[robobun]

Problem

• A selector with many combinators, for example "p p p ... p" with 30000 compounds, parses fine but overflows the native stack when the program is compiled. In bun this is a silent SIGSEGV in HTMLRewriter.transform().
• Compiler::compile_nodes (src/selectors_vm/compiler.rs) recurses through compile_descendants once per combinator. The derived drop glue for the AST recurses the same way when an Ast is dropped without compilation.

Fix

• compile_nodes walks the tree with an explicit work list. Each node reserves the address ranges for its children and descendants first, then queues them. Siblings still land in one contiguous range.
• Ast gets a Drop impl that moves the tree into a work list before the nodes are freed. Ast is the only owner of a node tree, so the compiler still destructures nodes by move.
• Verified: deep_combinator_chain compiles a 100k deep chain for both and >, walks the program link by link, and drops an uncompiled AST. Without the compiler change, or without the Drop impl, the test aborts with a stack overflow. cargo test --features _integration_test: 208 + 3 + 38 + 2 pass. cargo clippy --all-targets: no new warnings. cargo fmt --check: clean.

Cost

Compile-only benchmark: 100 pre-parsed selectors, a fresh HtmlRewriter per 9-byte document, release build, min of 6 interleaved runs, against e1a306d.

selectors	change
mixed	-1.1 %
flat (div.cN)	-0.1 %
chains (aN b c d > e f g h)	+1.4 %

The work list holds no entry until a node has children, so a flat selector list allocates nothing extra.

Branches

• This branch is the v3.0.1-based bun head (e1a306d) plus one commit. It was rebased on 2026-09-22. It cherry-picks clean onto robobun/31756292/not-de-morgan (selectors_vm: apply De Morgan's laws to :not() #9).
• The same change for the v2.7.2 lineage is kept at robobun/selector-compiler-iterative-v2.7.2 (5702629 = 725ce49 plus one commit). HTMLRewriter: compile long combinator chains without a native stack overflow bun#41475 pins that commit while Bun's main is on the v2.7.2 lineage, and moves to this branch after the v3.0.1 move lands in Bun.