src: detach cppgc wrappers from their Realm before it is freed - #65778
Open
codebytere wants to merge 1 commit into
Open
src: detach cppgc wrappers from their Realm before it is freed#65778codebytere wants to merge 1 commit into
codebytere wants to merge 1 commit into
Conversation
Collaborator
|
Review requested:
|
nodejs-github-bot
added
c++
Collaborator
`Realm::RunCleanup()` finalizes the cppgc-managed wrappers it tracks so that none of them touches the Realm once it is gone, but it reaches them through weak persistents, and the GC clears those as soon as it finds a wrapper dead. With lazy and concurrent sweeping the destructor can run much later, so a wrapper collected shortly before `FreeEnvironment()` and swept after it was skipped by the cleanup and kept its `realm_`: `~CppgcMixin()` then wrote `should_purge_empty_cppgc_wrappers_` into the freed Realm, and a subclass destructor calling `Finalize()` as documented would have called `Clean()` with a dangling Realm. A Worker that compiles a few `vm.Script`s, gets a full GC from external memory pressure and calls `process.exit()` is enough to hit the first case. Move the Realm pointer into the list node, which the wrapper now owns and deletes in its destructor. `CppgcWrapperList::Cleanup()` unlinks every node, finalizing the wrappers that are still alive and clearing the Realm pointer for the collected ones, which only their own destructor may still touch. `Realm::PendingCleanup()` accounts for the list so it is always drained. The purge flag, its GC epilogue callback and `PurgeEmpty()` are no longer needed, and removing them also stops the list nodes of wrappers that are alive at `FreeEnvironment()` from leaking. Refs: nodejs#56534 Signed-off-by: Shelley Vohr <[email protected]>
codebytere
force-pushed
the
fix/embedder-cppgc-wrapper-realm-lifetime
branch
from
September 4, 2026 08:45
bbc133a to
6bb6296
Compare
Collaborator
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #65778 +/- ##
==========================================
+ Coverage 89.99% 90.05% +0.05%
==========================================
Files 757 769 +12
Lines 257739 261377 +3638
Branches 48881 49629 +748
==========================================
+ Hits 231961 235377 +3416
- Misses 16861 17033 +172
- Partials 8917 8967 +50
🚀 New features to boost your workflow:
|
mcollina
approved these changes
Sep 4, 2026
github-actions
Bot
removed
the
request-ci
Collaborator
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Realm::RunCleanup()finalizes the cppgc-managed wrappers it tracks (vm.Script, contextified objects) so that none of them touches the Realm after it is gone, but it reaches them through weak persistents, and the GC clears those as soon as marking finds a wrapper dead - with lazy and concurrent sweeping that can be well before the destructor runs. A wrapper collected shortly beforeFreeEnvironment()and swept after it is skipped, keeps itsrealm_, and~CppgcMixin()then writesshould_purge_empty_cppgc_wrappers_into the freed Realm; a subclass using the documented~MyWrap() { Finalize(); }pattern would callClean()with a dangling Realm the same way. A Worker that compiles a fewvm.Scripts, gets a full GC from external memory pressure and callsprocess.exit()is enough: ASAN reports a heap-use-after-free write in~ContextifyScriptduring isolate disposal.Once the GC has found a wrapper dead only its own destructor may touch it, so the Realm cannot reach into those wrappers to clear anything. Instead the Realm pointer moves into the off-heap
CppgcWrapperListNode, which the wrapper now owns and deletes in~CppgcMixin().CppgcWrapperList::Cleanup()pops every node, callsFinalize()on the wrappers whose weak persistent is still set, and clears the node's Realm pointer either way, so a collected wrapper's destructor sees no Realm instead of a freed one.Realm::PendingCleanup()also looks at the wrapper list so cleanup always drains it. The purge flag, its GC epilogue callback andPurgeEmpty()are no longer needed; removing them also stops the nodes of wrappers that are alive atFreeEnvironment()from leaking (they were unlinked by~ListHead()and never freed).Tests:
CppgcTest.CleanIsNotCalledWithFreedRealm,VmScriptCollectedBeforeFreeEnvironmentSweptAfterandWrappersAliveAtFreeEnvironmentDoNotLeakin test_cppgc.cc. Under ASAN the first two fail on every run before (the second with the use-after-free above) and the third under LSAN; in a regular build the first fails before only when the sweeper has not reached the wrappers by the timeFreeEnvironment()pumps the loop, about one run in three locally.Refs: #56534
Disclosure: the code, tests and this description were written by Claude Code, directed and reviewed by @codebytere.