resolver: pass paths as an argument and delete Resolver::custom_dir_paths - #47752

How it was found. No issue and no crash report exist. #46802 and #47477 describe the bug in their bodies and leave the fix to a separate PR. The field and the job's copy both date from #18851 (April 2025).

Repro without the test rig. A script starts 24 import()s of modules that each import a macro from ./the-macro.ts, then calls require.resolve("./no-such-file", { paths }) with 100,001 entries. The first entry is a directory that has another the-macro.ts.

• main, release build: {"right":11,"wrong":13}. Released 1.4.3-canary: 15, 17 and 20 wrong of 24.
• This PR, release and debug builds: {"right":24,"wrong":0} in 6 of 6 runs.

The use after free on main (debug ASAN build, Malloc=1, the fifth new test):

ERROR: AddressSanitizer: heap-use-after-free
READ of size 1, thread "Bun Pool 1"
  #0 bun_core::string::String::to_utf8            src/bun_core/string/mod.rs:752
  #1 Resolver::resolve_without_symlinks           src/resolver/resolver.rs:2149
  #2 Resolver::resolve_and_auto_install           src/resolver/resolver.rs:1623
  #3 Resolver::resolve                            src/resolver/resolver.rs:1771
  #4 MacroContext::call                           src/js_parser_jsc/Macro.rs:156
freed by the main thread in WTF::VectorBuffer<BunString>::~VectorBuffer (the `paths` vector)

Why delete the field and not reset it on the job's copy.

• TranspilerJob::run already replaces some fields on its copy (set_log, macro_context, and since bun test: Vitest compatibility #44833 options.target). One more line there fixes every case that a test can observe.
• The job would still load the field in an unsynchronized ptr::read while the main thread writes it. The borrow would still sit, with a detached lifetime, in a struct that is copied bytewise to other threads.
• paths belongs to one call. A job needs no value for it, so there is nothing to reset once no struct holds it.
• Node does the same: paths is a local of Module._resolveFilename that it passes to Module._findPath.

Three call sites where the value is a decision. Each keeps the result of main.

• VirtualMachine::_resolve passes paths on every turn of its retry loop.
• The path that an onResolve callback returns is looked up in paths. A resolve that the callback itself makes has its own. On main, OnResolveScope (bun test: Vitest compatibility #44833) took the field for the length of the callback and put it back after. The first new test in resolve.test.ts pins the first half, and the order in which paths are searched. plugins.test.ts ("doesn't share paths with the outer call") already pins the second half.
• The lookup of chai next to vitest is skipped when paths is given. On main that lookup could not succeed with paths set, because its second step searched paths again. The second new test in resolve.test.ts pins it.
• With either of the two changed the other way, its test fails. Passing None in resolve_with_on_resolve does not compile (unused_variables is denied).

What this PR does not fix. The job's copy of vm.transpiler still shares state with the main thread. The SAFETY comment at the copy said that vm.transpiler is not concurrently mutated. It now says that the main thread writes it.

• resolver.opts.extra_cjs_extensions: require.extensions[ext] = fn frees the list (src/jsc/NodeModuleModule.rs:167) while a job's macro resolve reads it. With this PR, debug ASAN build: heap-use-after-free in Resolver::load_as_file (src/resolver/resolver.rs:6186), under the same MacroContext::call frame. bun test --isolate: reset Module._extensions per file and ask it before the source cache answers a require() #47477 and macros: resolve macro imports with a resolver for Bun, so the "macro" export condition applies #46802 each give the job its own copy of that list.
• resolver.package_manager (written at src/resolver/resolver.rs:860 on first use), options.test_file_imports_vitest and options.own_test_globals (src/runtime/jsc_hooks.rs:899, :975, :977, :2859), and resolver.caches.fs.use_alternate_source_cache (src/jsc/VirtualMachine.rs:2041) are written by the main thread after startup and read through the copy. Found by reading. Not run.

Related PRs.

• bun test: Vitest compatibility #44833 (merged) added the OnResolveScope save and restore of the field that this PR deletes.
• Bun global + crypto: remove unsafe from BunObject.rs and runtime/crypto #40399 (open) turns the field into an owned Box<[String]>. The field stays in the struct that jobs copy, so a job that starts during the call still gets the list.
• macros: resolve macro imports with a resolver for Bun, so the "macro" export condition applies #46802 (open) resolves macro imports with a second resolver. If it lands first, a job no longer reads the field, the 5 macro tests pass on the base, and this PR is a refactor.
• resolver: treat require.resolve paths entries as search starts only #47184, resolver: with options.paths, ask the package of the calling module for #imports and its own name #47243 and resolver: redo a require.resolve lookup with paths after a stale miss #47481 (open) change the field or its two readers. They conflict with this PR. resolver: treat require.resolve paths entries as search starts only #47184 and resolver: with options.paths, ask the package of the calling module for #imports and its own name #47243 also use the field deeper in the resolver, so after this PR they need paths as an argument there.

Measurements. Release builds (LTO) of main 3f3a9ff and of main plus this diff. valgrind, perf and bloaty are not in the build container. Instruction counts come from a perf_event_open counter (instructions:u, the counter of perf stat), call counts from gdb, sizes from size and llvm-nm.

• resolve without paths: +3 instructions, +0 branches per resolve_and_auto_install call, and +2 in Resolver::resolve (llvm-objdump diff of the path that has no paths).
• JS-thread resolve: +22.8 instructions per require.resolve(id) (8,486.5 to 8,509.3), +7.0 per Bun.resolveSync (6,663.0 to 6,670.0), +18.0 per require.resolve(id, { paths }) (17,880.3 to 17,898.3). Per call over 200,000 calls, JIT off, minimum of 10 interleaved runs, noise floor 0.4 to 2.5.
• bun build of 2,000 modules: 6,001 resolves x +5 = +30,005 instructions (0.014% of 212.2M). Measured minimum of 10 interleaved runs: 212,210,077 to 212,181,587, noise floor 837,095.
• per-job transpiler copy: 3,040 to 3,024 bytes. sizeof in the debug layout: Resolver 1,272 to 1,256, Transpiler 3,160 to 3,144, TranspilerJob 392 to 392. TranspilerJob::run_from_worker_thread: 1,721 to 1,721 instructions, and no difference but offsets.
• import() of a module with no macro: 161,663 to 161,871 instructions per module (2,000 modules, minimum of 60 runs in 3 interleaved rounds, medians differ by 21, noise floor about 1,500).
• release binary text: +0 bytes (140,286,972 both). 49 symbols changed size, net -13 bytes.
• custom_dir_paths references 11 to 0. detach_lifetime in BunObject.rs 1 to 0. Source +61/-40 in 8 files. FFI signatures changed: 0.
• new tests in macro-test.test.ts: fail 100 of 100 on main (debug ASAN, 20 runs of 5) and 25 of 25 on released 1.4.3-canary. Pass 250 of 250 with this PR (debug ASAN, 50 runs of 5) and 50 of 50 on the release build. About 1.1 s per test on the debug ASAN build. The after-return test ends in the ASAN report above in 20 of 20 runs on main.

How the macro tests make the order certain. Nothing waits for time to pass.

• The child runs with UV_THREADPOOL_SIZE=2. One pool thread reads a FIFO until the end of the test.
• The other transpiles a module whose node:fs macro waits to write to a FIFO. The module under test therefore waits for a thread.
• The resolver reads the tsconfig.json of each directory in paths, and what it extends. In two of them that is a FIFO, so the main thread stops inside the resolve until a macro writes.
• The first stop releases the waiting job, so the module under test starts during the call. Its first macro releases the second stop.
• The five tests: require.resolve(), require() and Module._resolveFilename() with paths, a macro that is a package, and a macro import that is resolved after the call returned.
• POSIX only (mkfifo).

Suites run on the debug ASAN build of this PR. macro-test.test.ts (39 pass), resolve.test.ts (114 pass), plugins.test.ts (269 pass, 1 timeout that main has too on this machine: "keeps the object alive across a GC" needs 30 s here), vitest-flavor.test.ts (191 pass), module-resolve-filename-paths.test.js, node-module-module.test.js, require.test.ts, resolve-error.test.ts, and Node's test-require-resolve*.js. cargo check --workspace and bun run rust:check-all (12 targets) pass.