server: remove unsafe from RequestContext

JA
2mo ago
+1543-1694

What

Same programme as #40055 / #40135 / #40136 / #40139 / #40187 / #40190 / #40200 / #40202, applied to Bun.serve's per-request state: src/runtime/server/RequestContext.rs 63 → 0 (incidental: server/mod.rs 99 → 92, server_body.rs 83 → 68, webcore/streams.rs 28 → 22). Stacked on #40192 (BackRef<T, Root>), whose commit is included.

  • RequestContext is created into its hive slot as a RefPtr (HiveSlot::write_ref) and every uws / stream / promise / S3 / file callback receives ThisPtr<Self> (AnyResponse::on_data_this joins on_writable_this/on_aborted_this); the refs the context holds on its own behalf are typed slots released at their terminal events (release_in_flight), deinit(this: ThisPtr) returns the slot to the pool through the #[ref_count(destroy = …)] hook (bun_ptr::destroy_with, sibling of destroy_box_with). req, sink, pending body etc. are Cell/JsCell; ServerLike is sealed with const SSL/DEBUG and on_request_complete(this: BackRef<Self, Mut>).
  • AnyRequestContext carries ThisPtr<T> (init(ThisPtr<T>), get<T>() -> Option<ThisPtr<T>>, sealed CtxKind); Request.request_context: Cell<AnyRequestContext>; Body::ReceiveValue::Server(AnyRequestContext); HTTPServerWritable.first_write_ctx: Option<AnyRequestContext>, StreamOwner::RequestContext(AnyRequestContext); s3::client::stat_for_request_context.
  • bun_jsc::native_promise_context: unsafe trait NativePromiseContextType { const TAG } + native_promise_context_type!, create(global, RefPtr<T>, held) (the GC cell owns the ref), take<T>(cell) -> Option<RefPtr<T>>; C++ Bun__NativePromiseContext__take now takes the expected tag and does a checked downcast (nullptr on mismatch/empty). The previously untyped runtime create/take are now create_html_rewriter_suspension/take_html_rewriter_suspension with a fixed tag, so tag ↔ type is injective.
  • WeakPtr::{from_this, get_ref, is}, From<RefPtr<T>> for ScopedRef<T>, From<ThisPtr<T>> for NonNull<T>, uws_sys::AnyRequest: Copy.

Residual (zero unsafe, noted for a follow-up): Body::PendingValue's three producer hooks still receive task: NonNull<c_void> (decoded via BackRef as html_rewriter.rs does); making them a typed dispatch on producer: SourceHandle touches fetch/html_rewriter/Blob and is left for the PR that unifies those.

Testing

Debug+ASAN: serve.test.ts 296/297 (uid-0 port case), serve-body-leak 8/8, bun-serve-{static,html,file,routes,date,args,body-json-async,cookies,headers,propagate-errors}, bun-server, async-iterator-stream, request-smuggling, serve-request-extra-memory, fetch.stream, body-stream, fetch-abort-stream-body, request-cyclic-reference, test/js/web/request, web/html, static-stress, websocket-server-{upgrade-reentrant,upgrade-signal-gc,stop-retained-ws,reload-leak}, websocket-server.test.ts 128/128 (--max-concurrency=1; at default concurrency the tests adjacent to the 300k-message benchmark case time out on a loaded box and pass individually), serve-http3, node-http, hono. Hand-driven: string/Response/promise/reject/throw/null returns, HEAD, file + Range, body text/stream/ignored, JS and direct streaming with client abort, req.signal abort, raw-socket abort mid-body, 2200 keep-alive requests → pendingRequests back to 0, reload(), stop() with in-flight requests — exit 0, no ASAN output. clippy clean on bun_runtime/bun_ptr/bun_jsc/bun_uws_sys/bun_collections; rust-check-all windows-msvc + apple-darwin pass.