Files
bun.sh/test/regression
Claude Bot 600a190ace fix(shell): use-after-free in interpreter when setupIOBeforeRun fails (#26919)
When `setupIOBeforeRun()` fails in `runFromJS()` (e.g., stdout/stderr
closed on Windows), the error path called `#deinitFromExec()` which
freed the interpreter struct via `allocator.destroy(this)`. The GC
would later finalize the JSShellInterpreter wrapper, accessing the
already-freed memory and causing a segfault.

Fix: use `#derefRootShellAndIOIfNeeded(true)` instead, which cleans
up runtime resources (IO, shell env) and sets `cleanup_state` to
`.runtime_cleaned`, deferring struct deallocation to the GC finalizer.

Co-Authored-By: Claude <noreply@anthropic.com>
2026-02-11 22:24:32 +00:00
..