fix: PathWatcherManager deadlock and UAF in deferred deinit

src/Watcher.zig

@@ -125,12 +125,24 @@ pub fn deinit(this: *Watcher, close_descriptors: bool) void {
                 fd.close();
             }
         }
+        this.freeOwnedFilePaths();
         this.watchlist.deinit(this.allocator);
         const allocator = this.allocator;
         allocator.destroy(this);
     }
 }
 
+fn freeOwnedFilePaths(this: *Watcher) void {
+    const slice = this.watchlist.slice();
+    const file_paths = slice.items(.file_path);
+    const owns = slice.items(.owns_file_path);
+    for (file_paths, owns) |fp, owned| {
+        if (owned and fp.len > 0) {
+            this.allocator.free(@constCast(fp.ptr[0 .. fp.len + 1]));
+        }
+    }
+}
+
 pub fn getHash(filepath: string) HashType {
     return @as(HashType, @truncate(bun.hash(filepath)));
 }
@@ -218,6 +230,7 @@ pub const WatchItem = struct {
     kind: Kind,
     package_json: ?*PackageJSON,
     eventlist_index: if (Environment.isLinux) Platform.EventListIndex else u0 = 0,
+    owns_file_path: bool = false,
 
     pub const Kind = enum { file, directory };
 };
@@ -248,6 +261,8 @@ fn threadMain(this: *Watcher) !void {
             fd.close();
         }
     }
+    // Free cloned file_path strings before freeing the backing storage.
+    this.freeOwnedFilePaths();
     this.watchlist.deinit(this.allocator);
 
     // Close trace file if open
@@ -291,8 +306,16 @@ pub fn flushEvictions(this: *Watcher) void {
 
     last_item = no_watch_item;
     // This is split into two passes because reading the slice while modified is potentially unsafe.
+    const file_paths = slice.items(.file_path);
+    const owns = slice.items(.owns_file_path);
     for (this.evict_list[0..this.evict_list_i]) |item| {
         if (item == last_item or this.watchlist.len <= item) continue;
+        // Free cloned file_path strings before swapRemove overwrites the slot.
+        // The string was allocated via allocator.dupeZ (len+1 bytes with null terminator).
+        if (owns[item]) {
+            const fp = file_paths[item];
+            this.allocator.free(@constCast(fp.ptr[0 .. fp.len + 1]));
+        }
         this.watchlist.swapRemove(item);
         last_item = item;
     }
@@ -376,6 +399,10 @@ fn appendFileAssumeCapacity(
         bun.asByteSlice(bun.handleOom(this.allocator.dupeZ(u8, file_path)))
     else
         file_path;
+    var should_free_file_path = comptime clone_file_path;
+    defer if (should_free_file_path) {
+        this.allocator.free(@constCast(file_path_.ptr[0 .. file_path_.len + 1]));
+    };
 
     var item = WatchItem{
         .file_path = file_path_,
@@ -386,6 +413,7 @@ fn appendFileAssumeCapacity(
         .parent_hash = parent_hash,
         .package_json = package_json,
         .kind = .file,
+        .owns_file_path = clone_file_path,
     };
 
     if (comptime Environment.isMac) {
@@ -404,6 +432,7 @@ fn appendFileAssumeCapacity(
     }
 
     this.watchlist.appendAssumeCapacity(item);
+    should_free_file_path = false; // ownership transferred to watchlist
     return .success;
 }
 fn appendDirectoryAssumeCapacity(
@@ -434,6 +463,10 @@ fn appendDirectoryAssumeCapacity(
         bun.asByteSlice(bun.handleOom(this.allocator.dupeZ(u8, file_path)))
     else
         file_path;
+    var should_free_file_path = comptime clone_file_path;
+    defer if (should_free_file_path) {
+        this.allocator.free(@constCast(file_path_.ptr[0 .. file_path_.len + 1]));
+    };
 
     const parent_hash = getHash(bun.fs.PathName.init(file_path_).dirWithTrailingSlash());
 
@@ -448,6 +481,7 @@ fn appendDirectoryAssumeCapacity(
         .parent_hash = parent_hash,
         .kind = .directory,
         .package_json = null,
+        .owns_file_path = clone_file_path,
     };
 
     if (Environment.isMac) {
@@ -506,6 +540,7 @@ fn appendDirectoryAssumeCapacity(
     }
 
     this.watchlist.appendAssumeCapacity(item);
+    should_free_file_path = false; // ownership transferred to watchlist
     return .{
         .result = @as(WatchItemIndex, @truncate(this.watchlist.len - 1)),
     };