DuplexUpgradeContext: hold state in Cell/JsCell, take ThisPtr instead of *mut Self
What
Same treatment as #40002 for DuplexUpgradeContext (the context behind new TLSSocket(duplex) / tls.connect({ socket }) / socket.upgradeTLS() over a JS stream) in src/runtime/socket/socket_body.rs.
tls,task_event,queued,ssl_config,owned_ctx,is_openmove intoCell/JsCell;upgrade,vm,server_verify,modeare never mutated after construction and stay plain.- The ten
UpgradedDuplexhandler callbacks,run_event,enqueue_self_task,deinit_in_next_tick,start_tls,stop_for_vm_teardowntakeThisPtr<Self>;duplex_socket/tls_this_ptrtake&self.deinit(the free) staysunsafe fn(*mut Self);Taskable::release_unrunkeeps the trait signature.dispatch.rsand the VM stop phase injsc_hooks.rsconstruct theThisPtrat the entry point. run_event's StartTLS arm lendsssl_configout of its cell aroundstart_tls(which dispatcheson_opensynchronously) instead of borrowing it in place.
UpgradedDuplex itself is unchanged — its *mut Self fns are the SSLWrapper<*mut UpgradedDuplex> handler targets, which is a separate change.
unsafe count: socket_body.rs 106 → 57.
Testing
Debug+ASAN build, all passing: node-tls-upgrade, node-tls-connect (60), node-tls-server (74), node-tls-duplex-close-throw-uaf, node-tls-duplex-write-throw-error-value, node-tls-socket-allow-half-open-option, node-tls-connect-hostname-verification, renegotiation, socket-retention, test/js/bun/net/socket.test.ts (94), node-net (80), node-http2 (362); node parallel tests test-tls-inception / test-tls-js-stream / test-tls-socket-close / test-tls-destroy-stream / test-tls-connect-stream-writes / test-tls-net-socket-keepalive / test-tls-streamwrap-buffersize under the debug binary; and a hand-rolled Duplex pair + new TLSSocket(isServer) / tls.connect({socket}) ping/pong/end script with event order identical to Node.