fix: clear dead stack before asynchronous GC requests

CHANGELOG.md

@@ -352,3 +352,5 @@
 - Resolve positive and negative CA options in order, applying `NODE_OPTIONS` before command-line flags across runtime and package commands while preserving Bun's existing trust stores.
 
 - x64 macOS without AVX (older Macs and Rosetta on macOS 14) no longer crashes with SIGILL at startup (openclaw/openclaw#181032).
+
+- Clear dead native stack slots before asynchronous GC requests so parked workers can finalize unreachable objects after `Bun.gc(false)`, including on Windows ARM64.

bench/gc-async-stack.mjs

@@ -0,0 +1,137 @@
+// node bench/gc-async-stack.mjs <baseline-bun> <candidate-bun> <output-directory>
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { arch, cpus, platform } from "node:os";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { Worker } from "node:worker_threads";
+
+const script = fileURLToPath(import.meta.url);
+const cpuMs = usage => (usage.user + usage.system) / 1000;
+
+async function measure(name) {
+  assert(process.versions.bun, "Run benchmark cases with the selected Bun executable");
+  if (name === "gc-loop") {
+    for (let i = 0; i < 2000; i++) Bun.gc(false);
+    Bun.gc(true);
+    const cpu = process.cpuUsage();
+    const start = performance.now();
+    for (let i = 0; i < 200000; i++) Bun.gc(false);
+    return { iterations: 200000, elapsedMs: performance.now() - start, cpuMs: cpuMs(process.cpuUsage(cpu)) };
+  }
+
+  assert.equal(name, "idle-worker");
+  const worker = new Worker(
+    `const { parentPort } = require("node:worker_threads");
+     async function turn(i) {
+       globalThis.payload = new Array(524288).fill(i);
+       // The controller can throttle after quiet ticks; request collection before every park.
+       Bun.gc(false);
+       await new Promise(resolve => setTimeout(resolve, 0));
+     }
+     (async () => {
+       for (let i = 0; i < 25; i++) await turn(i);
+       Bun.gc(true);
+       parentPort.postMessage("ready");
+       parentPort.once("message", async () => {
+         const start = performance.now();
+         for (let i = 0; i < 500; i++) await turn(i);
+         parentPort.postMessage({ iterations: 500, elapsedMs: performance.now() - start,
+           checksum: payload[0] + payload.length });
+         parentPort.close();
+       });
+     })().catch(error => { throw error; });`,
+    { eval: true },
+  );
+  let measured;
+  await new Promise((resolve, reject) => {
+    let cpu;
+    worker.on("error", reject);
+    worker.on("message", message => {
+      if (message === "ready") {
+        cpu = process.cpuUsage();
+        worker.postMessage("go");
+      } else {
+        measured = { ...message, cpuMs: cpuMs(process.cpuUsage(cpu)) };
+      }
+    });
+    worker.on("exit", code => {
+      if (code !== 0 || !measured) reject(new Error(`Worker exited with ${code} before completing the workload`));
+      else resolve();
+    });
+  });
+  assert.equal(measured.checksum, 524288 + 499);
+  return measured;
+}
+
+if (process.argv[2] === "--case") {
+  console.log(JSON.stringify(await measure(process.argv[3])));
+} else {
+  const [baselineArg, candidateArg, outputArg] = process.argv.slice(2);
+  assert(baselineArg && candidateArg && outputArg, "Expected baseline, candidate, and output directory");
+  const output = resolve(outputArg);
+  assert(!existsSync(output), "Use a fresh output directory to preserve every comparison");
+  mkdirSync(output, { recursive: true });
+  const baseEnv = { ...process.env, BUN_RUNTIME_TRANSPILER_CACHE_PATH: "0", NO_COLOR: "1" };
+  for (const key of ["NODE_OPTIONS", "BUN_OPTIONS", "BUN_DIAG_ASYNC_GC_CLEAR", "BUN_GC_TIMER_DISABLE",
+    "BUN_GC_TIMER_INTERVAL", "BUN_IDLE_GC_SECONDS", "BUN_GARBAGE_COLLECTOR_LEVEL", "BUN_TEST_DRAIN_EVENT_LOOP"])
+    delete baseEnv[key];
+  const binaries = { baseline: resolve(baselineArg), candidate: resolve(candidateArg) };
+  const identities = Object.fromEntries(Object.entries(binaries).map(([label, exe]) => {
+    const child = spawnSync(exe, ["-p", "JSON.stringify({revision:Bun.revision,webkit:process.versions.webkit,arch:process.arch})"],
+      { env: baseEnv, encoding: "utf8" });
+    assert.equal(child.status, 0, child.stderr);
+    return [label, { ...JSON.parse(child.stdout), sha256: createHash("sha256").update(readFileSync(exe)).digest("hex") }];
+  }));
+  assert.notEqual(identities.baseline.sha256, identities.candidate.sha256, "Select two distinct executables");
+  assert.equal(identities.baseline.arch, arch());
+  assert.equal(identities.candidate.arch, arch());
+  const result = { platform: platform(), arch: arch(), cpu: cpus()[0].model, identities, trials: [], summaries: {} };
+  const save = () => writeFileSync(join(output, "results.json"), JSON.stringify(result, null, 2) + "\n");
+  save();
+  const median = values => {
+    const sorted = [...values].sort((a, b) => a - b);
+    return (sorted[4] + sorted[5]) / 2;
+  };
+  for (const name of ["gc-loop", "idle-worker"]) {
+    for (let round = 1; round <= 10; round++) {
+      for (const label of round % 2 ? ["baseline", "candidate"] : ["candidate", "baseline"]) {
+        const dir = join(output, `${name}-${round}-${label}`);
+        mkdirSync(join(dir, "home"), { recursive: true, mode: 0o700 });
+        mkdirSync(join(dir, "tmp"), { mode: 0o700 });
+        const env = { ...baseEnv, HOME: join(dir, "home"), TMPDIR: join(dir, "tmp"),
+          BUN_GC_TIMER_DISABLE: name === "gc-loop" ? "1" : "0", BUN_GC_TIMER_INTERVAL: "1",
+          BUN_IDLE_GC_SECONDS: "1,2", BUN_GC_RUNS_UNTIL_SKIP_RELEASE_ACCESS: "0" };
+        if (name === "idle-worker") env.BUN_JSC_numberOfGCMarkers = "2";
+        const child = spawnSync(binaries[label], [script, "--case", name],
+          { env, encoding: "utf8", timeout: 120000, maxBuffer: 1024 * 1024 });
+        writeFileSync(join(dir, "stdout.log"), child.stdout ?? "");
+        writeFileSync(join(dir, "stderr.log"), child.stderr ?? "");
+        assert.equal(child.status, 0, child.error?.message ?? child.stderr);
+        const measurement = JSON.parse(child.stdout);
+        assert(Number.isFinite(measurement.elapsedMs) && measurement.elapsedMs > 0);
+        assert(Number.isFinite(measurement.cpuMs) && measurement.cpuMs > 0);
+        result.trials.push({ name, round, label, ...measurement });
+        save();
+        console.log(JSON.stringify(result.trials.at(-1)));
+      }
+    }
+    const rows = label => result.trials.filter(t => t.name === name && t.label === label);
+    const summary = {};
+    for (const metric of ["elapsedMs", "cpuMs"]) {
+      const baseline = rows("baseline"), candidate = rows("candidate");
+      summary[metric] = { baselineMedian: median(baseline.map(t => t[metric])),
+        candidateMedian: median(candidate.map(t => t[metric])),
+        pairedMedianRatio: median(candidate.map((t, i) => t[metric] / baseline[i][metric])) };
+    }
+    // Idle wall time includes intentional parking; CPU time exposes the collection cost.
+    summary.primaryMetric = name === "idle-worker" ? "cpuMs" : "elapsedMs";
+    summary.passed = summary[summary.primaryMetric].pairedMedianRatio <= 1.02;
+    result.summaries[name] = summary;
+    save();
+  }
+  console.log(JSON.stringify(result.summaries, null, 2));
+  assert(Object.values(result.summaries).every(summary => summary.passed), "Async GC cost exceeded 1.02");
+}

docs/runtime/nodejs-compat.mdx

@@ -365,7 +365,7 @@ Queued worker stdout and stderr are delivered before the worker's `exit` event,
 
 `worker.getHeapStatistics()` takes an owning-thread snapshot while a worker is idle, executing JavaScript, or blocked in `Atomics.wait()`. The snapshot includes freshly allocated external storage. Inspection preserves the atomic wait and pending requests settle if the worker exits.
 
-Immediate engine GC timers wake idle workers when scheduled. These native wakeups do not keep a worker alive.
+Immediate engine GC timers wake idle workers when scheduled. Asynchronous GC requests clear dead native stack slots so those collections can finalize unreachable objects after `Bun.gc(false)`, including on Windows ARM64. These native wakeups do not keep a worker alive.
 
 Worker teardown avoids an extra full collection before final heap destruction. Native cleanup hooks and registered finalizers still run before the exit is acknowledged.
 

src/jsc/bindings/bindings.cpp

@@ -20,6 +20,7 @@
 #include "JavaScriptCore/JSType.h"
 #include "JavaScriptCore/NumberObject.h"
 #include "JavaScriptCore/JSCJSValue.h"
+#include "JavaScriptCore/EnsureStillAliveHere.h"
 #include "JavaScriptCore/JSGlobalObject.h"
 #include "JavaScriptCore/JSPromiseConstructor.h"
 #include "JavaScriptCore/DeleteAllCodeEffort.h"
@@ -110,6 +111,7 @@
 #include "wtf/Assertions.h"
 #include "wtf/Compiler.h"
 #include "wtf/StackCheck.h"
+#include "wtf/StdLibExtras.h"
 #include "wtf/text/ExternalStringImpl.h"
 #include "wtf/text/OrdinalNumber.h"
 #include "wtf/text/StringCommon.h"
@@ -3114,9 +3116,13 @@ void JSC__JSGlobalObject__deleteModuleRegistryEntry(JSC::JSGlobalObject* global,
     global->moduleLoader()->removeEntry(identifier); // takes the loader's cellLock itself
 }
 
+static NEVER_INLINE SUPPRESS_ASAN void clearStackBelowCaller();
+
 void JSC__VM__collectAsync(JSC::VM* vm, bool full)
 {
     JSC::JSLockHolder lock(*vm);
+    // As in runGC, dead native stack slots must not retain cells in the requested collection.
+    clearStackBelowCaller();
     if (full)
         vm->heap.collectAsync(JSC::CollectionScope::Full);
     else
@@ -3145,6 +3151,7 @@ void JSC__VM__collectAsyncIdle(JSC::VM* vm)
     }
     request.didFinishEndPhase = clientData->idleCollectionDidFinish;
     clientData->idleCollectionsPending.fetch_add(1);
+    clearStackBelowCaller();
     vm->heap.collectAsync(request);
 }
 
@@ -4950,15 +4957,15 @@ void JSC__VM__completeAllJITPlans(JSC::VM* vm)
     vm->heap.completeAllJITPlans();
 }
 
-// A mitigation, not an exact fix: zeroes a fixed amount of dead stack between the heap iteration and the collection in
-// JSC__VM__runGC. Zeroing dead stack cannot free anything live; the worst it can do is not help.
+// A mitigation, not an exact fix: zeroes a fixed amount of dead stack before an asynchronous request or between the heap
+// iteration and collection in JSC__VM__runGC. Zeroing dead stack cannot free anything live; the worst it can do is not help.
 //
 // What it is for: deleteAllUnlinkedCodeBlocks() stops the allocators to iterate the heap, and prologues under
 // MarkedBlock::Handle::stopAllocating() spill a register holding a free list's sentinel (the address of the first cell
 // allocated from its last interval, plus 1). The collector's frames are then built over those words without writing
 // every slot, and the conservative scan covers those frames, so that one cell, dead or not, survives the collection.
 // Nothing leaks (the next collection frees it), but a test that expects Bun.gc(true) to collect an object it just
-// dropped fails: node-sqlite.test.ts did on x64 ASAN. It has not been seen in a release build.
+// dropped fails: node-sqlite.test.ts did on x64 ASAN. Asynchronous worker finalization also needs this in release builds.
 //
 // The sizes: only the stack between JSC__VM__runGC and callWithCurrentThreadState(), where the collector captures the
 // stack, is scanned. Measured on x64, that is 0.6 KB in a release build and 1.8 KB under ASAN; the sizes below are a
@@ -4972,9 +4979,10 @@ static NEVER_INLINE SUPPRESS_ASAN void clearStackBelowCaller()
 #else
     constexpr size_t size = 2 * 1024;
 #endif
-    volatile char dead[size];
-    for (size_t i = 0; i < size; ++i)
-        dead[i] = 0;
+    char dead[size];
+    WTF::secureZeroBytes(dead);
+    // A memory clobber alone can discard writes to an unescaped local buffer.
+    JSC::ensureStillAliveHere(dead);
 }
 
 size_t JSC__VM__runGC(JSC::VM* vm, bool sync)

test/js/node/worker_threads/worker-track-unmanaged-fds.test.ts

@@ -242,12 +242,13 @@ describe.concurrent.skipIf(isWindows)("Worker trackUnmanagedFds", () => {
     const worker =
       `const fs = require("node:fs");` +
       `const { parentPort, workerData } = require("node:worker_threads");` +
+      `globalThis.streams = []; let reading = 0;` +
       `for (let i = 0; i < 10; i++) {` +
       `  const r = fs.createReadStream(workerData, { highWaterMark: 1024 });` +
-      `  r.on("data", () => {});` +
+      `  globalThis.streams.push(r);` +
+      `  r.once("data", () => { r.pause(); if (++reading === 10) parentPort.postMessage("ready"); });` +
       `}` +
       `parentPort.on("message", () => parentPort.postMessage("reading"));` +
-      `parentPort.postMessage("ready");` +
       `setInterval(() => {}, 1e9);`;
     const fixture = `
       const { Worker } = require("node:worker_threads");
@@ -260,7 +261,7 @@ describe.concurrent.skipIf(isWindows)("Worker trackUnmanagedFds", () => {
       (async () => {
         const w = new Worker(${JSON.stringify(worker)}, { eval: true, workerData: target });
         await new Promise((res, rej) => { w.once("message", res); w.once("error", rej); });
-        // Round-trip once more so the streams have had a tick to open.
+        // Every stream has read and paused, so scheduling cannot drain them before the fd snapshot.
         w.postMessage("go");
         await new Promise((res, rej) => { w.once("message", res); w.once("error", rej); });
         const during = openFds(ino);