http_parser: do not dealloc during kOnExecute #2956

indutny · 2015-09-18T19:55:34Z

freeParser deallocates Parser instances early if they do not fit
into the free list. This does not play well with recent socket
consumption change, because it will try to deallocate the parser while
executing on its stack.

Fix: #2928

cc @nodejs/collaborators @trevnorris @bnoordhuis

indutny · 2015-09-18T19:57:45Z

Test is a bit complicated, because the crash happens only on the access to the uninitialized memory.

indutny · 2015-09-18T19:57:54Z

CI: https://ci.nodejs.org/job/node-test-pull-request/343/

bnoordhuis · 2015-09-18T19:58:07Z

What commit or commits introduced the regression?

bnoordhuis · 2015-09-18T20:03:36Z

src/node_http_parser.cc

+  class ScopedRetainParser {
+   public:
+    ScopedRetainParser(Parser* p) : p_(p) {
+      p_->refcount_++;


Consider doing CHECK(p_->refcount_ > 0) first in this function.

indutny · 2015-09-18T20:08:43Z

The regression happened at: 1bc4468

indutny · 2015-09-18T20:10:24Z

@bnoordhuis all fixed.

bnoordhuis · 2015-09-18T20:10:46Z

Test is a bit complicated, because the crash happens only on the access to the uninitialized memory.

Create 1,000 or 10,000 parser objects and close them from within .execute(). One of them is bound to trigger the crash.

The regression happened at: 1bc4468

Can you include that in the commit log? Maybe also reference the first line of its commit log, that saves the log spelunker an extra git show.

indutny · 2015-09-18T20:11:18Z

@bnoordhuis included. Will work on the test, but it won't be reliable unless started under valgrind.

indutny · 2015-09-18T20:11:25Z

Thank you!

bnoordhuis · 2015-09-18T20:11:27Z

src/node_http_parser.cc

@@ -668,7 +689,10 @@ class Parser : public BaseObject {
  char* current_buffer_data_;
  StreamResource::Callback<StreamResource::AllocCb> prev_alloc_cb_;
  StreamResource::Callback<StreamResource::ReadCb> prev_read_cb_;
+  int refcount_;


By the way, you can initialize it to 1 here.

trevnorris · 2015-09-18T21:40:12Z

@indutny this is a bit nitty on my part, but mind putting the regression sha in this format: 3b78b85

Find it's easier to parse when looking through history. No worries if you don't though. :)

trevnorris · 2015-09-18T21:45:37Z

Outside of including a test, don't see anything I would change. LGTM.

indutny · 2015-09-18T23:16:27Z

Force pushed, PTAL

indutny · 2015-09-18T23:17:21Z

New CI: https://ci.nodejs.org/job/node-test-pull-request/346/

thefourtheye · 2015-09-19T00:38:15Z

src/node_http_parser.cc

@@ -504,6 +506,22 @@ class Parser : public BaseObject {
  }

 protected:
+  class ScopedRetainParser {
+   public:
+    explicit ScopedRetainParser(Parser* p) : p_(p) {


Wouldn't it be better to have a const here?

I don't think that delete may be called on const pointer... Am I wrong?

@indutny I just tried this

# include <cstdio> class Test { public: Test(const char * str) : my_str(str) { } ~Test() { fprintf(stderr, "Cleaning up"); delete my_str; } private: const char * my_str; }; int main() { Test test(new char[50]); }

with

➜ Desktop g++ Test.cpp && ./a.out Cleaning up ➜ Desktop

@indutny Hmmm, I tried that now. No warnings.

➜ Desktop g++ -Wall Test.cpp && ./a.out Cleaning up ➜ Desktop

Oh, I think you're right.

Anyway, I'm changing the refcount of the parser, so it won't work.

@indutny Ah, right. Sorry for the fuss.

`freeParser` deallocates `Parser` instances early if they do not fit into the free list. This does not play well with recent socket consumption change, because it will try to deallocate the parser while executing on its stack. Regression was introduced in: 1bc4468 Fix: nodejs#2928

indutny · 2015-09-19T03:25:45Z

CI is green. Shall I land it?

trevnorris · 2015-09-19T07:24:25Z

LGTM

indutny · 2015-09-19T07:31:54Z

Landed in 229a03f, thank you!

`freeParser` deallocates `Parser` instances early if they do not fit into the free list. This does not play well with recent socket consumption change, because it will try to deallocate the parser while executing on its stack. Regression was introduced in: 1bc4468 Fix: #2928 PR-URL: #2956 Reviewed-by: Trevor Norris <trev.norris@gmail.com>

stephank · 2015-09-19T07:35:37Z

Awesome! Thanks guys! 💪

`freeParser` deallocates `Parser` instances early if they do not fit into the free list. This does not play well with recent socket consumption change, because it will try to deallocate the parser while executing on its stack. Regression was introduced in: 1bc4468 Fix: #2928 PR-URL: #2956 Reviewed-by: Trevor Norris <trev.norris@gmail.com>

MylesBorins · 2015-11-16T19:20:25Z

landed in lts-v4.x-staging as bc9f629

indutny added http Issues or PRs related to the http subsystem. land-on-v4.x labels Sep 18, 2015

indutny mentioned this pull request Sep 18, 2015

Segfault in node::Environment::KickNextTick #2928

Closed

indutny force-pushed the fix/gh-2928 branch from ac7df35 to a14e796 Compare September 18, 2015 19:56

bnoordhuis reviewed Sep 18, 2015
View reviewed changes

indutny force-pushed the fix/gh-2928 branch from a14e796 to 8432445 Compare September 18, 2015 20:10

indutny force-pushed the fix/gh-2928 branch from 8432445 to 2900294 Compare September 18, 2015 20:10

bnoordhuis reviewed Sep 18, 2015
View reviewed changes

indutny force-pushed the fix/gh-2928 branch from 2900294 to b0e844f Compare September 18, 2015 23:16

thefourtheye reviewed Sep 19, 2015
View reviewed changes

indutny force-pushed the fix/gh-2928 branch from 0007ada to 485e152 Compare September 19, 2015 02:31

indutny closed this Sep 19, 2015

indutny deleted the fix/gh-2928 branch September 19, 2015 07:33

trevnorris mentioned this pull request Sep 20, 2015

Release Proposal: v4.1.1 #2943

Closed

rvagg mentioned this pull request Sep 22, 2015

Release proposal: v4.1.1 #2995

Merged

jasnell added the lts-landed-on-v4.x label Oct 7, 2015

MylesBorins removed the land-on-v4.x label Nov 16, 2015

leonardoadame mentioned this pull request Dec 2, 2023

[Snyk] Security upgrade semantic-release from 20.1.3 to 22.0.0 leonardoadame/node#447

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

http_parser: do not dealloc during kOnExecute #2956

http_parser: do not dealloc during kOnExecute #2956

indutny commented Sep 18, 2015

indutny commented Sep 18, 2015

indutny commented Sep 18, 2015

bnoordhuis commented Sep 18, 2015

bnoordhuis Sep 18, 2015

indutny commented Sep 18, 2015

indutny commented Sep 18, 2015

bnoordhuis commented Sep 18, 2015

indutny commented Sep 18, 2015

indutny commented Sep 18, 2015

bnoordhuis Sep 18, 2015

trevnorris commented Sep 18, 2015

trevnorris commented Sep 18, 2015

indutny commented Sep 18, 2015

indutny commented Sep 18, 2015

thefourtheye Sep 19, 2015

indutny Sep 19, 2015

thefourtheye Sep 19, 2015

indutny Sep 19, 2015

thefourtheye Sep 19, 2015

indutny Sep 19, 2015

indutny Sep 19, 2015

thefourtheye Sep 19, 2015

indutny commented Sep 19, 2015

trevnorris commented Sep 19, 2015

indutny commented Sep 19, 2015

stephank commented Sep 19, 2015

MylesBorins commented Nov 16, 2015

http_parser: do not dealloc during kOnExecute #2956

http_parser: do not dealloc during kOnExecute #2956

Conversation

indutny commented Sep 18, 2015

indutny commented Sep 18, 2015

indutny commented Sep 18, 2015

bnoordhuis commented Sep 18, 2015

Choose a reason for hiding this comment

indutny commented Sep 18, 2015

indutny commented Sep 18, 2015

bnoordhuis commented Sep 18, 2015

indutny commented Sep 18, 2015

indutny commented Sep 18, 2015

Choose a reason for hiding this comment

trevnorris commented Sep 18, 2015

trevnorris commented Sep 18, 2015

indutny commented Sep 18, 2015

indutny commented Sep 18, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

indutny commented Sep 19, 2015

trevnorris commented Sep 19, 2015

indutny commented Sep 19, 2015

stephank commented Sep 19, 2015

MylesBorins commented Nov 16, 2015