[robobun]

Blocked on oven-sh/WebKit#714. A draft until the pin is a commit of the fork's main.

Problem

• A dlopen() symbol called after lib.close() jumps into the unloaded library: panic(main thread): Segmentation fault at address 0x73EAAAEA94B0.
• FFI::do_close (src/runtime/ffi/ffi_body.rs:1318) calls dlclose. The JSC::JSFFIFunction objects keep the address, and their JIT code has it baked in.
• bun:ffi: use the engine-native FFI when available #35246 did not pick up this piece of bun:ffi: throw when calling a symbol after close() instead of jumping into freed TinyCC memory #31960.

Fix

• [JSC] bun:ffi: JSFFIFunction::close() makes a call throw instead of jumping to an unloaded library WebKit#714 adds JSFFIFunction::close(). A call after it throws TypeError: bun:ffi: cannot call '<name>' because its library was closed. An open function pays nothing. WEBKIT_VERSION pins its preview build, autobuild-preview-pr-714-d4f2d385.
• The library object keeps its functions in a hidden array, and close() closes them before do_close unloads. lib.symbols cannot be the list: the user can change it.
• close() inside a call (a JSCallback that the library calls) keeps the library loaded, because that call returns into it. JSFFIFunction::isRunning() finds the call on the stack.
• Verified: two new cases in test/js/bun/ffi/ffi.test.js. USE_SYSTEM_BUN=1 bun test fails with exit code 139, bun bd test passes. Self-reviewed: 3 concerns raised, 3 addressed.

Background

• A JSFFIFunction is a JS function bound to a native address. A host function, a per-function stub, and DFG / FTL code call that address.
• values in ffi.classes.ts declares a GC-visited wrapper field that JS cannot reach.

Downsides

• A linkSymbols() symbol called after close() worked and now throws.
• A library closed inside one of its calls stays loaded until the process exits.
• Still a crash: native code that kept a function's address, and close() while the library runs under another library's call.

Notes

• Repro: dlopen("libz.so.1", { zlibVersion: { args: [], returns: "cstring" } }), call, lib.close(), call. A library that something else keeps mapped (libc, a second dlopen() of the same file) hides the crash. Under ASan it is SEGV on unknown address with pc at that address and no bun frame.
• A destructured symbol outlives the library object. bun:ffi: implement Symbol.dispose on dlopen/cc/linkSymbols libraries and CFunction #41631 adds using lib = dlopen(...), which closes at scope exit while a destructured symbol can outlive the scope.
• An argument conversion can run JS (valueOf, a ptr getter), so close() can happen after a call has started. The WebKit change covers that on the host path and in DFG / FTL code. The test has both cases.
• The test also checks that close() is per handle: with one file open twice, the closed handle's symbols throw and the other handle's symbols work.
• With src/ and packages/ from main and the rest of this branch, bun bd test fails the new case: the child dies with AddressSanitizer: SEGV on unknown address.
• Rebased on main 1313ca6 (WebKit f20ce77445). The pin is the preview build of [JSC] bun:ffi: JSFFIFunction::close() makes a call throw instead of jumping to an unloaded library WebKit#714 at d4f2d385, which is rebased on that WebKit commit.
• A review of [JSC] bun:ffi: JSFFIFunction::close() makes a call throw instead of jumping to an unloaded library WebKit#714 found that isRunning() said no for a call made through a bound function, because optimized code holds that function as a constant and not as a weak reference. 79abc9a6 has the fix and a stress test case for it.
• A second review finding there: isRunning() also said no when the callback was a strict function that ends in a call (() => finish()). That is a tail call, optimized code inlines the callee in place of the callback's frame, and the stack walk did not see the VM entry. With the preview at 79abc9a6 the new test's tail call case dies with AddressSanitizer: SEGV at the return address. d4f2d385 has the fix.
• The close inside a call has a test of its own (close() inside a call of the library lets the call finish), so that each child process has the whole test timeout. With src/ and packages/ from main both new tests fail.
• The WebKit change keeps the call paths of an open function as they are. The stub's instruction stream is identical, close() overwrites its first fast-path instruction with a jump to the slow path, and a watchpoint jettisons DFG / FTL code. [JSC] bun:ffi: JSFFIFunction::close() makes a call throw instead of jumping to an unloaded library WebKit#714 has the details and a JSC stress test. Its CI ran that test on Linux x64 and arm64.
• CI build 119586 (the first push) passed test/js/bun/ffi/ffi.test.js on every lane, macOS and Windows included. On Windows DynLib::close never unloads, so the crash is a Linux and macOS one. The TypeError is the same on all three.
• CFunction.close() stays a no-op.
• cc() symbols are bun:ffi: throw a TypeError when a cc() symbol is called after its library's close() #43802. It adds the same hidden field (functionsValue) and a close function of its own for the TinyCC functions, so the two conflict. The second to land makes one function of the two. ffi.d.ts here still calls a closed cc() symbol undefined behavior.
• close() inside a call: without the rule the call returns into unmapped code. The test runs it cold, warm, and warm with a callback that makes a tail call (5,000 calls on a debug build, 20,000 otherwise), each on a copy of the fixture library of its own, because a library that stays loaded would hide a later unload. The fixture's cb_identity_* functions are tail calls at -O2 and never return into the library, so the test has a new fixture function, cb_result_plus_int32_t. isRunning() can also say yes for DFG or FTL code that calls the function and is inside another native call that entered JS again. Then the library only stays loaded.
• A library object keeps every function it made alive, also one deleted from symbols.
• Self-review findings, all addressed. (1) The hidden array was filled with JSArray::push, a [[Set]]: an indexed setter on a prototype was handed the array and could leave a hole in it or take a function out of it. It is filled with putDirectIndex now, close() skips an empty slot, and the test has the case. (2) A closed function passed as a ptr or function argument handed the native callee its dangling address. [JSC] bun:ffi: JSFFIFunction::close() makes a call throw instead of jumping to an unloaded library WebKit#714 throws for it now, and the test has the case. (3) Missing coverage: a symbol deleted from lib.symbols before close() (here), and a close from inside the call, a close inside the before-hook and no CallFFI for a caller compiled after the close (in the JSC stress test).
• [JSC] Read an FFI buffer address after the argument conversions that can run JS WebKit#713 and bun:ffi: read a buffer argument after the other arguments coerce #43740 (a buffer argument read before the other arguments coerce) edit the same ffiCall loop. The second one to land needs a rebase.

---

no test proof · iteration 0 · platform-specific test(s) that do not run on this machine, deferring to CI, which covers all platforms: test/js/bun/ffi/ffi.test.js

[robobun]

Reproduced on 1.4.3-canary (367d939) with one file:

import { dlopen } from "bun:ffi";
const lib = dlopen("libz.so.1", { zlibVersion: { args: [], returns: "cstring" } });
console.log("before close:", String(lib.symbols.zlibVersion()));
lib.close();
console.log("after close:", String(lib.symbols.zlibVersion()));

It prints before close: 1.3.1 and then panic(main thread): Segmentation fault at address 0x73EAAAEA94B0. With this branch the last line throws TypeError: bun:ffi: cannot call 'zlibVersion' because its library was closed.

The two new cases in test/js/bun/ffi/ffi.test.js run in child processes on the test fixture library. The first is the sequence above. The second closes a library from a JSCallback inside one of the library's calls: that call finishes, and the next one throws. The engine half is oven-sh/WebKit#714.

State: this waits for oven-sh/WebKit#714. When that merges, WEBKIT_VERSION takes its merge commit and the draft flag comes off. #43802 (the same for cc()) adds the same hidden field and a close function of its own, so the second of the two to land has a small conflict to resolve in FFI::close.

CI: the diff is green. Build 121158 passed test/js/bun/ffi/ffi.test.js on every lane (Linux glibc and musl, the ASan lane, macOS, Windows, x64 and arm64). Its one red job is test/js/bun/spawn/spawn.test.ts on debian 13 x64-asan. This diff does not touch that test, and it failed the same way on every build of this PR.

[robobun]

^{Updated 1:03 AM PT - Sep 27th, 2026}

❌ @robobun, your commit 4d9d5ee has 1 failures in Build #121158 (All Failures):

• test/js/bun/spawn/spawn.test.ts - code 1: stdout reader of an unref'd child and process lifetime > an idle reader stopped at the highwater … on 🐧 13 x64-asan

---

🧪   To try this PR locally:

bunx bun-pr 43764

That installs a local version of the PR into your bun-43764 executable, so you can run:

bun-43764 --bun