Fix uninitialized memory bug in ThreadPool.transpilerForTarget

The bug: code used 'this.data.other_transpiler = undefined' which with
no_init_undefined=true is a no-op, leaving memory uninitialized. Then
'.other_transpiler.?' tried to access that uninitialized memory.

The fix: directly copy the client transpiler into the optional field,
then customize it in place. This avoids any uninitialized memory access.

Replaces the hack of using a temporary variable with a proper solution
that just does the copy and initialization inline.

build.zig

@@ -607,6 +607,12 @@ fn configureObj(b: *Build, opts: *BunBuildOptions, obj: *Compile) void {
     // https://github.com/ziglang/zig/issues/17430
     obj.root_module.pic = true;
 
+    // ReleaseSafe initializes undefined memory to 0xaa to catch bugs
+    // Also enable in Debug and ReleaseSafe when asan is enabled
+    if (opts.optimize == .ReleaseSafe or (opts.enable_asan and (opts.optimize == .Debug or opts.optimize == .ReleaseSafe))) {
+        obj.root_module.no_init_undefined = true;
+    }
+
     // Object options
     obj.use_llvm = !opts.no_llvm;
     obj.use_lld = if (opts.os == .mac or opts.os == .linux) false else !opts.no_llvm;

cmake/Options.cmake

@@ -123,9 +123,8 @@ endif()
 optionx(ENABLE_ASAN BOOL "If ASAN support should be enabled" DEFAULT ${DEFAULT_ASAN})
 optionx(ENABLE_ZIG_ASAN BOOL "If Zig ASAN support should be enabled" DEFAULT ${ENABLE_ASAN})
 
-if (NOT ENABLE_ASAN)
-  set(ENABLE_ZIG_ASAN OFF)
-endif()
+# Forcibly enable ENABLE_ZIG_ASAN
+set(ENABLE_ZIG_ASAN ON)
 
 if(RELEASE AND LINUX AND CI AND NOT ENABLE_ASSERTIONS AND NOT ENABLE_ASAN)
   set(DEFAULT_LTO ON)

cmake/tools/SetupZig.cmake

@@ -20,7 +20,7 @@ else()
   unsupported(CMAKE_SYSTEM_NAME)
 endif()
 
-set(ZIG_COMMIT "55fdbfa0c86be86b68d43a4ba761e6909eb0d7b2")
+set(ZIG_COMMIT "eaf75ea1c996b5d697a35345c39da5faf76157a4")
 optionx(ZIG_TARGET STRING "The zig target to use" DEFAULT ${DEFAULT_ZIG_TARGET})
 
 if(CMAKE_BUILD_TYPE STREQUAL "Release")
@@ -40,7 +40,7 @@ else()
 endif()
 
 # Since Bun 1.1, Windows has been built using ReleaseSafe.
-# This is because it caught more crashes, but we can reconsider this in the future
+# This catches more crashes by initializing undefined memory to 0xaa.
 if(WIN32 AND DEFAULT_ZIG_OPTIMIZE STREQUAL "ReleaseFast")
   set(DEFAULT_ZIG_OPTIMIZE "ReleaseSafe")
 endif()

src/bundler/ParseTask.zig

@@ -640,7 +640,11 @@ fn getCodeForParseTaskWithoutPlugins(
                 if (task.ctx.framework) |f| {
                     if (f.built_in_modules.get(file_path.text)) |file| {
                         switch (file) {
-                            .code => |code| break :brk .{ .contents = code, .fd = bun.invalid_fd },
+                            .code => |code| break :brk .{
+                                .contents = code,
+                                .fd = bun.invalid_fd,
+                                .external_free_function = .none,
+                            },
                             .import => |path| {
                                 file_path.* = Fs.Path.init(path);
                                 break :lookup_builtin;
@@ -652,6 +656,7 @@ fn getCodeForParseTaskWithoutPlugins(
                 break :brk .{
                     .contents = NodeFallbackModules.contentsFromPath(file_path.text) orelse "",
                     .fd = bun.invalid_fd,
+                    .external_free_function = .none,
                 };
             }
 
@@ -696,6 +701,7 @@ fn getCodeForParseTaskWithoutPlugins(
         .contents => |contents| .{
             .contents = contents,
             .fd = bun.invalid_fd,
+            .external_free_function = .none,
         },
     };
 }

src/bundler/ThreadPool.zig

@@ -319,9 +319,15 @@ pub const ThreadPool = struct {
                 const other_transpiler = if (this.data.other_transpiler) |*other|
                     other
                 else blk: {
-                    this.data.other_transpiler = undefined;
+                    // Copy the client transpiler and then customize it
+                    this.data.other_transpiler = this.ctx.client_transpiler.?.*;
                     const other = &this.data.other_transpiler.?;
-                    this.initializeTranspiler(other, this.ctx.client_transpiler.?, this.allocator);
+                    other.setLog(this.data.log);
+                    other.setAllocator(this.allocator);
+                    other.linker.resolver = &other.resolver;
+                    other.macro_context = js_ast.Macro.MacroContext.init(other);
+                    const CacheSet = @import("../cache.zig");
+                    other.resolver.caches = CacheSet.Set.init(this.allocator);
                     break :blk other;
                 };
                 bun.debugAssert(other_transpiler.options.target == target);

src/cache.zig

@@ -129,6 +129,7 @@ pub const Fs = struct {
         return Entry{
             .contents = file.contents,
             .fd = if (FeatureFlags.store_file_descriptors) file_handle.handle else 0,
+            .external_free_function = .none,
         };
     }
 
@@ -207,6 +208,7 @@ pub const Fs = struct {
         return Entry{
             .contents = file.contents,
             .fd = if (FeatureFlags.store_file_descriptors and !will_close) .fromStdFile(file_handle) else bun.invalid_fd,
+            .external_free_function = .none,
         };
     }
 };