fix(runtime): strong Worker wrapper lifetime while the thread runs - #456

Stacked on #454 (feat/worker-threads). Merge that first.

What this fixes

Worker JS wrappers previously lived by finalizer resurrection: registered weak immediately, condemned by GC while the thread ran, then revived by ObjectManager::DisposeValue refusing disposal and re-arming the handle (sanctioned by our custom V8 kFinalizer patch). We reproduced real heap corruption from that pattern: the patch handles resurrected ephemeron keys in the atomic mark-compact pause, but not under concurrent marking — a resurrected WeakMap key whose values are reachable only through the entry leaves a dangling value slot, crashing ConcurrentMarkingVisitor::RecordSlot on a later cycle:

EXC_BAD_ACCESS KERN_INVALID_ADDRESS
  v8::internal::ConcurrentMarkingVisitor::RecordSlot<FullObjectSlot, ...>
  v8::internal::ConcurrentMarking::RunMajor

Reproducing required a task-posted GC (no conservative stack scan), values held only through the ephemeron entries, and a two-level chain — which is why it survived unnoticed: plain __collect() never hits it. Any app putting a Worker in a WeakMap could crash this way on current releases.

The change

Reachability-based lifetime, matching browsers and Node: the wrapper's persistent goes strong when the thread starts and is released only by a thread-exit notification posted from the worker's teardown to the parent's event loop. terminate() initiates wind-down but never drops the root early — the wrapper is strong for exactly the thread's lifetime, so the resurrection fallback is unreachable for workers (kept as a commented defensive branch). Teardown cascade verified: strong persistents flow through DisposeAllRegistered correctly.

Bonus from the same notification: an internal nsworkerended event on the Worker object lets the node:worker_threads shim emit 'exit' on self-close (previously only on terminate()), exactly once either way.

Tests

WorkerLifetimeTests.js (deliberately not in the shared suite — the repro would crash the Android runtime's CI until it gets the same treatment):

• the WeakMap-key corruption repro — verified to crash the runtime before this change, passes after;
• wrapper collectable after terminate() and after worker self-close (WeakRef-observed);
• an unreferenced live worker still receives and answers messages;
• 'exit' exactly once on self-close and on terminate.

Suite: 1663 / 0.

Related

• The V8-side collector bug (concurrent-marking ephemeron handling for resurrected keys) still affects other resurrectable wrapper types and is being root-caused separately against the patched 14.9 tree; fix will ride the next prebuilt rebuild.
• android-runtime uses the equivalent resurrection pattern and needs the same migration.

Review round (2026-09-11)

• BackgroundLooper reads everything it needs before publishing isDisposed_, which is the signal that lets a tearing-down parent delete the wrapper concurrently.
• Every worker-thread post to the parent now goes through a weak_ptr to the parent's event loop captured on the parent's thread at construction, never through the parent isolate's runtime slot. The parent runtime may be mid-teardown or its isolate already disposed when a worker-side post runs; a loop that has shut down drops the post instead. This covers the thread-ended notification added here and the two pre-existing sites (error forwarding, postMessage to the parent).
• New spec in WorkerLifetimeTests.js: a worker whose loop still holds a message carrying a port it owns the sibling of is terminated, and its thread must end. Before the EventLoop::Shutdown fix on the base branch this deadlocked the worker thread.

Summary by CodeRabbit

• New Features

  • Worker threads now emit an exit event exactly once when they finish naturally or are terminated.
  • Workers remain available during their active lifetime, including when application references are removed.
  • Worker lifetime and garbage-collection behavior are now documented.

• Bug Fixes

  • Improved worker cleanup and lifecycle handling after termination or self-closing.
  • Prevented duplicate exit notifications.

• Tests

  • Added coverage for worker messaging, termination, self-closing, garbage collection, and exit events.

• Documentation

  • Clarified worker lifetime guarantees and documented exit behavior.