From cb749736c8f7ea49c6f7add9b73a99946734b4f1 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sat, 15 Aug 2026 08:12:08 +0000
Subject: [PATCH 1/7] bake: check for exceptions in the production build's
 module helpers

BakeGetModuleNamespace, BakeGetDefaultExportFromModule,
BakeGetOnModuleNamespace and BakeLoadModuleByKey called throwing JSC
APIs (getModuleNamespaceObject, JSObject::get, loadAndEvaluateModule)
without a throw scope or an exception check, and production.rs used
their results without checking either, so every bun build --app aborted
under BUN_JSC_validateExceptionChecks=1 while loading the config file.
bakeModuleLoaderImportModule returned JSC::importModule's result from
inside a scope it never released, which aborted the same way once a
bundled module called import(). BakeLoadInitialServerCode returned the
runtime init function's (undefined) result when it threw, so its Rust
caller could not see the exception.

Give each helper a throw scope, return empty iff an exception is
pending, wrap them in from_js_host_call on the Rust side and propagate
the error. Take production.test.ts off the exception validation skip
list and add validated builds covering the config and prerender paths.
---
 src/runtime/bake/BakeGlobalObject.cpp   |  21 ++--
 src/runtime/bake/BakeSourceProvider.cpp |  66 ++++++++---
 src/runtime/bake/production.rs          | 148 ++++++++++++++----------
 test/bake/dev/production.test.ts        |  95 ++++++++++++++-
 test/no-validate-exceptions.txt         |   1 -
 5 files changed, 240 insertions(+), 91 deletions(-)

diff --git a/src/runtime/bake/BakeGlobalObject.cpp b/src/runtime/bake/BakeGlobalObject.cpp
index 766b100614fe..3baabb02962f 100644
--- a/src/runtime/bake/BakeGlobalObject.cpp
+++ b/src/runtime/bake/BakeGlobalObject.cpp
@@ -22,35 +22,36 @@ bakeModuleLoaderImportModule(JSC::JSGlobalObject* global,
     bool deferred)
 {
     UNUSED_PARAM(deferred);
+    auto& vm = JSC::getVM(global);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // Returning nullptr with an exception pending is fine: globalFuncImportModule rejects the import() promise with it.
     WTF::String keyString = moduleNameValue->getString(global);
+    RETURN_IF_EXCEPTION(scope, nullptr);
     if (keyString.startsWith("bake:/"_s)) {
-        auto& vm = JSC::getVM(global);
-        return JSC::importModule(global, JSC::Identifier::fromString(vm, keyString),
-            JSC::Identifier(), WTF::move(parameters), nullptr);
+        RELEASE_AND_RETURN(scope, JSC::importModule(global, JSC::Identifier::fromString(vm, keyString),
+            JSC::Identifier(), WTF::move(parameters), nullptr));
     }
 
     if (!sourceOrigin.isNull() && sourceOrigin.string().startsWith("bake:/"_s)) {
-        auto& vm = JSC::getVM(global);
-        auto scope = DECLARE_THROW_SCOPE(vm);
-
         WTF::String refererString = sourceOrigin.string();
-        WTF::String keyString = moduleNameValue->getString(global);
 
         if (!keyString) {
             auto promise = JSC::JSPromise::create(vm, global->promiseStructure());
             promise->reject(vm, JSC::createError(global, "import() requires a string"_s));
+            RETURN_IF_EXCEPTION(scope, nullptr);
             return promise;
         }
 
         BunString result = BakeProdResolve(global, Bun::toString(refererString), Bun::toString(keyString));
         RETURN_IF_EXCEPTION(scope, nullptr);
 
-        return JSC::importModule(global, JSC::Identifier::fromString(vm, result.toWTFString()),
-            JSC::Identifier(), WTF::move(parameters), nullptr);
+        RELEASE_AND_RETURN(scope, JSC::importModule(global, JSC::Identifier::fromString(vm, result.toWTFString()),
+            JSC::Identifier(), WTF::move(parameters), nullptr));
     }
 
     // TODO: make static cast instead of jscast
-    return uncheckedDowncast<Zig::GlobalObject>(global)->moduleLoaderImportModule(global, moduleLoader, moduleNameValue, WTF::move(parameters), sourceOrigin, false);
+    RELEASE_AND_RETURN(scope, uncheckedDowncast<Zig::GlobalObject>(global)->moduleLoaderImportModule(global, moduleLoader, moduleNameValue, WTF::move(parameters), sourceOrigin, false));
 }
 
 JSC::Identifier bakeModuleLoaderResolve(JSC::JSGlobalObject* jsGlobal,
diff --git a/src/runtime/bake/BakeSourceProvider.cpp b/src/runtime/bake/BakeSourceProvider.cpp
index b337c9f3f218..2963d7c56480 100644
--- a/src/runtime/bake/BakeSourceProvider.cpp
+++ b/src/runtime/bake/BakeSourceProvider.cpp
@@ -24,6 +24,8 @@ extern "C" BunString BakeSourceProvider__getSourceSlice(SourceProvider* provider
     return Bun::toStringView(provider->source());
 }
 
+// Rust calls the EncodedJSValue-returning functions below via `jsc::from_js_host_call`: empty return <=> exception pending.
+
 extern "C" JSC::EncodedJSValue BakeLoadInitialServerCode(JSC::JSGlobalObject* global, BunString source, bool separateSSRGraph) {
   auto& vm = JSC::getVM(global);
   auto scope = DECLARE_THROW_SCOPE(vm);
@@ -51,11 +53,24 @@ extern "C" JSC::EncodedJSValue BakeLoadInitialServerCode(JSC::JSGlobalObject* gl
   args.append(JSC::jsBoolean(separateSSRGraph)); // separateSSRGraph
   args.append(Zig::ImportMetaObject::create(global, "bake://server-runtime.js"_s)); // importMeta
 
-  RELEASE_AND_RETURN(scope, JSC::JSValue::encode(JSC::profiledCall(global, JSC::ProfilingReason::API, fn, callData, JSC::jsUndefined(), args)));
+  // `JSC::call` returns undefined (not empty) when the callee throws.
+  JSC::JSValue result = JSC::profiledCall(global, JSC::ProfilingReason::API, fn, callData, JSC::jsUndefined(), args);
+  RETURN_IF_EXCEPTION(scope, {});
+  return JSC::JSValue::encode(result);
 }
 
-extern "C" JSC::JSPromise* BakeLoadModuleByKey(GlobalObject* global, JSC::JSString* key) {
-  return JSC::loadAndEvaluateModule(global, key->getString(global), nullptr, nullptr);
+extern "C" JSC::EncodedJSValue BakeLoadModuleByKey(GlobalObject* global, JSC::EncodedJSValue keyValue) {
+  auto& vm = JSC::getVM(global);
+  auto scope = DECLARE_THROW_SCOPE(vm);
+
+  JSC::JSString* key = uncheckedDowncast<JSC::JSString>(JSC::JSValue::decode(keyValue));
+  String keyString = key->getString(global);
+  RETURN_IF_EXCEPTION(scope, {});
+
+  JSC::JSPromise* promise = JSC::loadAndEvaluateModule(global, keyString, nullptr, nullptr);
+  RETURN_IF_EXCEPTION(scope, {});
+  ASSERT(promise);
+  return JSC::JSValue::encode(promise);
 }
 
 extern "C" JSC::EncodedJSValue BakeLoadServerHmrPatch(GlobalObject* global, BunString source) {
@@ -108,42 +123,63 @@ extern "C" JSC::EncodedJSValue BakeLoadServerHmrPatchWithSourceMap(GlobalObject*
   return JSC::JSValue::encode(result);
 }
 
-extern "C" JSC::EncodedJSValue BakeGetModuleNamespace(
-  JSC::JSGlobalObject* global,
-  JSC::JSValue keyValue
-) {
-  JSC::JSString* key = uncheckedDowncast<JSC::JSString>(keyValue);
+// Returns nullptr if and only if an exception is pending.
+static JSC::JSModuleNamespaceObject* getModuleNamespace(JSC::JSGlobalObject* global, JSC::JSValue keyValue) {
   auto& vm = JSC::getVM(global);
+  auto scope = DECLARE_THROW_SCOPE(vm);
+
+  JSC::JSString* key = uncheckedDowncast<JSC::JSString>(keyValue);
   auto keyIdent = JSC::Identifier::fromString(vm, key->value(global));
+  RETURN_IF_EXCEPTION(scope, nullptr);
+
   auto* entry = global->moduleLoader()->registryEntry(keyIdent);
-  ASSERT(entry); // should have called BakeLoadServerCode and wait for that promise
+  ASSERT(entry); // should have called BakeLoadModuleByKey and waited for that promise
   auto* module = entry ? entry->record() : nullptr;
   ASSERT(module);
   JSC::JSModuleNamespaceObject* namespaceObject = global->moduleLoader()->getModuleNamespaceObject(global, module);
+  RETURN_IF_EXCEPTION(scope, nullptr);
   ASSERT(namespaceObject);
-  return JSC::JSValue::encode(namespaceObject);
+  return namespaceObject;
+}
+
+extern "C" JSC::EncodedJSValue BakeGetModuleNamespace(
+  JSC::JSGlobalObject* global,
+  JSC::EncodedJSValue keyValue
+) {
+  return JSC::JSValue::encode(getModuleNamespace(global, JSC::JSValue::decode(keyValue)));
 }
 
 extern "C" JSC::EncodedJSValue BakeGetDefaultExportFromModule(
   JSC::JSGlobalObject* global,
-  JSC::JSValue keyValue
+  JSC::EncodedJSValue keyValue
 ) {
   auto& vm = JSC::getVM(global);
-  return JSC::JSValue::encode(uncheckedDowncast<JSC::JSModuleNamespaceObject>(JSC::JSValue::decode(BakeGetModuleNamespace(global, keyValue)))->get(global, vm.propertyNames->defaultKeyword));
+  auto scope = DECLARE_THROW_SCOPE(vm);
+
+  JSC::JSModuleNamespaceObject* namespaceObject = getModuleNamespace(global, JSC::JSValue::decode(keyValue));
+  RETURN_IF_EXCEPTION(scope, {});
+
+  JSC::JSValue defaultExport = namespaceObject->get(global, vm.propertyNames->defaultKeyword);
+  RETURN_IF_EXCEPTION(scope, {});
+  return JSC::JSValue::encode(defaultExport);
 }
 
-// There were issues when trying to use JSValue.get from zig
 extern "C" JSC::EncodedJSValue BakeGetOnModuleNamespace(
   JSC::JSGlobalObject* global,
-  JSC::JSModuleNamespaceObject* moduleNamespace,
+  JSC::EncodedJSValue moduleNamespaceValue,
   const unsigned char* key,
   size_t keyLength
 ) {
   auto& vm = JSC::getVM(global);
+  auto scope = DECLARE_THROW_SCOPE(vm);
+
+  auto* moduleNamespace = uncheckedDowncast<JSC::JSModuleNamespaceObject>(JSC::JSValue::decode(moduleNamespaceValue));
   const auto propertyString = String(StringImpl::createWithoutCopying({ key, keyLength }));
   const auto identifier = JSC::Identifier::fromString(vm, propertyString);
   const auto property = JSC::PropertyName(identifier);
-  return JSC::JSValue::encode(moduleNamespace->get(global, property));
+  JSC::JSValue value = moduleNamespace->get(global, property);
+  RETURN_IF_EXCEPTION(scope, {});
+  return JSC::JSValue::encode(value);
 }
 
 extern "C" JSC::EncodedJSValue BakeRegisterProductionChunk(JSC::JSGlobalObject* global, BunString virtualPathName, BunString source) {
diff --git a/src/runtime/bake/production.rs b/src/runtime/bake/production.rs
index 81c32d956928..977d202156a9 100644
--- a/src/runtime/bake/production.rs
+++ b/src/runtime/bake/production.rs
@@ -355,10 +355,11 @@ fn build_with_vm(ctx: Context, cwd: &[u8], pt: &mut PerThread) -> crate::Result<
     {
         Unwrapped::Pending => unreachable!(),
         Unwrapped::Fulfilled(_) => {
-            let default = BakeGetDefaultExportFromModule(
+            let default = c::bake_get_default_export_from_module(
                 global,
                 config_entry_point_string.to_js(global).map_err(js_err)?,
-            );
+            )
+            .map_err(js_err)?;
 
             if !default.is_object() {
                 return Err(js_err(global.throw_invalid_arguments(format_args!(
@@ -843,17 +844,10 @@ fn build_with_vm(ctx: Context, cwd: &[u8], pt: &mut PerThread) -> crate::Result<
 
         let server_file = router_type.server_file;
         let server_entry_point = pt.load_bundled_module(server_file)?;
-        let server_render_func = 'brk: {
-            let Some(raw) = bake_get_on_module_namespace(global, server_entry_point, b"prerender")
-            else {
-                break 'brk None;
-            };
-            if !raw.is_callable() {
-                break 'brk None;
-            }
-            break 'brk Some(raw);
-        };
-        let Some(server_render_func) = server_render_func else {
+        let server_render_func =
+            c::bake_get_on_module_namespace(global, server_entry_point, b"prerender")
+                .map_err(js_err)?;
+        if !server_render_func.is_callable() {
             bun_core::err_generic!("Framework does not support static site generation");
             bun_core::note!(
                 "The file {} is missing the \"prerender\" export, which defines how to generate static files.",
@@ -863,34 +857,23 @@ fn build_with_vm(ctx: Context, cwd: &[u8], pt: &mut PerThread) -> crate::Result<
                 ))
             );
             Global::crash();
-        };
+        }
 
         let server_param_func = if router.dynamic_routes.count() > 0 {
-            let f = 'brk: {
-                let Some(raw) =
-                    bake_get_on_module_namespace(global, server_entry_point, b"getParams")
-                else {
-                    break 'brk None;
-                };
-                if !raw.is_callable() {
-                    break 'brk None;
-                }
-                break 'brk Some(raw);
-            };
-            match f {
-                Some(f) => f,
-                None => {
-                    bun_core::err_generic!("Framework does not support static site generation");
-                    bun_core::note!(
-                        "The file {} is missing the \"getParams\" export, which defines how to generate static files.",
-                        bun_core::fmt::quote(resolve_path::relative(
-                            cwd,
-                            pt.input_file(server_file).abs_path()
-                        ))
-                    );
-                    Global::crash();
-                }
+            let f = c::bake_get_on_module_namespace(global, server_entry_point, b"getParams")
+                .map_err(js_err)?;
+            if !f.is_callable() {
+                bun_core::err_generic!("Framework does not support static site generation");
+                bun_core::note!(
+                    "The file {} is missing the \"getParams\" export, which defines how to generate static files.",
+                    bun_core::fmt::quote(resolve_path::relative(
+                        cwd,
+                        pt.input_file(server_file).abs_path()
+                    ))
+                );
+                Global::crash();
             }
+            f
         } else {
             JSValue::NULL
         };
@@ -1225,7 +1208,7 @@ fn load_module(
     global: &JSGlobalObject,
     key: JSValue,
 ) -> crate::Result<JSValue> {
-    let promise_value = BakeLoadModuleByKey(global, key);
+    let promise_value = c::bake_load_module_by_key(global, key).map_err(js_err)?;
     let promise: *mut jsc::JSInternalPromise = match promise_value.as_any_promise().unwrap() {
         AnyPromise::Internal(p) => p,
         AnyPromise::Normal(_) => unreachable!(),
@@ -1252,38 +1235,75 @@ fn load_module(
     let jsc_vm = vm_ref.as_mut().jsc_vm_mut();
     match jsc::JSInternalPromise::opaque_mut(promise).unwrap(jsc_vm, UnwrapMode::MarkHandled) {
         Unwrapped::Pending => unreachable!(),
-        Unwrapped::Fulfilled(_) => Ok(BakeGetModuleNamespace(global, key)),
+        Unwrapped::Fulfilled(_) => c::bake_get_module_namespace(global, key).map_err(js_err),
         Unwrapped::Rejected(err) => Err(js_err(vm_ref.global().throw_value(err))),
     }
 }
 
-// extern apis:
+/// BakeSourceProvider.cpp entry points; each returns empty iff it threw, as
+/// `from_js_host_call` requires.
+mod c {
+    use super::*;
 
-unsafe extern "C" {
-    safe fn BakeGetDefaultExportFromModule(global: &JSGlobalObject, key: JSValue) -> JSValue;
-    safe fn BakeGetModuleNamespace(global: &JSGlobalObject, key: JSValue) -> JSValue;
-    safe fn BakeLoadModuleByKey(global: &JSGlobalObject, key: JSValue) -> JSValue;
-}
+    /// Returns the promise for loading and evaluating the module named by the `key` JSString.
+    pub(super) fn bake_load_module_by_key(
+        global: &JSGlobalObject,
+        key: JSValue,
+    ) -> JsResult<JSValue> {
+        unsafe extern "C" {
+            safe fn BakeLoadModuleByKey(global: &JSGlobalObject, key: JSValue) -> JSValue;
+        }
+        jsc::from_js_host_call(global, || BakeLoadModuleByKey(global, key))
+    }
 
-fn bake_get_on_module_namespace(
-    global: &JSGlobalObject,
-    module: JSValue,
-    property: &[u8],
-) -> Option<JSValue> {
-    unsafe extern "C" {
-        // PRECONDITION: `ptr` must be readable for `len` bytes (C++ builds an
-        // `Identifier` from the slice). Cannot be `safe fn` — raw ptr+len pair
-        // carries a caller-side validity precondition.
-        #[link_name = "BakeGetOnModuleNamespace"]
-        fn f(global: *const JSGlobalObject, module: JSValue, ptr: *const u8, len: usize)
-        -> JSValue;
+    /// The module's promise from [`bake_load_module_by_key`] must already be fulfilled.
+    pub(super) fn bake_get_module_namespace(
+        global: &JSGlobalObject,
+        key: JSValue,
+    ) -> JsResult<JSValue> {
+        unsafe extern "C" {
+            safe fn BakeGetModuleNamespace(global: &JSGlobalObject, key: JSValue) -> JSValue;
+        }
+        jsc::from_js_host_call(global, || BakeGetModuleNamespace(global, key))
+    }
+
+    /// The module's evaluation promise must already be fulfilled.
+    pub(super) fn bake_get_default_export_from_module(
+        global: &JSGlobalObject,
+        key: JSValue,
+    ) -> JsResult<JSValue> {
+        unsafe extern "C" {
+            safe fn BakeGetDefaultExportFromModule(
+                global: &JSGlobalObject,
+                key: JSValue,
+            ) -> JSValue;
+        }
+        jsc::from_js_host_call(global, || BakeGetDefaultExportFromModule(global, key))
+    }
+
+    /// `module_namespace` comes from [`bake_get_module_namespace`].
+    pub(super) fn bake_get_on_module_namespace(
+        global: &JSGlobalObject,
+        module_namespace: JSValue,
+        property: &[u8],
+    ) -> JsResult<JSValue> {
+        unsafe extern "C" {
+            // PRECONDITION: `ptr` must be readable for `len` bytes (C++ builds an
+            // `Identifier` from the slice). Cannot be `safe fn` — raw ptr+len pair
+            // carries a caller-side validity precondition.
+            fn BakeGetOnModuleNamespace(
+                global: &JSGlobalObject,
+                module_namespace: JSValue,
+                ptr: *const u8,
+                len: usize,
+            ) -> JSValue;
+        }
+        // SAFETY: `property.as_ptr()`/`len()` describe a borrowed `&[u8]` that
+        // outlives the call, which discharges the ptr+len precondition above.
+        jsc::from_js_host_call(global, || unsafe {
+            BakeGetOnModuleNamespace(global, module_namespace, property.as_ptr(), property.len())
+        })
     }
-    // SAFETY: `global` is a live `&JSGlobalObject`, `module` is a stack-held
-    // `JSValue`, and `property.as_ptr()`/`len()` describe a valid borrowed
-    // `&[u8]` for the call duration — discharges the ptr+len precondition above.
-    let result: JSValue = unsafe { f(global, module, property.as_ptr(), property.len()) };
-    debug_assert!(!result.is_empty());
-    Some(result)
 }
 
 // Renders all routes for static site generation by calling the JavaScript implementation.
diff --git a/test/bake/dev/production.test.ts b/test/bake/dev/production.test.ts
index 1335e3244c00..5386e00b3a7e 100644
--- a/test/bake/dev/production.test.ts
+++ b/test/bake/dev/production.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { existsSync } from "fs";
-import { bunEnv, bunExe } from "harness";
+import { bunEnv, bunExe, tempDir } from "harness";
 import path from "path";
 import { tempDirWithBakeDeps } from "../bake-harness";
 
@@ -594,4 +594,97 @@ export default function IndexPage() {
     // Verify NO JavaScript imports are included in the HTML
     expect(htmlContent).not.toContain('<script type="module"');
   });
+
+  // BUN_JSC_validateExceptionChecks=1 aborts the child on the first JSC call whose
+  // exception state goes unchecked. Debug and ASAN builds enforce it; release builds
+  // ignore the option, so there these only check that the build succeeds.
+  describe("exception checks", () => {
+    async function buildApp(cwd: string, ...args: string[]) {
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), "build", "--app", ...args],
+        cwd,
+        env: { ...bunEnv, BUN_JSC_validateExceptionChecks: "1", BUN_JSC_dumpSimulatedThrows: "1" },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      // The validator's report names the scope that can throw and the scope that failed to
+      // check it; surfacing those two lines makes a failure point at the offending call.
+      const uncheckedScopes = stderr
+        .split("\n")
+        .map(line => line.trim())
+        .filter(line => line.startsWith("This scope can throw") || line.startsWith("But the exception was unchecked"));
+      return { stdout, exitCode, signalCode: proc.signalCode, uncheckedScopes };
+    }
+
+    test("loading the config file", async () => {
+      // No routes directory, so the build stops after reading the config's default export
+      // (BakeGetDefaultExportFromModule) and bundles nothing.
+      using dir = tempDir("bake-production-validate-config", {
+        "bun.app.ts": `export default {
+          app: {
+            framework: {
+              fileSystemRouterTypes: [{ root: "routes", style: "nextjs-pages", serverEntryPoint: "./server.ts" }],
+            },
+          },
+        };`,
+        "server.ts": `export function render() { return new Response("unused"); }`,
+      });
+
+      const { stdout, exitCode, signalCode, uncheckedScopes } = await buildApp(String(dir));
+      expect({ stdout, exitCode, signalCode, uncheckedScopes }).toEqual({
+        stdout: "done\n",
+        exitCode: 0,
+        signalCode: null,
+        uncheckedScopes: [],
+      });
+    });
+
+    test("loading the server entry point and prerendering routes", async () => {
+      // Reaches the rest of the production path: the server entry point is loaded
+      // (BakeLoadModuleByKey, BakeGetModuleNamespace), its prerender and getParams
+      // exports are read (BakeGetOnModuleNamespace), and rendering import()s the
+      // bundled modules through Bake::GlobalObject's module loader hooks. The client
+      // component matters: server-side rendering it is what makes a bundled "bake:/"
+      // module itself call import(), the hook's second branch.
+      const dir = await tempDirWithBakeDeps("bake-production-validate-prerender", {
+        "src/index.tsx": `export default { app: { framework: "react" } };`,
+        "pages/index.tsx": `import Greeting from "../components/Greeting";
+
+export default function IndexPage() {
+  return (
+    <main>
+      <h1>Static Home</h1>
+      <Greeting />
+    </main>
+  );
+}`,
+        "components/Greeting.tsx": `"use client";
+
+export default function Greeting() {
+  return <p>Hello from the client</p>;
+}`,
+        "pages/posts/[slug].tsx": `export default function Post({ params }) {
+  return <h1>{"Post " + params.slug}</h1>;
+}
+
+export function getStaticPaths() {
+  return { paths: [{ params: { slug: "first" } }, { params: { slug: "second" } }], fallback: false };
+}`,
+      });
+
+      const { exitCode, signalCode, uncheckedScopes } = await buildApp(dir, "./src/index.tsx");
+      expect({ exitCode, signalCode, uncheckedScopes }).toEqual({ exitCode: 0, signalCode: null, uncheckedScopes: [] });
+
+      const rendered = await Promise.all(
+        ["index.html", "posts/first/index.html", "posts/second/index.html"].map(file =>
+          Bun.file(path.join(dir, "dist", file)).text(),
+        ),
+      );
+      expect(rendered[0]).toContain("<h1>Static Home</h1>");
+      expect(rendered[0]).toContain("<p>Hello from the client</p>");
+      expect(rendered[1]).toContain("<h1>Post first</h1>");
+      expect(rendered[2]).toContain("<h1>Post second</h1>");
+    });
+  });
 });
diff --git a/test/no-validate-exceptions.txt b/test/no-validate-exceptions.txt
index 62ca171731f6..4de031172d57 100644
--- a/test/no-validate-exceptions.txt
+++ b/test/no-validate-exceptions.txt
@@ -1,7 +1,6 @@
 # List of tests for which we do NOT set validateExceptionChecks=1 when running in ASAN CI
 
 # List of tests that potentially throw inside of reifyStaticProperties
-test/bake/dev/production.test.ts
 test/cli/install/bun-install-lifecycle-scripts.test.ts
 test/integration/vite-build/vite-build.test.ts
 test/js/bun/resolve/import-meta.test.js

From ab5fe2469c75a0752653c71dbcb1d1a095d5ac29 Mon Sep 17 00:00:00 2001
From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com>
Date: Sat, 15 Aug 2026 08:16:11 +0000
Subject: [PATCH 2/7] [autofix.ci] apply automated fixes

---
 src/runtime/bake/BakeGlobalObject.cpp | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/runtime/bake/BakeGlobalObject.cpp b/src/runtime/bake/BakeGlobalObject.cpp
index 3baabb02962f..e9541b7f5cbe 100644
--- a/src/runtime/bake/BakeGlobalObject.cpp
+++ b/src/runtime/bake/BakeGlobalObject.cpp
@@ -29,8 +29,7 @@ bakeModuleLoaderImportModule(JSC::JSGlobalObject* global,
     WTF::String keyString = moduleNameValue->getString(global);
     RETURN_IF_EXCEPTION(scope, nullptr);
     if (keyString.startsWith("bake:/"_s)) {
-        RELEASE_AND_RETURN(scope, JSC::importModule(global, JSC::Identifier::fromString(vm, keyString),
-            JSC::Identifier(), WTF::move(parameters), nullptr));
+        RELEASE_AND_RETURN(scope, JSC::importModule(global, JSC::Identifier::fromString(vm, keyString), JSC::Identifier(), WTF::move(parameters), nullptr));
     }
 
     if (!sourceOrigin.isNull() && sourceOrigin.string().startsWith("bake:/"_s)) {
@@ -46,8 +45,7 @@ bakeModuleLoaderImportModule(JSC::JSGlobalObject* global,
         BunString result = BakeProdResolve(global, Bun::toString(refererString), Bun::toString(keyString));
         RETURN_IF_EXCEPTION(scope, nullptr);
 
-        RELEASE_AND_RETURN(scope, JSC::importModule(global, JSC::Identifier::fromString(vm, result.toWTFString()),
-            JSC::Identifier(), WTF::move(parameters), nullptr));
+        RELEASE_AND_RETURN(scope, JSC::importModule(global, JSC::Identifier::fromString(vm, result.toWTFString()), JSC::Identifier(), WTF::move(parameters), nullptr));
     }
 
     // TODO: make static cast instead of jscast

From 62666f48d86572314db978ed601a6c2c8ee51e0e Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sat, 15 Aug 2026 08:22:39 +0000
Subject: [PATCH 3/7] bake: declare the production helpers' externs in one
 block

---
 src/runtime/bake/production.rs | 49 +++++++++++++---------------------
 1 file changed, 18 insertions(+), 31 deletions(-)

diff --git a/src/runtime/bake/production.rs b/src/runtime/bake/production.rs
index 977d202156a9..3a6b0dc67cd9 100644
--- a/src/runtime/bake/production.rs
+++ b/src/runtime/bake/production.rs
@@ -1240,66 +1240,53 @@ fn load_module(
     }
 }
 
-/// BakeSourceProvider.cpp entry points; each returns empty iff it threw, as
-/// `from_js_host_call` requires.
+/// BakeSourceProvider.cpp entry points; each returns empty iff it threw (`from_js_host_call`).
 mod c {
     use super::*;
 
-    /// Returns the promise for loading and evaluating the module named by the `key` JSString.
+    unsafe extern "C" {
+        safe fn BakeLoadModuleByKey(global: &JSGlobalObject, key: JSValue) -> JSValue;
+        safe fn BakeGetModuleNamespace(global: &JSGlobalObject, key: JSValue) -> JSValue;
+        safe fn BakeGetDefaultExportFromModule(global: &JSGlobalObject, key: JSValue) -> JSValue;
+        /// Not `safe`: `ptr` must be readable for `len` bytes.
+        fn BakeGetOnModuleNamespace(
+            global: &JSGlobalObject,
+            module_namespace: JSValue,
+            ptr: *const u8,
+            len: usize,
+        ) -> JSValue;
+    }
+
+    /// Returns the promise for evaluating the module that `key` (a JSString) names.
     pub(super) fn bake_load_module_by_key(
         global: &JSGlobalObject,
         key: JSValue,
     ) -> JsResult<JSValue> {
-        unsafe extern "C" {
-            safe fn BakeLoadModuleByKey(global: &JSGlobalObject, key: JSValue) -> JSValue;
-        }
         jsc::from_js_host_call(global, || BakeLoadModuleByKey(global, key))
     }
 
-    /// The module's promise from [`bake_load_module_by_key`] must already be fulfilled.
+    /// The promise from [`bake_load_module_by_key`] for `key` must already be fulfilled.
     pub(super) fn bake_get_module_namespace(
         global: &JSGlobalObject,
         key: JSValue,
     ) -> JsResult<JSValue> {
-        unsafe extern "C" {
-            safe fn BakeGetModuleNamespace(global: &JSGlobalObject, key: JSValue) -> JSValue;
-        }
         jsc::from_js_host_call(global, || BakeGetModuleNamespace(global, key))
     }
 
-    /// The module's evaluation promise must already be fulfilled.
+    /// The module `key` names must already be evaluated (here: the config module).
     pub(super) fn bake_get_default_export_from_module(
         global: &JSGlobalObject,
         key: JSValue,
     ) -> JsResult<JSValue> {
-        unsafe extern "C" {
-            safe fn BakeGetDefaultExportFromModule(
-                global: &JSGlobalObject,
-                key: JSValue,
-            ) -> JSValue;
-        }
         jsc::from_js_host_call(global, || BakeGetDefaultExportFromModule(global, key))
     }
 
-    /// `module_namespace` comes from [`bake_get_module_namespace`].
     pub(super) fn bake_get_on_module_namespace(
         global: &JSGlobalObject,
         module_namespace: JSValue,
         property: &[u8],
     ) -> JsResult<JSValue> {
-        unsafe extern "C" {
-            // PRECONDITION: `ptr` must be readable for `len` bytes (C++ builds an
-            // `Identifier` from the slice). Cannot be `safe fn` — raw ptr+len pair
-            // carries a caller-side validity precondition.
-            fn BakeGetOnModuleNamespace(
-                global: &JSGlobalObject,
-                module_namespace: JSValue,
-                ptr: *const u8,
-                len: usize,
-            ) -> JSValue;
-        }
-        // SAFETY: `property.as_ptr()`/`len()` describe a borrowed `&[u8]` that
-        // outlives the call, which discharges the ptr+len precondition above.
+        // SAFETY: `property` is borrowed for the whole call, so `ptr` is readable for `len` bytes.
         jsc::from_js_host_call(global, || unsafe {
             BakeGetOnModuleNamespace(global, module_namespace, property.as_ptr(), property.len())
         })

From 2861fedf18ec0ded6aaddbb1057e45863dceac8f Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sat, 15 Aug 2026 08:32:02 +0000
Subject: [PATCH 4/7] bake: drop the unreachable null key branch in
 bakeModuleLoaderImportModule

The key string is read once at the top of the function and a throwing
read returns there, so the branch can no longer be entered. Also state
getModuleNamespace's precondition instead of an unconditional iff, and
normalize the config test's stdout.
---
 src/runtime/bake/BakeGlobalObject.cpp   | 8 --------
 src/runtime/bake/BakeSourceProvider.cpp | 4 ++--
 test/bake/dev/production.test.ts        | 6 +++---
 3 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/src/runtime/bake/BakeGlobalObject.cpp b/src/runtime/bake/BakeGlobalObject.cpp
index e9541b7f5cbe..9e368cc5f961 100644
--- a/src/runtime/bake/BakeGlobalObject.cpp
+++ b/src/runtime/bake/BakeGlobalObject.cpp
@@ -34,14 +34,6 @@ bakeModuleLoaderImportModule(JSC::JSGlobalObject* global,
 
     if (!sourceOrigin.isNull() && sourceOrigin.string().startsWith("bake:/"_s)) {
         WTF::String refererString = sourceOrigin.string();
-
-        if (!keyString) {
-            auto promise = JSC::JSPromise::create(vm, global->promiseStructure());
-            promise->reject(vm, JSC::createError(global, "import() requires a string"_s));
-            RETURN_IF_EXCEPTION(scope, nullptr);
-            return promise;
-        }
-
         BunString result = BakeProdResolve(global, Bun::toString(refererString), Bun::toString(keyString));
         RETURN_IF_EXCEPTION(scope, nullptr);
 
diff --git a/src/runtime/bake/BakeSourceProvider.cpp b/src/runtime/bake/BakeSourceProvider.cpp
index 2963d7c56480..a5382ae0a60b 100644
--- a/src/runtime/bake/BakeSourceProvider.cpp
+++ b/src/runtime/bake/BakeSourceProvider.cpp
@@ -123,7 +123,7 @@ extern "C" JSC::EncodedJSValue BakeLoadServerHmrPatchWithSourceMap(GlobalObject*
   return JSC::JSValue::encode(result);
 }
 
-// Returns nullptr if and only if an exception is pending.
+// keyValue must name a module that has already been evaluated; then nullptr means an exception is pending.
 static JSC::JSModuleNamespaceObject* getModuleNamespace(JSC::JSGlobalObject* global, JSC::JSValue keyValue) {
   auto& vm = JSC::getVM(global);
   auto scope = DECLARE_THROW_SCOPE(vm);
@@ -133,7 +133,7 @@ static JSC::JSModuleNamespaceObject* getModuleNamespace(JSC::JSGlobalObject* glo
   RETURN_IF_EXCEPTION(scope, nullptr);
 
   auto* entry = global->moduleLoader()->registryEntry(keyIdent);
-  ASSERT(entry); // should have called BakeLoadModuleByKey and waited for that promise
+  ASSERT(entry); // the caller waited for this module's evaluation promise
   auto* module = entry ? entry->record() : nullptr;
   ASSERT(module);
   JSC::JSModuleNamespaceObject* namespaceObject = global->moduleLoader()->getModuleNamespaceObject(global, module);
diff --git a/test/bake/dev/production.test.ts b/test/bake/dev/production.test.ts
index 5386e00b3a7e..9c37cea72ced 100644
--- a/test/bake/dev/production.test.ts
+++ b/test/bake/dev/production.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { existsSync } from "fs";
-import { bunEnv, bunExe, tempDir } from "harness";
+import { bunEnv, bunExe, normalizeBunSnapshot, tempDir } from "harness";
 import path from "path";
 import { tempDirWithBakeDeps } from "../bake-harness";
 
@@ -632,8 +632,8 @@ export default function IndexPage() {
       });
 
       const { stdout, exitCode, signalCode, uncheckedScopes } = await buildApp(String(dir));
-      expect({ stdout, exitCode, signalCode, uncheckedScopes }).toEqual({
-        stdout: "done\n",
+      expect({ stdout: normalizeBunSnapshot(stdout), exitCode, signalCode, uncheckedScopes }).toEqual({
+        stdout: "done",
         exitCode: 0,
         signalCode: null,
         uncheckedScopes: [],

From 05726ffae425b911922d0df7d75b10477b57dc39 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sat, 15 Aug 2026 12:51:26 +0000
Subject: [PATCH 5/7] bake: release the resolve and fetch hooks' scopes when
 delegating to the regular loader

bakeModuleLoaderResolve and bakeModuleLoaderFetch returned the result of
Zig::GlobalObject's implementation from inside their own throw scopes
without releasing them, so a config import that fails to resolve, or a
route import()ing a file the bundler never saw, aborted under
BUN_JSC_validateExceptionChecks=1 the same way the import hook did. Add
a validated build for each path.
---
 src/runtime/bake/BakeGlobalObject.cpp |  4 +--
 test/bake/dev/production.test.ts      | 39 +++++++++++++++++++++++++--
 2 files changed, 39 insertions(+), 4 deletions(-)

diff --git a/src/runtime/bake/BakeGlobalObject.cpp b/src/runtime/bake/BakeGlobalObject.cpp
index 9e368cc5f961..794e1f4443c2 100644
--- a/src/runtime/bake/BakeGlobalObject.cpp
+++ b/src/runtime/bake/BakeGlobalObject.cpp
@@ -78,7 +78,7 @@ JSC::Identifier bakeModuleLoaderResolve(JSC::JSGlobalObject* jsGlobal,
         }
     }
 
-    return Zig::GlobalObject::moduleLoaderResolve(jsGlobal, loader, key, referrer, WTF::move(origin), useImportMap);
+    RELEASE_AND_RETURN(scope, Zig::GlobalObject::moduleLoaderResolve(jsGlobal, loader, key, referrer, WTF::move(origin), useImportMap));
 }
 
 static JSC::JSPromise* rejectedInternalPromise(JSC::JSGlobalObject* globalObject, JSC::JSValue value)
@@ -154,7 +154,7 @@ JSC::JSPromise* bakeModuleLoaderFetch(JSC::JSGlobalObject* globalObject,
 #endif
             JSString* bakePrefixRemovedString = jsNontrivialString(vm, bakePrefixRemoved);
             JSValue bakePrefixRemovedJsvalue = bakePrefixRemovedString;
-            return Zig::GlobalObject::moduleLoaderFetch(globalObject, loader, bakePrefixRemovedJsvalue, WTF::move(parameters), WTF::move(script));
+            RELEASE_AND_RETURN(scope, Zig::GlobalObject::moduleLoaderFetch(globalObject, loader, bakePrefixRemovedJsvalue, WTF::move(parameters), WTF::move(script)));
         }
         return rejectedInternalPromise(globalObject, createTypeError(globalObject, "BakeGlobalObject does not have per-thread data configured"_s));
     }
diff --git a/test/bake/dev/production.test.ts b/test/bake/dev/production.test.ts
index 9c37cea72ced..0d14609fb30b 100644
--- a/test/bake/dev/production.test.ts
+++ b/test/bake/dev/production.test.ts
@@ -598,7 +598,7 @@ export default function IndexPage() {
   // BUN_JSC_validateExceptionChecks=1 aborts the child on the first JSC call whose
   // exception state goes unchecked. Debug and ASAN builds enforce it; release builds
   // ignore the option, so there these only check that the build succeeds.
-  describe("exception checks", () => {
+  describe.concurrent("exception checks", () => {
     async function buildApp(cwd: string, ...args: string[]) {
       await using proc = Bun.spawn({
         cmd: [bunExe(), "build", "--app", ...args],
@@ -614,7 +614,7 @@ export default function IndexPage() {
         .split("\n")
         .map(line => line.trim())
         .filter(line => line.startsWith("This scope can throw") || line.startsWith("But the exception was unchecked"));
-      return { stdout, exitCode, signalCode: proc.signalCode, uncheckedScopes };
+      return { stdout, stderr, exitCode, signalCode: proc.signalCode, uncheckedScopes };
     }
 
     test("loading the config file", async () => {
@@ -686,5 +686,40 @@ export function getStaticPaths() {
       expect(rendered[1]).toContain("<h1>Post first</h1>");
       expect(rendered[2]).toContain("<h1>Post second</h1>");
     });
+
+    test("a config import that fails to resolve", async () => {
+      // Resolving the config's imports goes through Bake::GlobalObject's resolve hook; a
+      // specifier it cannot resolve falls through to the regular resolver, which throws.
+      using dir = tempDir("bake-production-validate-unresolved", {
+        "bun.app.ts": `import "./does-not-exist";
+          export default { app: { framework: "react" } };`,
+      });
+
+      const { stderr, exitCode, signalCode, uncheckedScopes } = await buildApp(String(dir));
+      expect({ exitCode, signalCode, uncheckedScopes }).toEqual({ exitCode: 1, signalCode: null, uncheckedScopes: [] });
+      expect(stderr).toContain("Cannot find module './does-not-exist'");
+    });
+
+    test("a route importing a file outside the bundle while rendering", async () => {
+      // import() of a path the bundler never saw is resolved to a "bake:/" key that is not
+      // in the output map, so the fetch hook hands it to the regular loader to read from disk.
+      const dir = await tempDirWithBakeDeps("bake-production-validate-disk-import", {
+        "src/index.tsx": `export default { app: { framework: "react" } };`,
+        "extra/banner.mjs": `export const banner = "read from disk while rendering";`,
+        "pages/index.tsx": `import { join } from "node:path";
+
+export default async function IndexPage() {
+  // A computed specifier, so the bundler leaves this import() for the runtime.
+  const { banner } = await import(join(import.meta.dir, "../extra/banner.mjs"));
+  return <p>{banner}</p>;
+}`,
+      });
+
+      const { exitCode, signalCode, uncheckedScopes } = await buildApp(dir, "./src/index.tsx");
+      expect({ exitCode, signalCode, uncheckedScopes }).toEqual({ exitCode: 0, signalCode: null, uncheckedScopes: [] });
+      expect(await Bun.file(path.join(dir, "dist", "index.html")).text()).toContain(
+        "<p>read from disk while rendering</p>",
+      );
+    });
   });
 });

From 61d75e9e60fe9d7718b6e0dd19c24cf6bf206624 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sat, 15 Aug 2026 12:59:16 +0000
Subject: [PATCH 6/7] bake: skip the out-of-bundle import test on Windows

The import() it relies on fails there before reaching the loader hooks
(EINVAL reading a mangled drive path), independently of what the test
checks; that is tracked separately.
---
 test/bake/dev/production.test.ts | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/test/bake/dev/production.test.ts b/test/bake/dev/production.test.ts
index 0d14609fb30b..17a0324f0259 100644
--- a/test/bake/dev/production.test.ts
+++ b/test/bake/dev/production.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { existsSync } from "fs";
-import { bunEnv, bunExe, normalizeBunSnapshot, tempDir } from "harness";
+import { bunEnv, bunExe, isWindows, normalizeBunSnapshot, tempDir } from "harness";
 import path from "path";
 import { tempDirWithBakeDeps } from "../bake-harness";
 
@@ -700,7 +700,10 @@ export function getStaticPaths() {
       expect(stderr).toContain("Cannot find module './does-not-exist'");
     });
 
-    test("a route importing a file outside the bundle while rendering", async () => {
+    // On Windows this import() currently fails before reaching the loader (the build exits 1
+    // with `EINVAL reading "\\"`: the drive path gets joined as if it were relative), with or
+    // without the exception checks this test is about. Tracked separately.
+    test.skipIf(isWindows)("a route importing a file outside the bundle while rendering", async () => {
       // import() of a path the bundler never saw is resolved to a "bake:/" key that is not
       // in the output map, so the fetch hook hands it to the regular loader to read from disk.
       const dir = await tempDirWithBakeDeps("bake-production-validate-disk-import", {

From 77dc183d452eb44ebf7c451379fdcd2336651fc8 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sat, 15 Aug 2026 13:12:26 +0000
Subject: [PATCH 7/7] bake: delete BakeRegisterProductionChunk, which nothing
 calls

---
 src/runtime/bake/BakeSourceProvider.cpp | 22 ----------------------
 1 file changed, 22 deletions(-)

diff --git a/src/runtime/bake/BakeSourceProvider.cpp b/src/runtime/bake/BakeSourceProvider.cpp
index a5382ae0a60b..51508f0dfd65 100644
--- a/src/runtime/bake/BakeSourceProvider.cpp
+++ b/src/runtime/bake/BakeSourceProvider.cpp
@@ -182,26 +182,4 @@ extern "C" JSC::EncodedJSValue BakeGetOnModuleNamespace(
   return JSC::JSValue::encode(value);
 }
 
-extern "C" JSC::EncodedJSValue BakeRegisterProductionChunk(JSC::JSGlobalObject* global, BunString virtualPathName, BunString source) {
-  auto& vm = JSC::getVM(global);
-  auto scope = DECLARE_THROW_SCOPE(vm);
-
-  String string = virtualPathName.toWTFString();
-  JSC::JSString* key = JSC::jsString(vm, string);
-  JSC::SourceOrigin origin = JSC::SourceOrigin(WTF::URL(string));
-  JSC::SourceCode sourceCode = JSC::SourceCode(SourceProvider::create(
-    global,
-    source.toWTFString(),
-    origin,
-    WTF::move(string),
-    WTF::TextPosition(),
-    JSC::SourceProviderSourceType::Module
-  ));
-
-  global->moduleLoader()->provideFetch(global, JSC::Identifier::fromString(vm, key->getString(global)), JSC::ScriptFetchParameters::Type::JavaScript, WTF::move(sourceCode));
-  RETURN_IF_EXCEPTION(scope, {});
-
-  return JSC::JSValue::encode(key);
-}
-
 } // namespace Bake