bun test --isolate: intermittent segfault in Bun__runDeferredWork at exit after all tests pass (1.4.2, Linux x64, JIT off)

How can we reproduce the crash?

No minimal repro yet — this is an intermittent exit-time crash in a large bun test --isolate suite (642 test files, sharded 4 ways) on GitHub Actions ubuntu-latest (Linux x64). It does not reproduce on macOS arm64 with the same tree and flags (3/3 clean runs).

Shape:

BUN_JSC_useJIT=0 bun test --isolate --shard=2/4

• Every test passes and the summary is printed (2707 pass / 0 fail / Ran 2707 tests across 161 files).
• Bun then segfaults while exiting: panic(main thread): Segmentation fault at address 0x9670, exit 139.
• Rate: ~4 of the last ~40 CI runs had one such crash. One job hit it 3 attempts in a row on the same runner VM; re-running that exact commit on a fresh runner had 0 crashes, so it clusters per machine.
• BUN_JSC_useJIT=0 and sharding (fewer worker threads per invocation) reduce but do not eliminate it.
• The suite uses mock.module heavily across files (which is why --isolate is required), Prisma (NAPI query engine), and pg/http servers under test with fakes.

Looks like a successor to #22901 (closed can't-repro on 1.3.13) — same flag combination, same teardown timing — and adjacent to the --isolate NapiEnv fix in #30216. Still occurs on 1.4.2.

Relevant log output

##[group]src/__tests__/lint/no-legacy-reads.test.ts:
(pass) No legacy reads outside adapter/ingest > forbid envelope.raw, extractTerraMetadata, and direct plan/legacy property access [1417.54ms]
============================================================
Bun v1.4.2 (744846f84) Linux x64
Linux Kernel v6.17.0 | glibc v2.39
CPU: sse42 popcnt avx avx2
Args: "bun" "test" "--isolate" "--shard=2/4"
Features: Bun.stderr(20) Bun.stdin(18) Bun.stdout(18) bunfig dotenv http_server(160) jsc transpiler_cache(767) tsconfig(28) process_dlopen(8)
Builtins: "bun:test" "bun:wrap" "node:assert" "node:async_hooks" "node:buffer" "node:child_process" "node:crypto" "node:diagnostics_channel" "node:dns" "node:events" "node:fs" "node:fs/promises" "node:http" "node:http2"

Elapsed: 5352ms | User: 11177ms | Sys: 664ms
RSS: 0.37 GB | Peak: 0.38 GB | Commit: 0.75 GB | Faults: 0 | Machine: 33.65 GB

panic(main thread): Segmentation fault at address 0x9670
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

line 3:  2674 Segmentation fault      (core dumped) bun test --isolate --shard="$shard/4"

Stack Trace (bun.report)

https://bun.report/1.4.2/lt1744846fgjEu0goCimt0uC2+v6nCgi0oyBwgwoyBm/j/2By15+2B+m5+2Bmuq82BmmsivB0+9hvB2y4hvBy8wK0oxK6i0+uBA2AgnrC

Remapped:

Segmentation fault at address 0x00009670
- HeapCellInlines.h:0: vm
- JSCTaskScheduler.cpp:31: vm
- JSCTaskScheduler.cpp:137: Bun__runDeferredWork
- JSCScheduler.rs:43: {closure#0}
- TopExceptionScope.rs:705: call_check_slow
- TopExceptionScope.rs:721: call_check_slow
- JSCScheduler.rs:43: run
- dispatch.rs:370: bun_runtime::dispatch::run_task
- dispatch.rs:614: tick_queue_with_count
- dispatch.rs:1198: __bun_tick_queue

Reads as deferred JSC work being ticked after the VM for that (isolated) test file has already been torn down.