bun test --isolate: 在所有测试通过后, Bun__runDeferredWork 在退出时出现间歇性 segfault (1.4.2, Linux x64, JIT 关闭)

How can we reproduce the crash? No minimal repro yet — this is an intermittent exit-time crash in a large bun test --isolate suite (642 test files, sharded 4 ways) on GitHub Actions ubuntu-latest (Linux x64). It does not reproduce on macOS arm64 with the same tree and flags (3/3 clean runs). Shape: sh BUN_JSC_useJIT=0 bun test --isolate --shard=2/4 - Every test passes and the summary is printed (`2707 pass / 0 fail / Ran 2707 tests across 161 files`). - Bun then segfaults while exiting: `panic(main thread): Segmentation fault at address 0x9670`, exit 139. - Rate: ~4 of the last ~40 CI runs had one such crash. One job hit it 3 attempts in a row on the same runner VM; re-running that exact commit on a fresh runner had 0 crashes, so it clusters per machine. - `BUN_JSC_useJIT=0` and sharding (fewer worker threads per invocation) reduce but do not eliminate it. - The suite uses `mock.module` heavily across files (which is why `--isolate` is required), Prisma (NAPI query engine), and pg/http servers under test with fakes. Looks like a successor to #22901 (closed can't-repro on 1.3.13) — same flag combination, same teardown timing — and adjacent to the `--isolate` NapiEnv fix in #30216. Still occurs on 1.4.2. ### Relevant log output text ##[group]src/tests/lint/no-legacy-reads.test.ts: (pass) No legacy reads outside adapter/ingest > forbid envelope.raw, extractTerraMetadata, and direct plan/legacy property access [1417.54ms] ============================================================= Bun v1.4.2 (744846f84) Linux x64 Linux Kernel v6.17.0 | glibc v2.39 CPU: sse42 popcnt avx avx2 Args: "bun" "test" "--isolate" "--shard=2/4" Features: Bun.stderr(20) Bun.stdin(18) Bun.stdout(18) bunfig dotenv http_server(160) jsc transpiler_cache(767) tsconfig(28) process_dlopen(8) Builtins: "bun:test" "bun:wrap" "node:assert" "node:async_hooks" "node:buffer" "node:child_process" "node:crypto" "node:diagnostics_channel" "node:dns" "node:events" "node:fs" "node:fs/promises" "node:http" "node:http2" Elapsed: 5352ms | User: 11177ms | Sys: 664ms RSS: 0.37 GB | Peak: 0.38 GB | Commit: 0.75 GB | Faults: 0 | Machine: 33.65 GB panic(main thread): Segmentation fault at address 0x9670 oh no: Bun has crashed. This indicates a bug in Bun, not your code. line 3: 2674 Segmentation fault (core dumped) bun test --isolate --shard="$shard/4" ### Stack Trace (bun.report) https://bun.report/1.4.2/lt1744846fgjEu0goCimt0uC2+v6nCgi0oyBwgwoyBm/j/2By15+2B+m5+2Bmuq82BmmsivB0+9hvB2y4hvBy8wK0oxK6i0+uBA2AgnrC Remapped: Segmentation fault at address 0x00009670 - HeapCellInlines.h:0: vm - JSCTaskScheduler.cpp:31: vm - JSCTaskScheduler.cpp:137: Bun__runDeferredWork - JSCScheduler.rs:43: {closure#0} - TopExceptionScope.rs:705: call_check_slow - TopExceptionScope.rs:721: call_check_slow - JSCScheduler.rs:43: run - dispatch.rs:370: bun_runtime::dispatch::run_task - dispatch.rs:614: tick_queue_with_count - dispatch.rs:1198: __bun_tick_queue