thread. Both are erased
+// `bun_jsc::vm_handle` types; `bun_jsc` fills the vtables.
+//
+// `JsPoster` is the *uncounted* form (an erased `VmHandle`): what something
+// that merely refers to a VM holds (spawn's process-wide waiter thread). Its
+// `post` is deliver-or-refuse: once the VM has closed, the task comes back and
+// the caller releases it — its own payload — on its own thread.
 //
-// How code below `bun_jsc` (spawn's waiter thread, the bundler's JS-loop hops,
-// shell/fs work that may serve a JS VM) posts a `ConcurrentTask` to a JS VM
-// from another thread. It is an erased `bun_jsc::VmHandle` clone: `bun_jsc`
-// fills the vtable; holders just call `post`. The VM's teardown closes the
-// underlying handle, after which `post` refuses (returns the task) and the
-// caller releases it on its own thread. Valid for as long as it is held.
-
-/// Result of posting a task to a JS loop from another thread: it was queued, or
-/// the loop's VM is gone and the caller has the task back to release on this
+// `JsTicket` is the *counted* form (an erased `Ticket`): what work running on
+// another thread on behalf of a VM holds (the bundler's JS-loop hops for a
+// `Bun.build`). The VM's teardown waits for every ticket, so its `post` cannot
+// fail. Hold it in the in-flight operation and drop it when done.
+
+/// Result of a weak post to a JS loop from another thread: it was queued, or
+/// the loop's VM is closed and the caller has the task back to release on this
 /// thread.
 #[must_use = "a refused task must be released by its producer"]
 pub enum Posted {
@@ -543,9 +567,6 @@ pub enum Posted {
 
 pub struct JsPosterVTable {
     pub post: unsafe fn(data: *const (), task: NonNull<ConcurrentTask>) -> Posted,
-    /// `VmHandle::embedded_work_scheduled` / `_finished` (see there).
-    pub embedded_work_scheduled: unsafe fn(data: *const ()),
-    pub embedded_work_finished: unsafe fn(data: *const ()),
     pub clone: unsafe fn(data: *const ()) -> *const (),
     pub drop: unsafe fn(data: *const ()),
 }
@@ -564,30 +585,76 @@ unsafe impl Sync for JsPoster {}
 impl JsPoster {
     /// # Safety
     /// `data`/`vtable` come from one of `bun_jsc::vm_handle`'s `to_js_poster`
-    /// implementations (`VmHandle` / `LoopHandle` / the isolated poster).
+    /// implementations (`VmHandle` / the isolated poster).
     #[inline]
     pub unsafe fn from_raw(data: *const (), vtable: &'static JsPosterVTable) -> Self {
         Self { data, vtable }
     }
 
     /// Queue `task` on the VM this poster was created for and wake it, or hand
-    /// it back if the VM has been torn down.
+    /// it back if the VM has closed.
     #[inline]
     pub fn post(&self, task: NonNull<ConcurrentTask>) -> Posted {
         // SAFETY: vtable contract.
         unsafe { (self.vtable.post)(self.data, task) }
     }
+}
+
+pub struct JsTicketVTable {
+    pub post: unsafe fn(data: *const (), task: NonNull<ConcurrentTask>),
+    pub script_allowed: unsafe fn(data: *const ()) -> bool,
+    pub clone: unsafe fn(data: *const ()) -> *const (),
+    pub drop: unsafe fn(data: *const ()),
+}
+
+/// See the section note. Cloning shares the one underlying ticket.
+pub struct JsTicket {
+    data: *const (),
+    vtable: &'static JsTicketVTable,
+}
+
+// SAFETY: `data` is an erased `Arc<bun_jsc::Ticket>`, itself `Send + Sync`.
+unsafe impl Send for JsTicket {}
+// SAFETY: as above.
+unsafe impl Sync for JsTicket {}
+
+impl JsTicket {
+    /// # Safety
+    /// `data`/`vtable` come from `bun_jsc::Ticket::to_js_ticket`.
+    #[inline]
+    pub unsafe fn from_raw(data: *const (), vtable: &'static JsTicketVTable) -> Self {
+        Self { data, vtable }
+    }
+
+    /// Queue `task` on the VM this ticket is for and wake it.
+    #[inline]
+    pub fn post(&self, task: NonNull<ConcurrentTask>) {
+        // SAFETY: vtable contract.
+        unsafe { (self.vtable.post)(self.data, task) }
+    }
 
+    /// Whether the VM is still running script (not stopping).
     #[inline]
-    /// Count work whose storage the VM (indirectly) owns; it waits for the
-    /// matching `embedded_work_finished` before closing. See `VmHandle`.
-    pub fn embedded_work_scheduled(&self) {
+    pub fn script_allowed(&self) -> bool {
         // SAFETY: vtable contract.
-        unsafe { (self.vtable.embedded_work_scheduled)(self.data) }
+        unsafe { (self.vtable.script_allowed)(self.data) }
     }
-    pub fn embedded_work_finished(&self) {
+}
+
+impl Clone for JsTicket {
+    fn clone(&self) -> Self {
+        Self {
+            // SAFETY: vtable contract.
+            data: unsafe { (self.vtable.clone)(self.data) },
+            vtable: self.vtable,
+        }
+    }
+}
+
+impl Drop for JsTicket {
+    fn drop(&mut self) {
         // SAFETY: vtable contract.
-        unsafe { (self.vtable.embedded_work_finished)(self.data) }
+        unsafe { (self.vtable.drop)(self.data) }
     }
 }
 

src/event_loop/ConcurrentTask.rs

@@ -137,12 +137,12 @@ pub struct Task {
 /// freed when it will never run. Implement on every type that can be
 /// enqueued; the impl lives in whatever crate owns the type.
 ///
-/// A queued task ends one of three ways: it runs (`bun_runtime::dispatch::
-/// run_task`); it is refused at post because its VM already closed (the
-/// poster frees it — `Postable::release_refused` / the `Posted::Refused` arm);
-/// or it was queued in time but its VM stops before running it —
+/// A queued task ends one of two ways: it runs (`bun_runtime::dispatch::
+/// run_task`), or its VM stops before running it —
 /// [`release_unrun`](Self::release_unrun), required here so no type can be
-/// queued without having decided it.
+/// queued without having decided it. (A *weak* poster — `JsPoster` — can also
+/// get its task back unqueued once the VM has closed; that task never entered
+/// a queue and is the poster's own to free: [`ConcurrentTask::release_refused`].)
 ///
 /// Re-exported from `bun_jsc` for ergonomics, but defined here (lowest tier on
 /// the hot-dispatch list, see PORTING.md §Dispatch) so that
@@ -312,8 +312,9 @@ impl ConcurrentTask {
         self
     }
 
-    /// A poster got `task` back because the target VM is gone: free it if it
-    /// is a heap task (`create*`); an intrusive one belongs to its container.
+    /// A weak poster got `task` back because the target VM has closed: free
+    /// it if it is a heap task (`create*`); an intrusive one belongs to its
+    /// container.
     ///
     /// # Safety
     /// `task` was just refused and is not queued anywhere.

src/event_loop/lib.rs

@@ -37,7 +37,8 @@ pub use DeferredTaskQueue as deferred_task_queue;
 
 pub use MiniEventLoop::PipeReadBuffer;
 pub use any_event_loop::{
-    AnyEventLoop, EventLoopHandle, EventLoopTask, JsPoster, JsPosterVTable, Posted,
+    AnyEventLoop, EventLoopHandle, EventLoopTask, JsPoster, JsPosterVTable, JsTicket,
+    JsTicketVTable, Posted,
 };
 
 // JS-event-loop arm of `AnyEventLoop` / `EventLoopHandle`. `bun_event_loop` is
@@ -61,7 +62,9 @@ bun_dispatch::link_interface! {
         fn enter();
         fn exit();
         fn enqueue_task(task: Task);
+        fn enqueue_task_concurrent_same_thread(task: core::ptr::NonNull<ConcurrentTask::ConcurrentTask>);
         fn js_poster() -> any_event_loop::JsPoster;
+        fn js_ticket() -> any_event_loop::JsTicket;
         fn env() -> *mut bun_dotenv::Loader;
         fn top_level_dir() -> *const [u8];
         fn create_null_delimited_env_map() -> Result<bun_dotenv::NullDelimitedEnvMap, bun_core::AllocError>;

src/jsc/AsyncModule.rs

@@ -74,11 +74,13 @@ pub struct Queue {
 
 /// What the resolver's `WakeHandler` carries as its opaque context: the
 /// module queue (for the JS-thread dependency-error callback) and the VM's
-/// handle (for wake-ups from install / HTTP threads). Allocated once per VM at
-/// registration and kept for the VM's lifetime.
+/// weak handle (for wake-ups from the process-wide install / HTTP threads,
+/// which outlive any one VM). Allocated once per VM at registration and kept
+/// for the VM's lifetime.
 pub struct WakeContext {
     pub queue: *mut Queue,
-    pub loop_handle: crate::LoopHandle,
+    pub handle: crate::VmHandle,
+    pub kind: crate::LoopKind,
 }
 
 impl Queue {
@@ -382,8 +384,8 @@ impl Queue {
         // SAFETY: `ctx` is the leaked `WakeContext` registered with this handler.
         let ctx = unsafe { &*ctx.cast::<WakeContext>() };
         let task = ConcurrentTaskItem::create_from(ctx.queue);
-        if let crate::vm_handle::Posted::Refused(task) = ctx.loop_handle.post_task(task) {
-            // VM torn down: nobody is waiting on these modules any more.
+        if let crate::vm_handle::Posted::Refused(task) = ctx.handle.post(ctx.kind, task) {
+            // That VM has closed: nobody is waiting on these modules any more.
             // SAFETY: refused ⇒ we own the task box.
             unsafe { drop(bun_core::heap::take(task.as_ptr())) };
         }

src/jsc/CppTask.rs

@@ -2,12 +2,8 @@ use crate::{JSGlobalObject, JsResult};
 use bun_event_loop::{TaskTag, Taskable, task_tag};
 use bun_threading::work_pool::{Task as WorkPoolTask, WorkPool};
 
-#[allow(improper_ctypes)] // `Shared` is opaque to C++ (`BunVmHandleRef`)
 unsafe extern "C" {
     fn Bun__EventLoopTaskNoContext__performTask(task: *mut EventLoopTaskNoContext);
-    safe fn Bun__EventLoopTaskNoContext__vmHandle(
-        task: &EventLoopTaskNoContext,
-    ) -> *const crate::vm_handle::Shared;
 }
 
 bun_opaque::opaque_ffi! {
@@ -53,54 +49,46 @@ impl EventLoopTaskNoContext {
         // SAFETY: caller guarantees `this` is a valid C++ EventLoopTaskNoContext; performTask consumes/frees it.
         unsafe { Bun__EventLoopTaskNoContext__performTask(this) }
     }
-
-    /// The handle of the VM this task was created in (a reference the C++
-    /// task holds for its lifetime).
-    pub(crate) fn vm_handle(&self) -> crate::vm_handle::BorrowedRef {
-        // SAFETY: C++ stores a `BunVmHandleRef` from `Bun__VmHandle__retainRef`
-        // for the task's whole lifetime.
-        unsafe { crate::VmHandle::borrow_ref(Bun__EventLoopTaskNoContext__vmHandle(self)) }
-    }
 }
 
-/// A task created from C++ code that runs inside the workpool, usually via ScriptExecutionContext.
+/// A task created from C++ code that runs inside the workpool (WebCrypto's
+/// `PhonyWorkQueue`). Holds the creating VM's ticket: the C++ closure captures
+/// context-affine objects and posts its result back by context id.
 #[repr(C)]
 pub struct ConcurrentCppTask {
     pub(crate) cpp_task: *mut EventLoopTaskNoContext,
+    pub(crate) ticket: crate::Ticket,
     pub(crate) workpool_task: WorkPoolTask,
 }
 
 bun_threading::owned_task!(ConcurrentCppTask, workpool_task);
 
 impl ConcurrentCppTask {
+    // `owned_task!` requires `fn run_owned(self: Box<Self>)`.
+    #[allow(clippy::boxed_local)]
     fn run_owned(self: Box<Self>) {
-        // Extract all the info we need from `self` and `cpp_task` before we call functions that
-        // free them.
-        let cpp_task = self.cpp_task;
-        // `EventLoopTaskNoContext` is an `opaque_ffi!` ZST handle; `opaque_ref`
-        // is the centralised non-null deref proof. Valid until `run` consumes it.
-        // Clone before `run` consumes (and frees) the C++ task that holds the reference.
-        let handle: crate::VmHandle = EventLoopTaskNoContext::opaque_ref(cpp_task)
-            .vm_handle()
-            .clone();
-        drop(self);
+        let ConcurrentCppTask {
+            cpp_task, ticket, ..
+        } = *self;
         // SAFETY: `cpp_task` is the valid C++ handle stored by `ConcurrentCppTask__createAndRun`;
-        // `opaque_ref` above proved it non-null and it has not yet been freed — `run` consumes it here.
+        // `run` consumes it here.
         unsafe { EventLoopTaskNoContext::run(cpp_task) };
-        handle.unref_keep_alive(crate::LoopKind::Regular);
+        ticket.unref_keep_alive();
     }
 }
 
+/// JS thread (`PhonyWorkQueue::dispatch`).
 #[unsafe(no_mangle)]
-extern "C" fn ConcurrentCppTask__createAndRun(cpp_task: *mut EventLoopTaskNoContext) {
+extern "C" fn ConcurrentCppTask__createAndRun(
+    global: &JSGlobalObject,
+    cpp_task: *mut EventLoopTaskNoContext,
+) {
     crate::mark_binding!();
-    // `EventLoopTaskNoContext` is an `opaque_ffi!` ZST handle; `opaque_ref` is
-    // the centralised non-null deref proof. C++ just handed it over.
-    EventLoopTaskNoContext::opaque_ref(cpp_task)
-        .vm_handle()
-        .ref_keep_alive(crate::LoopKind::Regular);
+    let ticket = global.bun_vm().ticket();
+    ticket.ref_keep_alive();
     WorkPool::schedule_new(ConcurrentCppTask {
         cpp_task,
+        ticket,
         workpool_task: WorkPoolTask::default(),
     });
 }