fetch: encode FetchTasklet's cross-thread ownership in the type system

src/jsc/Weak.rs

@@ -115,14 +115,36 @@ impl<T> Weak<T> {
         global_this: &JSGlobalObject,
         ref_type: WeakRefType,
         ctx: &mut T,
+    ) -> Self {
+        // SAFETY: `ctx` is derived from a live `&mut T`, so it satisfies the
+        // liveness contract at creation; the caller's `&mut T` is the same
+        // proof `create` has always demanded.
+        unsafe { Self::create_ptr(value, global_this, ref_type, NonNull::from(ctx)) }
+    }
+
+    /// Like [`create`](Self::create), but takes `ctx` as a raw pointer for
+    /// callers that cannot form `&mut T` (e.g. while disjoint field borrows of
+    /// the owner are live).
+    ///
+    /// # Safety
+    ///
+    /// `ctx` must point to a live `T` and remain valid for as long as the
+    /// weak ref's finalize callback can fire — the GC finalizer dereferences
+    /// it. (`create` enforces this via `&mut T`; here the caller must prove
+    /// liveness instead.)
+    pub unsafe fn create_ptr(
+        value: JSValue,
+        global_this: &JSGlobalObject,
+        ref_type: WeakRefType,
+        ctx: NonNull<T>,
     ) -> Self {
         if !value.is_empty() {
             return Self {
                 r#ref: Some(WeakImpl::init(
                     global_this,
                     value,
                     ref_type,
-                    Some(NonNull::from(ctx).cast::<c_void>()),
+                    Some(ctx.cast::<c_void>()),
                 )),
                 global_this: Some(global_this.into()),
                 _ctx: PhantomData,

src/runtime/dispatch.rs

@@ -1184,16 +1184,16 @@ pub(crate) fn __bun_release_task_at_shutdown(task: bun_event_loop::Task) -> bool
     use bun_event_loop::task_tag;
     match task.tag {
         // `callback` (HTTP thread) won the `has_schedule_callback` CAS and
-        // posted this entry, then deref'd its own +1 if final; the JS-side
-        // +1 it expected `on_progress_update` to drop is the one we release
-        // here. Runs on the JS thread, so the plain `deref` (→ `deinit` on
+        // posted this entry, then released its own ref if final; the JS-side
+        // ref it expected `on_progress_update` to drop is the one we release
+        // here. Runs on the JS thread, so `release_js_ref` (→ `deinit` on
         // 1→0) is the right teardown path; the HTTP daemon is already
         // parked (`shutdown_for_exit` precedes `destroy`), so the
         // `Box<AsyncHTTP>` and any `metadata` it owns are exclusively ours.
         task_tag::FetchTasklet => {
             // SAFETY: `task.ptr` is the live heap `FetchTasklet`; HTTP daemon is
             // already parked so we hold the sole reference.
-            FetchTasklet::deref(task.ptr.cast::<FetchTasklet>());
+            FetchTasklet::release_js_ref(task.ptr.cast::<FetchTasklet>());
             true
         }
         // `AsyncFSTask`s are `Box::leak`'d in `create()` and freed by