bun icon indicating copy to clipboard operation
bun copied to clipboard

WIP: Fix ref counting bugs in spawn API observed under rr

Open 190n opened this issue 7 months ago • 3 comments

What does this PR do?

This fixes use-after-free bugs which I observed running worker_threads.test.ts under rr. I unfortunately have no idea how to repro this outside of rr so there's no test.

  • Makes ProcessAutoKiller ref and deref the processes it monitors
  • Fixes Process not getting re-ref'd in rewatchPosix in some cases

How did you verify your code works?

Will see if CI passes

190n avatar Jun 04 '25 22:06 190n

Updated 11:39 AM PT - Jun 13th, 2025

:x: @Jarred-Sumner, your commit 63263d3463b8fd55eb92ec27a881a959801598a3 has 1 failures in Build #18629:


🧪   To try this PR locally:

bunx bun-pr 20191

That installs a local version of the PR into your bun-20191 executable, so you can run:

bun-20191 --bun

robobun avatar Jun 04 '25 23:06 robobun

This leaks memory if it goes through on the WaiterThread.shouldUseWaiterThread code path due to the ref call on this line:

https://github.com/oven-sh/bun/blob/48cb2889b84552226c089b522dad42ec81498bd6/src/bun.js/api/bun/process.zig#L370-L375

Maybe instead, rewatchPosix in the success case should this.ref()?

https://github.com/oven-sh/bun/blob/48cb2889b84552226c089b522dad42ec81498bd6/src/bun.js/api/bun/process.zig#L272-L278

Jarred-Sumner avatar Jun 06 '25 03:06 Jarred-Sumner

Maybe instead, rewatchPosix in the success case should this.ref()?

That sounds good, we'll see if it works

190n avatar Jun 06 '25 23:06 190n