Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

buffer,n-api: release external buffers from BackingStore callback #33321

Closed

Commits on May 9, 2020

  1. src: distinguish refed/unrefed threadsafe Immediates

    In some situations, it can be useful to use threadsafe callbacks
    on an `Environment` to perform cleanup operations that should run
    even when the process would otherwise be ending.
    addaleax committed May 9, 2020
    Configuration menu
    Copy the full SHA
    5d2eeec View commit details
    Browse the repository at this point in the history
  2. buffer,n-api: release external buffers from BackingStore callback

    Release `Buffer` and `ArrayBuffer` instances that were created through
    our addon APIs and have finalizers attached to them only after V8 has
    called the deleter callback passed to the `BackingStore`, instead of
    relying on our own GC callback(s).
    
    This fixes the following race condition:
    
    1. Addon code allocates pointer P via `malloc`.
    2. P is passed into `napi_create_external_buffer` with a finalization
       callback which calls `free(P)`. P is inserted into V8’s global array
       buffer table for tracking.
    3. The finalization callback is executed on GC. P is freed and returned
       to the allocator. P is not yet removed from V8’s global array
       buffer table. (!)
    4. Addon code attempts to allocate memory once again. The allocator
       returns P, as it is now available.
    5. P is passed into `napi_create_external_buffer`. P still has not been
       removed from the v8 global array buffer table.
    6. The world ends with `Check failed: result.second`.
    
    Since our API contract is to call the finalizer on the JS thread on
    which the `ArrayBuffer` was created, but V8 may call the `BackingStore`
    deleter callback on another thread, fixing this requires posting
    a task back to the JS thread.
    
    Refs: nodejs#32463 (comment)
    Fixes: nodejs#32463
    addaleax committed May 9, 2020
    Configuration menu
    Copy the full SHA
    655585c View commit details
    Browse the repository at this point in the history

Commits on May 10, 2020

  1. Configuration menu
    Copy the full SHA
    d33de7a View commit details
    Browse the repository at this point in the history