Changed PackedNext implementation to preserve ARM TBI/PAC/MTE pointer metadata:
- Store full usize pointer with auto_delete flag in LOW alignment bit (not high bit)
- ConcurrentTask is 8-byte aligned (contains u64 Task), so low bit is guaranteed zero
- Use enum(usize) { zero = 0, _ } for type safety and clean initialization syntax
- All atomic operations use usize (instead of u64) with @intFromEnum/@enumFromInt
- Masks: AUTO_DELETE_MASK=0x1, POINTER_MASK=~0x1
Benefits:
- Preserves all high pointer metadata (ARM pointer authentication, tagging, etc.)
- Uses guaranteed-zero low alignment bits instead of truncating address space
- Type-safe enum wrapper prevents accidental misuse
- Clean .zero initialization syntax
1. Explicitly zero out bit 63 when unpacking pointer to avoid any UB
- Added mask: ptr_bits & 0x7FFFFFFFFFFFFFFF before ptrFromInt
2. Add ConcurrentTask.auto_delete() getter to hide implementation detail
- The fact that auto_delete is packed into next field is now internal
- Updated event_loop.zig to use the public getter
- Makes the API cleaner and easier to maintain
The previous implementation had a critical bug where atomic stores in
pushBatch would overwrite the auto_delete flag. This fix ensures:
1. When atomically updating the next pointer, we preserve the existing
auto_delete flag by doing a read-modify-write
2. All atomic operations use consistent types:
- u64 for packed structs (via bitcast)
- ?*T for plain pointers (front/back queue pointers)
3. Added initPreserveAutoDelete() method to create new PackedNext
values while preserving the auto_delete bit
The key insight is that front/back hold plain pointers to tasks, while
each task's 'next' field holds a PackedNext struct. When updating a
task's next pointer via pushBatch, we must preserve that task's
auto_delete flag.
Pack the auto_delete boolean into the lowest bit of the next pointer in
ConcurrentTask, reducing memory usage by 33% (from 24 to 16 bytes).
Implementation details:
- Created PackedNext struct that packs u63 pointer + bool into u64
- Extended UnboundedQueue to support packed pointer types via
UnboundedQueuePacked function
- Added getter/setter helpers to abstract packed vs unpacked access
- All atomic operations properly handle packed pointer unpacking
- Added compile-time assertion to ensure ConcurrentTask is 16 bytes
The next pointer uses only 63 bits since pointers on 64-bit systems
don't use the full address space, leaving the LSB for the auto_delete flag.
tests not in `test/no-validate-leaksan.txt` will run with leaksanitizer
in CI
leaks documented in `test/leaksan.supp` will not cause a test failure
-- notes about leaksanitizer
- will not catch garbage collected objects accumulated during
long-running processes
- will not catch js objects (eg a strong held to a promise)
- will catch native calls to `malloc` not `free`d
- will catch allocations made in C, Zig, C++, libc, dependencies,
dlopen'd
---------
Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
## What does this PR do?
Fixes https://github.com/oven-sh/bun/issues/22650
Fixes https://github.com/oven-sh/bun/issues/22615
Fixes https://github.com/oven-sh/bun/issues/22603
Fixes https://github.com/oven-sh/bun/issues/22602
Fixes a crash that occurred when running shell commands through `bun
run` (package.json scripts) on Windows that use the `&&` operator
followed by an external command.
### The Problem
The minimal reproduction was:
```bash
bun exec 'echo && node --version'
```
This would crash with: `panic(main thread): attempt to use null value`
### Root Causes
Two issues were causing the crash:
1. **Missing top_level_dir**: When `runPackageScriptForeground` creates
a MiniEventLoop for running package scripts, it wasn't setting the
`top_level_dir` field. This caused a null pointer dereference when the
shell tried to access it.
2. **MovableIfWindowsFd handling**: After PR #21800 introduced
`MovableIfWindowsFd` to handle file descriptor ownership on Windows, the
`IOWriter.fd` could be moved to libuv, leaving it null. When the shell
tried to spawn an external command after a `&&` operator, it would crash
trying to access this null fd.
### The Fix
1. Set `mini.top_level_dir = cwd` after initializing the MiniEventLoop
in `run_command.zig`
2. In `IO.zig`, when the fd has been moved to libuv (is null), use
`.inherit` for stdio instead of trying to pass the null fd
### How did you verify your code works?
- Added a regression test that reproduces the issue
- Verified the test fails without the fix and passes with it
- Tested the minimal reproduction command directly
- The fix correctly allows both commands in the `&&` chain to execute
```bash
# Before fix: crashes
> bun exec 'echo test && node --version'
panic(main thread): attempt to use null value
# After fix: works correctly
> bun exec 'echo test && node --version'
test
v22.4.1
```
<sub>
also probably fixes#22615 and fixes#22603 and fixes#22602
</sub>
---------
Co-authored-by: Zack Radisic <zack@theradisic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Replace `catch bun.outOfMemory()`, which can accidentally catch
non-OOM-related errors, with either `bun.handleOom` or a manual `catch
|err| switch (err)`.
(For internal tracking: fixes STAB-1070)
---------
Co-authored-by: Dylan Conway <dylan.conway567@gmail.com>
