install: gate the exit-callback cache teardown to the main thread

src/install/PackageManager.rs

@@ -1414,18 +1414,33 @@ pub(crate) fn allocate_package_manager() {
     let ptr =
         bun_core::heap::into_raw(Box::<PackageManager>::new_uninit()).cast::<PackageManager>();
     holder::RAW_PTR.store(ptr, core::sync::atomic::Ordering::Release);
+    // The exit callback exists only so LeakSanitizer does not report the
+    // caches as still reachable at exit; non-ASAN builds don't compile it in.
+    #[cfg(bun_asan)]
     bun_core::add_exit_callback(deinit_caches_at_exit);
 }
 
+#[cfg(bun_asan)]
 extern "C" fn deinit_caches_at_exit() {
+    // Exit callbacks run on whichever thread called `Global::exit()` — e.g.
+    // the HTTP client thread when CA-file validation fails in
+    // `http_thread_on_init_error`. The cache's `MimallocArena` heaps are
+    // created by and belong to the main thread, and the main thread may still
+    // be mutating the cache concurrently, so off-main this would be both a
+    // wrong-thread `mi_heap_destroy` and a data race. Skip it and let the OS
+    // reclaim the memory.
+    if !bun_crash_handler::cli_state::is_main_thread() {
+        return;
+    }
     if !holder::INITIALIZED.load(core::sync::atomic::Ordering::Acquire) {
         return;
     }
     let ptr = get();
     if ptr.is_null() {
         return;
     }
-    // SAFETY: `deinit_caches()` only touches main-thread-owned fields.
+    // SAFETY: `deinit_caches()` only touches main-thread-owned fields, and the
+    // main-thread precondition is checked above (not assumed).
     unsafe { (*ptr).deinit_caches() };
 }
 

test/cli/install/bun-install-registry.test.ts

@@ -260,6 +260,42 @@ describe("certificate authority", () => {
     expect(await exited).toBe(1);
   });
 
+  test("non-existent --cafile with workspaces exits 1 without crashing", async () => {
+    // The workspace walk in `PackageManager::init()` populates the workspace
+    // package.json cache before the HTTP thread starts. When the HTTP thread
+    // then fails CA validation and drives process exit, the exit path must not
+    // tear down that main-thread-owned cache from the HTTP thread.
+    await Promise.all([
+      write(
+        packageJson,
+        JSON.stringify({
+          name: "foo",
+          version: "1.0.0",
+          workspaces: ["packages/*"],
+          dependencies: { "no-deps": "1.1.1" },
+        }),
+      ),
+      ...["a", "b", "c"].map(name =>
+        write(
+          join(packageDir, "packages", name, "package.json"),
+          JSON.stringify({ name: `pkg-${name}`, version: "1.0.0" }),
+        ),
+      ),
+    ]);
+    const { stdout, stderr, exited } = spawn({
+      cmd: [bunExe(), "install", "--cafile", "/does/not/exist"],
+      cwd: packageDir,
+      stderr: "pipe",
+      stdout: "pipe",
+      env,
+    });
+    const out = await stdout.text();
+    expect(out).not.toContain("no-deps");
+    const err = await stderr.text();
+    expect(err).toContain(`HTTPThread: could not find CA file: '/does/not/exist'`);
+    expect(await exited).toBe(1);
+  });
+
   test("cafile from bunfig does not exist", async () => {
     await Promise.all([
       write(