Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

n-api: unlink reference during its destructor #35933

Commits on Nov 2, 2020

  1. n-api: unlink reference during its destructor

    Currently, a reference is being unlinked from the list of references
    tracked by the environment when `v8impl::Reference::Delete` is called.
    This causes a leak when deletion must be deferred because the finalizer
    hasn't yet run, but the finalizer does not run because environment
    teardown is in progress, and so no more gc runs will happen, and the
    `FinalizeAll` run that happens during environment teardown does not
    catch the reference because it's no longer in the list. The test below
    will fail when running with ASAN:
    ```
    ./node ./test/node-api/test_worker_terminate_finalization/test.js
    ```
    
    OTOH if, to address the above leak, we make a special case to not
    unlink a reference during environment teardown, we run into a
    situation where the reference gets deleted by
    `v8impl::Reference::Delete` but does not get unlinked because it's
    environment teardown time. This leaves a stale pointer in the linked
    list which will result in a use-after-free in `FinalizeAll` during
    environment teardown. The test below will fail if we make the above
    change:
    ```
    ./node -e "require('./test/node-api/test_instance_data/build/Release/test_ref_then_set.node');"
    ```
    
    Thus, we unlink a reference precisely when we destroy it – in its
    destructor.
    
    Refs: nodejs#34731
    Refs: nodejs#34839
    Refs: nodejs#35620
    Refs: nodejs#35777
    Fixes: nodejs#35778
    Signed-off-by: Gabriel Schulhof <gabriel.schulhof@intel.com>
    Gabriel Schulhof committed Nov 2, 2020
    Copy the full SHA
    dd7d042 View commit details
    Browse the repository at this point in the history

Commits on Nov 3, 2020

  1. fixup! make the destructor virtual

    Gabriel Schulhof committed Nov 3, 2020
    Copy the full SHA
    b2cf693 View commit details
    Browse the repository at this point in the history