Skip to content

bake: report per-file print failures in the dev server instead of serving empty modules - #37039

Closed
robobun wants to merge 23 commits into
mainfrom
farm/bc6e59f6/dev-server-print-failure
Closed

robobun wants to merge 23 commits into
mainfrom
farm/bc6e59f6/dev-server-print-failure

Conversation

@robobun

@robobun robobun commented Aug 6, 2026 •

Copy link
Copy Markdown
Collaborator

Problem

  • The dev server serves a file that the printer cannot print as empty code or as an empty stylesheet, with no error. Debug builds abort: debug_assert!(matches!(compile_result, CompileResult::Javascript { result: PrintResult::Result(_), .. })) in finalize_bundle.
  • A rebuild frees a file the moment one of its imports fails (insert_stale_extra, src/runtime/bake/dev_server/incremental_graph.rs:1334). A linked stylesheet is then no CssRoot, but its route stays loaded. A page request before the rebuild ends gets no <link> for it. If the stylesheet has an @import, debug builds abort: panic: only CSS roots should be found by tracing.

Fix

  • finalize_bundle records a part or a CSS chunk that failed to print as a per-file failure (insert_failure). A parse error takes the same path: error overlay, 500 for the route.
  • A failed stylesheet keeps its CssRoot content, and its asset while the rebuild is in flight. The id is the hash of the path, so it stays valid. trace_imports collects a failure before the CSS check.
  • Verified: test/bake/dev/bundle.test.ts (eleven new tests), test/js/bun/http/bun-serve-html.test.ts (one new test). Notes list the other suites.
  • Self-reviewed: 12 concerns raised, 6 addressed. Notes name the other 6 with the reason.

Background

  • The dev server keeps one File per path and one edge per import. File.failed marks a file with an error.
  • A CSS root is a stylesheet that HTML links or a script imports, served as one chunk at /_bun/asset/<path hash>.css. A stylesheet that a root imports is a CssChild with no chunk.
  • trace_imports with the FindCss goal collects the root ids of a route for its <link> list and stops at each root.
Notes

Merge of main and the page request during a rebuild

  • The branch did not build on main: error[E0609]: no field first_dep on type &mut IncrementalGraph<SIDE>. dev server: keep a file's two edge list heads in one Vec #39151 moved the two edge list heads of a file into edge_lists. The walk in invalidate that used the field is removed (see Self-review).
  • New test: page request while a rebuild that fails a linked stylesheet is in flight in test/js/bun/http/bun-serve-html.test.ts. An onResolve plugin parks the rebuild after @import "./missing.css" failed. The fixture then requests the page and every stylesheet that the page links. The HMR socket tells it when each rebuild has ended, so the test has no sleep. The same steps as a script give:
build page during the rebuild
main 367d939, release canary 200, no <link>
main 367d939, debug exit 134, panic: only CSS roots should be found by tracing
this branch, debug build 200, one <link>, the stylesheet answers 200 with the last good rules
this branch, release build 200, one <link>, the stylesheet answers 200 with the last good rules
  • The debug stack on main: trace_imports (incremental_graph.rs:1236), called from trace_all_route_imports, generate_html_payload, on_html_request_with_bundle, ensure_route_is_bundled, respond_for_html_bundle.
  • A framework route has the same window through generate_css_js_array (meta.styles). Probe with a route that imports the stylesheet. A debug build of main aborts with the same panic. The release canary answers styles: []. A debug build of this branch answers the stylesheet URL, and the URL answers 200. There is no test for this probe: it goes through the same trace_imports code.
  • The asset of the stylesheet: insert_stale_extra dropped it together with the content, so the <link> of a page that is served during the rebuild answered 404. eb59386 keeps the asset of a CSS root there. The rebuild replaces it (replace_path) or insert_failure drops it when the rebuild ends.
  • Not covered: a stylesheet that fails to parse. handle_parse_task_failure calls insert_failure before the rebuild ends, so the asset is gone at once. Probe: one batch breaks the syntax of a linked stylesheet and parks on an import of a second one. The page that is served in between keeps both <link>s, and the broken stylesheet answers 404 until the rebuild ends (debug and release build of this branch). After the rebuild the route answers the build failure page. The test does not cover this: the parse result comes from another thread, so the fixture cannot wait for it without a sleep.
  • After a failed rebuild the URL of the stylesheet answers 404 until the next good build, as on main. An HTML route answers the build failure page in that state. dev server: fail a framework route when a stylesheet it imports fails to build #42872 covers a framework route that keeps its 200.

Self-review

Addressed in 9993ca1:

  • invalidate had two walks that queued the failed dependents of an edited file. They date from a revision where a failed stylesheet had Unknown content. A failed stylesheet keeps CssRoot now, so the existing CSS root arm reaches it, and no test needed the walks. Their only effect left was to bundle a failed script or html file again on every save of a stylesheet that it imports. They are removed, so this PR no longer changes invalidate.
  • trace_imports had a branch for a failed CssChild. It could not run: insert_failure leaves Unknown or CssRoot, and only insert_empty creates CssChild, for a new file. The function is the code of main again, with the FindErrors block moved before the CSS check.
  • The test css resolution error with an edge adjustment passed on a release build without the fix. It now checks that the failed stylesheet keeps its place in the CSS list, like the parse error test. It fails on 1.4.2 with Selector '.fine' was not found.
  • A comment in generateChunksInParallel.rs said that the dev server drops the code of a part that fails to print. It names the per-file failure now. A comment in finalize_bundle claimed more than the code does (a root that fails its first parse has no place in the CSS list), so it is the text of main again.
  • The six CSS print tests depend on a second defect: the dev server prints a stylesheet with other targets than it was minified for, and only then do the nested :fullscreen rules fan out. bun build --target=browser prints the same file (1.26 KB). bake: minify stylesheets for browser targets in every graph #37051 and css: print a stylesheet with the targets StyleSheet::minify recorded #39251 make the two agree. After either of them these tests need another stylesheet that fails to print. I found none that fails under every target set: the mixed prefix shape of nested-vendor-prefix-duplication.test.ts fails in the minifier with browser targets, not in the printer. A comment at the first CSS test says so.
  • An earlier text of this body said that all eleven tests fail without the fix. See Tests below for the correct counts.

Not taken:

  • A stylesheet that fails to parse during a held rebuild still links a 404 (see above). The fix is to keep the asset in insert_failure too. Then nothing drops the asset of a CSS root any more, and unref_by_path and FreeCssMode::UnrefCss are dead code. That cleanup is a change of its own.
  • On main and here: a CSS root that prints and then fails later in the same bundle (an onResolve plugin that rejects an @import) is sent to connected pages as an empty stylesheet, because insert_failure dropped the asset before the hot update is written. Read from the code, not run.
  • On main and here: when two roots of one bundle import the same file, only the first root gets the edge (dev server: give every CSS root in a bundle its own edges to the files it imports #42697). An edit of the shared file then queues only that root.
  • Four tests write two files in one batchChanges and need both in one bundle. hot.test.ts and css.test.ts use the same harness pattern.
  • The two TOML tests take 9 to 21 s each on a debug build. The printer writes its indentation until the stack guard trips, and a shallower table does not trip it.
  • No test covers the imported_on_server branch of a failed CSS chunk. A stylesheet that a server file imports is minified without browser prefixes, so the :fullscreen input prints there.

Related open PRs

Repros for the print failure

Import a TOML file with "[" + "a.".repeat(100_000) + "a]\nd = 1\n" (the AST is too deep for the recursion guard of the printer), or link a stylesheet of 30 nested .xN:fullscreen { ... } rules (629 bytes of valid CSS, the per-prefix output trips the expansion guard of the CSS printer).

This is the dev server counterpart of #37036, which made bun build and Bun.build fail on a module that the printer cannot print. That PR excluded the dev server: its caller chain turns a linker error into an OOM panic, so a build-wide failure would stop the whole server on one bad file.

How the print failure is recorded

  • JS parts: pass 1 of finalize_bundle builds a log with one message ("Maximum call stack size exceeded while generating code for this file" for a stack overflow, the printer error name otherwise). It calls insert_failure for the source file of the part, and not receive_chunk with empty code. Pass 2 skips the failed parts, because they have no resolved file index.
  • CSS chunks: when a compile result of the chunk has an error, the failure goes on the entry point file of the chunk. That is the file receive_chunk registers, so a good rebuild clears it. The message names the file that failed when its source index is known. Pass 2 still runs for the chunk, so the @import edges stay and an edit of an imported file queues the chunk again.
  • A failed CSS chunk is left out of the hot update payload. The stylesheet that the page already has stays active until the next good build.

Tests in test/bake/dev/bundle.test.ts

  • client graph (HTML route, TOML module): the first load shows the error overlay with the message, recovery reloads and runs, a second break over a hot update serves the error page and shows the overlay again, and a second recovery works.
  • server graph (framework route, TOML module): the broken module answers 500 with the error page, recovery serves the route.
  • CSS (HTML route stylesheet): the first load shows the error overlay with "Failed to generate CSS for this file (PrintError)", recovery reloads and applies the fixed stylesheet.
  • CSS with the rules that cannot be printed in an @imported child: the failure belongs to the chunk entry, and an edit of the child alone queues the chunk again and recovers.
  • CSS failure plus a change of the @import list in one batch, with a connected client: a failed chunk entry keeps its CssRoot content, so a trace keeps the place of the stylesheet and does not recurse into css children. The recovery bundle restyles the page in place.
  • a stylesheet that HTML links and that another linked stylesheet imports: one edit of the shared file recovers both failed chunks.
  • two @imports that cannot be printed in one chunk: both are reported.
  • a failure that is broken and fixed over hot updates only, then a new stylesheet import: the css list of the route is traced again and the new link reaches the page.
  • a stylesheet imported through a js file that fails to parse: the css list trace continues through failed js files, so the stylesheet stays active while the file is broken and after recovery.
  • a css parse error plus an edge adjustment in one batch: insert_failure keeps a prior CssRoot through any kind of failure.
  • the same with a css resolution error: insert_stale, which runs before insert_failure on that path, keeps the CssRoot the same way.

Without the fix, ten of the eleven fail on a debug build of main and ten fail on the 1.4.2 release. stylesheets imported through a failed js file stay active passes on both: it guards the trace_imports change of this PR. css resolution error with an edge adjustment failed only through the debug assert before 9993ca1. All eleven pass with the fix.

Suites

  • Debug build of this branch (9993ca1), all pass: test/bake/dev/{bundle,css,html,hot,esm,plugins,incremental-graph-edge-deletion}.test.ts, test/bake/{dev-and-prod,deinitialization}.test.ts, test/js/bun/http/bun-serve-html.test.ts.
  • Release build of this branch (c39a8ca), all pass: test/js/bun/http/bun-serve-html.test.ts, test/bake/dev/{bundle,css,html}.test.ts.
  • The new test in bun-serve-html.test.ts fails on a release build without the fix ("stylesheets":[] during the rebuild, main 367d939 and 1.4.2) and on a debug build of main (exit 134 with the panic).

[human-review] gate passed · iteration 1 · 4 files touched

fails on main (without fix)
ASAN without fix: 11 failed, 2 skipped
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/pr_gate.xml" test/bake/dev/bundle.test.ts test/js/bun/http/bun-serve-html.test.ts
bun test v1.4.3 (367d939d9)

test/bake/dev/bundle.test.ts:
Dev server testing directory: /tmp/bun-dev-test-c53kLF
^[[0;30mdev|^[[0m Started development server: http://localhost:37877
^[[0;30mdev|^[[0m ^[[32mBundled page in 136ms^[[0m^[[2m:^[[0m routes/index.ts ^[[2m+ 1 more^[[0m
^[[0;30mdev|^[[0m [Bun] Hot update was not accepted because it or its importers do not call `import.meta.hot.accept`. To prevent full page reloads, call `import.meta.hot.accept` in one of the following files to handle the update:
^[[0;30mdev|^[[0m 
^[[0;30mdev|^[[0m Module "db.ts" is not accepted by routes/index.ts,
^[[0;30mdev|^[[0m ^[[32mReloaded in 36ms^[[0m^[[2m:^[[0m db.ts
^[[0;30mdev|^[[0m [Bun] Hot update was not accepted because it or its importers do not call `import.meta.hot.accept`. To prevent full page reloads, call `import.meta.hot.accept` in one of the following files to handle the update:
^[[0;30mdev|^[[0m 
^[[0;30mdev|^[[0m Module "routes/index.ts" is a root module that does not self-accept.
^[[0;30mdev|^[[0
... (truncated)

release without fix: all passed
bun test v1.4.3-canary.1 (88053e2b0)

test/bake/dev/bundle.test.ts:
Dev server testing directory: /tmp/bun-dev-test-P8LRSr
^[[0;30mdev|^[[0m Started development server: http://localhost:45023
^[[0;30mdev|^[[0m ^[[32mBundled page in 3ms^[[0m^[[2m:^[[0m routes/index.ts ^[[2m+ 1 more^[[0m
^[[0;30mdev|^[[0m [Bun] Hot update was not accepted because it or its importers do not call `import.meta.hot.accept`. To prevent full page reloads, call `import.meta.hot.accept` in one of the following files to handle the update:
^[[0;30mdev|^[[0m 
^[[0;30mdev|^[[0m Module "db.ts" is not accepted by routes/index.ts,
^[[0;30mdev|^[[0m ^[[32mReloaded in 1ms^[[0m^[[2m:^[[0m db.ts
^[[0;30mdev|^[[0m [Bun] Hot update was not accepted because it or its importers do not call `import.meta.hot.accept`. To prevent full page reloads, call `import.meta.hot.accept` in one of the following files to handle the update:
^[[0;30mdev|^[[0m 
^[[0;30mdev|^[[0m Module "routes/index.ts" is a root module that does not self-accept.
^[[0;30mdev|^[[0m ^[[36m[x2]^[[0m ^[[32mReloaded in 1ms^[[0m^[[2m:^[[0m routes/index.ts
(pass)  DEV:bundle-1: import identifier doesnt get renamed [203.24ms]
^[[0;30mdev|^[[0m Started development server: http://localhos
... (truncated)
passes on PR (with fix)
ASAN with fix: 2 skipped
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/pr_gate.xml" test/bake/dev/bundle.test.ts test/js/bun/http/bun-serve-html.test.ts
bun test v1.4.3 (367d939d9)

test/bake/dev/bundle.test.ts:
Dev server testing directory: /tmp/bun-dev-test-iBB0eM
^[[0;30mdev|^[[0m Started development server: http://localhost:43439
^[[0;30mdev|^[[0m ^[[32mBundled page in 155ms^[[0m^[[2m:^[[0m routes/index.ts ^[[2m+ 1 more^[[0m
^[[0;30mdev|^[[0m [Bun] Hot update was not accepted because it or its importers do not call `import.meta.hot.accept`. To prevent full page reloads, call `import.meta.hot.accept` in one of the following files to handle the update:
^[[0;30mdev|^[[0m 
^[[0;30mdev|^[[0m Module "db.ts" is not accepted by routes/index.ts,
^[[0;30mdev|^[[0m ^[[32mReloaded in 38ms^[[0m^[[2m:^[[0m db.ts
^[[0;30mdev|^[[0m [Bun] Hot update was not accepted because it or its importers do not call `import.meta.hot.accept`. To prevent full page reloads, call `import.meta.hot.accept` in one of the following files to handle the update:
^[[0;30mdev|^[[0m 
^[[0;30mdev|^[[0m Module "routes/index.ts" is a root module that does not self-accept.
^[[0;30mdev|^[[0
... (truncated)

release with fix: all passed
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped) in 736ms (unchanged)
ninja: Entering directory `/workspace/bun/build/release'
[1/7] gen generated_host_exports.rs
generated_host_exports.rs: 121 exports (host=5, lazy=10, generic=106, rust=0); 245 extern-C blocks audited
[1/7] cargo bun_runtime → libbun_runtime.a
^[[1m^[[33mwarning^[[0m^[[1m: binary `bun_shim_impl` should have a kebab-case name^[[0m
   ^[[1m^[[94m|^[[0m
^[[1m^[[94m 1^[[0m ^[[1m^[[94m|^[[0m /workspace/bun/build/release/rust-target/.../bun_shim_impl
   ^[[1m^[[94m|^[[0m                                              ^[[1m^[[33m^^^^^^^^^^^^^^[[0m
   ^[[1m^[[94m|^[[0m
   ^[[1m^[[94m= ^[[0m^[[1mnote^[[0m: `cargo::non_kebab_case_bins` is set to `warn` by default
^[[1m^[[96mhelp^[[0m: to change the binary name to `bun-shim-impl`, convert `bin.name`
  ^[[1m^[[94m--> ^[[0msrc/install/windows-shim/Cargo.toml:41:8
   ^[[1m^[[94m|^[[0m
^[[1m^[[94m41^[[0m ^[[91m- ^[[0mname = ^[[91m"bun_shim_impl"^[[0m
^[[1m^[[94m41^[[0m ^[[92m+ ^[[0mname = ^[[92m"bun-shim-impl"^[[0m
   ^[[1m^[[94m|^[[0m
^[[1m^[[33mwarning^[[0m: `bun_shim_impl` (manifest) generated 1 warning
^[[1m^[[33mwarning^[[0m^[[1m: `feature(generic_const_exprs)` is not supported with
... (truncated)
diff hotspot
src/runtime/bake/DevServer.rs                    | 131 +++++++-
 src/runtime/bake/dev_server/incremental_graph.rs | 144 +++++++--
 test/bake/dev/bundle.test.ts                     | 380 +++++++++++++++++++++++
 test/js/bun/http/bun-serve-html.test.ts          | 121 ++++++++
 4 files changed, 743 insertions(+), 33 deletions(-)

gate history · 3 passed · 0 rejected · iteration 1

evidence per changed file
file                                              reads  edits  tests
src/runtime/bake/DevServer.rs                         0      0      5
src/runtime/bake/dev_server/incremental_graph.rs      1      3      5
test/bake/dev/bundle.test.ts                          0      0      1
test/js/bun/http/bun-serve-html.test.ts               1      3      4

root cause · written by the author bot

The dev server dropped a per-file print failure of the JavaScript or CSS printer in finalize_bundle and served an empty module or an empty stylesheet with no error. The fix records each print failure as a per-file failure in the incremental graph (insert_failure), skips the failed JavaScript parts, and leaves failed CSS chunks out of the hot update payload. A failed stylesheet keeps its CssRoot content and, while a rebuild is in flight, its asset, so a page served in between still links it. invalidate is unchanged: the existing CSS root arm re-enqueues a failed stylesheet.

…rving empty modules

A module whose AST is too deep to print (e.g. a TOML file with a deeply
dotted header) produces a CompileResult carrying a PrintResult error.
finalize_bundle previously consumed it via compile_result.code(), which
maps the error to an empty byte slice: release builds fed an empty
module into the incremental graph (imports from it silently became
undefined in the browser) and debug builds crashed on the
finalize_bundle assert that expects a successful print whenever the
source map is absent.

Route failed parts through the same per-file failure path as parse
errors: build a one-message log and call insert_failure for the part's
source file, then skip the part in both finalize_bundle passes. The
error overlay reports the failure, the dev server stays alive, and the
file rebuilds once edited. The message matches the bundler-side error
for an unprintable module.
@github-actions github-actions Bot added the claude label Aug 6, 2026
@coderabbitai

coderabbitai Bot commented Aug 6, 2026 •

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

Changes

Bundle finalization records JavaScript and CSS printer failures per file. Incremental graph tracing and invalidation re-enqueue failed entries for recovery. DevServer tests cover client, server, CSS imports, hot updates, and shared stylesheet recovery.

Printing failure recovery

Layer / File(s) Summary
Record printing failures
src/runtime/bake/DevServer.rs
JavaScript and CSS printing failures create graph diagnostics. Failed JavaScript parts are skipped. Failed CSS routes retain prior HMR CSS identifiers, and failed CSS chunks are omitted from HMR payloads.
Re-enqueue failed graph entries
src/runtime/bake/dev_server/incremental_graph.rs
Import tracing handles failed JavaScript and CSS files. Client invalidation restores failed CSS roots, marks failed dependents stale, and re-enqueues them with the required entry-point handling.
Validate failure and recovery
test/bake/dev/bundle.test.ts
Tests cover per-file errors, server responses, CSS import-edge updates, hot-update recovery, failed JavaScript CSS tracing, and recovery of shared stylesheet entries.

Suggested reviewers: jarred-sumner

🚥 Pre-merge checks | ✅ 4
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly and concisely describes the primary change: reporting per-file printer failures instead of serving empty modules in the dev server.
Description check ✅ Passed The description provides detailed problem context, implementation details, verification results, tests, and known limitations. It does not use the exact template headings, but it covers the required c…

Comment @coderabbitai help to get the list of available commands.

A CSS chunk whose printer fails (e.g. the vendor-prefix expansion guard
trips on deeply nested prefixed rules) was registered as an empty
stylesheet with no error. Route it through the same per-file failure
path: insert a failure on the chunk's entry point file, name the
failing file in the message when its source index is known, and skip
the chunk in both finalize_bundle passes.
Comment thread src/runtime/bake/DevServer.rs Resolved
Comment thread src/runtime/bake/DevServer.rs Resolved
Comment thread src/runtime/bake/DevServer.rs Resolved
Comment thread src/runtime/bake/DevServer.rs Resolved

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Additional findings (outside current diff — PR may have been updated during review):

  • 🔴 src/runtime/bake/DevServer.rs:4325-4338 — When the failing CSS is an @imported child (e.g. main.css imports child.css and child.css contains the unprintable rules), Pass 1 attaches the failure to main.css and Pass 2 skips the chunk, so process_css_chunk_import_records never runs and child.css never gets a CssChild entry in bundled_files. The overlay then names child.css (via err_source), but editing child.css hits invalidate()'s get_index → None → continue and no rebuild is enqueued — the user must touch main.css to clear the error. Pre-PR, Pass 2 ran on the near-empty stylesheet and registered the child, so editing it did rebuild the chunk; consider registering the chunk's import-record children (or caching the entry index so Pass 2 can run) in the failure branch.

    Extended reasoning...

    What the bug is

    When a CSS chunk fails to print because of a non-entry @imported file, the PR's new failure path leaves that child file unregistered in the incremental graph. The error overlay names the child file, but editing it does not trigger a rebuild — the overlay stays up until the user edits the entry CSS file instead. This is a regression: before this PR, editing the child file did trigger a rebuild.

    Code path

    Take index.html → <link href="main.css">, with main.css containing @import "./child.css"; and child.css containing the 30 nested :fullscreen rules from the PR's own repro.

    Pass 1 (DevServer.rs:4097-4133): the chunk's compile results contain an Err for child.css. The new find_map picks it up with err_source_index = child.css, so err_source = child.css and the log message reads child.css: error: Failed to generate CSS for this file (PrintError). insert_failure is called with entry_source.path = main.css and then continue skips receive_chunk.

    insert_failure (incremental_graph.rs:1417-1455) only touches bundled_files[main.css]: it pushes first_dep/first_import = None for a new entry and sets kind = FileKind::Unknown. It never walks import records, so child.css is not inserted.

    Pass 2 (DevServer.rs:4325-4338): the chunk contains an Err result, so it continues. process_chunk_dependencies(..., ProcessMode::Css, entry_index) never runs, so process_css_chunk_import_records never reaches the mode == Css branch at incremental_graph.rs:991-994 that would call self.insert_empty(child.css, FileKind::Css) and create the main.css → child.css edge.

    Hot reload: the user sees the overlay naming child.css, fixes it, and saves. HotReloadEvent::process_file_list calls client_graph.invalidate([child.css], &mut entry_points). At incremental_graph.rs:1577:

    let Some(index) = self.bundled_files.get_index(path) else {
        continue;
    };

    child.css is not in bundled_files → continue. entry_points stays empty → "nothing to bundle" → no rebuild is enqueued. The error overlay persists.

    Why existing code doesn't prevent it

    The Pass-2 skip is required — Pass 1 no longer calls receive_chunk, so ctx never caches the entry's file index and process_chunk_dependencies would hit .expect("unresolved index"). But the skip drops the side effect of registering @imported children. insert_failure was designed for parse failures where import records don't exist; here they do (parsing succeeded, only printing failed), but nothing consumes them.

    Why this is a regression

    Pre-PR, Pass 1 called receive_chunk(main.css, Css(hash)) with the near-empty /* child.css */ stylesheet, which cached the entry index. Pass 2 then ran process_css_chunk_import_records, which walked import_records[main.css] (populated at parse time, unaffected by the print failure), hit the mode == Css branch at line 992, and called insert_empty(child.css, FileKind::Css) — creating the CssChild entry and the main.css → child.css edge. Editing child.css then matched Content::CssChild at incremental_graph.rs:1589, walked first_dep to main.css (CssRoot), and enqueued it via append_css at line 1608. The chunk rebuilt and the fixed stylesheet was served.

    Impact

    The PR's stated recovery contract — "stale bit so the file rebuilds once edited" — does not hold for the file the error message actually names when that file is @imported rather than directly linked. The user is told exactly which file to fix, fixes it, and nothing happens. @import from an entry stylesheet into shared CSS is a common pattern. The PR's CSS test only covers the case where the entry file itself is the failing file (amp.css linked directly from HTML), so this variant is untested.

    Step-by-step proof

    1. main.css: @import "./child.css"; body { margin: 0; }
    2. child.css: 30 nested .xN:fullscreen { … } rules (the PR's repro).
    3. Initial bundle: chunk entry = main.css, compile results = [Ok(main), Err(PrintError, source_index=child)].
    4. Pass 1: find_map → (PrintError, child); log attributes to child.css; insert_failure(main.css); continue. bundled_files = { main.css: Unknown/failed }. No child.css.
    5. Pass 2: chunk has an Err → continue. No process_chunk_dependencies.
    6. Overlay shows child.css: error: Failed to generate CSS for this file (PrintError).
    7. User rewrites child.css to .visible { color: blue; }.
    8. invalidate([child.css]) → get_index(child.css) = None → continue. entry_points empty. No rebuild.
    9. Overlay unchanged. User must additionally touch main.css (which is in bundled_files, routes through the _ => append_js fallback since its content is Unknown, and enqueues a rebuild) to recover.

    Fix

    In the Pass-1 CSS failure branch, after insert_failure on the entry, also register each @imported CSS source from chunk.compile_results_for_chunk / the chunk's import records via client_graph.insert_empty(child_path, FileKind::Css) and attach the entry → child edge (mirroring what process_css_chunk_import_records does). Alternatively, have insert_failure cache the entry's file index in ctx so Pass 2 can run process_chunk_dependencies for failed chunks too. Either way, add a test variant where the failing CSS is @imported and recovery edits the child file.

The failure belongs to the chunk's entry point, but the file the user
edits to recover may be an @imported child. Cache the entry's file index
after insert_failure so pass 2 still diffs the chunk's import edges
(registering children), and teach invalidate's CssChild walk to
re-enqueue failed chunk entries the way a direct edit of them would.
@robobun

robobun commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator Author

Good catch on the @imported child case: the failure sat on the chunk entry while the child never entered the graph, so editing the child hit the get_index -> None -> continue path in invalidate and no rebuild was enqueued.

Fixed in 99c3514 with the second suggested approach plus one more piece it needed:

  • the failure branch now caches the entry's file index so pass 2 runs process_chunk_dependencies for failed CSS chunks too, registering the @import children and their edges (the pass-2 skip for CSS is gone)
  • invalidate's CssChild walk re-enqueues dependents whose last build failed (their content is Unknown, not CssRoot, so the edge alone was not enough; they now route through append_js the way a direct edit of a failed file does)

Added the suggested test variant: the unprintable rules live in @import"./child.css" and recovery edits only the child. It times out on the previous commit and passes now.

Comment thread src/runtime/bake/DevServer.rs Resolved
Comment thread src/runtime/bake/DevServer.rs Resolved
A failed CSS chunk imported on the server still needs its server-graph
file entry so route tracing can bridge to the failed client entry and
the recovered route keeps its stylesheet link. Mirrors the success
path's imported_on_server handling.
@robobun

robobun commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator Author

Applied the suggested mirror in a264758: the failure branch now calls insert_css_file_on_server when metadata.imported_on_server, so the server graph keeps its stub and cached index for edge attachment.

One honest caveat on reachability: I could not construct a server-imported CSS chunk that actually fails to print today. Both printer-guard repros (30 nested :fullscreen rules tripping the vendor-prefix expansion budget, and 40 nested two-selector lists tripping selector expansion) error when the stylesheet is linked from an HTML route, but the identical files print cleanly when imported from a framework route, no prefix fan-out at all. The target-dependent prefix data appears not to be assigned for CSS parsed via a server-graph import, which is its own inconsistency (dev serves unprefixed CSS for server-imported stylesheets) and I am tracking it separately. So this commit has no test; it keeps the failure branch consistent with the success path for whenever that pipeline can fail.

Comment thread src/runtime/bake/DevServer.rs Resolved
Comment thread src/runtime/bake/DevServer.rs Resolved
A failed chunk entry has Unknown content but, since the chunk keeps its
import edges, css children remain reachable from it; the FindCss trace
recursing through one tripped the debug assert that only css roots may
reach a css child, killing the dev server. Stop tracing at failed files
for every goal except error collection, and keep a failing route's
previous css list in hot updates instead of regenerating it (tracing
would drop the failed chunk; css ids are path-stable, so recovery
reuses them and restyles the page in place).

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Additional findings (outside current diff — PR may have been updated during review):

  • 🟡 src/runtime/bake/dev_server/incremental_graph.rs:1609-1616 — When a stylesheet is both a chunk entry (linked from HTML) and @imported by another linked stylesheet, a print failure in it makes Pass 1 call insert_failure on both chunk entries, so both get content = Content::Unknown. Fixing the file then routes invalidate through the Js(_) | Unknown arm — which enqueues only the edited file and never walks first_dep — so the importing root is not re-enqueued and stays failed with a stale error until the user touches it. This new branch handles the mirror direction (edited CssChild → failed dependent) but not edited failed-root → failed dependent; same underlying gap as the open trace_imports/CssChild finding, and preserving CSS kind through insert_failure (or walking first_dep from the Unknown arm when failed) would fix both.

    Extended reasoning...

    What breaks

    Commit 99c3514 added this else if failed branch so that editing a CssChild re-enqueues a failed dependent chunk entry (whose content is now Unknown, not CssRoot). But the branch lives inside the Content::CssRoot(_) | Content::CssChild match arm of invalidate, so it only fires when the edited file is still tagged as CSS. When the edited file is itself a failed chunk entry (Content::Unknown), invalidate falls into the Content::Js(_) | Content::Unknown arm at the bottom, which does not iterate first_dep[index]. Any failed dependent that @imports the edited file is never re-enqueued.

    Repro topology

    index.html links both main.css and sub.css; main.css contains @import "./sub.css";; sub.css has the 30-nested :fullscreen rules that trip the CSS printer's expansion guard.

    Step-by-step proof

    1. Initial bundle — both entries become Unknown. Two CSS chunks are emitted (one per <link>). sub.css's CompileResult::Css { result: Err(_) } appears in both chunks' compile_results_for_chunk (main.css bundles it via @import). Pass 1's new failure branch (DevServer.rs:4097-4139) fires for each chunk → client_graph.insert_failure(main.css) and client_graph.insert_failure(sub.css). insert_failure on the client side unconditionally sets kind = FileKind::Unknown, content = Content::Unknown, failed = true. Each chunk's failure branch also sets ctx.get_cached_index(Client, entry_src_idx).

    2. Pass 2 creates the edge; sub.css stays Unknown. Pass 1 completes over all CSS chunks before Pass 2's CSS loop runs, so both cached indices are set. process_chunk_dependencies(Css) for main.css walks its @import record for sub.css; process_edge_attachment finds ctx.get_cached_index(Client, sub_css_idx) is Some (set in step 1 by sub.css's own chunk) and breaks with that index — it does not reach the insert_empty(FileKind::Css) fallback, so sub.css is never overwritten to CssChild. The edge is created: first_dep[sub.css] now includes main.css.

    3. User fixes sub.css → wrong invalidate arm. client_graph.invalidate([sub.css]) matches on sub.css.content == Content::Unknown → the Content::Js(_) | Content::Unknown arm → entry_points.append_js(sub.css, Client) only. The CssRoot | CssChild arm's first_dep walk (which would find main.css and hit this new else if failed branch) never runs.

    4. Rebuild clears only sub.css. Only the sub.css chunk is enqueued; receive_chunk(sub.css) clears its failure. main.css remains { failed: true, content: Unknown }; its bundling_failures entry (whose message points at sub.css) persists. trace_imports(FindErrors) from index.html still reaches it, so the route keeps serving the error page for a file the user has already fixed. Recovery requires touching main.css.

    Why this is a regression

    Before this PR, a print-failed CSS chunk still ran receive_chunk (with the header-only asset), so both entries kept content = CssRoot(_). Editing sub.css matched the CssRoot | CssChild arm, walked first_dep[sub.css] → found main.css (CssRoot) → append_css(main.css). Both roots re-bundled and recovered in one edit.

    Impact and fix

    This is the same root cause as the open trace_imports/CssChild debug_assert finding: insert_failure on a CSS entry erases the CSS marker so downstream code that keys on Content::CssRoot | CssChild skips it. 99c3514 patched one direction (edited CssChild → failed dependent) but not this one (edited failed-Unknown root → failed dependent). Either (a) the Js | Unknown arm in invalidate should walk first_dep when failed is true and re-enqueue CssRoot/failed dependents, or (b) insert_failure for a client-side CSS entry should preserve enough kind/content state to keep routing through the CSS arm — which would also address the open trace_imports finding.

    Filing as a nit given the narrow trigger (a stylesheet must be both directly <link>'d and @imported by another <link>'d stylesheet, and hit a printer failure) and trivial workaround (touch main.css); the PR is still a net improvement over the silent empty stylesheet.

A stylesheet that is both a chunk entry and @imported by another linked
stylesheet fails both chunks when it cannot print. Editing the shared
file goes through invalidate's Unknown arm, which re-enqueued only the
edited file, leaving the other failed root stuck with a stale error.
Walk the edited failed file's dependents and re-enqueue css roots and
failed entries, mirroring the CssChild branch.
@robobun

robobun commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator Author

Confirmed the both-linked-and-imported case: fixing the shared stylesheet left the other failed root stuck with a stale error until it was touched. Fixed in 8526d56: invalidate's Unknown arm now walks the edited failed file's dependents and re-enqueues css roots and failed entries, the mirror of the CssChild-to-failed-dependent walk. Test added (index.html links main.css and sub.css, main.css imports sub.css, one edit of sub.css recovers both chunks); it times out on the previous commit.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/runtime/bake/DevServer.rs`:
- Around line 4094-4139: Update the failed-CSS handling around insert_failure
and the hot-update payload generation so chunks with a CSS print failure are
excluded from serialized CSS output rather than emitted as empty stylesheets.
Preserve the existing failure reporting, cached index, and server-graph
behavior, and add a regression test covering successful style → print failure →
recovery that verifies the previously active style remains until recovery.
- Around line 4630-4637: Move or add the SAFETY comment immediately before the
unsafe expression in the had_adjusted_edges condition within the surrounding
route bundle logic. Ensure it directly explains why dereferencing route_bundle
to read server_state is safe, satisfying Clippy’s unsafe-block documentation
requirement.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 61d69569-00e5-428a-af6d-ced319aa375f

📥 Commits

Reviewing files that changed from the base of the PR and between a32adeb and 8526d56.

📒 Files selected for processing (3)
  • src/runtime/bake/DevServer.rs
  • src/runtime/bake/dev_server/incremental_graph.rs
  • test/bake/dev/bundle.test.ts

Comment thread src/runtime/bake/DevServer.rs Resolved
Comment thread src/runtime/bake/DevServer.rs Resolved
A failed chunk has no new content; serializing it emitted an empty
stylesheet over the one already applied in the browser. Skip failed
chunks so the previous style stays active until recovery, and hoist the
route failure-state read so the safety comment sits on the unsafe
block (clippy).
@robobun

robobun commented Aug 6, 2026 •

Copy link
Copy Markdown
Collaborator Author
Updated 2:11 PM PT - Sep 19th, 2026

❌ @robobun, your commit 9993ca1 has 1 failures in Build #118457 (All Failures):


🧪   To try this PR locally:

bunx bun-pr 37039

That installs a local version of the PR into your bun-37039 executable, so you can run:

bun-37039 --bun

Comment thread src/runtime/bake/DevServer.rs Resolved
Comment thread src/runtime/bake/DevServer.rs Resolved
@robobun

robobun commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator Author

CI status for build 89633: every lane passes except debian 13 x64-asan, which fails on test/js/node/worker_threads/worker-transfer-terminate-stress.test.ts (SIGABRT). That failure is pre-existing on main and unrelated to this change; it is being tracked separately. All bake dev-server suites, including the ten tests this PR adds, pass on every lane.

Resolution failures route through insert_stale before insert_failure,
so the CssRoot preservation added there never saw the prior content.
Apply the same capture in insert_stale's client arm.

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No new issues found on this pass, but this touches the bake dev server's incremental-graph state machine (failure insertion, trace_imports refactor, CssRoot preservation across insert_stale/insert_failure, invalidate re-enqueue) and went through four review rounds that each surfaced a real regression — worth a human look before merging.

What was reviewed:

  • CssRoot preservation now runs free_file_content(UnrefCss) twice on the resolution-failure path (insert_stale then insert_failure); verified unref_by_path is idempotent via path_map.fetch_swap_remove, so no refcount imbalance.
  • restore_failed_css_root after insert_failure on the print-failure path is redundant when the entry already existed but still needed for first-failure entries — harmless.
  • The refactored trace_imports failed-file gating (css root stops, css child stops, js falls through) matches the edge invariants; the four earlier regressions each have a dedicated test.
Extended reasoning...

Overview

The PR routes JS/CSS printer failures in finalize_bundle through the existing per-file failure machinery instead of registering empty modules/stylesheets. It touches src/runtime/bake/DevServer.rs (~110 new lines in finalize_bundle pass 1/2 and the hot-update CSS payload filter) and src/runtime/bake/dev_server/incremental_graph.rs (~110 lines: refactored client-side trace_imports, new restore_failed_css_root, CssRoot preservation in insert_stale_extra and insert_failure, and failed-dependent re-enqueue in invalidate). Eleven new devTests in test/bake/dev/bundle.test.ts cover initial-load failure, hot-update failure, recovery, edge-adjustment-while-failed, and the parse/resolution/print failure siblings.

Security risks

None. The change is entirely inside the dev server's bundle-finalization and graph bookkeeping; no new inputs are parsed, no auth/crypto/filesystem surface is touched.

Level of scrutiny

High. The incremental graph is a multi-phase state machine where content/failed/kind, the parallel first_import/first_dep edge lists, and the asset refcount must stay coherent across insert_stale → insert_failure → receive_chunk → trace_imports transitions. The PR history bears this out: four prior review passes on this PR each found a concrete regression (sticky server_state guard, failed-JS early-return dropping CSS roots, parse-failure not preserving CssRoot, resolution-failure via insert_stale not preserving CssRoot), each fixed with a dedicated test. That iteration count alone argues for a human reading of the final shape.

Other factors

  • Every prior inline finding (mine, CodeRabbit's, comment-cop's) is marked resolved with a fix commit and a regression test.
  • CI is green except a pre-existing unrelated ASAN flake per robobun's build summary.
  • I spot-checked the one new interaction the last commit introduces: insert_stale and insert_failure now both call free_file_content(UnrefCss) on a preserved CssRoot in the resolution-failure sequence. assets.unref_by_path swap-removes the path_map entry on the first call, so the second is a no-op — no double-decrement. The redundant restore_failed_css_root after insert_failure on the print path overwrites CssRoot(id) with the same path-hash id, also harmless.
  • The else if failed re-enqueue branch in invalidate's Css arm may overlap with the later CssRoot-preservation commits (a failed root now matches the CssRoot(_) arm directly), but appending it for rebuild is correct either way — not a bug, just possible redundancy a maintainer may want to look at.

main keeps the two edge list heads of a file in one Vec (edge_lists), so
first_dep is no longer a field of the graph. A failed dependent is queued
through append_client_entry_point, so the html file of a route is bundled
as html.
@robobun

robobun commented Sep 18, 2026 •

Copy link
Copy Markdown
Collaborator Author

Status

This branch is merged with main (ca41503) and builds again. The build error was error[E0609]: no field first_dep on type &mut IncrementalGraph<SIDE>. Commit 48efa9f fixes it.

I ran the branch against the page request during a rebuild that the notes of #42733 describe. An onResolve plugin parks a rebuild after @import "./missing.css" failed in a linked stylesheet that already imports another one. Then the script requests the page and the stylesheet that the page links.

build page during the rebuild
main, release canary (367d939) 200, no <link>
main, debug build exit 134, panic: only CSS roots should be found by tracing
this branch, debug build 200, one <link>, the stylesheet answers 200 with the last good rules
this branch, release build 200, one <link>, the stylesheet answers 200 with the last good rules

test/js/bun/http/bun-serve-html.test.ts has these steps as a test (93f5382, extended in eb59386). A framework route (meta.styles) gives the same results in a probe.

Commit 9993ca1 is the result of a self-review. It removes the two walks in invalidate and the extra branches in trace_imports, which the kept CssRoot content made redundant, and it makes one test stricter. The Notes in the PR body list every concern.

Not covered: a linked stylesheet that fails to parse while another file holds the same rebuild open. insert_failure drops its asset before the rebuild ends, so its <link> answers 404 in that window. The Notes in the PR body have the probe.

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

A stylesheet marked stale by a resolution failure kept its place as a css
root but lost its asset. A page served before the rebuild ended linked a
stylesheet that answered 404. The rebuild replaces the asset on success
and drops it on failure, so insert_stale leaves it in place.
@robobun

robobun commented Sep 19, 2026

Copy link
Copy Markdown
Collaborator Author

Addressed the optional note on the stylesheet link served during a rebuild. In eb59386, insert_stale no longer unrefs the asset of a css root it keeps routable. The asset lives until the rebuild replaces it (replace_path) or drops it (insert_failure), so the page's link serves the previous stylesheet instead of a 404. The in-flight rebuild test in bun-serve-html.test.ts now fetches every linked stylesheet and checks its status and rules. It fails on the previous commit (404 during the rebuild) and passes now. The bake dev suites (bundle, css, html) pass as well.

@robobun

robobun commented Sep 19, 2026

Copy link
Copy Markdown
Collaborator Author

CI status for build 118107: the diff is green on every lane. The one red test is test/bake/deinitialization.test.ts on alpine aarch64, a GC check that one JS Server wrapper was not collected in afterAll. That fixture bundles a plain index.html and never reaches the failure paths this PR changes. It passed on retry on the same lane in build 118105 and on Windows in this build. The other failures passed on retry. The bake dev suites and the tests this PR adds pass on every lane. This is ready for a maintainer review.

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review found no issues

No high-confidence issues detected in this change.

This review covers commit 88053e2, which is no longer the latest commit on this pull request; later commits are not covered by it.

A failed stylesheet keeps its CssRoot content, so invalidate reaches it
through the existing css root arm. The two walks over failed dependents
are gone. They also queued a failed script or html file again on every
save of a stylesheet that it imports.

trace_imports is the code of main again, with the FindErrors block moved
before the css check. A failed file never has CssChild content, so the
other branches could not run.

The css resolution error test now checks that the failed stylesheet
keeps its place in the css list of the route. Without that check it
passed on a release build without the fix.

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Beyond the inline finding, I also checked that dropping the invalidate additions in 9993ca1 does not break recovery when only an @ imported child of a print-failed stylesheet is edited: the failed entry now keeps Content::CssRoot, so the existing Css arm of invalidate re-enqueues it through append_css, and the "recovery by editing the child" test in test/bake/dev/bundle.test.ts still exercises that path. The PR description's line about invalidate queuing failed dependents describes code that is no longer in the diff.

Extended reasoning...

The hunt was cut off at its bug cap rather than running dry, and one confirmed finding on check_route_failures/trace_imports is posted inline, so approval is off the table. Since the last review (88053e2), commit 9993ca1 reverted the client-side trace_imports failed-file early return for non-FindErrors goals and removed both invalidate branches that re-enqueued failed dependents; I traced the child-edit recovery path through the current invalidate Css arm (dependent with Content::CssRoot gets append_css) and confirmed the preserved CssRoot content in insert_failure/insert_stale/restore_failed_css_root is what makes that arm fire, so the simplification is behavior-preserving for the tested scenario. The only other candidate examined (the "used to" comment at test/bake/dev/bundle.test.ts:1052) is regression context, not a stale description of current state, so it was dropped as a nit.

Additional findings (outside the current diff — GitHub can't attach inline comments there):

  • 🟣 src/runtime/bake/dev_server/incremental_graph.rs — Pre-existing: a developer whose linked stylesheet @ imports a child that fails to parse or resolve gets the page served 200 with the child's rules silently missing once they reload. check_route_failures runs trace_imports with FindErrors, and at incremental_graph.rs:1258 a CssRoot returns before its imports are walked, so a failed CssChild is never reported and the route is promoted to Loaded. Fix: let FindErrors reach failures below a css root, e.g. recurse into first_import under FindErrors and report a failed CssChild instead of asserting, or attach a child's parse/resolution failure to its chunk entry as the new print path does.

    Extended reasoning...

    Fixture: index.html links main.css; main.css is @ import "./child.css"; body { margin: 0 }; child.css is body {\n color: red;\n background-color\n} (the CSS parse error the PR's own test uses) or @ import "./missing.css".
    child.css fails in ParseTask; bundle_v2.rs:7609 calls handle_parse_task_failure(Client, child.css), DevServer.rs:5127 calls client_graph.insert_failure(child): failed=true, content Unknown.
    main.css still has parts, so it stays a css entry point; scan_css_imports (LinkerContext.rs:3396) raises no error for a Loader::Css record whose ast is None; findImportedFilesInCSSOrder.rs:141 skips the child; the chunk prints main's rules only and receive_chunk(main) stores CssRoot(id) with failed=false.
    Pass 2 process_css_chunk_import_records inserts the edge main -> child via insert_empty (found existing).
    index_failures traces child -> main -> index.html and sets the route to PossibleBundlingFailures (DevServer.rs:3409); the overlay shows the error on the open page.
    The user reloads. DevServer.rs:2050 calls check_route_failures;…

    Verification: pre-existing. Triggering condition: a CSS root linked by an HTML route (or imported by a script) @ imports a child stylesheet that fails to parse (or to resolve), and the developer reloads the page after the first error response. Mechanism verified in the head checkout: - Child parse failure: bundle_v2.rs:7609 / DevServer.rs:5127 -> client_graph.insert_failure(AbsPath(child.css)) sets…

@robobun

robobun commented Sep 19, 2026

Copy link
Copy Markdown
Collaborator Author

Updated the root cause paragraph of the PR body. It no longer says that invalidate queues failed dependents. 9993ca1 removed those walks, and the existing CSS root arm re-enqueues a failed stylesheet because it keeps its CssRoot content.

The other note is a gap of main, not of this PR: a child stylesheet that fails to parse under a root that prints is not found by the FindErrors trace on reload, because trace_imports stops at a CssRoot before it walks the imports. The code of main does the same. This PR does not change that walk, so I leave it for a change of its own.

Jarred-Sumner added a commit that referenced this pull request Oct 20, 2026
… and CLI (#46021)

### What does this PR do?

Hardening. This collects the open pull requests that fix a crash in Bun
into one change, and fixes about 20 more crashes that had no pull
request.

"Crash" here means a segfault, a Rust panic, an abort, a failed
assertion, memory corruption that a sanitizer reports, a native stack
overflow, or an exception that ends the process and that the program
can't catch. With this PR those cases throw a normal error, print a
normal CLI error and exit 1, or just work.

306 pull requests are included: 227 whole, and 79 cut down to the crash
fix where the rest was a refactor, a feature or a behavior change. Each
one was checked against current `main` first. 45 more turned out to be
fixed already, and 17 were duplicates. The full list is at the bottom.

#### Crashes you could hit in normal use

- **`bun build` with macros and a `.env` file crashed at random.** In a
repro with many macro modules, more than a third of the builds crashed.
Now 3,000 of 3,000 produce the right bundle. (#45960)
- **`bun run` and `bunx` aborted if a signal arrived while the child was
being spawned.** (#38926, #45965)
- **`bun build --compile ./index.js ./public/*` panicked** if an
embedded file's name wasn't valid UTF-8.
- **A truncated or corrupted compiled executable** died with SIGBUS or a
panic at startup. It now prints an error. (#31787, #38251, #41360)
- **Dev server:** several `Option::unwrap()` panics after a failed or
deleted import (#38046, #44744, #44746), a segfault when an `onLoad`
plugin throws while another bundle is queued, a request that hung and
then panicked with `bundle active`, and `server.stop()` that never
resolved after a client aborted a waiting request.
- **`Bun.serve`:** `server.fetch(url, { headers: new Headers() })`
followed by a GC segfaulted (#40888). Routes were used after free after
`server.reload()` with `tls.serverName` (#38636).
- **`text()` and `json()` on a stream of string chunks** could abort the
process, a regression in 1.4.0. (#44269)
- **`Bun.Transpiler` with `exports.eliminate` or `exports.replace`**
aborted on `export default 1` and on most re-export clauses. (#44137)
- **A decorated `declare` field in a class expression** with
`experimentalDecorators` panicked. (#38095)
- **YAML and JSON5 files with a key that isn't a string** panicked with
`--no-bundle` and in `Bun.Transpiler`. (#41827)
- **`Bun.FileSystemRouter`:** reading `.params` segfaulted when a
rejected route candidate left its parameters behind. (#39290, #39291)
- **Native addons that call `uv_async_*`, `uv_timer_*`, `uv_idle_*`,
`uv_prepare_*`, `uv_check_*`, `uv_queue_work` or `uv_cwd`** aborted with
"unsupported uv function" on Linux and macOS. They're implemented now.
(#36609, #39652, #39892)
- **`--watch` and `--hot`** panicked when the system was out of inotify
instances or file descriptors, or when the reload `exec` failed. They
print an error now. (#39629, #39975, #44837)
- **Paths longer than the path buffer** panicked in `bun install`, the
resolver, the bundler, `--compile`, `tsconfig.json` `paths` and
`baseUrl`, `package.json` `main` and `sideEffects`, `bun run --filter`,
`bun pm diff`, source maps and snapshots. They're ordinary errors now,
or they work. (#36340, #37529, #39104, #39650, #43067)
- **A Worker that creates a `ShadowRealm` and imports
`node:worker_threads` in it** segfaulted.
- **`structuredClone` or `postMessage` of an X25519 key** gave an object
that aborted the process when read. (#45624)
- **`node:stream` web adapters and `node:http2`** could end the process
with an exception that no handler could catch. (#45076, #45975)
- **Windows:** a watcher panic in a burst of file changes (#44344), a
segfault after the machine resumes from sleep (#33015), crashes in the
shell's pipe reader (#39638, #43606), and addons that import from
`node.exe` without the delay-load hook (#35618).

Most of the rest needs unusual input: strings near the 2 GiB limit,
buffers that another thread or a getter resizes or detaches in the
middle of a call, `worker.terminate()` at a bad moment, running out of
memory or file descriptors, very deep nesting, or hostile arguments to
`bun:ffi`, `node:vm` and `bun:sqlite`.

#### Behavior changes

Things that didn't crash before and behave differently now:

- `new` on native functions that aren't constructors throws a
`TypeError`, as in Node: `util.types.*`, `buffer.isAscii`, `isUtf8`,
`transcode`, `resolveObjectURL`, `bun:jsc` exports, `cc()` symbols. It
used to return the call's result. They also stop printing as `[class
hostname]`. (#34575)
- `` $`cmd` `` throws `ERR_INVALID_ARG_VALUE` if an environment
variable's name or value contains a NUL byte. It used to cut the value
at the NUL. (#44981)
- `cc()` functions throw a `TypeError` for arguments that used to reach
C as garbage, and `read.*(ptr, NaN)` throws. (#37989, #38057, #40773)
- As PID 1, `bun` exits with 128 + the signal number on Ctrl+C or
`docker stop`. (#38877)
- A `NODE_MODULE` addon that's already loaded by the main thread throws
`ERR_DLOPEN_FAILED` when a live Worker loads it too, as in Node.
(#39968)
- An exception from a `node:vm` context reaches `uncaughtException`
handlers. (#39992) `vm.constants.DONT_CONTEXTIFY` returns the real
global proxy. (#34623)
- `createPrivateKey` rejects an EC JWK whose private value doesn't match
its public point. (#33752)
- `@dec static {}` is a syntax error, as in TypeScript and esbuild.
(#44883)
- `clearTimeout` ignores 0 and negative ids, and timer ids no longer
wrap. (#44771)
- HEAD for a `Response` whose body is an S3-backed `Blob` reports the
length that GET sends. (#44734)
- `bun:sqlite` and `node:sqlite`: if `iterate()` left a write unfinished
on a connection that has a hook, a user function or an authorizer, the
write is finished on the connection's next call instead of during
garbage collection. If the database is gone too, it's rolled back.
- `bun test --bail` runs exit listeners and closes SQLite databases.
(#39010)
- Dev server: a request for a client script waits while a bundle is in
flight (#42733), query strings reach framework routes (#33232), and a
request gets a 500 instead of hanging when plugins fail (#36812).

#### File formats

- `.jsc` bytecode files get a 24-byte footer so they can be verified
before decoding. Files from an older Bun are ignored and the source is
parsed instead. (#39396)
- `node:vm` `cachedData` gets an 8-byte checksum. A blob from an older
Bun is rejected, which the API allows. (#32839)
- The built-in modules section of a compiled executable changes from
format 1 to 2 and carries an engine stamp. (#44907)

#### Performance

Measured in instructions per operation on release builds of this branch
and its base, with an A/A run for the noise floor (0.0 to 0.2 %).

No change: `Bun.serve`, `node:http`, WebSocket echo and publish, `bun
build` of 3,807 modules, `bun run` with 2,000 imports, `readdir` /
`Glob` / `fs.cp` over 23,689 entries, startup and RSS. The binary grows
by 176 KB (0.17 %).

| Faster | Instructions |
| --- | --- |
| WebSocket echo of a 1 MB non-ASCII text message | −72 % |
| `Bun.inspect` of a large non-ASCII string | −39 % |
| `Bun.markdown.html` on large non-ASCII input | −33 % |
| `` $`cmd` `` with 300 environment variables | −6 % |
| `fs.readSync` | −5 % |
| `TextEncoder.encodeInto`, short ASCII strings | −4 % |
| async `crypto.pbkdf2`, 16-byte inputs | −17 % |

| Slower | Instructions | Why |
| --- | --- | --- |
| `cc()` calls | +5 to +51 per call | Argument count and type checks,
and a check for `close()` (#37989, #38057, #43802, #44921). `dlopen()`
calls don't change |
| `process.env.X = v` | 38 → 593 per write | Writes aren't cached. Reads
don't change (#38871) |
| async `crypto.pbkdf2`, inputs of 1 KB or more | +4 to +9 % | Password
and salt are copied (#40554) |
| `bun build` with an object `--define` used thousands of times | +4.5 %
| The object is copied per use (#45969) |

#### Not included

- Fixes that need a WebKit change: #39967, #42534, #42982, #43764,
#43786, #44226. #42185 too: a typed array that has no `ArrayBuffer` yet
can't be pinned, so `view.buffer.transfer()` during an async call can
still free its bytes. Creating the `ArrayBuffer` up front costs 7 to 12
% on every async `fs` call, so the fix belongs in JSC: an `ArrayBuffer`
created while the view is borrowed should start out pinned.
- #45442 (`calc()` sums as a flat list): it changes minified output for
real stylesheets to survive a `calc()` with 25,000 terms. It deserves
its own review.
- #40023 (Windows event loop redesign), #29928 (Windows exit path),
#40534, #43963, #39571, #42904, #42834, #36355, #43266: refactors or
features whose crash is already covered or isn't a crash.
- The pull requests marked *(crash fix only)* below should stay open for
their other half.

### How did you verify your code works?

- **Tests.** Every fix has a test that fails on `main` (a release or an
ASAN build) and passes on this branch, except where that isn't
practical: code that only runs on Windows or macOS, inputs that need
several GB of memory, and a few rare races. Those were checked by hand
or by reading.
- **Stored repro scripts.** 230 crash repros ran on release and ASAN
builds of this branch and of `main`, side by side. Release: 88 no longer
crash. ASAN: 106 no longer crash. None crashes that didn't before. What
still crashes needs WebKit, is SQLite's own bug, or isn't a crash. The
ASAN number is from a later commit than the release number.
- **Dev server.** Because one fix makes requests wait, 2,171 generated
programs ran random interleavings of edits, build errors, failing
plugins, reloads, stops and disconnects with about 120,000 requests. No
request hung, was answered twice or got a stale body. `main` hung in 82
of 1,161 programs. This also found the four dev server bugs listed
above.
- **Path helpers.** 336,000 boundary cases with buffers of exactly the
computed size, and 12,003 random calls through 30 JS APIs on an ASAN
build, compared with `main`. No sanitizer report, and the results match
wherever `main` doesn't panic.
- **What worked on 1.4.3 still works.** Reviewers compared behavior with
1.4.3 and took out what changed it: for example an output directory
layout change for 9 or more entry points, a `server.reload()` change,
and a changed error message for `import("file:///50%deposit.ts")`.
- **Not run locally:** the Windows, macOS and FreeBSD code paths. CI
compiles and tests them.

### Included pull requests

**Bundler, transpiler, CSS, macros** (33)

- #33881 bundler: allocate wrapper_ref for CommonJS modules with no
non-hoistable statements
- #35055 Bun.build plugins: handle filter RegExp flags beyond i/m/v
- #37769 bundler: fail the build instead of panicking when the bundle
thread cannot create its waker
- #37784 bundler: copy inlined env values into the define arena, and
give each Bun.build its own env copy *(crash fix only)*
- #37858 bundler: fail the build instead of panicking when a plugin
answer string cannot be converted
- #38046 bun build --server-components: require the bun target and
reject directives without a framework *(crash fix only)*
- #38095 js_parser: fix panic on decorated declare/abstract fields in
class expressions with experimentalDecorators
- #38966 bundler: keep deep CSS, export star and composes graphs from
overflowing the linker's stack
- #38984 bundler: stop an export star ambiguity that loops back into a
re-export chain from overflowing the stack
- #39113 css: reject stylesheets of 2 GiB or more instead of aborting on
an int cast
- #39396 bundler: frame .jsc bytecode sidecars and verify them before
decoding
- #39855 bundler: join the work still on the pools before the bundle is
torn down *(crash fix only)*
- #41157 dev server: leave out an html link to a cached json module
instead of panicking, and mark a new placeholder file stale
- #41801 css: decode ill-formed UTF-8 to U+FFFD before tokenizing
*(crash fix only)*
- #41827 bundler: handle YAML and JSON5 keys that are not strings
instead of panicking
- #42242 js_parser: compress symbol link chains when following merged
declarations
- #42387 bundler: check receivers on the Bun.build plugin object and
freeze its filters during a build
- #42413 Bounds-check the InternalSourceMap window reader
- #42657 macros: keep visited values alive so a reused address does not
get another value's Expr
- #43330 transpiler: do not print an empty `var` for a data file with no
named export
- #43355 bundler: fix "The memory limit has been exceeded." on large
HTML entries
- #43658 react-compiler: fix skipped functions and build aborts for dead
code in a try body *(crash fix only)*
- #44137 js_parser: fix four crashes of exports.eliminate and
exports.replace
- #44467 js_parser: replace skipped expressions with E::Missing and skip
argument checks after a stack overflow
- #44662 js_parser: walk binary chains on the heap and check the stack
when rewriting decorated #private accesses
- #44712 json5: reject sources of 2 GiB or more before parsing instead
of aborting on an int cast
- #44864 js_parser: walk conditional chains in import()/require() and
define keys in a loop
- #44883 js_parser: reject a decorator on a class static block, keep
decorators out of the body of `declare global` *(crash fix only)*
- #45045 Fix a segfault in new Bun.Transpiler(): re-point options.log
after the constructor moves its Log
- #45604 css: keep a url() in an at-rule prelude as written, and never
print the resolved path of a url() *(crash fix only)*
- #45748 bundler: put --banner/--footer in the bytecode ESM module
record (flags from a parse, entries from JSC) *(crash fix only)*
- #45960 macros: give each parse-worker macro VM its own env loader
- #45969 js_parser: copy object and array defines per use, and copy the
list of a lone JSX spread object *(crash fix only)*

**`bun build --compile` and standalone executables** (3)

- #31787 Don't crash at startup when a standalone executable's embedded
graph is corrupted *(crash fix only)*
- #38251 compile: exit with an error instead of SIGBUS when a standalone
executable is truncated
- #41360 standalone: check every offset in the embedded module graph
before reading it

**Resolver, module loading, plugins, paths** (25)

- #32269 Bun.plugin: validate the namespace without a shared regex
- #33183 bun:jsc: filter internal cells out of getProtectedObjects()
- #34575 Don't register native functions as their own constructors
- #36340 paths: size the thread-local join output buffers to
MAX_PATH_BYTES on Windows
- #37037 mock.module: reject async factory results that are not objects
- #37065 bun:jsc: propagate JSONParse exceptions from
samplingProfilerStackTraces
- #37529 resolver: don't abort on a package.json sideEffects entry
longer than the join buffer
- #38179 node:module: throw instead of crashing when module._compile is
set to a non-function
- #38273 bun test: report a test file or preload the loader cannot
resolve instead of exiting; keep the JUnit report valid U… *(crash fix
only)*
- #38732 paths: compute the common path of 9+ inputs with the same loop
as fewer *(crash fix only)*
- #39228 paths: strip C:\\ down to the drive root in
without_trailing_slash_windows_path *(crash fix only)*
- #39650 bun run --filter: stop panicking on workspace paths longer than
the path buffer
- #40186 resolver: stop deeply nested exports targets from overflowing
the stack
- #40258 resolver: publish Entry.abs_path through the per-entry mutex
- #42183 node:module: reject a _resolveFilename override result that
contains a null byte
- #42401 node:module: accept any `this` in Module.prototype.require
*(crash fix only)*
- #42405 Bun.plugin: transpile a copy of typed array onLoad contents
- #42414 node:module: end the Module._stat path at the first null byte
- #42685 resolver: strip the trailing separator inside bust_dir_cache
- #42735 Throw a RangeError instead of aborting when require.resolve
paths or Worker preload outgrows its Vector
- #43067 Report a path that does not fit a path buffer instead of
aborting *(crash fix only)*
- #44410 Fix a crash when code from a node:vm context reads
require.cache or require.extensions
- #44466 Trace the value an object or data module exports from its
JSSourceCode
- #45044 Bun.plugin: give onLoad's args.path its own bytes
- #45117 cjs: do not call an `__esModule` getter during the annotation
lookup

**Dev server, `bun bake`, routers, `--watch` and `--hot`** (28)

- #28793 Stop file watcher thread before Global.exit tears down memory
*(crash fix only)*
- #32143 bake: fix "Runtime file not found" panic in production builds
of custom frameworks
- #32443 watcher: don't free the Watcher in the spawn-to-start window
*(crash fix only)*
- #33232 bake: normalize the HTTP request-target before matching
framework routes
- #36812 bake: respond 500 and release both RequestContext refs when
on_plugins_rejected / OOM drains a deferred framework r…
- #37039 bake: report per-file print failures in the dev server instead
of serving empty modules
- #37276 hot_reloader: take entries_mutex for watcher-thread directory
cache probes
- #37444 bake: unregister Bake::SourceProvider from the source map table
when it is destroyed
- #39290 FileSystemRouter: match / against a root-level optional
catch-all route *(crash fix only)*
- #39291 FileSystemRouter: order dynamic routes by per-segment
precedence like Next.js *(crash fix only)*
- #39629 watch: report a failed watcher init as an error instead of a
crash
- #41185 bake: check for exceptions in the production build's module
loader hooks and helpers
- #41340 bake: skip the directory watch when the directory cannot be
opened
- #41617 Decide a directory watch event from the watchlist, not from the
resolver's cached listing *(crash fix only)*
- #42547 bake: re-arm the memory visualizer timer when it fires
- #42733 dev server: make a client script request wait for the bundle in
flight
- #42828 bake: serve routes from a router root outside the project root
instead of aborting or answering 404
- #42831 bake: resolve app.root and router roots through one checked
join
- #42836 bake: report route scan errors instead of aborting, and fail
bun build --app on them *(crash fix only)*
- #42840 dev server: map a router type's server entry point to the root
route of that type
- #42862 Bun.serve: return before a pending app.plugins setup() settles
*(crash fix only)*
- #42920 Do not create a mimalloc heap per FileSystemRouter, reload() or
:nth-child(An-B) selector
- #42934 dev server: register a client component without evaluating it
- #43329 dev server: check the route bundle index of a client script URL
before Index::init
- #44249 fs.watch: read each directory and close it before descending
- #44344 Windows: fix a watcher panic and lost events in a burst of file
changes, and a --hot that stops watching a deleted…
- #44744 dev server: answer a cached-file lookup only for a graph that
bundled the file
- #44746 dev server: keep an importer in its own graph when an import
fails or is deleted

**`Bun.serve`, sockets, HTTP, WebSocket, HTTP/2, QUIC, DNS** (28)

- #42667 Reland "usockets(windows): keep a closed poll alive until the
outer tick and libuv are done with it" (#39643)
- #33015 fix(windows): segfault in uv__wake_all_loops after system
resume *(crash fix only)*
- #35761 node:quic: detach lsquic ctx pointers before the finalize-order
sweep at worker VM teardown
- #37082 Bun.serve: terminate FIFO/pipe file responses at EOF
- #38024 dns: keep the c-ares uv_poll_t alive while its poll callback is
on the stack (Windows)
- #38636 serve: fix route use-after-free after reload() with
tls.serverName *(crash fix only)*
- #40888 server.fetch: copy a Headers argument instead of adopting the
wrapper's pointer
- #41337 Update lsquic to 4.9.4 and free unsent stateless resets on
destroy *(crash fix only)*
- #41384 usockets: hold a tick level for the whole of close_all
- #41412 Windows: wait for close completions when closing a worker's uv
loop
- #41516 node:http2: handle an empty byte range in respondWithFile and
respondWithFD
- #41521 udp: report every binaryType from the getter, reject a dgram
bind of the other family *(crash fix only)*
- #42188 net: do not assert a two-character host in SocketAddress.parse
- #42210 libuv(windows): keep a pipe's completed read counted until its
read callback returns
- #42334 fetch, Bun.serve: throw a RangeError for Headers that total 4
GiB or more *(crash fix only)*
- #43738 usockets: close a socket whose resume the kernel refuses from
the loop, not from the caller
- #44338 node:http: response trailers travel with the end call of the
response *(crash fix only)*
- #44433 bake: make the parked-request list non-owning and look up the
DevServer when a plugin load settles
- #44533 node:quic: capture the handshake while the conn is alive, set
the application at session creation
- #44734 Bun.serve: answer HEAD for an S3-backed Blob body without an S3
stat
- #44751 node:quic: close() waits only for opened streams, and lsquic
sends no GOAWAY before HTTP/3 starts *(crash fix only)*
- #44897 node:http2: throw instead of panic when the native
setNextStreamID() misses its argument
- #45076 node:http2: let close() and destroy() win over the refusal of a
request
- #45341 uws: AsyncSocket::write takes a size_t length, so res.end()
sends a body of 2 GiB or more whole
- #45522 node:http2: throw for an ALTSVC frame that is too long and for
a pushPromise id that is not a stream id
- #45676 node:quic: do not reset a stream lsquic has already finished
- #45822 node:quic: name a stream in queued session events by a
per-session key, not by its address
- #45858 Bun.serve WebSocket: a message that does not fit in memory
fails one connection, not the server *(crash fix only)*

**Streams, Blob, S3, files, `node:fs`** (28)

- #33845 io: propagate IoRequestLoop init failure instead of aborting
*(crash fix only)*
- #36365 prompt: drop debug_assert that rejects answers containing CR
- #37090 Deliver FIFO bodies whose writer connects after the reader
opens *(crash fix only)*
- #38039 node:fs: stop fs.copyFile(src, "") from segfaulting on Windows
- #38653 shell(cp): reject copying a directory into itself; walk cp
trees without recursion
- #39207 Convert scope-object receivers in the chaining functions and
inspect.custom fallbacks
- #39390 Blob deserialize: reject over-long paths, treat size >=
MAX_SIZE as unknown, make slice() non-panicking
- #39639 fetch: drop the upload and drain hop refs at VM teardown
*(crash fix only)*
- #40008 inspect hooks: copy user options with putDirectMayBeIndex
*(crash fix only)*
- #40462 Windows: FileSink.start({ path }) on a live writer: hand the
writer a libuv fd and close the old source *(crash fix only)*
- #41440 node:fs: pass the buffer to the read/readv/write/writev
callback on error
- #41584 Walk the timer pairing heap without recursion
- #41608 native-readable: accept a stream with no native handle
- #41710 JSSink write(): convert the chunk before resolving the native
sink *(crash fix only)*
- #42711 webstreams: bound the native recursion through a chain of tees
or text streams
- #43264 fetch: reject a file: URL whose path has an encoded NUL
- #43709 s3: fix double free of a multipart part's bytes on worker
terminate
- #43950 streams: link readers and writers last, reject their promises
as handled
- #44036 PipeReader: label a chunk Eof only when the reader is at its
end
- #44181 streams: throw instead of aborting when a direct stream's text
sink cannot take a string chunk
- #44195 fs: validate POSIX directory records in one parser, report a
malformed record as EIO *(crash fix only)*
- #44269 streams: join the string chunks of a text consumer with one
allocation
- #44490 watch(windows): report a failed child spawn as an error instead
of a panic *(crash fix only)*
- #44954 process.stdout/stderr with no FileSink: write synchronously,
reset after a failed write *(crash fix only)*
- #45004 streams: leave a stream alone when a consumer fails to lock it
- #45521 FileSink: throw ERR_ILLEGAL_CONSTRUCTOR from the constructor
that script reaches by writer.constructor
- #45738 s3: own the Blob store across the calls that run user JS
- #45975 node:stream: do not touch the web controller after the web side
is done

**Node-API, V8 API, `bun:ffi`, `process.dlopen`** (15)

- #36609 napi: implement uv_cwd on POSIX
- #37989 bun:ffi: stop cc() from turning non-numeric pointer arguments
into garbage pointers
- #38057 bun:ffi: make cc() reject non-numeric i64/u64 arguments instead
of passing garbage
- #38425 bun:ffi: throw on an empty cc() source array instead of
panicking
- #39652 napi: implement uv_async_t, uv_queue_work and uv_default_loop
on posix
- #39805 Share one handle scope implementation between Node-API and the
V8 API
- #39892 napi: implement uv_idle_t, uv_prepare_t, uv_check_t and
uv_timer_t on posix
- #40144 bun:ffi: return undefined for a NULL napi_value from cc() and
throw the scheduled napi exception
- #40773 bun:ffi: add the full byteOffset in read.*, do not truncate it
to int32
- #41704 napi: hand the thrown value to
napi_get_and_clear_last_exception after napi_run_script
- #42960 process.dlopen: run a V8 addon's init function after dlopen()
returns
- #43797 Fix debug assertion on an empty error message from a V8 addon
or SQLite *(crash fix only)*
- #43802 bun:ffi: throw a TypeError when a cc() symbol is called after
its library's close()
- #43940 napi: fail with ERR_BUFFER_TOO_LARGE instead of aborting above
the ArrayBuffer limit *(crash fix only)*
- #44921 bun:ffi: pad a short call to a cc() symbol with undefined

**`node:vm`, workers, process, timers** (19)

- #34623 node:vm: run DONT_CONTEXTIFY contexts directly against the real
global
- #32839 node:vm: reject invalid cachedData instead of crashing
- #36921 error printer: clear the pending exception when formatting a
non-Error uncaught value throws
- #37270 error printer: one render per error, [Circular] under the key
that closes the cycle
- #38740 bun:test: give each VM its own fake clock *(crash fix only)*
- #39864 Report a refused HTTP, bundle, IO or process waiter thread as
an error instead of a crash *(crash fix only)*
- #39992 process: deliver exceptions reported against a node:vm context
to uncaughtException
- #41654 node:vm: give each SourceTextModule request the import
attributes of the declaration that created it *(crash fix only)*
- #41739 Do not forward the inherited IPC channel to spawned scripts and
tools
- #41769 node:vm: stop compiling accepted cachedData, report each
cachedData decode to the GC *(crash fix only)*
- #42045 bun:test fake timers: never move the fake clock backwards
- #42308 process.execve: throw instead of aborting for a string past the
string limits
- #42734 node:vm: report cachedData of 2 GiB or more as rejected instead
of aborting
- #42843 process.dlopen: reject a filename of PATH_MAX or more before
dlopen()
- #43500 process: accept SIGSTKFLT, SIGPOLL and SIGPWR, and emit every
name of a signal number *(crash fix only)*
- #44486 worker: stop the start sequence when a handler it calls stops
the worker
- #44771 timers: allocate ids from one 64-bit counter that never wraps
- #44837 --hot: defer a reload during the preloads, and report a reload
that cannot start
- #44991 Fix a use-after-free in the VM ref-string intern for a string
over the length limit

**Shell, spawn, CLI, `bun test`, `bun install`** (31)

- #30642 Fail fast at startup when simdutf has no usable implementation
for this CPU
- #34223 Fix four crashes: HTMLRewriter disturbed body, S3 locked-stream
upload, ConnectionsList closed parser, shell brace… *(crash fix only)*
- #34884 Guard the console and test-runner formatters against native
stack overflow on deeply nested values *(crash fix only)*
- #36584 process.chdir: publish an immutable cwd slice so no thread sees
a torn cwd
- #37135 bun test --parallel: hold the JSC API lock while draining the
worker's final IPC backlog
- #37527 shell(mv): report ENAMETOOLONG instead of panicking when a
source name does not fit the path buffers
- #37528 cli: stop aborting on absolute script paths longer than 1024
bytes on Windows
- #38162 shell(cp): report ENAMETOOLONG instead of panicking on operands
longer than the path buffers
- #38205 shell(windows): report ENAMETOOLONG for operands that do not
fit the path buffer
- #39010 bun test: exit through the VM teardown path when --bail stops a
run
- #39104 bun test: report over-long coverage dir, JUnit outfile and
bunfig root instead of panicking *(crash fix only)*
- #39638 shell(cat): serve a second cat on the same stdin instead of
hanging or panicking
- #39641 usockets: report an out-of-descriptors event loop init as an
error, not a crash *(crash fix only)*
- #40181 shell: stop deeply nested if clauses from overflowing the
parser stack
- #40885 shell: throw instead of panicking when a ReadableStream is used
as a redirect
- #41155 ipc: send a queue item larger than 2 GiB in capped write
requests
- #42298 bun:test: print String objects with 16-bit storage correctly
- #42577 bun:test: root the return values toHaveReturnedWith collects
- #43606 shell(windows): report a failed pipe reader start through
on_reader_error instead of leaking the subprocess *(crash fix only)*
- #43838 node:cluster: read a worker's `ack` and `addressType` in the
primary only when they are int32
- #44172 node:cluster: refuse a descriptor of the wrong kind in the
primary *(crash fix only)*
- #44185 node:cluster: one handle for each descriptor that workers name
*(crash fix only)*
- #44491 bun test: run every callback when native code leaves an
exception pending *(crash fix only)*
- #44694 shell mv: refuse to copy a directory into itself on the
cross-device fallback
- #44752 shell: take the command-substitution capture and drop its NUL
bytes
- #44981 shell: reject NUL bytes in .cwd() and .env() at the native
setters
- #45206 ini: reject a source of 2 GiB or more in Parser::parse instead
of aborting on an int cast *(crash fix only)*
- #45348 bun test: fix a segfault in .not.toThrow(Class) when
Symbol.hasInstance accepts a thrown string, symbol or BigInt
- #45649 shell: replace the output counters in mkdir, cp, ls and touch
with the OutputTask queue
- #45792 bun test: SIGKILL a spawnSync child that is still running 500
ms after the test's timeout *(crash fix only)*
- #45910 create: own the remote-template response buffers instead of
parking them in the CLI arena

**Web APIs, Buffer, encoding, URL, crypto, zlib, SQLite, Redis and the
rest** (96)

- #29709 console: guard JSX/Proxy recursion in Bun.inspect (stack
overflow SIGSEGV)
- #30817 console.takeHeapSnapshot: clear prior snapshots before building
- #30956 spawnSync: make signal-forwarding register/unregister safe for
concurrent callers *(crash fix only)*
- #31505 node:zlib: reject invalid brotli flush values at validation
*(crash fix only)*
- #31735 node:path: fix win32 drive-relative resolve on non-Windows
hosts *(crash fix only)*
- #32085 Fix crash when RedisClient onclose/onconnect is set to a
non-callable
- #32240 Fix BroadcastChannel custom inspect crash with numeric option
keys
- #33181 Reject interior null bytes in Bun.mmap, Glob.scan, and
FileSystemRouter paths *(crash fix only)*
- #33752 node:crypto: validate EC JWK private scalar matches public
point in createPrivateKey
- #34976 spyOn: install and restore through one writer that throws when
the object refuses *(crash fix only)*
- #35562 structuredClone: purify NaN in deserialized Date timestamp so
getTime never returns a forged JSValue
- #35618 napi(windows): load addons that import node.exe without
win_delay_load_hook
- #35757 Coerce later arguments before capturing input buffers in
Bun.Transpiler and Bun.RedisClient
- #37252 Report UTF-16 to UTF-8 encode counts through size_t so exactly
2^32 written bytes doesn't wrap to 0
- #37338 node:module: build require.cache without user-writable globals
and propagate its exceptions *(crash fix only)*
- #37340 redis: accept unsubscribe acks that arrive outside subscriber
mode
- #37370 Error.appendStackTrace: make appending an error's trace to
itself a no-op
- #37443 node:crypto: fix null deref when worker.terminate() lands
during an EC JWK private key import
- #37448 jsc: check for exceptions before using a stored
constructEmptyArray result *(crash fix only)*
- #38009 MessagePort: fix a heap-use-after-free in contextDestroyed(),
release ref() when the last 'message' listener is rem… *(crash fix
only)*
- #38469 napi: settle or refuse async work queued during VM teardown
instead of taking a ticket
- #38708 Handle 16-bit module sources in the error preview, the
new-position fix-up and the REPL *(crash fix only)*
- #38821 process.env: make a failed env build throw instead of aborting
(Windows 0xC0000409 on Bun.$ / Bun.sql / process.env…
- #38871 process.env: coerce to string on every execution of an
assignment, not just the first
- #38877 cli: exit 128 + signo when bun cannot die from a re-raised
signal (bun as container PID 1)
- #38926 Clear the inherited signal mask at startup and exec children
with an empty one *(crash fix only)*
- #39382 Make a failed util.inspect load throw from custom inspect
functions instead of aborting
- #39481 Always create the error when a native error message exceeds the
string length limit
- #39651 performance: keep the user timing entry counts exact after
clearMarks(name) and clearMeasures(name)
- #39775 Turn seccomp SIGSYS traps into ENOSYS so the syscall fallbacks
run on Android
- #39968 process.dlopen: replay a non-context-aware V8 addon only while
no other live VM owns it
- #39975 watch: report a failed reload exec as an error instead of a
panic *(crash fix only)*
- #40346 Give Glob's native scan methods their own private names
- #40554 node:crypto: copy password and salt for async pbkdf2 and scrypt
- #40567 url: reject URL-encoded input over the WTF decode limit instead
of aborting
- #40577 url: throw a RangeError instead of aborting when
URLSearchParams or FormData outgrows its Vector
- #41073 Store array-index property names as indexed properties in
native object builders
- #41137 Write the sampling profiler report at exit from Bun, not JSC's
atexit hook
- #41365 webview: fail only the view when WebKit lacks
initWithDirectory:
- #41574 Decode a private copy of a JS buffer in the UTF-8 decoders
*(crash fix only)*
- #41652 console: read a BigInt depth option by value in console.dir
- #41749 Startup: reopen fd 0-2 as /dev/null only when the fd is closed
- #41819 Report an incoherent BUN_JSC_* option combination as a
configuration error, not a crash *(crash fix only)*
- #42158 webview: reject malformed Chrome replies instead of crashing
- #42179 shell: clamp a `> ${buf}` redirect to the target buffer's live
length
- #42187 node:crypto: throw ERR_OUT_OF_RANGE for >2 GiB buffer arguments
instead of aborting
- #42191 URLPattern: throw instead of aborting when a pattern string
passes the string limit
- #42192 Copy WebAssembly.Memory bytes for native borrows that outlive
the call *(crash fix only)*
- #42198 Make Bun.$, Bun.sql, Bun.postgres and Bun.SQL custom value
getters so reifying the Bun object passes exception chec…
- #42203 node:fs: fs.read into a WebAssembly.Memory view writes into the
block a grow freed
- #42214 Headers: throw a RangeError instead of aborting when the
set-cookie list cannot grow
- #42218 Headers: throw instead of aborting when a value passes the
string length limit
- #42220 URLPattern: throw instead of aborting when the token list
cannot grow
- #42225 Throw ERR_STRING_TOO_LONG from Bun.wrapAnsi instead of aborting
when the output passes the string length limit
- #42226 Throw instead of aborting when a MIME string does not fit in a
string *(crash fix only)*
- #42237 Bun.Cookie: throw instead of aborting when the Set-Cookie
string passes the string length limit
- #42249 Copy a shared input before libdeflate compresses it in
Bun.gzipSync and Bun.deflateSync
- #42253 bun test: walk nested describe scopes without native recursion
- #42259 Throw instead of aborting when a domainToASCII host passes the
string length limit
- #42310 Parse a private copy of a shared or resizable buffer in
Bun.Transpiler, Bun.markdown, Bun.YAML and Bun.TOML *(crash fix only)*
- #42312 YAML, JSON5, XML stringify: throw instead of aborting when the
output passes the string length limit
- #42318 Bound libdeflate's emit path so a racing input cannot overrun
the output
- #42338 inspector: check the type of process.argv in getModuleGraph
- #42364 node:perf_hooks: do not truncate the monitorEventLoopDelay
resolution to int32
- #42412 transpiler cache: reject an entry with no sourcemap section
- #42479 worker_threads: do not abort when
markAsUntransferable/markAsUncloneable gets a WebAssembly GC reference
- #42517 EventTarget: skip a listener object that has no realm
- #42518 fs.Stats: make the date accessors define the property like
Object.defineProperty *(crash fix only)*
- #42575 Stop natives from writing onto a foreign `this` with putDirect:
process.ppid, require.cache, StringDecoder, the nat… *(crash fix only)*
- #42631 JSStringView: pin the cell that owns the borrowed characters
- #42660 bun_core: read /dev/urandom when getrandom(2) answers ENOSYS or
EPERM
- #42780 node:crypto: treat a name too long to convert to UTF-8 as
unknown instead of aborting
- #42782 node:crypto: throw ERR_OUT_OF_RANGE for a passphrase larger
than INT_MAX bytes
- #42856 url: do not abort when a host is too long for the IDNA
conversion buffers
- #42868 sqlite, console, process: do not abort on a string too long to
convert to UTF-8 *(crash fix only)*
- #42941 Bun.sliceAnsi: throw instead of aborting when the result passes
the string length limit
- #43058 Bun.serve: fix crash and cross-request 500 when inspecting a
non-Response return value throws
- #43904 JSC bindings: build property keys from a BunString through
Bun::toIdentifier
- #44124 Bun.Image: decode WebP into a Bun-owned canvas and read ICCP
without the demuxer *(crash fix only)*
- #44190 Convert scope-object receivers before Buffer read*/write* and
vm.Script describe them
- #44211 Stop getsockname(out), useFakeTimers() and the stream source
pull() from writing onto a caller's object with putDirect
- #44295 bun test --coverage: append a final newline to a text that
lacks one *(crash fix only)*
- #44360 rust-argon2: return OutOfMemory instead of aborting when the
memory cost cannot be allocated
- #44421 node:zlib: free zstd's workers before the dictionary they read
- #44521 util.parseArgs: pick the default args start from a per-VM eval
flag, as Node v26 does *(crash fix only)*
- #44740 structured clone: tolerate a zero-sized shared
WebAssembly.Memory in computeMemoryCost()
- #44759 HTMLRewriter: park a suspended handler's token before the
output flush
- #44907 Builtins section format 2: an engine stamp says which buns
compile its modules
- #45188 Reject an oversized WebCrypto cipher output instead of aborting
- #45354 Throw for a `file:` URL whose path is not UTF-8 on Linux and
macOS, through one `fileSystemPath()` accessor *(crash fix only)*
- #45608 ipc: refuse an over-long message before the receive buffer
stores it
- #45624 webcrypto: write the key type into the X25519 structured-clone
record
- #45625 node:sqlite: refuse session.close() and Symbol.dispose inside a
SQLite callback
- #45653 glob: a group with `?` or a class matches when an alternative
takes 64 bytes or more
- #45820 Bun.file, S3Client.file and Bun.write no longer keep a buffer
path alive forever
- #45832 `bun check`: fix a panic on `export *` without a module
specifier, and a false error for one in parentheses

### Already fixed on `main`, or duplicates of a pull request above

Already fixed: #27323 #30401 #31011 #31206 #31566 #31626 #31695 #31702
#31945 #32773 #34154 #34697 #34744 #34964 #35655 #35816 #36020 #36181
#36296 #36342 #36581 #36602 #36807 #36818 #36857 #37172 #37235 #37239
#37267 #37420 #37731 #37914 #38113 #38119 #38509 #38514 #38540 #38975
#39410 #40749 #41163 #41171 #42108 #43085 #43230

Duplicates: #45654 #29986 #33378 #36895 #37070 #37639 #38014 #39021
#41266 #42250 #42951 #43238 #44259 #45335 #45565 #45726 #45965

Fixes #5019
Fixes #6106
Fixes #10690
Fixes #10886
Fixes #13566
Fixes #14745
Fixes #15551
Fixes #20454
Fixes #21310
Fixes #29145
Fixes #30454
Fixes #30613
Fixes #30766
Fixes #32103
Fixes #32142
Fixes #32183
Fixes #32212
Fixes #39060
Fixes #42296
Fixes #42931
Fixes #43671
Fixes #44201
Fixes #44735
Fixes #44783
Fixes #45198
Fixes #45327
Fixes #45491
Fixes #45721

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
@Jarred-Sumner

Copy link
Copy Markdown
Collaborator

This is Claude (an AI assistant) commenting on Jarred's behalf.

This fix went in with #46021, which is merged. Closing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants