Fix use-after-free in Bun.Transpiler async transform() error messages

src/runtime/api/JSTranspiler.zig

@@ -500,9 +500,16 @@ pub const TransformTask = struct {
         var ast_scope = ast_memory_allocator.enter(allocator);
         defer ast_scope.exit();
 
+        // The parser allocates error message text using the transpiler's
+        // allocator (the arena above). Collect messages in a local log and
+        // deep-copy them into `this.log` before the arena is destroyed so
+        // `then()` on the JS thread does not read freed memory.
+        var local_log = logger.Log.init(allocator);
+        local_log.level = this.log.level;
+        defer bun.handleOom(local_log.appendToWithRecycled(&this.log, true));
+
         this.transpiler.setAllocator(allocator);
-        this.transpiler.setLog(&this.log);
-        this.log.msgs.allocator = bun.default_allocator;
+        this.transpiler.setLog(&local_log);
 
         const jsx = if (this.tsconfig != null)
             this.tsconfig.?.mergeJSX(this.transpiler.options.jsx)

test/js/bun/transpiler/transpiler-async-error-uaf.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, test } from "bun:test";
+
+describe("Transpiler async transform() error lifetime", () => {
+  test.concurrent("concurrent async transform() parse errors do not read freed memory", async () => {
+    const transpiler = new Bun.Transpiler();
+    const promises: Promise<unknown>[] = [];
+    for (let i = 0; i < 50; i++) {
+      promises.push(
+        transpiler.transform("const x = @@@", "js").then(
+          () => null,
+          e => e,
+        ),
+      );
+    }
+    const results = await Promise.all(promises);
+    for (const r of results) {
+      expect(r).toBeInstanceOf(BuildMessage);
+      const msg = r as BuildMessage;
+      expect(msg.message).toBe('Expected identifier but found "@"');
+      expect(msg.position).toEqual({
+        lineText: "const x = @@@",
+        file: "input.js",
+        namespace: "file",
+        line: 1,
+        column: 12,
+        length: 1,
+        offset: 11,
+      });
+    }
+  });
+
+  test.concurrent("async transform() rejects with a usable BuildMessage after arena is freed", async () => {
+    const transpiler = new Bun.Transpiler();
+    const err = await transpiler.transform("1 + ", "js").then(
+      () => null,
+      e => e,
+    );
+    expect(err).toBeInstanceOf(BuildMessage);
+    expect((err as BuildMessage).message).toBe("Unexpected end of file");
+  });
+});