#44896 fetch: send an empty Bun.file() slice without sendfile and close its file

No user reported this. It was found by reading the code.

Repro (Linux, no network)

import { readdirSync, writeFileSync, unlinkSync } from "node:fs";
const path = `/tmp/sf_${process.pid}.bin`;
writeFileSync(path, Buffer.alloc(64 * 1024, "a"));
const server = Bun.serve({ port: 0, async fetch(req) { return new Response(String((await req.arrayBuffer()).byteLength)); } });
const fds = () => readdirSync("/proc/self/fd").length;
async function run(label, mk) {
  for (let i = 0; i < 5; i++) await (await fetch(server.url, { method: "POST", body: mk() })).text();
  const before = fds();
  for (let i = 0; i < 50; i++) await (await fetch(server.url, { method: "POST", body: mk() })).text();
  console.log(label, "fd delta over 50 calls:", fds() - before);
}
await run("whole file", () => Bun.file(path));
await run("slice(0, 40000)", () => Bun.file(path).slice(0, 40000));
await run("slice(0, 0)", () => Bun.file(path).slice(0, 0));
await run("slice(100, 100)", () => Bun.file(path).slice(100, 100));
server.stop(true);
unlinkSync(path);

Main prints 0, 0, 50, 0. This branch prints 0, 0, 0, 0.

Which inputs leak on main. Every window with offset 0 and size 0 on a file-backed Blob:

• slice(0, 0), slice(undefined, 0), Bun.file(fd).slice(0, 0), a Request body, and an empty slice of a directory of 32 KiB or more.
• A whole-file handle whose size was read as 0 before the file was written. Example: if (!(await f.exists())) await Bun.write(f, data), then fetch(url, { body: f }). It leaks 50 of 50 on main and 0 here. Its upload is still empty on both builds. That stale size is the state of #4930, and #39763 works on it.
• The leak does not need a response. A failed connection and an abort right after the call leak too.
• slice(100, 100) does not leak, because its offset is not 0.

How long until EMFILE. Bun raises the soft descriptor limit to the hard limit. At a hard limit of 4096, main completes 4,086 uploads of slice(0, 0) and upload 4,087 rejects. An unrelated openSync then fails too. With ulimit -n 256, upload 247 rejects. This branch completes 6,000 in both cases.

The gate is old. It is in the Zig code of #3125 (May 2023): if (@max(this.Sendfile.offset, this.Sendfile.remain) > 0) _ = close(this.Sendfile.fd);. The Rust port kept it.

Test proof (debug builds, the 10 new cases)

With both changes, no empty window reaches detach. The slice(0, 40000) case is the test of the detach change. It passes on main too, so it is a control.

The two "sends nothing after the request head" cases pass on Linux with and without the fix. Linux sendfile(2) with a count of 0 sends nothing. They are for macOS. XNU sendfile() sends "until EOF if *nbytes == 0", and SendFile::write passes remain as that length (src/http/SendFile.rs:102, FreeBSD at line 79). I did not run a macOS or FreeBSD host. The macOS CI lanes are the first run of these cases there.

Numbers (main is e655c58032, release builds unless noted)

• fd delta over 50 uploads (whole / slice(0,40000) / slice(0,0) / slice(100,100)): main 0 / 0 / 50 / 0, PR 0 / 0 / 0 / 0. Refused connection: main 50, PR 0. Abort right after the call: main leaves 50 descriptors on the body file, PR 0.
• Syscalls on the body file per empty-window upload (openat / fstat / read / lseek / sendfile / close): main slice(0,0) 1 / 1 / 0 / 0 / 1 / 0, PR 1 / 1 / 0 / 0 / 0 / 1. slice(100,100): main 1 / 1 / 0 / 0 / 1 / 1, PR 1 / 1 / 0 / 0 / 0 / 1. Windows with bytes and files under 32 KiB: the same on both. (gdb catch syscall, descriptor resolved to the file, slope over 10 and 30 requests.)
• Instructions executed per call (gdb nexti, 5 uploads each, all equal): fetch_impl for a sendfile upload with bytes 1,113 to 1,115, for an empty window 1,088 to 1,081, for a string body 986 to 986, for no body 954 to 954. Tasklet teardown: sendfile with bytes 227 to 224, string body 201 to 201.
• read_file calls per 50 empty-window uploads of a 64 KiB file: 0 (1 KiB control: 50). The new exit calls close(2) and nothing else, so it adds no allocation.
• Descriptors on the body file held by 20 parked uploads (slice(0,0) / slice(100,100) / slice(0,40000)): main 20 / 20 / 20, PR 0 / 0 / 20.
• [sys] close lines on the body file per request, debug builds (whole / slice(0,40000) / slice(0,0) / slice(100,100)): main 1 / 1 / 0 / 1, PR 1 / 1 / 1 / 1. No EBADF assertion.
• Bytes after the Content-Length: 0 head (slice(0,0) / slice(100,100)): Linux 0 / 0 on both. The request heads for POST, PUT and GET are byte-identical on main and on the PR.
• Size: .text 65,658,709 B on both. fetch_impl::<false> 23,718 to 23,797 B, detach 352 to 351 B, the tasklet drop glue 3,589 to 3,557 B (size -A, nm -S).
• PUT with an empty slice on a stale keep-alive socket, rejected of 20: main 10 (a 1 KiB file on main: 0), PR 0. POST: 10 on both.

Also run. bun run rust:check-all: 12 targets, 0 failed. On the debug build: fetch-redirect.test.ts 30 pass, fetch-args.test.ts 85 pass, fetch-compress.test.ts 32 pass, body-clone.test.ts 100 pass. In fetch.test.ts the file-body, upload and Content-Length cases pass. Its other failures in my container are 5 s timeouts of (with gc) cases in the debug build, three cases that need the network, and the permission cases, which fail for root.

Kept as on main. The position of a caller's Bun.file(fd) descriptor does not move. An empty slice of a directory of 32 KiB or more still resolves with an empty body.

Not in this PR

• The descriptor lifetime of a file body with bytes. fetch() opens the file before the request is queued, and the tasklet closes it when the response ends. Concurrent uploads hold one descriptor each. With ulimit -n 512, 1,000 concurrent uploads of a 64 KiB file complete 9 to 123 on main and 19 to 187 here (three runs each). The rest reject with EMFILE. A Buffer or Bun.file(p).stream() body completes 1,000. This PR does not change that.
• The sendfile descriptor has no owning type between fetch_impl and the tasklet. No exit in between is reachable with a sendfile body today.
• SendFile::write has no guard for a length of 0. #38406 and #41494 re-arm or reuse a sendfile body and must keep remain > 0.
• A slice(a, a) with a > 0 of a large directory still reaches sendfile(2) and rejects with EINVAL, as on main.
• #41905 edits the same block of fetch.rs. The overlap is one hunk.