[bartlomieju]

Problem

The Windows panic reported in #35990 / #36047 still reproduces on canaries after the fix in #36032:

thread 'tokio-runtime-worker' panicked at ext/napi/node_api.rs:947:5:
assertion failed: self.is_closed.compare_exchange(false, true, Ordering::Relaxed, Ordering::Relaxed).is_ok()

#36032 closed the abort-frees-early path, but left a second way to double-free that it didn't cover: napi_acquire_threadsafe_function.

acquire did a plain fetch_add on thread_count after a non-atomic is_closing check:

pub fn acquire(&self) -> napi_status {
    if self.is_closing.load(Ordering::SeqCst) {
        return napi_closing;
    }
    self.thread_count.fetch_add(1, Ordering::Relaxed);
    napi_ok
}

This races the final release:

1. thread_count == 1. Thread R calls release: fetch_update does 1 -> 0 (result == Ok(1), will free), but hasn't set is_closing yet.
2. Thread Q calls acquire: is_closing still false (R sets it only after the fetch_update), so Q does fetch_add: 0 -> 1 and believes it holds a live ref.
3. R sets is_closing, spawns the drop → box freed.
4. Q later calls release: fetch_update 1 -> 0, result == Ok(1) → spawns a second drop of the already-freed box → use-after-free + double free → the is_closed assert panics.

This shows up under heavy concurrent addons — notably napi-rs's ThreadsafeFunction, which calls acquire on every clone — during teardown, exactly matching the reporter's "deno teardown crash after pass" logs.

Fix

acquire now uses a fetch_update CAS that refuses to increment thread_count from zero, returning napi_closing instead. Zero becomes a one-way terminal state, so exactly one release ever observes the 1 -> 0 transition and the box is freed exactly once. This matches Node.js, where acquiring a closing tsfn fails.

Test

test_tsfn_acquire_release_race races an acquire against the sole owning release (looped from JS to hit the narrow window). Verified locally:

• Before the fix: deno test async_test.js crashes with SIGSEGV (exit 139) on this test.
• After the fix: all 9 async tests pass, repeatedly.

Refs #35990
Closes #36047